231 files changed, 2954 insertions, 1728 deletions
diff --git a/drivers/acpi/acpica/exstorob.c b/drivers/acpi/acpica/exstorob.c
index 67340cc70142..257706e7734f 100644
--- a/drivers/acpi/acpica/exstorob.c
+++ b/drivers/acpi/acpica/exstorob.c
@@ -70,6 +70,12 @@ acpi_ex_store_buffer_to_buffer(union acpi_operand_object *source_desc,
        ACPI_FUNCTION_TRACE_PTR(ex_store_buffer_to_buffer, source_desc);
+        /* If Source and Target are the same, just return */
+        if (source_desc == target_desc) {
+                return_ACPI_STATUS(AE_OK);
+        }
        /* We know that source_desc is a buffer by now */
        buffer = ACPI_CAST_PTR(u8, source_desc->buffer.pointer);
@@ -161,6 +167,12 @@ acpi_ex_store_string_to_string(union acpi_operand_object *source_desc,
        ACPI_FUNCTION_TRACE_PTR(ex_store_string_to_string, source_desc);
+        /* If Source and Target are the same, just return */
+        if (source_desc == target_desc) {
+                return_ACPI_STATUS(AE_OK);
+        }
        /* We know that source_desc is a string by now */
        buffer = ACPI_CAST_PTR(u8, source_desc->string.pointer);
diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
index 84e0f3c07442..2cc4b3033872 100644
--- a/drivers/acpi/processor_core.c
+++ b/drivers/acpi/processor_core.c
@@ -1151,6 +1151,9 @@ static int __init acpi_processor_init(void)
 {
        int result = 0;
+        if (acpi_disabled)
+                return 0;
        memset(&errata, 0, sizeof(errata));
 #ifdef CONFIG_SMP
@@ -1197,6 +1200,9 @@ out_proc:
 static void __exit acpi_processor_exit(void)
 {
+        if (acpi_disabled)
+                return;
        acpi_processor_ppc_exit();
        acpi_thermal_cpufreq_exit();
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 0efa59e7e3af..66393d5c4c7c 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -162,8 +162,9 @@ static void lapic_timer_check_state(int state, struct acpi_processor *pr,
                pr->power.timer_broadcast_on_state = state;
 }
-static void lapic_timer_propagate_broadcast(struct acpi_processor *pr)
+static void lapic_timer_propagate_broadcast(void *arg)
 {
+        struct acpi_processor *pr = (struct acpi_processor *) arg;
        unsigned long reason;
        reason = pr->power.timer_broadcast_on_state < INT_MAX ?
@@ -635,7 +636,8 @@ static int acpi_processor_power_verify(struct acpi_processor *pr)
                working++;
        }
-        lapic_timer_propagate_broadcast(pr);
+        smp_call_function_single(pr->id, lapic_timer_propagate_broadcast,
+                                 pr, 1);
        return (working);
 }
diff --git a/drivers/acpi/processor_thermal.c b/drivers/acpi/processor_thermal.c
index 39838c666032..31adda1099e0 100644
--- a/drivers/acpi/processor_thermal.c
+++ b/drivers/acpi/processor_thermal.c
@@ -66,7 +66,7 @@ static int acpi_processor_apply_limit(struct acpi_processor *pr)
                if (pr->limit.thermal.tx > tx)
                        tx = pr->limit.thermal.tx;
-                result = acpi_processor_set_throttling(pr, tx);
+                result = acpi_processor_set_throttling(pr, tx, false);
                if (result)
                        goto end;
        }
@@ -421,12 +421,12 @@ processor_set_cur_state(struct thermal_cooling_device *cdev,
        if (state <= max_pstate) {
                if (pr->flags.throttling && pr->throttling.state)
-                        result = acpi_processor_set_throttling(pr, 0);
+                        result = acpi_processor_set_throttling(pr, 0, false);
                cpufreq_set_cur_state(pr->id, state);
        } else {
                cpufreq_set_cur_state(pr->id, max_pstate);
                result = acpi_processor_set_throttling(pr,
-                                state - max_pstate);
+                                state - max_pstate, false);
        }
        return result;
 }
diff --git a/drivers/acpi/processor_throttling.c b/drivers/acpi/processor_throttling.c
index 227543789ba9..ae39797aab55 100644
--- a/drivers/acpi/processor_throttling.c
+++ b/drivers/acpi/processor_throttling.c
@@ -62,7 +62,8 @@ struct throttling_tstate {
 #define THROTTLING_POSTCHANGE      (2)
 static int acpi_processor_get_throttling(struct acpi_processor *pr);
-int acpi_processor_set_throttling(struct acpi_processor *pr, int state);
+int acpi_processor_set_throttling(struct acpi_processor *pr,
+                                                int state, bool force);
 static int acpi_processor_update_tsd_coord(void)
 {
@@ -361,7 +362,7 @@ int acpi_processor_tstate_has_changed(struct acpi_processor *pr)
                 */
                target_state = throttling_limit;
        }
-        return acpi_processor_set_throttling(pr, target_state);
+        return acpi_processor_set_throttling(pr, target_state, false);
 }
 /*
@@ -839,10 +840,10 @@ static int acpi_processor_get_throttling_ptc(struct acpi_processor *pr)
        if (ret >= 0) {
                state = acpi_get_throttling_state(pr, value);
                if (state == -1) {
-                        ACPI_WARNING((AE_INFO,
+                        ACPI_DEBUG_PRINT((ACPI_DB_INFO,
-                                "Invalid throttling state, reset"));
+                                "Invalid throttling state, reset\n"));
                        state = 0;
-                        ret = acpi_processor_set_throttling(pr, state);
+                        ret = acpi_processor_set_throttling(pr, state, true);
                        if (ret)
                                return ret;
                }
@@ -915,7 +916,7 @@ static int acpi_processor_get_fadt_info(struct acpi_processor *pr)
 }
 static int acpi_processor_set_throttling_fadt(struct acpi_processor *pr,
-                                              int state)
+                                              int state, bool force)
 {
        u32 value = 0;
        u32 duty_mask = 0;
@@ -930,7 +931,7 @@ static int acpi_processor_set_throttling_fadt(struct acpi_processor *pr,
        if (!pr->flags.throttling)
                return -ENODEV;
-        if (state == pr->throttling.state)
+        if (!force && (state == pr->throttling.state))
                return 0;
        if (state < pr->throttling_platform_limit)
@@ -988,7 +989,7 @@ static int acpi_processor_set_throttling_fadt(struct acpi_processor *pr,
 }
 static int acpi_processor_set_throttling_ptc(struct acpi_processor *pr,
-                                             int state)
+                                             int state, bool force)
 {
        int ret;
        acpi_integer value;
@@ -1002,7 +1003,7 @@ static int acpi_processor_set_throttling_ptc(struct acpi_processor *pr,
        if (!pr->flags.throttling)
                return -ENODEV;
-        if (state == pr->throttling.state)
+        if (!force && (state == pr->throttling.state))
                return 0;
        if (state < pr->throttling_platform_limit)
@@ -1018,7 +1019,8 @@ static int acpi_processor_set_throttling_ptc(struct acpi_processor *pr,
        return 0;
 }
-int acpi_processor_set_throttling(struct acpi_processor *pr, int state)
+int acpi_processor_set_throttling(struct acpi_processor *pr,
+                                                int state, bool force)
 {
        cpumask_var_t saved_mask;
        int ret = 0;
@@ -1070,7 +1072,7 @@ int acpi_processor_set_throttling(struct acpi_processor *pr, int state)
                /* FIXME: use work_on_cpu() */
                set_cpus_allowed_ptr(current, cpumask_of(pr->id));
                ret = p_throttling->acpi_processor_set_throttling(pr,
-                                                t_state.target_state);
+                                                t_state.target_state, force);
        } else {
                /*
                 * When the T-state coordination is SW_ALL or HW_ALL,
@@ -1103,7 +1105,7 @@ int acpi_processor_set_throttling(struct acpi_processor *pr, int state)
                        set_cpus_allowed_ptr(current, cpumask_of(i));
                        ret = match_pr->throttling.
                                acpi_processor_set_throttling(
-                                match_pr, t_state.target_state);
+                                match_pr, t_state.target_state, force);
                }
        }
        /*
@@ -1201,7 +1203,7 @@ int acpi_processor_get_throttling_info(struct acpi_processor *pr)
                ACPI_DEBUG_PRINT((ACPI_DB_INFO,
                                  "Disabling throttling (was T%d)\n",
                                  pr->throttling.state));
-                result = acpi_processor_set_throttling(pr, 0);
+                result = acpi_processor_set_throttling(pr, 0, false);
                if (result)
                        goto end;
        }
@@ -1307,7 +1309,7 @@ static ssize_t acpi_processor_write_throttling(struct file *file,
        if (strcmp(tmpbuf, charp) != 0)
                return -EINVAL;
-        result = acpi_processor_set_throttling(pr, state_val);
+        result = acpi_processor_set_throttling(pr, state_val, false);
        if (result)
                return result;
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index 8851315ce858..60ea984c84a0 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -2004,8 +2004,11 @@ static int acpi_video_bus_put_one_device(struct acpi_video_device *device)
        status = acpi_remove_notify_handler(device->dev->handle,
                                            ACPI_DEVICE_NOTIFY,
                                            acpi_video_device_notify);
-        sysfs_remove_link(&device->backlight->dev.kobj, "device");
+        if (device->backlight) {
-        backlight_device_unregister(device->backlight);
+                sysfs_remove_link(&device->backlight->dev.kobj, "device");
+                backlight_device_unregister(device->backlight);
+                device->backlight = NULL;
+        }
        if (device->cdev) {
                sysfs_remove_link(&device->dev->dev.kobj,
                                  "thermal_cooling");
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 958c1fa41900..fe3eba5d6b3e 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -219,6 +219,8 @@ enum {
        AHCI_HFLAG_SECT255              = (1 << 8), /* max 255 sectors */
        AHCI_HFLAG_YES_NCQ              = (1 << 9), /* force NCQ cap on */
        AHCI_HFLAG_NO_SUSPEND           = (1 << 10), /* don't suspend */
+        AHCI_HFLAG_SRST_TOUT_IS_OFFLINE = (1 << 11), /* treat SRST timeout as
+                                                        link offline */
        /* ap->flags bits */
@@ -1663,6 +1665,7 @@ static int ahci_do_softreset(struct ata_link *link, unsigned int *class,
                             int (*check_ready)(struct ata_link *link))
 {
        struct ata_port *ap = link->ap;
+        struct ahci_host_priv *hpriv = ap->host->private_data;
        const char *reason = NULL;
        unsigned long now, msecs;
        struct ata_taskfile tf;
@@ -1701,12 +1704,21 @@ static int ahci_do_softreset(struct ata_link *link, unsigned int *class,
        /* wait for link to become ready */
        rc = ata_wait_after_reset(link, deadline, check_ready);
-        /* link occupied, -ENODEV too is an error */
+        if (rc == -EBUSY && hpriv->flags & AHCI_HFLAG_SRST_TOUT_IS_OFFLINE) {
-        if (rc) {
+                /*
+                 * Workaround for cases where link online status can't
+                 * be trusted.  Treat device readiness timeout as link
+                 * offline.
+                 */
+                ata_link_printk(link, KERN_INFO,
+                                "device not ready, treating as offline\n");
+                *class = ATA_DEV_NONE;
+        } else if (rc) {
+                /* link occupied, -ENODEV too is an error */
                reason = "device not ready";
                goto fail;
-        }
+        } else
-        *class = ahci_dev_classify(ap);
+                *class = ahci_dev_classify(ap);
        DPRINTK("EXIT, class=%u\n", *class);
        return 0;
@@ -1773,7 +1785,8 @@ static int ahci_sb600_softreset(struct ata_link *link, unsigned int *class,
                irq_sts = readl(port_mmio + PORT_IRQ_STAT);
                if (irq_sts & PORT_IRQ_BAD_PMP) {
                        ata_link_printk(link, KERN_WARNING,
-                                        "failed due to HW bug, retry pmp=0\n");
+                                        "applying SB600 PMP SRST workaround "
+                                        "and retrying\n");
                        rc = ahci_do_softreset(link, class, 0, deadline,
                                               ahci_check_ready);
                }
@@ -2726,6 +2739,56 @@ static bool ahci_broken_suspend(struct pci_dev *pdev)
        return !ver || strcmp(ver, dmi->driver_data) < 0;
 }
+static bool ahci_broken_online(struct pci_dev *pdev)
+{
+#define ENCODE_BUSDEVFN(bus, slot, func)                        \
+        (void *)(unsigned long)(((bus) << 8) | PCI_DEVFN((slot), (func)))
+        static const struct dmi_system_id sysids[] = {
+                /*
+                 * There are several gigabyte boards which use
+                 * SIMG5723s configured as hardware RAID.  Certain
+                 * 5723 firmware revisions shipped there keep the link
+                 * online but fail to answer properly to SRST or
+                 * IDENTIFY when no device is attached downstream
+                 * causing libata to retry quite a few times leading
+                 * to excessive detection delay.
+                 *
+                 * As these firmwares respond to the second reset try
+                 * with invalid device signature, considering unknown
+                 * sig as offline works around the problem acceptably.
+                 */
+                {
+                        .ident = "EP45-DQ6",
+                        .matches = {
+                                DMI_MATCH(DMI_BOARD_VENDOR,
+                                          "Gigabyte Technology Co., Ltd."),
+                                DMI_MATCH(DMI_BOARD_NAME, "EP45-DQ6"),
+                        },
+                        .driver_data = ENCODE_BUSDEVFN(0x0a, 0x00, 0),
+                },
+                {
+                        .ident = "EP45-DS5",
+                        .matches = {
+                                DMI_MATCH(DMI_BOARD_VENDOR,
+                                          "Gigabyte Technology Co., Ltd."),
+                                DMI_MATCH(DMI_BOARD_NAME, "EP45-DS5"),
+                        },
+                        .driver_data = ENCODE_BUSDEVFN(0x03, 0x00, 0),
+                },
+                { }     /* terminate list */
+        };
+#undef ENCODE_BUSDEVFN
+        const struct dmi_system_id *dmi = dmi_first_match(sysids);
+        unsigned int val;
+        if (!dmi)
+                return false;
+        val = (unsigned long)dmi->driver_data;
+        return pdev->bus->number == (val >> 8) && pdev->devfn == (val & 0xff);
+}
 static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
        static int printed_version;
@@ -2841,6 +2904,12 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                           "BIOS update required for suspend/resume\n");
        }
+        if (ahci_broken_online(pdev)) {
+                hpriv->flags |= AHCI_HFLAG_SRST_TOUT_IS_OFFLINE;
+                dev_info(&pdev->dev,
+                         "online status unreliable, applying workaround\n");
+        }
        /* CAP.NP sometimes indicate the index of the last enabled
         * port, at other times, that of the last possible port, so
         * determining the maximum port number requires looking at
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index 56b8a3ff1286..9ac4e378992e 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -664,6 +664,8 @@ static int piix_pata_prereset(struct ata_link *link, unsigned long deadline)
        return ata_sff_prereset(link, deadline);
 }
+static DEFINE_SPINLOCK(piix_lock);
 /**
 *      piix_set_piomode - Initialize host controller PATA PIO timings
 *      @ap: Port whose timings we are configuring
@@ -677,8 +679,9 @@ static int piix_pata_prereset(struct ata_link *link, unsigned long deadline)
 static void piix_set_piomode(struct ata_port *ap, struct ata_device *adev)
 {
-        unsigned int pio        = adev->pio_mode - XFER_PIO_0;
        struct pci_dev *dev     = to_pci_dev(ap->host->dev);
+        unsigned long flags;
+        unsigned int pio        = adev->pio_mode - XFER_PIO_0;
        unsigned int is_slave   = (adev->devno != 0);
        unsigned int master_port= ap->port_no ? 0x42 : 0x40;
        unsigned int slave_port = 0x44;
@@ -708,6 +711,8 @@ static void piix_set_piomode(struct ata_port *ap, struct ata_device *adev)
        if (adev->class == ATA_DEV_ATA)
                control |= 4;   /* PPE enable */
+        spin_lock_irqsave(&piix_lock, flags);
        /* PIO configuration clears DTE unconditionally.  It will be
         * programmed in set_dmamode which is guaranteed to be called
         * after set_piomode if any DMA mode is available.
@@ -747,6 +752,8 @@ static void piix_set_piomode(struct ata_port *ap, struct ata_device *adev)
                udma_enable &= ~(1 << (2 * ap->port_no + adev->devno));
                pci_write_config_byte(dev, 0x48, udma_enable);
        }
+        spin_unlock_irqrestore(&piix_lock, flags);
 }
 /**
@@ -764,6 +771,7 @@ static void piix_set_piomode(struct ata_port *ap, struct ata_device *adev)
 static void do_pata_set_dmamode(struct ata_port *ap, struct ata_device *adev, int isich)
 {
        struct pci_dev *dev     = to_pci_dev(ap->host->dev);
+        unsigned long flags;
        u8 master_port          = ap->port_no ? 0x42 : 0x40;
        u16 master_data;
        u8 speed                = adev->dma_mode;
@@ -777,6 +785,8 @@ static void do_pata_set_dmamode(struct ata_port *ap, struct ata_device *adev, in
                            { 2, 1 },
                            { 2, 3 }, };
+        spin_lock_irqsave(&piix_lock, flags);
        pci_read_config_word(dev, master_port, &master_data);
        if (ap->udma_mask)
                pci_read_config_byte(dev, 0x48, &udma_enable);
@@ -867,6 +877,8 @@ static void do_pata_set_dmamode(struct ata_port *ap, struct ata_device *adev, in
        /* Don't scribble on 0x48 if the controller does not support UDMA */
        if (ap->udma_mask)
                pci_write_config_byte(dev, 0x48, udma_enable);
+        spin_unlock_irqrestore(&piix_lock, flags);
 }
 /**
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 8ac98ff16d7d..072ba5ea138f 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4302,6 +4302,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
        { "WDC WD2500JD-00HBB0", "WD-WMAL71490727", ATA_HORKAGE_BROKEN_HPA },
        { "MAXTOR 6L080L4",     "A93.0500",     ATA_HORKAGE_BROKEN_HPA },
+        /* this one allows HPA unlocking but fails IOs on the area */
+        { "OCZ-VERTEX",             "1.30",     ATA_HORKAGE_BROKEN_HPA },
        /* Devices which report 1 sector over size HPA */
        { "ST340823A",          NULL,           ATA_HORKAGE_HPA_SIZE, },
        { "ST320413A",          NULL,           ATA_HORKAGE_HPA_SIZE, },
diff --git a/drivers/ata/pata_at91.c b/drivers/ata/pata_at91.c
index 5702affcb325..41c94b1ae493 100644
--- a/drivers/ata/pata_at91.c
+++ b/drivers/ata/pata_at91.c
@@ -250,7 +250,7 @@ static int __devinit pata_at91_probe(struct platform_device *pdev)
                ata_port_desc(ap, "no IRQ, using PIO polling");
        }
-        info = kzalloc(sizeof(*info), GFP_KERNEL);
+        info = devm_kzalloc(dev, sizeof(*info), GFP_KERNEL);
        if (!info) {
                dev_err(dev, "failed to allocate memory for private data\n");
@@ -275,7 +275,7 @@ static int __devinit pata_at91_probe(struct platform_device *pdev)
        if (!info->ide_addr) {
                dev_err(dev, "failed to map IO base\n");
                ret = -ENOMEM;
-                goto err_ide_ioremap;
+                goto err_put;
        }
        info->alt_addr = devm_ioremap(dev,
@@ -284,7 +284,7 @@ static int __devinit pata_at91_probe(struct platform_device *pdev)
        if (!info->alt_addr) {
                dev_err(dev, "failed to map CTL base\n");
                ret = -ENOMEM;
-                goto err_alt_ioremap;
+                goto err_put;
        }
        ap->ioaddr.cmd_addr = info->ide_addr;
@@ -303,13 +303,8 @@ static int __devinit pata_at91_probe(struct platform_device *pdev)
                        irq ? ata_sff_interrupt : NULL,
                        irq_flags, &pata_at91_sht);
-err_alt_ioremap:
+err_put:
-        devm_iounmap(dev, info->ide_addr);
-err_ide_ioremap:
        clk_put(info->mck);
-        kfree(info);
        return ret;
 }
@@ -317,7 +312,6 @@ static int __devexit pata_at91_remove(struct platform_device *pdev)
 {
        struct ata_host *host = dev_get_drvdata(&pdev->dev);
        struct at91_ide_info *info;
-        struct device *dev = &pdev->dev;
        if (!host)
                return 0;
@@ -328,11 +322,8 @@ static int __devexit pata_at91_remove(struct platform_device *pdev)
        if (!info)
                return 0;
-        devm_iounmap(dev, info->ide_addr);
-        devm_iounmap(dev, info->alt_addr);
        clk_put(info->mck);
-        kfree(info);
        return 0;
 }
diff --git a/drivers/ata/pata_atiixp.c b/drivers/ata/pata_atiixp.c
index bec0b8ade66d..45915566e4e9 100644
--- a/drivers/ata/pata_atiixp.c
+++ b/drivers/ata/pata_atiixp.c
@@ -1,6 +1,7 @@
 /*
 * pata_atiixp.c        - ATI PATA for new ATA layer
 *                        (C) 2005 Red Hat Inc
+ *                        (C) 2009 Bartlomiej Zolnierkiewicz
 *
 * Based on
 *
@@ -61,20 +62,19 @@ static void atiixp_set_pio_timing(struct ata_port *ap, struct ata_device *adev,
        struct pci_dev *pdev = to_pci_dev(ap->host->dev);
        int dn = 2 * ap->port_no + adev->devno;
-        /* Check this is correct - the order is odd in both drivers */
        int timing_shift = (16 * ap->port_no) + 8 * (adev->devno ^ 1);
-        u16 pio_mode_data, pio_timing_data;
+        u32 pio_timing_data;
+        u16 pio_mode_data;
        pci_read_config_word(pdev, ATIIXP_IDE_PIO_MODE, &pio_mode_data);
        pio_mode_data &= ~(0x7 << (4 * dn));
        pio_mode_data |= pio << (4 * dn);
        pci_write_config_word(pdev, ATIIXP_IDE_PIO_MODE, pio_mode_data);
-        pci_read_config_word(pdev, ATIIXP_IDE_PIO_TIMING, &pio_timing_data);
+        pci_read_config_dword(pdev, ATIIXP_IDE_PIO_TIMING, &pio_timing_data);
        pio_timing_data &= ~(0xFF << timing_shift);
        pio_timing_data |= (pio_timings[pio] << timing_shift);
-        pci_write_config_word(pdev, ATIIXP_IDE_PIO_TIMING, pio_timing_data);
+        pci_write_config_dword(pdev, ATIIXP_IDE_PIO_TIMING, pio_timing_data);
 }
 /**
@@ -119,16 +119,17 @@ static void atiixp_set_dmamode(struct ata_port *ap, struct ata_device *adev)
                udma_mode_data |= dma << (4 * dn);
                pci_write_config_word(pdev, ATIIXP_IDE_UDMA_MODE, udma_mode_data);
        } else {
-                u16 mwdma_timing_data;
-                /* Check this is correct - the order is odd in both drivers */
                int timing_shift = (16 * ap->port_no) + 8 * (adev->devno ^ 1);
+                u32 mwdma_timing_data;
                dma -= XFER_MW_DMA_0;
-                pci_read_config_word(pdev, ATIIXP_IDE_MWDMA_TIMING, &mwdma_timing_data);
+                pci_read_config_dword(pdev, ATIIXP_IDE_MWDMA_TIMING,
+                                      &mwdma_timing_data);
                mwdma_timing_data &= ~(0xFF << timing_shift);
                mwdma_timing_data |= (mwdma_timings[dma] << timing_shift);
-                pci_write_config_word(pdev, ATIIXP_IDE_MWDMA_TIMING, mwdma_timing_data);
+                pci_write_config_dword(pdev, ATIIXP_IDE_MWDMA_TIMING,
+                                       mwdma_timing_data);
        }
        /*
         *      We must now look at the PIO mode situation. We may need to
diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
index b2d11f300c39..86a40582999c 100644
--- a/drivers/ata/sata_nv.c
+++ b/drivers/ata/sata_nv.c
@@ -602,6 +602,7 @@ MODULE_VERSION(DRV_VERSION);
 static int adma_enabled;
 static int swncq_enabled = 1;
+static int msi_enabled;
 static void nv_adma_register_mode(struct ata_port *ap)
 {
@@ -2459,6 +2460,11 @@ static int nv_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        } else if (type == SWNCQ)
                nv_swncq_host_init(host);
+        if (msi_enabled) {
+                dev_printk(KERN_NOTICE, &pdev->dev, "Using MSI\n");
+                pci_enable_msi(pdev);
+        }
        pci_set_master(pdev);
        return ata_host_activate(host, pdev->irq, ipriv->irq_handler,
                                 IRQF_SHARED, ipriv->sht);
@@ -2558,4 +2564,6 @@ module_param_named(adma, adma_enabled, bool, 0444);
 MODULE_PARM_DESC(adma, "Enable use of ADMA (Default: false)");
 module_param_named(swncq, swncq_enabled, bool, 0444);
 MODULE_PARM_DESC(swncq, "Enable use of SWNCQ (Default: true)");
+module_param_named(msi, msi_enabled, bool, 0444);
+MODULE_PARM_DESC(msi, "Enable use of MSI (Default: false)");
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index 81cb01bfc356..456594bd97bc 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -483,9 +483,6 @@ int platform_driver_register(struct platform_driver *drv)
                drv->driver.remove = platform_drv_remove;
        if (drv->shutdown)
                drv->driver.shutdown = platform_drv_shutdown;
-        if (drv->suspend || drv->resume)
-                pr_warning("Platform driver '%s' needs updating - please use "
-                        "dev_pm_ops\n", drv->driver.name);
        return driver_register(&drv->driver);
 }
diff --git a/drivers/char/n_tty.c b/drivers/char/n_tty.c
index 973be2f44195..4e28b35024ec 100644
--- a/drivers/char/n_tty.c
+++ b/drivers/char/n_tty.c
@@ -300,8 +300,7 @@ static int do_output_char(unsigned char c, struct tty_struct *tty, int space)
                        if (space < 2)
                                return -1;
                        tty->canon_column = tty->column = 0;
-                        tty_put_char(tty, '\r');
+                        tty->ops->write(tty, "\r\n", 2);
-                        tty_put_char(tty, c);
                        return 2;
                }
                tty->canon_column = tty->column;
diff --git a/drivers/char/pty.c b/drivers/char/pty.c
index d083c73d784a..b33d6688e910 100644
--- a/drivers/char/pty.c
+++ b/drivers/char/pty.c
@@ -109,21 +109,13 @@ static int pty_space(struct tty_struct *to)
 *      the other side of the pty/tty pair.
 */
-static int pty_write(struct tty_struct *tty, const unsigned char *buf,
+static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c)
-                                                                int count)
 {
        struct tty_struct *to = tty->link;
-        int c;
        if (tty->stopped)
                return 0;
-        /* This isn't locked but our 8K is quite sloppy so no
-           big deal */
-        c = pty_space(to);
-        if (c > count)
-                c = count;
        if (c > 0) {
                /* Stuff the data into the input queue of the other end */
                c = tty_insert_flip_string(to, buf, c);
diff --git a/drivers/char/tty_ldisc.c b/drivers/char/tty_ldisc.c
index 1733d3439ad2..e48af9f79219 100644
--- a/drivers/char/tty_ldisc.c
+++ b/drivers/char/tty_ldisc.c
@@ -508,8 +508,9 @@ static void tty_ldisc_restore(struct tty_struct *tty, struct tty_ldisc *old)
 *      be obtained while the delayed work queue halt ensures that no more
 *      data is fed to the ldisc.
 *
- *      In order to wait for any existing references to complete see
+ *      You need to do a 'flush_scheduled_work()' (outside the ldisc_mutex)
- *      tty_ldisc_wait_idle.
+ *      in order to make sure any currently executing ldisc work is also
+ *      flushed.
 */
 static int tty_ldisc_halt(struct tty_struct *tty)
@@ -753,11 +754,14 @@ void tty_ldisc_hangup(struct tty_struct *tty)
         * N_TTY.
         */
        if (tty->driver->flags & TTY_DRIVER_RESET_TERMIOS) {
+                /* Make sure the old ldisc is quiescent */
+                tty_ldisc_halt(tty);
+                flush_scheduled_work();
                /* Avoid racing set_ldisc or tty_ldisc_release */
                mutex_lock(&tty->ldisc_mutex);
                if (tty->ldisc) {       /* Not yet closed */
                        /* Switch back to N_TTY */
-                        tty_ldisc_halt(tty);
                        tty_ldisc_reinit(tty);
                        /* At this point we have a closed ldisc and we want to
                           reopen it. We could defer this to the next open but
diff --git a/drivers/clocksource/sh_cmt.c b/drivers/clocksource/sh_cmt.c
index 2964f5f4a7ef..6b3e0c2f33e2 100644
--- a/drivers/clocksource/sh_cmt.c
+++ b/drivers/clocksource/sh_cmt.c
@@ -40,6 +40,7 @@ struct sh_cmt_priv {
        struct platform_device *pdev;
        unsigned long flags;
+        unsigned long flags_suspend;
        unsigned long match_value;
        unsigned long next_match_value;
        unsigned long max_match_value;
@@ -667,11 +668,38 @@ static int __devexit sh_cmt_remove(struct platform_device *pdev)
        return -EBUSY; /* cannot unregister clockevent and clocksource */
 }
+static int sh_cmt_suspend(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct sh_cmt_priv *p = platform_get_drvdata(pdev);
+        /* save flag state and stop CMT channel */
+        p->flags_suspend = p->flags;
+        sh_cmt_stop(p, p->flags);
+        return 0;
+}
+static int sh_cmt_resume(struct device *dev)
+{
+        struct platform_device *pdev = to_platform_device(dev);
+        struct sh_cmt_priv *p = platform_get_drvdata(pdev);
+        /* start CMT channel from saved state */
+        sh_cmt_start(p, p->flags_suspend);
+        return 0;
+}
+static struct dev_pm_ops sh_cmt_dev_pm_ops = {
+        .suspend = sh_cmt_suspend,
+        .resume = sh_cmt_resume,
+};
 static struct platform_driver sh_cmt_device_driver = {
        .probe          = sh_cmt_probe,
        .remove         = __devexit_p(sh_cmt_remove),
        .driver         = {
                .name   = "sh_cmt",
+                .pm     = &sh_cmt_dev_pm_ops,
        }
 };
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index fd69086d08d5..2968ed6a9c49 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1250,20 +1250,11 @@ static int cpufreq_suspend(struct sys_device *sysdev, pm_message_t pmsg)
 {
        int ret = 0;
-#ifdef __powerpc__
        int cpu = sysdev->id;
-        unsigned int cur_freq = 0;
        struct cpufreq_policy *cpu_policy;
        dprintk("suspending cpu %u\n", cpu);
-        /*
-         * This whole bogosity is here because Powerbooks are made of fail.
-         * No sane platform should need any of the code below to be run.
-         * (it's entirely the wrong thing to do, as driver->get may
-         *  reenable interrupts on some architectures).
-         */
        if (!cpu_online(cpu))
                return 0;
@@ -1282,47 +1273,13 @@ static int cpufreq_suspend(struct sys_device *sysdev, pm_message_t pmsg)
        if (cpufreq_driver->suspend) {
                ret = cpufreq_driver->suspend(cpu_policy, pmsg);
-                if (ret) {
+                if (ret)
                        printk(KERN_ERR "cpufreq: suspend failed in ->suspend "
                                        "step on CPU %u\n", cpu_policy->cpu);
-                        goto out;
-                }
-        }
-        if (cpufreq_driver->flags & CPUFREQ_CONST_LOOPS)
-                goto out;
-        if (cpufreq_driver->get)
-                cur_freq = cpufreq_driver->get(cpu_policy->cpu);
-        if (!cur_freq || !cpu_policy->cur) {
-                printk(KERN_ERR "cpufreq: suspend failed to assert current "
-                       "frequency is what timing core thinks it is.\n");
-                goto out;
-        }
-        if (unlikely(cur_freq != cpu_policy->cur)) {
-                struct cpufreq_freqs freqs;
-                if (!(cpufreq_driver->flags & CPUFREQ_PM_NO_WARN))
-                        dprintk("Warning: CPU frequency is %u, "
-                               "cpufreq assumed %u kHz.\n",
-                               cur_freq, cpu_policy->cur);
-                freqs.cpu = cpu;
-                freqs.old = cpu_policy->cur;
-                freqs.new = cur_freq;
-                srcu_notifier_call_chain(&cpufreq_transition_notifier_list,
-                                    CPUFREQ_SUSPENDCHANGE, &freqs);
-                adjust_jiffies(CPUFREQ_SUSPENDCHANGE, &freqs);
-                cpu_policy->cur = cur_freq;
        }
 out:
        cpufreq_cpu_put(cpu_policy);
-#endif  /* __powerpc__ */
        return ret;
 }
@@ -1330,24 +1287,21 @@ out:
 *      cpufreq_resume -  restore proper CPU frequency handling after resume
 *
 *      1.) resume CPUfreq hardware support (cpufreq_driver->resume())
- *      2.) if ->target and !CPUFREQ_CONST_LOOPS: verify we're in sync
+ *      2.) schedule call cpufreq_update_policy() ASAP as interrupts are
- *      3.) schedule call cpufreq_update_policy() ASAP as interrupts are
+ *          restored. It will verify that the current freq is in sync with
- *          restored.
+ *          what we believe it to be. This is a bit later than when it
+ *          should be, but nonethteless it's better than calling
+ *          cpufreq_driver->get() here which might re-enable interrupts...
 */
 static int cpufreq_resume(struct sys_device *sysdev)
 {
        int ret = 0;
-#ifdef __powerpc__
        int cpu = sysdev->id;
        struct cpufreq_policy *cpu_policy;
        dprintk("resuming cpu %u\n", cpu);
-        /* As with the ->suspend method, all the code below is
-         * only necessary because Powerbooks suck.
-         * See commit 42d4dc3f4e1e for jokes. */
        if (!cpu_online(cpu))
                return 0;
@@ -1373,45 +1327,10 @@ static int cpufreq_resume(struct sys_device *sysdev)
                }
        }
-        if (!(cpufreq_driver->flags & CPUFREQ_CONST_LOOPS)) {
-                unsigned int cur_freq = 0;
-                if (cpufreq_driver->get)
-                        cur_freq = cpufreq_driver->get(cpu_policy->cpu);
-                if (!cur_freq || !cpu_policy->cur) {
-                        printk(KERN_ERR "cpufreq: resume failed to assert "
-                                        "current frequency is what timing core "
-                                        "thinks it is.\n");
-                        goto out;
-                }
-                if (unlikely(cur_freq != cpu_policy->cur)) {
-                        struct cpufreq_freqs freqs;
-                        if (!(cpufreq_driver->flags & CPUFREQ_PM_NO_WARN))
-                                dprintk("Warning: CPU frequency "
-                                       "is %u, cpufreq assumed %u kHz.\n",
-                                       cur_freq, cpu_policy->cur);
-                        freqs.cpu = cpu;
-                        freqs.old = cpu_policy->cur;
-                        freqs.new = cur_freq;
-                        srcu_notifier_call_chain(
-                                        &cpufreq_transition_notifier_list,
-                                        CPUFREQ_RESUMECHANGE, &freqs);
-                        adjust_jiffies(CPUFREQ_RESUMECHANGE, &freqs);
-                        cpu_policy->cur = cur_freq;
-                }
-        }
-out:
        schedule_work(&cpu_policy->update);
 fail:
        cpufreq_cpu_put(cpu_policy);
-#endif  /* __powerpc__ */
        return ret;
 }
diff --git a/drivers/firewire/core-iso.c b/drivers/firewire/core-iso.c
index 110e731f5574..1c0b504a42f3 100644
--- a/drivers/firewire/core-iso.c
+++ b/drivers/firewire/core-iso.c
@@ -196,7 +196,7 @@ static int manage_bandwidth(struct fw_card *card, int irm_id, int generation,
                switch (fw_run_transaction(card, TCODE_LOCK_COMPARE_SWAP,
                                irm_id, generation, SCODE_100,
                                CSR_REGISTER_BASE + CSR_BANDWIDTH_AVAILABLE,
-                                data, sizeof(data))) {
+                                data, 8)) {
                case RCODE_GENERATION:
                        /* A generation change frees all bandwidth. */
                        return allocate ? -EAGAIN : bandwidth;
@@ -233,7 +233,7 @@ static int manage_channel(struct fw_card *card, int irm_id, int generation,
                data[1] = old ^ c;
                switch (fw_run_transaction(card, TCODE_LOCK_COMPARE_SWAP,
                                           irm_id, generation, SCODE_100,
-                                           offset, data, sizeof(data))) {
+                                           offset, data, 8)) {
                case RCODE_GENERATION:
                        /* A generation change frees all channels. */
                        return allocate ? -EAGAIN : i;
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index ecddd11b797a..76b321bb73f9 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -34,6 +34,7 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/pci.h>
+#include <linux/pci_ids.h>
 #include <linux/spinlock.h>
 #include <linux/string.h>
@@ -2372,6 +2373,9 @@ static void ohci_pmac_off(struct pci_dev *dev)
 #define ohci_pmac_off(dev)
 #endif /* CONFIG_PPC_PMAC */
+#define PCI_VENDOR_ID_AGERE             PCI_VENDOR_ID_ATT
+#define PCI_DEVICE_ID_AGERE_FW643       0x5901
 static int __devinit pci_probe(struct pci_dev *dev,
                               const struct pci_device_id *ent)
 {
@@ -2422,6 +2426,16 @@ static int __devinit pci_probe(struct pci_dev *dev,
        version = reg_read(ohci, OHCI1394_Version) & 0x00ff00ff;
        ohci->use_dualbuffer = version >= OHCI_VERSION_1_1;
+        /* dual-buffer mode is broken if more than one IR context is active */
+        if (dev->vendor == PCI_VENDOR_ID_AGERE &&
+            dev->device == PCI_DEVICE_ID_AGERE_FW643)
+                ohci->use_dualbuffer = false;
+        /* dual-buffer mode is broken */
+        if (dev->vendor == PCI_VENDOR_ID_RICOH &&
+            dev->device == PCI_DEVICE_ID_RICOH_R5C832)
+                ohci->use_dualbuffer = false;
 /* x86-32 currently doesn't use highmem for dma_alloc_coherent */
 #if !defined(CONFIG_X86_32)
        /* dual-buffer mode is broken with descriptor addresses above 2G */
diff --git a/drivers/firewire/sbp2.c b/drivers/firewire/sbp2.c
index 8d51568ee143..e5df822a8130 100644
--- a/drivers/firewire/sbp2.c
+++ b/drivers/firewire/sbp2.c
@@ -456,12 +456,12 @@ static void sbp2_status_write(struct fw_card *card, struct fw_request *request,
        }
        spin_unlock_irqrestore(&card->lock, flags);
-        if (&orb->link != &lu->orb_list)
+        if (&orb->link != &lu->orb_list) {
                orb->callback(orb, &status);
-        else
+                kref_put(&orb->kref, free_orb);
+        } else {
                fw_error("status write for unknown orb\n");
+        }
-        kref_put(&orb->kref, free_orb);
        fw_send_response(card, request, RCODE_COMPLETE);
 }
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 33be210d6723..2f631c75f704 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -258,31 +258,6 @@ void *drm_mode_object_find(struct drm_device *dev, uint32_t id, uint32_t type)
 EXPORT_SYMBOL(drm_mode_object_find);
 /**
- * drm_crtc_from_fb - find the CRTC structure associated with an fb
- * @dev: DRM device
- * @fb: framebuffer in question
- *
- * LOCKING:
- * Caller must hold mode_config lock.
- *
- * Find CRTC in the mode_config structure that matches @fb.
- *
- * RETURNS:
- * Pointer to the CRTC or NULL if it wasn't found.
- */
-struct drm_crtc *drm_crtc_from_fb(struct drm_device *dev,
-                                  struct drm_framebuffer *fb)
-{
-        struct drm_crtc *crtc;
-        list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
-                if (crtc->fb == fb)
-                        return crtc;
-        }
-        return NULL;
-}
-/**
 * drm_framebuffer_init - initialize a framebuffer
 * @dev: DRM device
 *
@@ -328,11 +303,20 @@ void drm_framebuffer_cleanup(struct drm_framebuffer *fb)
 {
        struct drm_device *dev = fb->dev;
        struct drm_crtc *crtc;
+        struct drm_mode_set set;
+        int ret;
        /* remove from any CRTC */
        list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
-                if (crtc->fb == fb)
+                if (crtc->fb == fb) {
-                        crtc->fb = NULL;
+                        /* should turn off the crtc */
+                        memset(&set, 0, sizeof(struct drm_mode_set));
+                        set.crtc = crtc;
+                        set.fb = NULL;
+                        ret = crtc->funcs->set_config(&set);
+                        if (ret)
+                                DRM_ERROR("failed to reset crtc %p when fb was deleted\n", crtc);
+                }
        }
        drm_mode_object_put(dev, &fb->base);
@@ -1511,7 +1495,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
        set.mode = mode;
        set.connectors = connector_set;
        set.num_connectors = crtc_req->count_connectors;
-        set.fb =fb;
+        set.fb = fb;
        ret = crtc->funcs->set_config(&set);
 out:
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index 80cc6d06d61b..7f2728bbc16c 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -502,12 +502,40 @@ static int add_detailed_info(struct drm_connector *connector,
                struct detailed_non_pixel *data = &timing->data.other_data;
                struct drm_display_mode *newmode;
-                /* EDID up to and including 1.2 may put monitor info here */
+                /* X server check is version 1.1 or higher */
-                if (edid->version == 1 && edid->revision < 3)
+                if (edid->version == 1 && edid->revision >= 1 &&
-                        continue;
+                    !timing->pixel_clock) {
+                        /* Other timing or info */
-                /* Detailed mode timing */
+                        switch (data->type) {
-                if (timing->pixel_clock) {
+                        case EDID_DETAIL_MONITOR_SERIAL:
+                                break;
+                        case EDID_DETAIL_MONITOR_STRING:
+                                break;
+                        case EDID_DETAIL_MONITOR_RANGE:
+                                /* Get monitor range data */
+                                break;
+                        case EDID_DETAIL_MONITOR_NAME:
+                                break;
+                        case EDID_DETAIL_MONITOR_CPDATA:
+                                break;
+                        case EDID_DETAIL_STD_MODES:
+                                /* Five modes per detailed section */
+                                for (j = 0; j < 5; i++) {
+                                        struct std_timing *std;
+                                        struct drm_display_mode *newmode;
+                                        std = &data->data.timings[j];
+                                        newmode = drm_mode_std(dev, std);
+                                        if (newmode) {
+                                                drm_mode_probed_add(connector, newmode);
+                                                modes++;
+                                        }
+                                }
+                                break;
+                        default:
+                                break;
+                        }
+                } else {
                        newmode = drm_mode_detailed(dev, edid, timing, quirks);
                        if (!newmode)
                                continue;
@@ -518,38 +546,6 @@ static int add_detailed_info(struct drm_connector *connector,
                        drm_mode_probed_add(connector, newmode);
                        modes++;
-                        continue;
-                }
-                /* Other timing or info */
-                switch (data->type) {
-                case EDID_DETAIL_MONITOR_SERIAL:
-                        break;
-                case EDID_DETAIL_MONITOR_STRING:
-                        break;
-                case EDID_DETAIL_MONITOR_RANGE:
-                        /* Get monitor range data */
-                        break;
-                case EDID_DETAIL_MONITOR_NAME:
-                        break;
-                case EDID_DETAIL_MONITOR_CPDATA:
-                        break;
-                case EDID_DETAIL_STD_MODES:
-                        /* Five modes per detailed section */
-                        for (j = 0; j < 5; i++) {
-                                struct std_timing *std;
-                                struct drm_display_mode *newmode;
-                                std = &data->data.timings[j];
-                                newmode = drm_mode_std(dev, std);
-                                if (newmode) {
-                                        drm_mode_probed_add(connector, newmode);
-                                        modes++;
-                                }
-                        }
-                        break;
-                default:
-                        break;
                }
        }
diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c
index 85ec31b3ff00..f7a615b80c70 100644
--- a/drivers/gpu/drm/drm_sysfs.c
+++ b/drivers/gpu/drm/drm_sysfs.c
@@ -22,44 +22,50 @@
 #define to_drm_minor(d) container_of(d, struct drm_minor, kdev)
 #define to_drm_connector(d) container_of(d, struct drm_connector, kdev)
+static struct device_type drm_sysfs_device_minor = {
+        .name = "drm_minor"
+};
 /**
- * drm_sysfs_suspend - DRM class suspend hook
+ * drm_class_suspend - DRM class suspend hook
 * @dev: Linux device to suspend
 * @state: power state to enter
 *
 * Just figures out what the actual struct drm_device associated with
 * @dev is and calls its suspend hook, if present.
 */
-static int drm_sysfs_suspend(struct device *dev, pm_message_t state)
+static int drm_class_suspend(struct device *dev, pm_message_t state)
 {
-        struct drm_minor *drm_minor = to_drm_minor(dev);
+        if (dev->type == &drm_sysfs_device_minor) {
-        struct drm_device *drm_dev = drm_minor->dev;
+                struct drm_minor *drm_minor = to_drm_minor(dev);
+                struct drm_device *drm_dev = drm_minor->dev;
-        if (drm_minor->type == DRM_MINOR_LEGACY &&
-            !drm_core_check_feature(drm_dev, DRIVER_MODESET) &&
+                if (drm_minor->type == DRM_MINOR_LEGACY &&
-            drm_dev->driver->suspend)
+                    !drm_core_check_feature(drm_dev, DRIVER_MODESET) &&
-                return drm_dev->driver->suspend(drm_dev, state);
+                    drm_dev->driver->suspend)
+                        return drm_dev->driver->suspend(drm_dev, state);
+        }
        return 0;
 }
 /**
- * drm_sysfs_resume - DRM class resume hook
+ * drm_class_resume - DRM class resume hook
 * @dev: Linux device to resume
 *
 * Just figures out what the actual struct drm_device associated with
 * @dev is and calls its resume hook, if present.
 */
-static int drm_sysfs_resume(struct device *dev)
+static int drm_class_resume(struct device *dev)
 {
-        struct drm_minor *drm_minor = to_drm_minor(dev);
+        if (dev->type == &drm_sysfs_device_minor) {
-        struct drm_device *drm_dev = drm_minor->dev;
+                struct drm_minor *drm_minor = to_drm_minor(dev);
+                struct drm_device *drm_dev = drm_minor->dev;
-        if (drm_minor->type == DRM_MINOR_LEGACY &&
-            !drm_core_check_feature(drm_dev, DRIVER_MODESET) &&
+                if (drm_minor->type == DRM_MINOR_LEGACY &&
-            drm_dev->driver->resume)
+                    !drm_core_check_feature(drm_dev, DRIVER_MODESET) &&
-                return drm_dev->driver->resume(drm_dev);
+                    drm_dev->driver->resume)
+                        return drm_dev->driver->resume(drm_dev);
+        }
        return 0;
 }
@@ -99,8 +105,8 @@ struct class *drm_sysfs_create(struct module *owner, char *name)
                goto err_out;
        }
-        class->suspend = drm_sysfs_suspend;
+        class->suspend = drm_class_suspend;
-        class->resume = drm_sysfs_resume;
+        class->resume = drm_class_resume;
        err = class_create_file(class, &class_attr_version);
        if (err)
@@ -480,6 +486,7 @@ int drm_sysfs_device_add(struct drm_minor *minor)
        minor->kdev.class = drm_class;
        minor->kdev.release = drm_sysfs_device_release;
        minor->kdev.devt = minor->device;
+        minor->kdev.type = &drm_sysfs_device_minor;
        if (minor->type == DRM_MINOR_CONTROL)
                minor_str = "controlD%d";
        else if (minor->type == DRM_MINOR_RENDER)
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 7537f57d8a87..5b4f87e55621 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -222,6 +222,7 @@ typedef struct drm_i915_private {
        unsigned int edp_support:1;
        int lvds_ssc_freq;
+        int crt_ddc_bus; /* -1 = unknown, else GPIO to use for CRT DDC */
        struct drm_i915_fence_reg fence_regs[16]; /* assume 965 */
        int fence_reg_start; /* 4 if userland hasn't ioctl'd us yet */
        int num_fence_regs; /* 8 on pre-965, 16 otherwise */
@@ -384,6 +385,9 @@ typedef struct drm_i915_private {
                 */
                struct list_head inactive_list;
+                /** LRU list of objects with fence regs on them. */
+                struct list_head fence_list;
                /**
                 * List of breadcrumbs associated with GPU requests currently
                 * outstanding.
@@ -451,6 +455,9 @@ struct drm_i915_gem_object {
        /** This object's place on the active/flushing/inactive lists */
        struct list_head list;
+        /** This object's place on the fenced object LRU */
+        struct list_head fence_list;
        /**
         * This is set if the object is on the active or flushing lists
         * (has pending rendering), and is not set if it's on inactive (ready
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 140bee142fc2..0c07a755b3a3 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -978,6 +978,7 @@ int
 i915_gem_set_domain_ioctl(struct drm_device *dev, void *data,
                          struct drm_file *file_priv)
 {
+        struct drm_i915_private *dev_priv = dev->dev_private;
        struct drm_i915_gem_set_domain *args = data;
        struct drm_gem_object *obj;
        uint32_t read_domains = args->read_domains;
@@ -1010,8 +1011,18 @@ i915_gem_set_domain_ioctl(struct drm_device *dev, void *data,
                 obj, obj->size, read_domains, write_domain);
 #endif
        if (read_domains & I915_GEM_DOMAIN_GTT) {
+                struct drm_i915_gem_object *obj_priv = obj->driver_private;
                ret = i915_gem_object_set_to_gtt_domain(obj, write_domain != 0);
+                /* Update the LRU on the fence for the CPU access that's
+                 * about to occur.
+                 */
+                if (obj_priv->fence_reg != I915_FENCE_REG_NONE) {
+                        list_move_tail(&obj_priv->fence_list,
+                                       &dev_priv->mm.fence_list);
+                }
                /* Silently promote "you're not bound, there was nothing to do"
                 * to success, since the client was just asking us to
                 * make sure everything was done.
@@ -1155,8 +1166,7 @@ int i915_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
        }
        /* Need a new fence register? */
-        if (obj_priv->fence_reg == I915_FENCE_REG_NONE &&
+        if (obj_priv->tiling_mode != I915_TILING_NONE) {
-            obj_priv->tiling_mode != I915_TILING_NONE) {
                ret = i915_gem_object_get_fence_reg(obj);
                if (ret) {
                        mutex_unlock(&dev->struct_mutex);
@@ -2208,6 +2218,12 @@ i915_gem_object_get_fence_reg(struct drm_gem_object *obj)
        struct drm_i915_gem_object *old_obj_priv = NULL;
        int i, ret, avail;
+        /* Just update our place in the LRU if our fence is getting used. */
+        if (obj_priv->fence_reg != I915_FENCE_REG_NONE) {
+                list_move_tail(&obj_priv->fence_list, &dev_priv->mm.fence_list);
+                return 0;
+        }
        switch (obj_priv->tiling_mode) {
        case I915_TILING_NONE:
                WARN(1, "allocating a fence for non-tiled object?\n");
@@ -2229,7 +2245,6 @@ i915_gem_object_get_fence_reg(struct drm_gem_object *obj)
        }
        /* First try to find a free reg */
-try_again:
        avail = 0;
        for (i = dev_priv->fence_reg_start; i < dev_priv->num_fence_regs; i++) {
                reg = &dev_priv->fence_regs[i];
@@ -2243,52 +2258,41 @@ try_again:
        /* None available, try to steal one or wait for a user to finish */
        if (i == dev_priv->num_fence_regs) {
-                uint32_t seqno = dev_priv->mm.next_gem_seqno;
+                struct drm_gem_object *old_obj = NULL;
                if (avail == 0)
                        return -ENOSPC;
-                for (i = dev_priv->fence_reg_start;
+                list_for_each_entry(old_obj_priv, &dev_priv->mm.fence_list,
-                     i < dev_priv->num_fence_regs; i++) {
+                                    fence_list) {
-                        uint32_t this_seqno;
+                        old_obj = old_obj_priv->obj;
-                        reg = &dev_priv->fence_regs[i];
+                        reg = &dev_priv->fence_regs[old_obj_priv->fence_reg];
-                        old_obj_priv = reg->obj->driver_private;
                        if (old_obj_priv->pin_count)
                                continue;
+                        /* Take a reference, as otherwise the wait_rendering
+                         * below may cause the object to get freed out from
+                         * under us.
+                         */
+                        drm_gem_object_reference(old_obj);
                        /* i915 uses fences for GPU access to tiled buffers */
                        if (IS_I965G(dev) || !old_obj_priv->active)
                                break;
-                        /* find the seqno of the first available fence */
+                        /* This brings the object to the head of the LRU if it
-                        this_seqno = old_obj_priv->last_rendering_seqno;
+                         * had been written to.  The only way this should
-                        if (this_seqno != 0 &&
+                         * result in us waiting longer than the expected
-                            reg->obj->write_domain == 0 &&
+                         * optimal amount of time is if there was a
-                            i915_seqno_passed(seqno, this_seqno))
+                         * fence-using buffer later that was read-only.
-                                seqno = this_seqno;
+                         */
-                }
+                        i915_gem_object_flush_gpu_write_domain(old_obj);
+                        ret = i915_gem_object_wait_rendering(old_obj);
-                /*
+                        if (ret != 0)
-                 * Now things get ugly... we have to wait for one of the
-                 * objects to finish before trying again.
-                 */
-                if (i == dev_priv->num_fence_regs) {
-                        if (seqno == dev_priv->mm.next_gem_seqno) {
-                                i915_gem_flush(dev,
-                                               I915_GEM_GPU_DOMAINS,
-                                               I915_GEM_GPU_DOMAINS);
-                                seqno = i915_add_request(dev, NULL,
-                                                         I915_GEM_GPU_DOMAINS);
-                                if (seqno == 0)
-                                        return -ENOMEM;
-                        }
-                        ret = i915_wait_request(dev, seqno);
-                        if (ret)
                                return ret;
-                        goto try_again;
+                        break;
                }
                /*
@@ -2296,10 +2300,15 @@ try_again:
                 * for this object next time we need it.
                 */
                i915_gem_release_mmap(reg->obj);
+                i = old_obj_priv->fence_reg;
                old_obj_priv->fence_reg = I915_FENCE_REG_NONE;
+                list_del_init(&old_obj_priv->fence_list);
+                drm_gem_object_unreference(old_obj);
        }
        obj_priv->fence_reg = i;
+        list_add_tail(&obj_priv->fence_list, &dev_priv->mm.fence_list);
        reg->obj = obj;
        if (IS_I965G(dev))
@@ -2342,6 +2351,7 @@ i915_gem_clear_fence_reg(struct drm_gem_object *obj)
        dev_priv->fence_regs[obj_priv->fence_reg].obj = NULL;
        obj_priv->fence_reg = I915_FENCE_REG_NONE;
+        list_del_init(&obj_priv->fence_list);
 }
 /**
@@ -3595,9 +3605,7 @@ i915_gem_object_pin(struct drm_gem_object *obj, uint32_t alignment)
         * Pre-965 chips need a fence register set up in order to
         * properly handle tiled surfaces.
         */
-        if (!IS_I965G(dev) &&
+        if (!IS_I965G(dev) && obj_priv->tiling_mode != I915_TILING_NONE) {
-            obj_priv->fence_reg == I915_FENCE_REG_NONE &&
-            obj_priv->tiling_mode != I915_TILING_NONE) {
                ret = i915_gem_object_get_fence_reg(obj);
                if (ret != 0) {
                        if (ret != -EBUSY && ret != -ERESTARTSYS)
@@ -3806,6 +3814,7 @@ int i915_gem_init_object(struct drm_gem_object *obj)
        obj_priv->obj = obj;
        obj_priv->fence_reg = I915_FENCE_REG_NONE;
        INIT_LIST_HEAD(&obj_priv->list);
+        INIT_LIST_HEAD(&obj_priv->fence_list);
        return 0;
 }
@@ -4253,6 +4262,7 @@ i915_gem_load(struct drm_device *dev)
        INIT_LIST_HEAD(&dev_priv->mm.flushing_list);
        INIT_LIST_HEAD(&dev_priv->mm.inactive_list);
        INIT_LIST_HEAD(&dev_priv->mm.request_list);
+        INIT_LIST_HEAD(&dev_priv->mm.fence_list);
        INIT_DELAYED_WORK(&dev_priv->mm.retire_work,
                          i915_gem_retire_work_handler);
        dev_priv->mm.next_gem_seqno = 1;
diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c
index 300aee3296c2..f806fcc54e09 100644
--- a/drivers/gpu/drm/i915/intel_bios.c
+++ b/drivers/gpu/drm/i915/intel_bios.c
@@ -59,6 +59,16 @@ find_section(struct bdb_header *bdb, int section_id)
        return NULL;
 }
+static u16
+get_blocksize(void *p)
+{
+        u16 *block_ptr, block_size;
+        block_ptr = (u16 *)((char *)p - 2);
+        block_size = *block_ptr;
+        return block_size;
+}
 static void
 fill_detail_timing_data(struct drm_display_mode *panel_fixed_mode,
                        struct lvds_dvo_timing *dvo_timing)
@@ -215,6 +225,41 @@ parse_general_features(struct drm_i915_private *dev_priv,
 }
 static void
+parse_general_definitions(struct drm_i915_private *dev_priv,
+                          struct bdb_header *bdb)
+{
+        struct bdb_general_definitions *general;
+        const int crt_bus_map_table[] = {
+                GPIOB,
+                GPIOA,
+                GPIOC,
+                GPIOD,
+                GPIOE,
+                GPIOF,
+        };
+        /* Set sensible defaults in case we can't find the general block
+           or it is the wrong chipset */
+        dev_priv->crt_ddc_bus = -1;
+        general = find_section(bdb, BDB_GENERAL_DEFINITIONS);
+        if (general) {
+                u16 block_size = get_blocksize(general);
+                if (block_size >= sizeof(*general)) {
+                        int bus_pin = general->crt_ddc_gmbus_pin;
+                        DRM_DEBUG("crt_ddc_bus_pin: %d\n", bus_pin);
+                        if ((bus_pin >= 1) && (bus_pin <= 6)) {
+                                dev_priv->crt_ddc_bus =
+                                        crt_bus_map_table[bus_pin-1];
+                        }
+                } else {
+                        DRM_DEBUG("BDB_GD too small (%d). Invalid.\n",
+                                  block_size);
+                }
+        }
+}
+static void
 parse_sdvo_device_mapping(struct drm_i915_private *dev_priv,
                       struct bdb_header *bdb)
 {
@@ -222,7 +267,7 @@ parse_sdvo_device_mapping(struct drm_i915_private *dev_priv,
        struct bdb_general_definitions *p_defs;
        struct child_device_config *p_child;
        int i, child_device_num, count;
-        u16     block_size, *block_ptr;
+        u16     block_size;
        p_defs = find_section(bdb, BDB_GENERAL_DEFINITIONS);
        if (!p_defs) {
@@ -240,8 +285,7 @@ parse_sdvo_device_mapping(struct drm_i915_private *dev_priv,
                return;
        }
        /* get the block size of general definitions */
-        block_ptr = (u16 *)((char *)p_defs - 2);
+        block_size = get_blocksize(p_defs);
-        block_size = *block_ptr;
        /* get the number of child device */
        child_device_num = (block_size - sizeof(*p_defs)) /
                                sizeof(*p_child);
@@ -362,6 +406,7 @@ intel_init_bios(struct drm_device *dev)
        /* Grab useful general definitions */
        parse_general_features(dev_priv, bdb);
+        parse_general_definitions(dev_priv, bdb);
        parse_lfp_panel_data(dev_priv, bdb);
        parse_sdvo_panel_data(dev_priv, bdb);
        parse_sdvo_device_mapping(dev_priv, bdb);
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index 4cf8e2e88a40..590f81c8f594 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -508,6 +508,7 @@ void intel_crt_init(struct drm_device *dev)
 {
        struct drm_connector *connector;
        struct intel_output *intel_output;
+        struct drm_i915_private *dev_priv = dev->dev_private;
        u32 i2c_reg;
        intel_output = kzalloc(sizeof(struct intel_output), GFP_KERNEL);
@@ -527,8 +528,12 @@ void intel_crt_init(struct drm_device *dev)
        /* Set up the DDC bus. */
        if (IS_IGDNG(dev))
                i2c_reg = PCH_GPIOA;
-        else
+        else {
                i2c_reg = GPIOA;
+                /* Use VBT information for CRT DDC if available */
+                if (dev_priv->crt_ddc_bus != -1)
+                        i2c_reg = dev_priv->crt_ddc_bus;
+        }
        intel_output->ddc_bus = intel_i2c_create(dev, i2c_reg, "CRTDDC_A");
        if (!intel_output->ddc_bus) {
                dev_printk(KERN_ERR, &dev->pdev->dev, "DDC bus registration "
@@ -537,6 +542,10 @@ void intel_crt_init(struct drm_device *dev)
        }
        intel_output->type = INTEL_OUTPUT_ANALOG;
+        intel_output->clone_mask = (1 << INTEL_SDVO_NON_TV_CLONE_BIT) |
+                                   (1 << INTEL_ANALOG_CLONE_BIT) |
+                                   (1 << INTEL_SDVO_LVDS_CLONE_BIT);
+        intel_output->crtc_mask = (1 << 0) | (1 << 1);
        connector->interlace_allowed = 0;
        connector->doublescan_allowed = 0;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index d6fce2133413..3fadb5358858 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -666,7 +666,7 @@ intel_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
        intel_clock_t clock;
        int err = target;
-        if (IS_I9XX(dev) && intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS) &&
+        if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS) &&
            (I915_READ(LVDS)) != 0) {
                /*
                 * For LVDS, if the panel is on, just rely on its current
@@ -2396,7 +2396,7 @@ static int intel_crtc_mode_set(struct drm_crtc *crtc,
                if (is_sdvo) {
                        dpll |= DPLL_DVO_HIGH_SPEED;
                        sdvo_pixel_multiply = adjusted_mode->clock / mode->clock;
-                        if (IS_I945G(dev) || IS_I945GM(dev))
+                        if (IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev))
                                dpll |= (sdvo_pixel_multiply - 1) << SDVO_MULTIPLIER_SHIFT_HIRES;
                        else if (IS_IGDNG(dev))
                                dpll |= (sdvo_pixel_multiply - 1) << PLL_REF_SDVO_HDMI_MULTIPLIER_SHIFT;
@@ -3170,7 +3170,7 @@ static int intel_connector_clones(struct drm_device *dev, int type_mask)
        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
                struct intel_output *intel_output = to_intel_output(connector);
-                if (type_mask & (1 << intel_output->type))
+                if (type_mask & intel_output->clone_mask)
                        index_mask |= (1 << entry);
                entry++;
        }
@@ -3218,30 +3218,30 @@ static void intel_setup_outputs(struct drm_device *dev)
                        intel_dp_init(dev, PCH_DP_D);
        } else if (IS_I9XX(dev)) {
-                int found;
+                bool found = false;
-                u32 reg;
                if (I915_READ(SDVOB) & SDVO_DETECTED) {
                        found = intel_sdvo_init(dev, SDVOB);
                        if (!found && SUPPORTS_INTEGRATED_HDMI(dev))
                                intel_hdmi_init(dev, SDVOB);
                        if (!found && SUPPORTS_INTEGRATED_DP(dev))
                                intel_dp_init(dev, DP_B);
                }
                /* Before G4X SDVOC doesn't have its own detect register */
-                if (IS_G4X(dev))
-                        reg = SDVOC;
-                else
-                        reg = SDVOB;
-                if (I915_READ(reg) & SDVO_DETECTED) {
+                if (I915_READ(SDVOB) & SDVO_DETECTED)
                        found = intel_sdvo_init(dev, SDVOC);
-                        if (!found && SUPPORTS_INTEGRATED_HDMI(dev))
+                if (!found && (I915_READ(SDVOC) & SDVO_DETECTED)) {
+                        if (SUPPORTS_INTEGRATED_HDMI(dev))
                                intel_hdmi_init(dev, SDVOC);
-                        if (!found && SUPPORTS_INTEGRATED_DP(dev))
+                        if (SUPPORTS_INTEGRATED_DP(dev))
                                intel_dp_init(dev, DP_C);
                }
                if (SUPPORTS_INTEGRATED_DP(dev) && (I915_READ(DP_D) & DP_DETECTED))
                        intel_dp_init(dev, DP_D);
        } else
@@ -3253,51 +3253,10 @@ static void intel_setup_outputs(struct drm_device *dev)
        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
                struct intel_output *intel_output = to_intel_output(connector);
                struct drm_encoder *encoder = &intel_output->enc;
-                int crtc_mask = 0, clone_mask = 0;
-                /* valid crtcs */
+                encoder->possible_crtcs = intel_output->crtc_mask;
-                switch(intel_output->type) {
+                encoder->possible_clones = intel_connector_clones(dev,
-                case INTEL_OUTPUT_HDMI:
+                                                intel_output->clone_mask);
-                        crtc_mask = ((1 << 0)|
-                                     (1 << 1));
-                        clone_mask = ((1 << INTEL_OUTPUT_HDMI));
-                        break;
-                case INTEL_OUTPUT_DVO:
-                case INTEL_OUTPUT_SDVO:
-                        crtc_mask = ((1 << 0)|
-                                     (1 << 1));
-                        clone_mask = ((1 << INTEL_OUTPUT_ANALOG) |
-                                      (1 << INTEL_OUTPUT_DVO) |
-                                      (1 << INTEL_OUTPUT_SDVO));
-                        break;
-                case INTEL_OUTPUT_ANALOG:
-                        crtc_mask = ((1 << 0)|
-                                     (1 << 1));
-                        clone_mask = ((1 << INTEL_OUTPUT_ANALOG) |
-                                      (1 << INTEL_OUTPUT_DVO) |
-                                      (1 << INTEL_OUTPUT_SDVO));
-                        break;
-                case INTEL_OUTPUT_LVDS:
-                        crtc_mask = (1 << 1);
-                        clone_mask = (1 << INTEL_OUTPUT_LVDS);
-                        break;
-                case INTEL_OUTPUT_TVOUT:
-                        crtc_mask = ((1 << 0) |
-                                     (1 << 1));
-                        clone_mask = (1 << INTEL_OUTPUT_TVOUT);
-                        break;
-                case INTEL_OUTPUT_DISPLAYPORT:
-                        crtc_mask = ((1 << 0) |
-                                     (1 << 1));
-                        clone_mask = (1 << INTEL_OUTPUT_DISPLAYPORT);
-                        break;
-                case INTEL_OUTPUT_EDP:
-                        crtc_mask = (1 << 1);
-                        clone_mask = (1 << INTEL_OUTPUT_EDP);
-                        break;
-                }
-                encoder->possible_crtcs = crtc_mask;
-                encoder->possible_clones = intel_connector_clones(dev, clone_mask);
        }
 }
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index a6ff15ac548a..f2afc4af4bc9 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -1254,6 +1254,18 @@ intel_dp_init(struct drm_device *dev, int output_reg)
        else
                intel_output->type = INTEL_OUTPUT_DISPLAYPORT;
+        if (output_reg == DP_B)
+                intel_output->clone_mask = (1 << INTEL_DP_B_CLONE_BIT);
+        else if (output_reg == DP_C)
+                intel_output->clone_mask = (1 << INTEL_DP_C_CLONE_BIT);
+        else if (output_reg == DP_D)
+                intel_output->clone_mask = (1 << INTEL_DP_D_CLONE_BIT);
+        if (IS_eDP(intel_output)) {
+                intel_output->crtc_mask = (1 << 1);
+                intel_output->clone_mask = (1 << INTEL_OUTPUT_EDP);
+        } else
+                intel_output->crtc_mask = (1 << 0) | (1 << 1);
        connector->interlace_allowed = true;
        connector->doublescan_allowed = 0;
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index d6f92ea1b553..25aa6facc12d 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -57,6 +57,24 @@
 #define INTEL_OUTPUT_DISPLAYPORT 7
 #define INTEL_OUTPUT_EDP 8
+/* Intel Pipe Clone Bit */
+#define INTEL_HDMIB_CLONE_BIT 1
+#define INTEL_HDMIC_CLONE_BIT 2
+#define INTEL_HDMID_CLONE_BIT 3
+#define INTEL_HDMIE_CLONE_BIT 4
+#define INTEL_HDMIF_CLONE_BIT 5
+#define INTEL_SDVO_NON_TV_CLONE_BIT 6
+#define INTEL_SDVO_TV_CLONE_BIT 7
+#define INTEL_SDVO_LVDS_CLONE_BIT 8
+#define INTEL_ANALOG_CLONE_BIT 9
+#define INTEL_TV_CLONE_BIT 10
+#define INTEL_DP_B_CLONE_BIT 11
+#define INTEL_DP_C_CLONE_BIT 12
+#define INTEL_DP_D_CLONE_BIT 13
+#define INTEL_LVDS_CLONE_BIT 14
+#define INTEL_DVO_TMDS_CLONE_BIT 15
+#define INTEL_DVO_LVDS_CLONE_BIT 16
 #define INTEL_DVO_CHIP_NONE 0
 #define INTEL_DVO_CHIP_LVDS 1
 #define INTEL_DVO_CHIP_TMDS 2
@@ -86,6 +104,8 @@ struct intel_output {
        bool needs_tv_clock;
        void *dev_priv;
        void (*hot_plug)(struct intel_output *);
+        int crtc_mask;
+        int clone_mask;
 };
 struct intel_crtc {
diff --git a/drivers/gpu/drm/i915/intel_dvo.c b/drivers/gpu/drm/i915/intel_dvo.c
index 13bff20930e8..a4d2606de778 100644
--- a/drivers/gpu/drm/i915/intel_dvo.c
+++ b/drivers/gpu/drm/i915/intel_dvo.c
@@ -435,14 +435,20 @@ void intel_dvo_init(struct drm_device *dev)
                        continue;
                intel_output->type = INTEL_OUTPUT_DVO;
+                intel_output->crtc_mask = (1 << 0) | (1 << 1);
                switch (dvo->type) {
                case INTEL_DVO_CHIP_TMDS:
+                        intel_output->clone_mask =
+                                (1 << INTEL_DVO_TMDS_CLONE_BIT) |
+                                (1 << INTEL_ANALOG_CLONE_BIT);
                        drm_connector_init(dev, connector,
                                           &intel_dvo_connector_funcs,
                                           DRM_MODE_CONNECTOR_DVII);
                        encoder_type = DRM_MODE_ENCODER_TMDS;
                        break;
                case INTEL_DVO_CHIP_LVDS:
+                        intel_output->clone_mask =
+                                (1 << INTEL_DVO_LVDS_CLONE_BIT);
                        drm_connector_init(dev, connector,
                                           &intel_dvo_connector_funcs,
                                           DRM_MODE_CONNECTOR_LVDS);
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index 1842290cded3..fa304e136010 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -230,22 +230,28 @@ void intel_hdmi_init(struct drm_device *dev, int sdvox_reg)
        connector->interlace_allowed = 0;
        connector->doublescan_allowed = 0;
+        intel_output->crtc_mask = (1 << 0) | (1 << 1);
        /* Set up the DDC bus. */
-        if (sdvox_reg == SDVOB)
+        if (sdvox_reg == SDVOB) {
+                intel_output->clone_mask = (1 << INTEL_HDMIB_CLONE_BIT);
                intel_output->ddc_bus = intel_i2c_create(dev, GPIOE, "HDMIB");
-        else if (sdvox_reg == SDVOC)
+        } else if (sdvox_reg == SDVOC) {
+                intel_output->clone_mask = (1 << INTEL_HDMIC_CLONE_BIT);
                intel_output->ddc_bus = intel_i2c_create(dev, GPIOD, "HDMIC");
-        else if (sdvox_reg == HDMIB)
+        } else if (sdvox_reg == HDMIB) {
+                intel_output->clone_mask = (1 << INTEL_HDMID_CLONE_BIT);
                intel_output->ddc_bus = intel_i2c_create(dev, PCH_GPIOE,
                                                                "HDMIB");
-        else if (sdvox_reg == HDMIC)
+        } else if (sdvox_reg == HDMIC) {
+                intel_output->clone_mask = (1 << INTEL_HDMIE_CLONE_BIT);
                intel_output->ddc_bus = intel_i2c_create(dev, PCH_GPIOD,
                                                                "HDMIC");
-        else if (sdvox_reg == HDMID)
+        } else if (sdvox_reg == HDMID) {
+                intel_output->clone_mask = (1 << INTEL_HDMIF_CLONE_BIT);
                intel_output->ddc_bus = intel_i2c_create(dev, PCH_GPIOF,
                                                                "HDMID");
+        }
        if (!intel_output->ddc_bus)
                goto err_connector;
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 3f445a80c552..8df02ef89261 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -916,6 +916,8 @@ void intel_lvds_init(struct drm_device *dev)
        drm_mode_connector_attach_encoder(&intel_output->base, &intel_output->enc);
        intel_output->type = INTEL_OUTPUT_LVDS;
+        intel_output->clone_mask = (1 << INTEL_LVDS_CLONE_BIT);
+        intel_output->crtc_mask = (1 << 1);
        drm_encoder_helper_add(encoder, &intel_lvds_helper_funcs);
        drm_connector_helper_add(connector, &intel_lvds_connector_helper_funcs);
        connector->display_info.subpixel_order = SubPixelHorizontalRGB;
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index 5371d9332554..d3b74ba62b4a 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -1458,7 +1458,7 @@ intel_sdvo_multifunc_encoder(struct intel_output *intel_output)
                (SDVO_OUTPUT_RGB0 | SDVO_OUTPUT_RGB1))
                caps++;
        if (sdvo_priv->caps.output_flags &
-                (SDVO_OUTPUT_SVID0 | SDVO_OUTPUT_SVID0))
+                (SDVO_OUTPUT_SVID0 | SDVO_OUTPUT_SVID1))
                caps++;
        if (sdvo_priv->caps.output_flags &
                (SDVO_OUTPUT_CVBS0 | SDVO_OUTPUT_CVBS1))
@@ -1967,6 +1967,9 @@ intel_sdvo_output_setup(struct intel_output *intel_output, uint16_t flags)
                        intel_sdvo_set_colorimetry(intel_output,
                                                   SDVO_COLORIMETRY_RGB256);
                        connector->connector_type = DRM_MODE_CONNECTOR_HDMIA;
+                        intel_output->clone_mask =
+                                        (1 << INTEL_SDVO_NON_TV_CLONE_BIT) |
+                                        (1 << INTEL_ANALOG_CLONE_BIT);
                }
        } else if (flags & SDVO_OUTPUT_SVID0) {
@@ -1975,11 +1978,14 @@ intel_sdvo_output_setup(struct intel_output *intel_output, uint16_t flags)
                connector->connector_type = DRM_MODE_CONNECTOR_SVIDEO;
                sdvo_priv->is_tv = true;
                intel_output->needs_tv_clock = true;
+                intel_output->clone_mask = 1 << INTEL_SDVO_TV_CLONE_BIT;
        } else if (flags & SDVO_OUTPUT_RGB0) {
                sdvo_priv->controlled_output = SDVO_OUTPUT_RGB0;
                encoder->encoder_type = DRM_MODE_ENCODER_DAC;
                connector->connector_type = DRM_MODE_CONNECTOR_VGA;
+                intel_output->clone_mask = (1 << INTEL_SDVO_NON_TV_CLONE_BIT) |
+                                        (1 << INTEL_ANALOG_CLONE_BIT);
        } else if (flags & SDVO_OUTPUT_RGB1) {
                sdvo_priv->controlled_output = SDVO_OUTPUT_RGB1;
@@ -1991,12 +1997,16 @@ intel_sdvo_output_setup(struct intel_output *intel_output, uint16_t flags)
                encoder->encoder_type = DRM_MODE_ENCODER_LVDS;
                connector->connector_type = DRM_MODE_CONNECTOR_LVDS;
                sdvo_priv->is_lvds = true;
+                intel_output->clone_mask = (1 << INTEL_ANALOG_CLONE_BIT) |
+                                        (1 << INTEL_SDVO_LVDS_CLONE_BIT);
        } else if (flags & SDVO_OUTPUT_LVDS1) {
                sdvo_priv->controlled_output = SDVO_OUTPUT_LVDS1;
                encoder->encoder_type = DRM_MODE_ENCODER_LVDS;
                connector->connector_type = DRM_MODE_CONNECTOR_LVDS;
                sdvo_priv->is_lvds = true;
+                intel_output->clone_mask = (1 << INTEL_ANALOG_CLONE_BIT) |
+                                        (1 << INTEL_SDVO_LVDS_CLONE_BIT);
        } else {
                unsigned char bytes[2];
@@ -2009,6 +2019,7 @@ intel_sdvo_output_setup(struct intel_output *intel_output, uint16_t flags)
                                  bytes[0], bytes[1]);
                ret = false;
        }
+        intel_output->crtc_mask = (1 << 0) | (1 << 1);
        if (ret && registered)
                ret = drm_sysfs_connector_add(connector) == 0 ? true : false;
diff --git a/drivers/gpu/drm/i915/intel_tv.c b/drivers/gpu/drm/i915/intel_tv.c
index da4ab4dc1630..2fbe13a0de81 100644
--- a/drivers/gpu/drm/i915/intel_tv.c
+++ b/drivers/gpu/drm/i915/intel_tv.c
@@ -1718,6 +1718,7 @@ intel_tv_init(struct drm_device *dev)
        if (!intel_output) {
                return;
        }
        connector = &intel_output->base;
        drm_connector_init(dev, connector, &intel_tv_connector_funcs,
@@ -1729,6 +1730,7 @@ intel_tv_init(struct drm_device *dev)
        drm_mode_connector_attach_encoder(&intel_output->base, &intel_output->enc);
        tv_priv = (struct intel_tv_priv *)(intel_output + 1);
        intel_output->type = INTEL_OUTPUT_TVOUT;
+        intel_output->clone_mask = (1 << INTEL_TV_CLONE_BIT);
        intel_output->enc.possible_crtcs = ((1 << 0) | (1 << 1));
        intel_output->enc.possible_clones = (1 << INTEL_OUTPUT_TVOUT);
        intel_output->dev_priv = tv_priv;
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index f1ba8ff41130..68e728e8be4d 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -254,6 +254,72 @@ void r100_mc_fini(struct radeon_device *rdev)
 /*
+ * Interrupts
+ */
+int r100_irq_set(struct radeon_device *rdev)
+{
+        uint32_t tmp = 0;
+        if (rdev->irq.sw_int) {
+                tmp |= RADEON_SW_INT_ENABLE;
+        }
+        if (rdev->irq.crtc_vblank_int[0]) {
+                tmp |= RADEON_CRTC_VBLANK_MASK;
+        }
+        if (rdev->irq.crtc_vblank_int[1]) {
+                tmp |= RADEON_CRTC2_VBLANK_MASK;
+        }
+        WREG32(RADEON_GEN_INT_CNTL, tmp);
+        return 0;
+}
+static inline uint32_t r100_irq_ack(struct radeon_device *rdev)
+{
+        uint32_t irqs = RREG32(RADEON_GEN_INT_STATUS);
+        uint32_t irq_mask = RADEON_SW_INT_TEST | RADEON_CRTC_VBLANK_STAT |
+                RADEON_CRTC2_VBLANK_STAT;
+        if (irqs) {
+                WREG32(RADEON_GEN_INT_STATUS, irqs);
+        }
+        return irqs & irq_mask;
+}
+int r100_irq_process(struct radeon_device *rdev)
+{
+        uint32_t status;
+        status = r100_irq_ack(rdev);
+        if (!status) {
+                return IRQ_NONE;
+        }
+        while (status) {
+                /* SW interrupt */
+                if (status & RADEON_SW_INT_TEST) {
+                        radeon_fence_process(rdev);
+                }
+                /* Vertical blank interrupts */
+                if (status & RADEON_CRTC_VBLANK_STAT) {
+                        drm_handle_vblank(rdev->ddev, 0);
+                }
+                if (status & RADEON_CRTC2_VBLANK_STAT) {
+                        drm_handle_vblank(rdev->ddev, 1);
+                }
+                status = r100_irq_ack(rdev);
+        }
+        return IRQ_HANDLED;
+}
+u32 r100_get_vblank_counter(struct radeon_device *rdev, int crtc)
+{
+        if (crtc == 0)
+                return RREG32(RADEON_CRTC_CRNT_FRAME);
+        else
+                return RREG32(RADEON_CRTC2_CRNT_FRAME);
+}
+/*
 * Fence emission
 */
 void r100_fence_ring_emit(struct radeon_device *rdev,
@@ -1025,6 +1091,16 @@ static int r100_packet0_check(struct radeon_cs_parser *p,
                        tmp |= tile_flags;
                        ib[idx] = tmp;
                        break;
+                case RADEON_RB3D_ZPASS_ADDR:
+                        r = r100_cs_packet_next_reloc(p, &reloc);
+                        if (r) {
+                                DRM_ERROR("No reloc for ib[%d]=0x%04X\n",
+                                          idx, reg);
+                                r100_cs_dump_packet(p, pkt);
+                                return r;
+                        }
+                        ib[idx] = ib_chunk->kdata[idx] + ((u32)reloc->lobj.gpu_offset);
+                        break;
                default:
                        /* FIXME: we don't want to allow anyothers packet */
                        break;
@@ -1556,26 +1632,6 @@ void r100_pll_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
        r100_pll_errata_after_data(rdev);
 }
-uint32_t r100_mm_rreg(struct radeon_device *rdev, uint32_t reg)
-{
-        if (reg < 0x10000)
-                return readl(((void __iomem *)rdev->rmmio) + reg);
-        else {
-                writel(reg, ((void __iomem *)rdev->rmmio) + RADEON_MM_INDEX);
-                return readl(((void __iomem *)rdev->rmmio) + RADEON_MM_DATA);
-        }
-}
-void r100_mm_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
-{
-        if (reg < 0x10000)
-                writel(v, ((void __iomem *)rdev->rmmio) + reg);
-        else {
-                writel(reg, ((void __iomem *)rdev->rmmio) + RADEON_MM_INDEX);
-                writel(v, ((void __iomem *)rdev->rmmio) + RADEON_MM_DATA);
-        }
-}
 int r100_init(struct radeon_device *rdev)
 {
        return 0;
diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
index 9c8d41534a5d..053f4ec397f7 100644
--- a/drivers/gpu/drm/radeon/r300.c
+++ b/drivers/gpu/drm/radeon/r300.c
@@ -83,8 +83,8 @@ void rv370_pcie_gart_tlb_flush(struct radeon_device *rdev)
                WREG32_PCIE(RADEON_PCIE_TX_GART_CNTL, tmp | RADEON_PCIE_TX_GART_INVALIDATE_TLB);
                (void)RREG32_PCIE(RADEON_PCIE_TX_GART_CNTL);
                WREG32_PCIE(RADEON_PCIE_TX_GART_CNTL, tmp);
-                mb();
        }
+        mb();
 }
 int rv370_pcie_gart_enable(struct radeon_device *rdev)
@@ -448,6 +448,7 @@ void r300_gpu_init(struct radeon_device *rdev)
                /* rv350,rv370,rv380 */
                rdev->num_gb_pipes = 1;
        }
+        rdev->num_z_pipes = 1;
        gb_tile_config = (R300_ENABLE_TILING | R300_TILE_SIZE_16);
        switch (rdev->num_gb_pipes) {
        case 2:
@@ -486,7 +487,8 @@ void r300_gpu_init(struct radeon_device *rdev)
                printk(KERN_WARNING "Failed to wait MC idle while "
                       "programming pipes. Bad things might happen.\n");
        }
-        DRM_INFO("radeon: %d pipes initialized.\n", rdev->num_gb_pipes);
+        DRM_INFO("radeon: %d quad pipes, %d Z pipes initialized.\n",
+                 rdev->num_gb_pipes, rdev->num_z_pipes);
 }
 int r300_ga_reset(struct radeon_device *rdev)
@@ -593,27 +595,6 @@ void r300_vram_info(struct radeon_device *rdev)
 /*
- * Indirect registers accessor
- */
-uint32_t rv370_pcie_rreg(struct radeon_device *rdev, uint32_t reg)
-{
-        uint32_t r;
-        WREG8(RADEON_PCIE_INDEX, ((reg) & 0xff));
-        (void)RREG32(RADEON_PCIE_INDEX);
-        r = RREG32(RADEON_PCIE_DATA);
-        return r;
-}
-void rv370_pcie_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
-{
-        WREG8(RADEON_PCIE_INDEX, ((reg) & 0xff));
-        (void)RREG32(RADEON_PCIE_INDEX);
-        WREG32(RADEON_PCIE_DATA, (v));
-        (void)RREG32(RADEON_PCIE_DATA);
-}
-/*
 * PCIE Lanes
 */
@@ -1403,6 +1384,21 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
                tmp = (ib_chunk->kdata[idx] >> 22) & 0xF;
                track->textures[i].txdepth = tmp;
                break;
+        case R300_ZB_ZPASS_ADDR:
+                r = r100_cs_packet_next_reloc(p, &reloc);
+                if (r) {
+                        DRM_ERROR("No reloc for ib[%d]=0x%04X\n",
+                                        idx, reg);
+                        r100_cs_dump_packet(p, pkt);
+                        return r;
+                }
+                ib[idx] = ib_chunk->kdata[idx] + ((u32)reloc->lobj.gpu_offset);
+                break;
+        case 0x4be8:
+                /* valid register only on RV530 */
+                if (p->rdev->family == CHIP_RV530)
+                        break;
+                /* fallthrough do not move */
        default:
                printk(KERN_ERR "Forbidden register 0x%04X in cs at %d\n",
                       reg, idx);
diff --git a/drivers/gpu/drm/radeon/r420.c b/drivers/gpu/drm/radeon/r420.c
index dea497a979f2..97426a6f370f 100644
--- a/drivers/gpu/drm/radeon/r420.c
+++ b/drivers/gpu/drm/radeon/r420.c
@@ -165,7 +165,18 @@ void r420_pipes_init(struct radeon_device *rdev)
                printk(KERN_WARNING "Failed to wait GUI idle while "
                       "programming pipes. Bad things might happen.\n");
        }
-        DRM_INFO("radeon: %d pipes initialized.\n", rdev->num_gb_pipes);
+        if (rdev->family == CHIP_RV530) {
+                tmp = RREG32(RV530_GB_PIPE_SELECT2);
+                if ((tmp & 3) == 3)
+                        rdev->num_z_pipes = 2;
+                else
+                        rdev->num_z_pipes = 1;
+        } else
+                rdev->num_z_pipes = 1;
+        DRM_INFO("radeon: %d quad pipes, %d z pipes initialized.\n",
+                 rdev->num_gb_pipes, rdev->num_z_pipes);
 }
 void r420_gpu_init(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/r500_reg.h b/drivers/gpu/drm/radeon/r500_reg.h
index 036691b38cb7..e1d5e0331e19 100644
--- a/drivers/gpu/drm/radeon/r500_reg.h
+++ b/drivers/gpu/drm/radeon/r500_reg.h
@@ -350,6 +350,7 @@
 #define AVIVO_D1CRTC_BLANK_CONTROL                              0x6084
 #define AVIVO_D1CRTC_INTERLACE_CONTROL                          0x6088
 #define AVIVO_D1CRTC_INTERLACE_STATUS                           0x608c
+#define AVIVO_D1CRTC_FRAME_COUNT                                0x60a4
 #define AVIVO_D1CRTC_STEREO_CONTROL                             0x60c4
 /* master controls */
@@ -438,14 +439,15 @@
 #       define AVIVO_DC_LB_DISP1_END_ADR_SHIFT  4
 #       define AVIVO_DC_LB_DISP1_END_ADR_MASK   0x7ff
-#define R500_DxMODE_INT_MASK 0x6540
-#define R500_D1MODE_INT_MASK (1<<0)
-#define R500_D2MODE_INT_MASK (1<<8)
 #define AVIVO_D1MODE_DATA_FORMAT                0x6528
 #       define AVIVO_D1MODE_INTERLEAVE_EN       (1 << 0)
 #define AVIVO_D1MODE_DESKTOP_HEIGHT             0x652C
+#define AVIVO_D1MODE_VBLANK_STATUS              0x6534
+#       define AVIVO_VBLANK_ACK                 (1 << 4)
 #define AVIVO_D1MODE_VLINE_START_END            0x6538
+#define AVIVO_DxMODE_INT_MASK                   0x6540
+#       define AVIVO_D1MODE_INT_MASK            (1 << 0)
+#       define AVIVO_D2MODE_INT_MASK            (1 << 8)
 #define AVIVO_D1MODE_VIEWPORT_START             0x6580
 #define AVIVO_D1MODE_VIEWPORT_SIZE              0x6584
 #define AVIVO_D1MODE_EXT_OVERSCAN_LEFT_RIGHT    0x6588
@@ -475,6 +477,7 @@
 #define AVIVO_D2CRTC_BLANK_CONTROL                              0x6884
 #define AVIVO_D2CRTC_INTERLACE_CONTROL                          0x6888
 #define AVIVO_D2CRTC_INTERLACE_STATUS                           0x688c
+#define AVIVO_D2CRTC_FRAME_COUNT                                0x68a4
 #define AVIVO_D2CRTC_STEREO_CONTROL                             0x68c4
 #define AVIVO_D2GRPH_ENABLE                                     0x6900
@@ -497,6 +500,7 @@
 #define AVIVO_D2CUR_SIZE                        0x6c10
 #define AVIVO_D2CUR_POSITION                    0x6c14
+#define AVIVO_D2MODE_VBLANK_STATUS              0x6d34
 #define AVIVO_D2MODE_VLINE_START_END            0x6d38
 #define AVIVO_D2MODE_VIEWPORT_START             0x6d80
 #define AVIVO_D2MODE_VIEWPORT_SIZE              0x6d84
@@ -748,4 +752,8 @@
 #       define AVIVO_I2C_EN                                                     (1 << 0)
 #       define AVIVO_I2C_RESET                                          (1 << 8)
+#define AVIVO_DISP_INTERRUPT_STATUS                             0x7edc
+#       define AVIVO_D1_VBLANK_INTERRUPT                        (1 << 4)
+#       define AVIVO_D2_VBLANK_INTERRUPT                        (1 << 5)
 #endif
diff --git a/drivers/gpu/drm/radeon/r520.c b/drivers/gpu/drm/radeon/r520.c
index 09fb0b6ec7dd..ebd6b0f7bdff 100644
--- a/drivers/gpu/drm/radeon/r520.c
+++ b/drivers/gpu/drm/radeon/r520.c
@@ -177,7 +177,6 @@ void r520_gpu_init(struct radeon_device *rdev)
         */
        /* workaround for RV530 */
        if (rdev->family == CHIP_RV530) {
-                WREG32(0x4124, 1);
                WREG32(0x4128, 0xFF);
        }
        r420_pipes_init(rdev);
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index b1d945b8ed6c..b519fb2fecbb 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -242,6 +242,7 @@ int radeon_object_pin(struct radeon_object *robj, uint32_t domain,
                      uint64_t *gpu_addr);
 void radeon_object_unpin(struct radeon_object *robj);
 int radeon_object_wait(struct radeon_object *robj);
+int radeon_object_busy_domain(struct radeon_object *robj, uint32_t *cur_placement);
 int radeon_object_evict_vram(struct radeon_device *rdev);
 int radeon_object_mmap(struct radeon_object *robj, uint64_t *offset);
 void radeon_object_force_delete(struct radeon_device *rdev);
@@ -574,6 +575,7 @@ struct radeon_asic {
        void (*ring_start)(struct radeon_device *rdev);
        int (*irq_set)(struct radeon_device *rdev);
        int (*irq_process)(struct radeon_device *rdev);
+        u32 (*get_vblank_counter)(struct radeon_device *rdev, int crtc);
        void (*fence_ring_emit)(struct radeon_device *rdev, struct radeon_fence *fence);
        int (*cs_parse)(struct radeon_cs_parser *p);
        int (*copy_blit)(struct radeon_device *rdev,
@@ -653,6 +655,7 @@ struct radeon_device {
        int                             usec_timeout;
        enum radeon_pll_errata          pll_errata;
        int                             num_gb_pipes;
+        int                             num_z_pipes;
        int                             disp_priority;
        /* BIOS */
        uint8_t                         *bios;
@@ -666,14 +669,11 @@ struct radeon_device {
        resource_size_t                 rmmio_base;
        resource_size_t                 rmmio_size;
        void                            *rmmio;
-        radeon_rreg_t                   mm_rreg;
-        radeon_wreg_t                   mm_wreg;
        radeon_rreg_t                   mc_rreg;
        radeon_wreg_t                   mc_wreg;
        radeon_rreg_t                   pll_rreg;
        radeon_wreg_t                   pll_wreg;
-        radeon_rreg_t                   pcie_rreg;
+        uint32_t                        pcie_reg_mask;
-        radeon_wreg_t                   pcie_wreg;
        radeon_rreg_t                   pciep_rreg;
        radeon_wreg_t                   pciep_wreg;
        struct radeon_clock             clock;
@@ -705,22 +705,42 @@ int radeon_device_init(struct radeon_device *rdev,
 void radeon_device_fini(struct radeon_device *rdev);
 int radeon_gpu_wait_for_idle(struct radeon_device *rdev);
+static inline uint32_t r100_mm_rreg(struct radeon_device *rdev, uint32_t reg)
+{
+        if (reg < 0x10000)
+                return readl(((void __iomem *)rdev->rmmio) + reg);
+        else {
+                writel(reg, ((void __iomem *)rdev->rmmio) + RADEON_MM_INDEX);
+                return readl(((void __iomem *)rdev->rmmio) + RADEON_MM_DATA);
+        }
+}
+static inline void r100_mm_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
+{
+        if (reg < 0x10000)
+                writel(v, ((void __iomem *)rdev->rmmio) + reg);
+        else {
+                writel(reg, ((void __iomem *)rdev->rmmio) + RADEON_MM_INDEX);
+                writel(v, ((void __iomem *)rdev->rmmio) + RADEON_MM_DATA);
+        }
+}
 /*
 * Registers read & write functions.
 */
 #define RREG8(reg) readb(((void __iomem *)rdev->rmmio) + (reg))
 #define WREG8(reg, v) writeb(v, ((void __iomem *)rdev->rmmio) + (reg))
-#define RREG32(reg) rdev->mm_rreg(rdev, (reg))
+#define RREG32(reg) r100_mm_rreg(rdev, (reg))
-#define WREG32(reg, v) rdev->mm_wreg(rdev, (reg), (v))
+#define WREG32(reg, v) r100_mm_wreg(rdev, (reg), (v))
 #define REG_SET(FIELD, v) (((v) << FIELD##_SHIFT) & FIELD##_MASK)
 #define REG_GET(FIELD, v) (((v) << FIELD##_SHIFT) & FIELD##_MASK)
 #define RREG32_PLL(reg) rdev->pll_rreg(rdev, (reg))
 #define WREG32_PLL(reg, v) rdev->pll_wreg(rdev, (reg), (v))
 #define RREG32_MC(reg) rdev->mc_rreg(rdev, (reg))
 #define WREG32_MC(reg, v) rdev->mc_wreg(rdev, (reg), (v))
-#define RREG32_PCIE(reg) rdev->pcie_rreg(rdev, (reg))
+#define RREG32_PCIE(reg) rv370_pcie_rreg(rdev, (reg))
-#define WREG32_PCIE(reg, v) rdev->pcie_wreg(rdev, (reg), (v))
+#define WREG32_PCIE(reg, v) rv370_pcie_wreg(rdev, (reg), (v))
 #define WREG32_P(reg, val, mask)                                \
        do {                                                    \
                uint32_t tmp_ = RREG32(reg);                    \
@@ -736,6 +756,24 @@ int radeon_gpu_wait_for_idle(struct radeon_device *rdev);
                WREG32_PLL(reg, tmp_);                          \
        } while (0)
+/*
+ * Indirect registers accessor
+ */
+static inline uint32_t rv370_pcie_rreg(struct radeon_device *rdev, uint32_t reg)
+{
+        uint32_t r;
+        WREG32(RADEON_PCIE_INDEX, ((reg) & rdev->pcie_reg_mask));
+        r = RREG32(RADEON_PCIE_DATA);
+        return r;
+}
+static inline void rv370_pcie_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
+{
+        WREG32(RADEON_PCIE_INDEX, ((reg) & rdev->pcie_reg_mask));
+        WREG32(RADEON_PCIE_DATA, (v));
+}
 void r100_pll_errata_after_index(struct radeon_device *rdev);
@@ -862,6 +900,7 @@ static inline void radeon_ring_write(struct radeon_device *rdev, uint32_t v)
 #define radeon_ring_start(rdev) (rdev)->asic->ring_start((rdev))
 #define radeon_irq_set(rdev) (rdev)->asic->irq_set((rdev))
 #define radeon_irq_process(rdev) (rdev)->asic->irq_process((rdev))
+#define radeon_get_vblank_counter(rdev, crtc) (rdev)->asic->get_vblank_counter((rdev), (crtc))
 #define radeon_fence_ring_emit(rdev, fence) (rdev)->asic->fence_ring_emit((rdev), (fence))
 #define radeon_copy_blit(rdev, s, d, np, f) (rdev)->asic->copy_blit((rdev), (s), (d), (np), (f))
 #define radeon_copy_dma(rdev, s, d, np, f) (rdev)->asic->copy_dma((rdev), (s), (d), (np), (f))
diff --git a/drivers/gpu/drm/radeon/radeon_asic.h b/drivers/gpu/drm/radeon/radeon_asic.h
index 9a75876e0c3b..7ca6c13569b5 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.h
+++ b/drivers/gpu/drm/radeon/radeon_asic.h
@@ -49,6 +49,7 @@ void r100_vram_info(struct radeon_device *rdev);
 int r100_gpu_reset(struct radeon_device *rdev);
 int r100_mc_init(struct radeon_device *rdev);
 void r100_mc_fini(struct radeon_device *rdev);
+u32 r100_get_vblank_counter(struct radeon_device *rdev, int crtc);
 int r100_wb_init(struct radeon_device *rdev);
 void r100_wb_fini(struct radeon_device *rdev);
 int r100_gart_enable(struct radeon_device *rdev);
@@ -96,6 +97,7 @@ static struct radeon_asic r100_asic = {
        .ring_start = &r100_ring_start,
        .irq_set = &r100_irq_set,
        .irq_process = &r100_irq_process,
+        .get_vblank_counter = &r100_get_vblank_counter,
        .fence_ring_emit = &r100_fence_ring_emit,
        .cs_parse = &r100_cs_parse,
        .copy_blit = &r100_copy_blit,
@@ -156,6 +158,7 @@ static struct radeon_asic r300_asic = {
        .ring_start = &r300_ring_start,
        .irq_set = &r100_irq_set,
        .irq_process = &r100_irq_process,
+        .get_vblank_counter = &r100_get_vblank_counter,
        .fence_ring_emit = &r300_fence_ring_emit,
        .cs_parse = &r300_cs_parse,
        .copy_blit = &r100_copy_blit,
@@ -196,6 +199,7 @@ static struct radeon_asic r420_asic = {
        .ring_start = &r300_ring_start,
        .irq_set = &r100_irq_set,
        .irq_process = &r100_irq_process,
+        .get_vblank_counter = &r100_get_vblank_counter,
        .fence_ring_emit = &r300_fence_ring_emit,
        .cs_parse = &r300_cs_parse,
        .copy_blit = &r100_copy_blit,
@@ -243,6 +247,7 @@ static struct radeon_asic rs400_asic = {
        .ring_start = &r300_ring_start,
        .irq_set = &r100_irq_set,
        .irq_process = &r100_irq_process,
+        .get_vblank_counter = &r100_get_vblank_counter,
        .fence_ring_emit = &r300_fence_ring_emit,
        .cs_parse = &r300_cs_parse,
        .copy_blit = &r100_copy_blit,
@@ -266,6 +271,8 @@ void rs600_vram_info(struct radeon_device *rdev);
 int rs600_mc_init(struct radeon_device *rdev);
 void rs600_mc_fini(struct radeon_device *rdev);
 int rs600_irq_set(struct radeon_device *rdev);
+int rs600_irq_process(struct radeon_device *rdev);
+u32 rs600_get_vblank_counter(struct radeon_device *rdev, int crtc);
 int rs600_gart_enable(struct radeon_device *rdev);
 void rs600_gart_disable(struct radeon_device *rdev);
 void rs600_gart_tlb_flush(struct radeon_device *rdev);
@@ -291,7 +298,8 @@ static struct radeon_asic rs600_asic = {
        .cp_disable = &r100_cp_disable,
        .ring_start = &r300_ring_start,
        .irq_set = &rs600_irq_set,
-        .irq_process = &r100_irq_process,
+        .irq_process = &rs600_irq_process,
+        .get_vblank_counter = &rs600_get_vblank_counter,
        .fence_ring_emit = &r300_fence_ring_emit,
        .cs_parse = &r300_cs_parse,
        .copy_blit = &r100_copy_blit,
@@ -308,6 +316,7 @@ static struct radeon_asic rs600_asic = {
 /*
 * rs690,rs740
 */
+int rs690_init(struct radeon_device *rdev);
 void rs690_errata(struct radeon_device *rdev);
 void rs690_vram_info(struct radeon_device *rdev);
 int rs690_mc_init(struct radeon_device *rdev);
@@ -316,7 +325,7 @@ uint32_t rs690_mc_rreg(struct radeon_device *rdev, uint32_t reg);
 void rs690_mc_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v);
 void rs690_bandwidth_update(struct radeon_device *rdev);
 static struct radeon_asic rs690_asic = {
-        .init = &r300_init,
+        .init = &rs690_init,
        .errata = &rs690_errata,
        .vram_info = &rs690_vram_info,
        .gpu_reset = &r300_gpu_reset,
@@ -333,7 +342,8 @@ static struct radeon_asic rs690_asic = {
        .cp_disable = &r100_cp_disable,
        .ring_start = &r300_ring_start,
        .irq_set = &rs600_irq_set,
-        .irq_process = &r100_irq_process,
+        .irq_process = &rs600_irq_process,
+        .get_vblank_counter = &rs600_get_vblank_counter,
        .fence_ring_emit = &r300_fence_ring_emit,
        .cs_parse = &r300_cs_parse,
        .copy_blit = &r100_copy_blit,
@@ -381,8 +391,9 @@ static struct radeon_asic rv515_asic = {
        .cp_fini = &r100_cp_fini,
        .cp_disable = &r100_cp_disable,
        .ring_start = &rv515_ring_start,
-        .irq_set = &r100_irq_set,
+        .irq_set = &rs600_irq_set,
-        .irq_process = &r100_irq_process,
+        .irq_process = &rs600_irq_process,
+        .get_vblank_counter = &rs600_get_vblank_counter,
        .fence_ring_emit = &r300_fence_ring_emit,
        .cs_parse = &r300_cs_parse,
        .copy_blit = &r100_copy_blit,
@@ -423,8 +434,9 @@ static struct radeon_asic r520_asic = {
        .cp_fini = &r100_cp_fini,
        .cp_disable = &r100_cp_disable,
        .ring_start = &rv515_ring_start,
-        .irq_set = &r100_irq_set,
+        .irq_set = &rs600_irq_set,
-        .irq_process = &r100_irq_process,
+        .irq_process = &rs600_irq_process,
+        .get_vblank_counter = &rs600_get_vblank_counter,
        .fence_ring_emit = &r300_fence_ring_emit,
        .cs_parse = &r300_cs_parse,
        .copy_blit = &r100_copy_blit,
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index afc4db280b94..2a027e00762a 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -685,23 +685,15 @@ static const uint32_t default_tvdac_adj[CHIP_LAST] = {
        0x00780000,             /* rs480 */
 };
-static struct radeon_encoder_tv_dac
+static void radeon_legacy_get_tv_dac_info_from_table(struct radeon_device *rdev,
-    *radeon_legacy_get_tv_dac_info_from_table(struct radeon_device *rdev)
+                                                     struct radeon_encoder_tv_dac *tv_dac)
 {
-        struct radeon_encoder_tv_dac *tv_dac = NULL;
-        tv_dac = kzalloc(sizeof(struct radeon_encoder_tv_dac), GFP_KERNEL);
-        if (!tv_dac)
-                return NULL;
        tv_dac->ps2_tvdac_adj = default_tvdac_adj[rdev->family];
        if ((rdev->flags & RADEON_IS_MOBILITY) && (rdev->family == CHIP_RV250))
                tv_dac->ps2_tvdac_adj = 0x00880000;
        tv_dac->pal_tvdac_adj = tv_dac->ps2_tvdac_adj;
        tv_dac->ntsc_tvdac_adj = tv_dac->ps2_tvdac_adj;
+        return;
-        return tv_dac;
 }
 struct radeon_encoder_tv_dac *radeon_combios_get_tv_dac_info(struct
@@ -713,19 +705,18 @@ struct radeon_encoder_tv_dac *radeon_combios_get_tv_dac_info(struct
        uint16_t dac_info;
        uint8_t rev, bg, dac;
        struct radeon_encoder_tv_dac *tv_dac = NULL;
+        int found = 0;
+        tv_dac = kzalloc(sizeof(struct radeon_encoder_tv_dac), GFP_KERNEL);
+        if (!tv_dac)
+                return NULL;
        if (rdev->bios == NULL)
-                return radeon_legacy_get_tv_dac_info_from_table(rdev);
+                goto out;
        /* first check TV table */
        dac_info = combios_get_table_offset(dev, COMBIOS_TV_INFO_TABLE);
        if (dac_info) {
-                tv_dac =
-                    kzalloc(sizeof(struct radeon_encoder_tv_dac), GFP_KERNEL);
-                if (!tv_dac)
-                        return NULL;
                rev = RBIOS8(dac_info + 0x3);
                if (rev > 4) {
                        bg = RBIOS8(dac_info + 0xc) & 0xf;
@@ -739,6 +730,7 @@ struct radeon_encoder_tv_dac *radeon_combios_get_tv_dac_info(struct
                        bg = RBIOS8(dac_info + 0x10) & 0xf;
                        dac = RBIOS8(dac_info + 0x11) & 0xf;
                        tv_dac->ntsc_tvdac_adj = (bg << 16) | (dac << 20);
+                        found = 1;
                } else if (rev > 1) {
                        bg = RBIOS8(dac_info + 0xc) & 0xf;
                        dac = (RBIOS8(dac_info + 0xc) >> 4) & 0xf;
@@ -751,22 +743,15 @@ struct radeon_encoder_tv_dac *radeon_combios_get_tv_dac_info(struct
                        bg = RBIOS8(dac_info + 0xe) & 0xf;
                        dac = (RBIOS8(dac_info + 0xe) >> 4) & 0xf;
                        tv_dac->ntsc_tvdac_adj = (bg << 16) | (dac << 20);
+                        found = 1;
                }
                tv_dac->tv_std = radeon_combios_get_tv_info(encoder);
+        }
-        } else {
+        if (!found) {
                /* then check CRT table */
                dac_info =
                    combios_get_table_offset(dev, COMBIOS_CRT_INFO_TABLE);
                if (dac_info) {
-                        tv_dac =
-                            kzalloc(sizeof(struct radeon_encoder_tv_dac),
-                                    GFP_KERNEL);
-                        if (!tv_dac)
-                                return NULL;
                        rev = RBIOS8(dac_info) & 0x3;
                        if (rev < 2) {
                                bg = RBIOS8(dac_info + 0x3) & 0xf;
@@ -775,6 +760,7 @@ struct radeon_encoder_tv_dac *radeon_combios_get_tv_dac_info(struct
                                    (bg << 16) | (dac << 20);
                                tv_dac->pal_tvdac_adj = tv_dac->ps2_tvdac_adj;
                                tv_dac->ntsc_tvdac_adj = tv_dac->ps2_tvdac_adj;
+                                found = 1;
                        } else {
                                bg = RBIOS8(dac_info + 0x4) & 0xf;
                                dac = RBIOS8(dac_info + 0x5) & 0xf;
@@ -782,13 +768,17 @@ struct radeon_encoder_tv_dac *radeon_combios_get_tv_dac_info(struct
                                    (bg << 16) | (dac << 20);
                                tv_dac->pal_tvdac_adj = tv_dac->ps2_tvdac_adj;
                                tv_dac->ntsc_tvdac_adj = tv_dac->ps2_tvdac_adj;
+                                found = 1;
                        }
                } else {
                        DRM_INFO("No TV DAC info found in BIOS\n");
-                        return radeon_legacy_get_tv_dac_info_from_table(rdev);
                }
        }
+out:
+        if (!found) /* fallback to defaults */
+                radeon_legacy_get_tv_dac_info_from_table(rdev, tv_dac);
        return tv_dac;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_cp.c b/drivers/gpu/drm/radeon/radeon_cp.c
index d8356827ef17..7a52c461145c 100644
--- a/drivers/gpu/drm/radeon/radeon_cp.c
+++ b/drivers/gpu/drm/radeon/radeon_cp.c
@@ -406,6 +406,15 @@ static void radeon_init_pipes(drm_radeon_private_t *dev_priv)
 {
        uint32_t gb_tile_config, gb_pipe_sel = 0;
+        if ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_RV530) {
+                uint32_t z_pipe_sel = RADEON_READ(RV530_GB_PIPE_SELECT2);
+                if ((z_pipe_sel & 3) == 3)
+                        dev_priv->num_z_pipes = 2;
+                else
+                        dev_priv->num_z_pipes = 1;
+        } else
+                dev_priv->num_z_pipes = 1;
        /* RS4xx/RS6xx/R4xx/R5xx */
        if ((dev_priv->flags & RADEON_FAMILY_MASK) >= CHIP_R420) {
                gb_pipe_sel = RADEON_READ(R400_GB_PIPE_SELECT);
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index 9ff6dcb97f9d..7693f7c67bd3 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -225,25 +225,18 @@ void radeon_invalid_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
 void radeon_register_accessor_init(struct radeon_device *rdev)
 {
-        rdev->mm_rreg = &r100_mm_rreg;
-        rdev->mm_wreg = &r100_mm_wreg;
        rdev->mc_rreg = &radeon_invalid_rreg;
        rdev->mc_wreg = &radeon_invalid_wreg;
        rdev->pll_rreg = &radeon_invalid_rreg;
        rdev->pll_wreg = &radeon_invalid_wreg;
-        rdev->pcie_rreg = &radeon_invalid_rreg;
-        rdev->pcie_wreg = &radeon_invalid_wreg;
        rdev->pciep_rreg = &radeon_invalid_rreg;
        rdev->pciep_wreg = &radeon_invalid_wreg;
        /* Don't change order as we are overridding accessor. */
        if (rdev->family < CHIP_RV515) {
-                rdev->pcie_rreg = &rv370_pcie_rreg;
+                rdev->pcie_reg_mask = 0xff;
-                rdev->pcie_wreg = &rv370_pcie_wreg;
+        } else {
-        }
+                rdev->pcie_reg_mask = 0x7ff;
-        if (rdev->family >= CHIP_RV515) {
-                rdev->pcie_rreg = &rv515_pcie_rreg;
-                rdev->pcie_wreg = &rv515_pcie_wreg;
        }
        /* FIXME: not sure here */
        if (rdev->family <= CHIP_R580) {
diff --git a/drivers/gpu/drm/radeon/radeon_drv.h b/drivers/gpu/drm/radeon/radeon_drv.h
index 3933f8216a34..6fa32dac4e97 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.h
+++ b/drivers/gpu/drm/radeon/radeon_drv.h
@@ -100,9 +100,10 @@
 * 1.28- Add support for VBL on CRTC2
 * 1.29- R500 3D cmd buffer support
 * 1.30- Add support for occlusion queries
+ * 1.31- Add support for num Z pipes from GET_PARAM
 */
 #define DRIVER_MAJOR            1
-#define DRIVER_MINOR            30
+#define DRIVER_MINOR            31
 #define DRIVER_PATCHLEVEL       0
 /*
@@ -329,6 +330,7 @@ typedef struct drm_radeon_private {
        resource_size_t fb_aper_offset;
        int num_gb_pipes;
+        int num_z_pipes;
        int track_flush;
        drm_local_map_t *mmio;
@@ -689,6 +691,7 @@ extern void r600_page_table_cleanup(struct drm_device *dev, struct drm_ati_pciga
 /* pipe config regs */
 #define R400_GB_PIPE_SELECT             0x402c
+#define RV530_GB_PIPE_SELECT2           0x4124
 #define R500_DYN_SCLK_PWMEM_PIPE        0x000d /* PLL */
 #define R300_GB_TILE_CONFIG             0x4018
 #       define R300_ENABLE_TILING       (1 << 0)
diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c
index 3206c0ad7b6c..ec383edf5f38 100644
--- a/drivers/gpu/drm/radeon/radeon_fb.c
+++ b/drivers/gpu/drm/radeon/radeon_fb.c
@@ -574,6 +574,8 @@ int radeonfb_create(struct radeon_device *rdev,
                goto out_unref;
        }
+        memset_io(fbptr, 0, aligned_size);
        strcpy(info->fix.id, "radeondrmfb");
        info->fix.type = FB_TYPE_PACKED_PIXELS;
        info->fix.visual = FB_VISUAL_TRUECOLOR;
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
index cded5180c752..d880edf254db 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -262,8 +262,34 @@ int radeon_gem_mmap_ioctl(struct drm_device *dev, void *data,
 int radeon_gem_busy_ioctl(struct drm_device *dev, void *data,
                          struct drm_file *filp)
 {
-        /* FIXME: implement */
+        struct drm_radeon_gem_busy *args = data;
-        return 0;
+        struct drm_gem_object *gobj;
+        struct radeon_object *robj;
+        int r;
+        uint32_t cur_placement;
+        gobj = drm_gem_object_lookup(dev, filp, args->handle);
+        if (gobj == NULL) {
+                return -EINVAL;
+        }
+        robj = gobj->driver_private;
+        r = radeon_object_busy_domain(robj, &cur_placement);
+        switch (cur_placement) {
+        case TTM_PL_VRAM:
+                args->domain = RADEON_GEM_DOMAIN_VRAM;
+                break;
+        case TTM_PL_TT:
+                args->domain = RADEON_GEM_DOMAIN_GTT;
+                break;
+        case TTM_PL_SYSTEM:
+                args->domain = RADEON_GEM_DOMAIN_CPU;
+        default:
+                break;
+        }
+        mutex_lock(&dev->struct_mutex);
+        drm_gem_object_unreference(gobj);
+        mutex_unlock(&dev->struct_mutex);
+        return r;
 }
 int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data,
diff --git a/drivers/gpu/drm/radeon/radeon_irq_kms.c b/drivers/gpu/drm/radeon/radeon_irq_kms.c
index 491d569deb0e..9805e4b6ca1b 100644
--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
@@ -32,60 +32,6 @@
 #include "radeon.h"
 #include "atom.h"
-static inline uint32_t r100_irq_ack(struct radeon_device *rdev)
-{
-        uint32_t irqs = RREG32(RADEON_GEN_INT_STATUS);
-        uint32_t irq_mask = RADEON_SW_INT_TEST;
-        if (irqs) {
-                WREG32(RADEON_GEN_INT_STATUS, irqs);
-        }
-        return irqs & irq_mask;
-}
-int r100_irq_set(struct radeon_device *rdev)
-{
-        uint32_t tmp = 0;
-        if (rdev->irq.sw_int) {
-                tmp |= RADEON_SW_INT_ENABLE;
-        }
-        /* Todo go through CRTC and enable vblank int or not */
-        WREG32(RADEON_GEN_INT_CNTL, tmp);
-        return 0;
-}
-int r100_irq_process(struct radeon_device *rdev)
-{
-        uint32_t status;
-        status = r100_irq_ack(rdev);
-        if (!status) {
-                return IRQ_NONE;
-        }
-        while (status) {
-                /* SW interrupt */
-                if (status & RADEON_SW_INT_TEST) {
-                        radeon_fence_process(rdev);
-                }
-                status = r100_irq_ack(rdev);
-        }
-        return IRQ_HANDLED;
-}
-int rs600_irq_set(struct radeon_device *rdev)
-{
-        uint32_t tmp = 0;
-        if (rdev->irq.sw_int) {
-                tmp |= RADEON_SW_INT_ENABLE;
-        }
-        WREG32(RADEON_GEN_INT_CNTL, tmp);
-        /* Todo go through CRTC and enable vblank int or not */
-        WREG32(R500_DxMODE_INT_MASK, 0);
-        return 0;
-}
 irqreturn_t radeon_driver_irq_handler_kms(DRM_IRQ_ARGS)
 {
        struct drm_device *dev = (struct drm_device *) arg;
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index 3357110e30ce..dce09ada32bc 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -95,6 +95,9 @@ int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
        case RADEON_INFO_NUM_GB_PIPES:
                value = rdev->num_gb_pipes;
                break;
+        case RADEON_INFO_NUM_Z_PIPES:
+                value = rdev->num_z_pipes;
+                break;
        default:
                DRM_DEBUG("Invalid request %d\n", info->request);
                return -EINVAL;
@@ -141,19 +144,42 @@ void radeon_driver_preclose_kms(struct drm_device *dev,
 */
 u32 radeon_get_vblank_counter_kms(struct drm_device *dev, int crtc)
 {
-        /* FIXME: implement */
+        struct radeon_device *rdev = dev->dev_private;
-        return 0;
+        if (crtc < 0 || crtc > 1) {
+                DRM_ERROR("Invalid crtc %d\n", crtc);
+                return -EINVAL;
+        }
+        return radeon_get_vblank_counter(rdev, crtc);
 }
 int radeon_enable_vblank_kms(struct drm_device *dev, int crtc)
 {
-        /* FIXME: implement */
+        struct radeon_device *rdev = dev->dev_private;
-        return 0;
+        if (crtc < 0 || crtc > 1) {
+                DRM_ERROR("Invalid crtc %d\n", crtc);
+                return -EINVAL;
+        }
+        rdev->irq.crtc_vblank_int[crtc] = true;
+        return radeon_irq_set(rdev);
 }
 void radeon_disable_vblank_kms(struct drm_device *dev, int crtc)
 {
-        /* FIXME: implement */
+        struct radeon_device *rdev = dev->dev_private;
+        if (crtc < 0 || crtc > 1) {
+                DRM_ERROR("Invalid crtc %d\n", crtc);
+                return;
+        }
+        rdev->irq.crtc_vblank_int[crtc] = false;
+        radeon_irq_set(rdev);
 }
@@ -295,5 +321,6 @@ struct drm_ioctl_desc radeon_ioctls_kms[] = {
        DRM_IOCTL_DEF(DRM_RADEON_INFO, radeon_info_ioctl, DRM_AUTH),
        DRM_IOCTL_DEF(DRM_RADEON_GEM_SET_TILING, radeon_gem_set_tiling_ioctl, DRM_AUTH),
        DRM_IOCTL_DEF(DRM_RADEON_GEM_GET_TILING, radeon_gem_get_tiling_ioctl, DRM_AUTH),
+        DRM_IOCTL_DEF(DRM_RADEON_GEM_BUSY, radeon_gem_busy_ioctl, DRM_AUTH),
 };
 int radeon_max_kms_ioctl = DRM_ARRAY_SIZE(radeon_ioctls_kms);
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
index 7d06dc98a42a..0da72f18fd3a 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
@@ -310,10 +310,13 @@ void radeon_crtc_dpms(struct drm_crtc *crtc, int mode)
                                                                         RADEON_CRTC_DISP_REQ_EN_B));
                        WREG32_P(RADEON_CRTC_EXT_CNTL, 0, ~mask);
                }
+                drm_vblank_post_modeset(dev, radeon_crtc->crtc_id);
+                radeon_crtc_load_lut(crtc);
                break;
        case DRM_MODE_DPMS_STANDBY:
        case DRM_MODE_DPMS_SUSPEND:
        case DRM_MODE_DPMS_OFF:
+                drm_vblank_pre_modeset(dev, radeon_crtc->crtc_id);
                if (radeon_crtc->crtc_id)
                        WREG32_P(RADEON_CRTC2_GEN_CNTL, mask, ~mask);
                else {
@@ -323,10 +326,6 @@ void radeon_crtc_dpms(struct drm_crtc *crtc, int mode)
                }
                break;
        }
-        if (mode != DRM_MODE_DPMS_OFF) {
-                radeon_crtc_load_lut(crtc);
-        }
 }
 /* properly set crtc bpp when using atombios */
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
index 34d0f58eb944..9322675ef6d0 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
@@ -1066,6 +1066,7 @@ radeon_add_legacy_encoder(struct drm_device *dev, uint32_t encoder_id, uint32_t
        switch (radeon_encoder->encoder_id) {
        case ENCODER_OBJECT_ID_INTERNAL_LVDS:
+                encoder->possible_crtcs = 0x1;
                drm_encoder_init(dev, encoder, &radeon_legacy_lvds_enc_funcs, DRM_MODE_ENCODER_LVDS);
                drm_encoder_helper_add(encoder, &radeon_legacy_lvds_helper_funcs);
                if (rdev->is_atom_bios)
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index e98cae3bf4a6..b85fb83d7ae8 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -316,6 +316,25 @@ int radeon_object_wait(struct radeon_object *robj)
        return r;
 }
+int radeon_object_busy_domain(struct radeon_object *robj, uint32_t *cur_placement)
+{
+        int r = 0;
+        r = radeon_object_reserve(robj, true);
+        if (unlikely(r != 0)) {
+                DRM_ERROR("radeon: failed to reserve object for waiting.\n");
+                return r;
+        }
+        spin_lock(&robj->tobj.lock);
+        *cur_placement = robj->tobj.mem.mem_type;
+        if (robj->tobj.sync_obj) {
+                r = ttm_bo_wait(&robj->tobj, true, true, true);
+        }
+        spin_unlock(&robj->tobj.lock);
+        radeon_object_unreserve(robj);
+        return r;
+}
 int radeon_object_evict_vram(struct radeon_device *rdev)
 {
        if (rdev->flags & RADEON_IS_IGP) {
diff --git a/drivers/gpu/drm/radeon/radeon_reg.h b/drivers/gpu/drm/radeon/radeon_reg.h
index e1b618574461..4df43f62c678 100644
--- a/drivers/gpu/drm/radeon/radeon_reg.h
+++ b/drivers/gpu/drm/radeon/radeon_reg.h
@@ -982,12 +982,15 @@
 #       define RS400_TMDS2_PLLRST           (1 << 1)
 #define RADEON_GEN_INT_CNTL                 0x0040
+#       define RADEON_CRTC_VBLANK_MASK          (1 << 0)
+#       define RADEON_CRTC2_VBLANK_MASK         (1 << 9)
 #       define RADEON_SW_INT_ENABLE             (1 << 25)
 #define RADEON_GEN_INT_STATUS               0x0044
-#       define RADEON_VSYNC_INT_AK          (1 <<  2)
+#       define AVIVO_DISPLAY_INT_STATUS         (1 << 0)
-#       define RADEON_VSYNC_INT             (1 <<  2)
+#       define RADEON_CRTC_VBLANK_STAT          (1 << 0)
-#       define RADEON_VSYNC2_INT_AK         (1 <<  6)
+#       define RADEON_CRTC_VBLANK_STAT_ACK      (1 << 0)
-#       define RADEON_VSYNC2_INT            (1 <<  6)
+#       define RADEON_CRTC2_VBLANK_STAT         (1 << 9)
+#       define RADEON_CRTC2_VBLANK_STAT_ACK     (1 << 9)
 #       define RADEON_SW_INT_FIRE               (1 << 26)
 #       define RADEON_SW_INT_TEST               (1 << 25)
 #       define RADEON_SW_INT_TEST_ACK           (1 << 25)
@@ -2334,6 +2337,9 @@
 #       define RADEON_RE_WIDTH_SHIFT        0
 #       define RADEON_RE_HEIGHT_SHIFT       16
+#define RADEON_RB3D_ZPASS_DATA 0x3290
+#define RADEON_RB3D_ZPASS_ADDR 0x3294
 #define RADEON_SE_CNTL                      0x1c4c
 #       define RADEON_FFACE_CULL_CW          (0 <<  0)
 #       define RADEON_FFACE_CULL_CCW         (1 <<  0)
@@ -3568,4 +3574,6 @@
 #define RADEON_SCRATCH_REG4             0x15f0
 #define RADEON_SCRATCH_REG5             0x15f4
+#define RV530_GB_PIPE_SELECT2           0x4124
 #endif
diff --git a/drivers/gpu/drm/radeon/radeon_state.c b/drivers/gpu/drm/radeon/radeon_state.c
index 46645f3e0328..2882f40d5ec5 100644
--- a/drivers/gpu/drm/radeon/radeon_state.c
+++ b/drivers/gpu/drm/radeon/radeon_state.c
@@ -3081,6 +3081,9 @@ static int radeon_cp_getparam(struct drm_device *dev, void *data, struct drm_fil
        case RADEON_PARAM_NUM_GB_PIPES:
                value = dev_priv->num_gb_pipes;
                break;
+        case RADEON_PARAM_NUM_Z_PIPES:
+                value = dev_priv->num_z_pipes;
+                break;
        default:
                DRM_DEBUG("Invalid parameter %d\n", param->param);
                return -EINVAL;
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index bbea6dee4a94..7e8ce983a908 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -240,6 +240,88 @@ void rs600_mc_fini(struct radeon_device *rdev)
 /*
+ * Interrupts
+ */
+int rs600_irq_set(struct radeon_device *rdev)
+{
+        uint32_t tmp = 0;
+        uint32_t mode_int = 0;
+        if (rdev->irq.sw_int) {
+                tmp |= RADEON_SW_INT_ENABLE;
+        }
+        if (rdev->irq.crtc_vblank_int[0]) {
+                tmp |= AVIVO_DISPLAY_INT_STATUS;
+                mode_int |= AVIVO_D1MODE_INT_MASK;
+        }
+        if (rdev->irq.crtc_vblank_int[1]) {
+                tmp |= AVIVO_DISPLAY_INT_STATUS;
+                mode_int |= AVIVO_D2MODE_INT_MASK;
+        }
+        WREG32(RADEON_GEN_INT_CNTL, tmp);
+        WREG32(AVIVO_DxMODE_INT_MASK, mode_int);
+        return 0;
+}
+static inline uint32_t rs600_irq_ack(struct radeon_device *rdev, u32 *r500_disp_int)
+{
+        uint32_t irqs = RREG32(RADEON_GEN_INT_STATUS);
+        uint32_t irq_mask = RADEON_SW_INT_TEST;
+        if (irqs & AVIVO_DISPLAY_INT_STATUS) {
+                *r500_disp_int = RREG32(AVIVO_DISP_INTERRUPT_STATUS);
+                if (*r500_disp_int & AVIVO_D1_VBLANK_INTERRUPT) {
+                        WREG32(AVIVO_D1MODE_VBLANK_STATUS, AVIVO_VBLANK_ACK);
+                }
+                if (*r500_disp_int & AVIVO_D2_VBLANK_INTERRUPT) {
+                        WREG32(AVIVO_D2MODE_VBLANK_STATUS, AVIVO_VBLANK_ACK);
+                }
+        } else {
+                *r500_disp_int = 0;
+        }
+        if (irqs) {
+                WREG32(RADEON_GEN_INT_STATUS, irqs);
+        }
+        return irqs & irq_mask;
+}
+int rs600_irq_process(struct radeon_device *rdev)
+{
+        uint32_t status;
+        uint32_t r500_disp_int;
+        status = rs600_irq_ack(rdev, &r500_disp_int);
+        if (!status && !r500_disp_int) {
+                return IRQ_NONE;
+        }
+        while (status || r500_disp_int) {
+                /* SW interrupt */
+                if (status & RADEON_SW_INT_TEST) {
+                        radeon_fence_process(rdev);
+                }
+                /* Vertical blank interrupts */
+                if (r500_disp_int & AVIVO_D1_VBLANK_INTERRUPT) {
+                        drm_handle_vblank(rdev->ddev, 0);
+                }
+                if (r500_disp_int & AVIVO_D2_VBLANK_INTERRUPT) {
+                        drm_handle_vblank(rdev->ddev, 1);
+                }
+                status = rs600_irq_ack(rdev, &r500_disp_int);
+        }
+        return IRQ_HANDLED;
+}
+u32 rs600_get_vblank_counter(struct radeon_device *rdev, int crtc)
+{
+        if (crtc == 0)
+                return RREG32(AVIVO_D1CRTC_FRAME_COUNT);
+        else
+                return RREG32(AVIVO_D2CRTC_FRAME_COUNT);
+}
+/*
 * Global GPU functions
 */
 void rs600_disable_vga(struct radeon_device *rdev)
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index 839595b00728..bc6b7c5339bc 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -652,3 +652,68 @@ void rs690_mc_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
        WREG32(RS690_MC_DATA, v);
        WREG32(RS690_MC_INDEX, RS690_MC_INDEX_WR_ACK);
 }
+static const unsigned rs690_reg_safe_bm[219] = {
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0x17FF1FFF,0xFFFFFFFC,0xFFFFFFFF,0xFF30FFBF,
+        0xFFFFFFF8,0xC3E6FFFF,0xFFFFF6DF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFF03F,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFEFCE,0xF00EBFFF,0x007C0000,
+        0xF0000078,0xFF000009,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFF7FF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFC78,0xFFFFFFFF,0xFFFFFFFE,0xFFFFFFFF,
+        0x38FF8F50,0xFFF88082,0xF000000C,0xFAE009FF,
+        0x0000FFFF,0xFFFFFFFF,0xFFFFFFFF,0x00000000,
+        0x00000000,0x0000C100,0x00000000,0x00000000,
+        0x00000000,0x00000000,0x00000000,0x00000000,
+        0x00000000,0xFFFF0000,0xFFFFFFFF,0xFF80FFFF,
+        0x00000000,0x00000000,0x00000000,0x00000000,
+        0x0003FC01,0xFFFFFFF8,0xFE800B19,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+        0xFFFFFFFF,0xFFFFFFFF,0xFFFFFFFF,
+};
+int rs690_init(struct radeon_device *rdev)
+{
+        rdev->config.r300.reg_safe_bm = rs690_reg_safe_bm;
+        rdev->config.r300.reg_safe_bm_size = ARRAY_SIZE(rs690_reg_safe_bm);
+        return 0;
+}
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index fd8f3ca716ea..31a7f668ae5a 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -400,25 +400,6 @@ void rv515_mc_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
        WREG32(MC_IND_INDEX, 0);
 }
-uint32_t rv515_pcie_rreg(struct radeon_device *rdev, uint32_t reg)
-{
-        uint32_t r;
-        WREG32(PCIE_INDEX, ((reg) & 0x7ff));
-        (void)RREG32(PCIE_INDEX);
-        r = RREG32(PCIE_DATA);
-        return r;
-}
-void rv515_pcie_wreg(struct radeon_device *rdev, uint32_t reg, uint32_t v)
-{
-        WREG32(PCIE_INDEX, ((reg) & 0x7ff));
-        (void)RREG32(PCIE_INDEX);
-        WREG32(PCIE_DATA, (v));
-        (void)RREG32(PCIE_DATA);
-}
 /*
 * Debugfs info
 */
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index d258b02aef44..827da0858136 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -674,7 +674,14 @@ omap_i2c_isr(int this_irq, void *dev_id)
                err = 0;
 complete:
-                omap_i2c_write_reg(dev, OMAP_I2C_STAT_REG, stat);
+                /*
+                 * Ack the stat in one go, but [R/X]DR and [R/X]RDY should be
+                 * acked after the data operation is complete.
+                 * Ref: TRM SWPU114Q Figure 18-31
+                 */
+                omap_i2c_write_reg(dev, OMAP_I2C_STAT_REG, stat &
+                                ~(OMAP_I2C_STAT_RRDY | OMAP_I2C_STAT_RDR |
+                                OMAP_I2C_STAT_XRDY | OMAP_I2C_STAT_XDR));
                if (stat & OMAP_I2C_STAT_NACK) {
                        err |= OMAP_I2C_STAT_NACK;
@@ -687,6 +694,9 @@ complete:
                }
                if (stat & (OMAP_I2C_STAT_ARDY | OMAP_I2C_STAT_NACK |
                                        OMAP_I2C_STAT_AL)) {
+                        omap_i2c_ack_stat(dev, stat &
+                                (OMAP_I2C_STAT_RRDY | OMAP_I2C_STAT_RDR |
+                                OMAP_I2C_STAT_XRDY | OMAP_I2C_STAT_XDR));
                        omap_i2c_complete_cmd(dev, err);
                        return IRQ_HANDLED;
                }
@@ -774,7 +784,7 @@ complete:
                                 * memory to the I2C interface.
                                 */
-                                if (cpu_is_omap34xx()) {
+                                if (dev->rev <= OMAP_I2C_REV_ON_3430) {
                                                while (!(stat & OMAP_I2C_STAT_XUDF)) {
                                                        if (stat & (OMAP_I2C_STAT_NACK | OMAP_I2C_STAT_AL)) {
                                                                omap_i2c_ack_stat(dev, stat & (OMAP_I2C_STAT_XRDY | OMAP_I2C_STAT_XDR));
diff --git a/drivers/i2c/busses/i2c-stu300.c b/drivers/i2c/busses/i2c-stu300.c
index 182e711318ba..d2728a28a8db 100644
--- a/drivers/i2c/busses/i2c-stu300.c
+++ b/drivers/i2c/busses/i2c-stu300.c
@@ -117,7 +117,8 @@ enum stu300_error {
        STU300_ERROR_NONE = 0,
        STU300_ERROR_ACKNOWLEDGE_FAILURE,
        STU300_ERROR_BUS_ERROR,
-        STU300_ERROR_ARBITRATION_LOST
+        STU300_ERROR_ARBITRATION_LOST,
+        STU300_ERROR_UNKNOWN
 };
 /* timeout waiting for the controller to respond */
@@ -127,7 +128,7 @@ enum stu300_error {
 * The number of address send athemps tried before giving up.
 * If the first one failes it seems like 5 to 8 attempts are required.
 */
-#define NUM_ADDR_RESEND_ATTEMPTS 10
+#define NUM_ADDR_RESEND_ATTEMPTS 12
 /* I2C clock speed, in Hz 0-400kHz*/
 static unsigned int scl_frequency = 100000;
@@ -149,6 +150,7 @@ module_param(scl_frequency, uint,  0644);
 * @msg_index: index of current message
 * @msg_len: length of current message
 */
 struct stu300_dev {
        struct platform_device  *pdev;
        struct i2c_adapter      adapter;
@@ -188,6 +190,27 @@ static inline u32 stu300_r8(void __iomem *address)
        return readl(address) & 0x000000FFU;
 }
+static void stu300_irq_enable(struct stu300_dev *dev)
+{
+        u32 val;
+        val = stu300_r8(dev->virtbase + I2C_CR);
+        val |= I2C_CR_INTERRUPT_ENABLE;
+        /* Twice paranoia (possible HW glitch) */
+        stu300_wr8(val, dev->virtbase + I2C_CR);
+        stu300_wr8(val, dev->virtbase + I2C_CR);
+}
+static void stu300_irq_disable(struct stu300_dev *dev)
+{
+        u32 val;
+        val = stu300_r8(dev->virtbase + I2C_CR);
+        val &= ~I2C_CR_INTERRUPT_ENABLE;
+        /* Twice paranoia (possible HW glitch) */
+        stu300_wr8(val, dev->virtbase + I2C_CR);
+        stu300_wr8(val, dev->virtbase + I2C_CR);
+}
 /*
 * Tells whether a certain event or events occurred in
 * response to a command. The events represent states in
@@ -196,9 +219,10 @@ static inline u32 stu300_r8(void __iomem *address)
 * documentation and can only be treated as abstract state
 * machine states.
 *
- * @ret 0 = event has not occurred, any other value means
+ * @ret 0 = event has not occurred or unknown error, any
- * the event occurred.
+ * other value means the correct event occurred or an error.
 */
 static int stu300_event_occurred(struct stu300_dev *dev,
                                   enum stu300_event mr_event) {
        u32 status1;
@@ -206,11 +230,28 @@ static int stu300_event_occurred(struct stu300_dev *dev,
        /* What event happened? */
        status1 = stu300_r8(dev->virtbase + I2C_SR1);
        if (!(status1 & I2C_SR1_EVF_IND))
                /* No event at all */
                return 0;
        status2 = stu300_r8(dev->virtbase + I2C_SR2);
+        /* Block any multiple interrupts */
+        stu300_irq_disable(dev);
+        /* Check for errors first */
+        if (status2 & I2C_SR2_AF_IND) {
+                dev->cmd_err = STU300_ERROR_ACKNOWLEDGE_FAILURE;
+                return 1;
+        } else if (status2 & I2C_SR2_BERR_IND) {
+                dev->cmd_err = STU300_ERROR_BUS_ERROR;
+                return 1;
+        } else if (status2 & I2C_SR2_ARLO_IND) {
+                dev->cmd_err = STU300_ERROR_ARBITRATION_LOST;
+                return 1;
+        }
        switch (mr_event) {
        case STU300_EVENT_1:
                if (status1 & I2C_SR1_ADSL_IND)
@@ -221,10 +262,6 @@ static int stu300_event_occurred(struct stu300_dev *dev,
        case STU300_EVENT_7:
        case STU300_EVENT_8:
                if (status1 & I2C_SR1_BTF_IND) {
-                        if (status2 & I2C_SR2_AF_IND)
-                                dev->cmd_err = STU300_ERROR_ACKNOWLEDGE_FAILURE;
-                        else if (status2 & I2C_SR2_BERR_IND)
-                                dev->cmd_err = STU300_ERROR_BUS_ERROR;
                        return 1;
                }
                break;
@@ -240,8 +277,6 @@ static int stu300_event_occurred(struct stu300_dev *dev,
        case STU300_EVENT_6:
                if (status2 & I2C_SR2_ENDAD_IND) {
                        /* First check for any errors */
-                        if (status2 & I2C_SR2_AF_IND)
-                                dev->cmd_err = STU300_ERROR_ACKNOWLEDGE_FAILURE;
                        return 1;
                }
                break;
@@ -252,8 +287,15 @@ static int stu300_event_occurred(struct stu300_dev *dev,
        default:
                break;
        }
-        if (status2 & I2C_SR2_ARLO_IND)
+        /* If we get here, we're on thin ice.
-                dev->cmd_err = STU300_ERROR_ARBITRATION_LOST;
+         * Here we are in a status where we have
+         * gotten a response that does not match
+         * what we requested.
+         */
+        dev->cmd_err = STU300_ERROR_UNKNOWN;
+        dev_err(&dev->pdev->dev,
+                "Unhandled interrupt! %d sr1: 0x%x sr2: 0x%x\n",
+                mr_event, status1, status2);
        return 0;
 }
@@ -262,21 +304,20 @@ static irqreturn_t stu300_irh(int irq, void *data)
        struct stu300_dev *dev = data;
        int res;
+        /* Just make sure that the block is clocked */
+        clk_enable(dev->clk);
        /* See if this was what we were waiting for */
        spin_lock(&dev->cmd_issue_lock);
-        if (dev->cmd_event != STU300_EVENT_NONE) {
-                res = stu300_event_occurred(dev, dev->cmd_event);
+        res = stu300_event_occurred(dev, dev->cmd_event);
-                if (res || dev->cmd_err != STU300_ERROR_NONE) {
+        if (res || dev->cmd_err != STU300_ERROR_NONE)
-                        u32 val;
+                complete(&dev->cmd_complete);
-                        complete(&dev->cmd_complete);
-                        /* Block any multiple interrupts */
-                        val = stu300_r8(dev->virtbase + I2C_CR);
-                        val &= ~I2C_CR_INTERRUPT_ENABLE;
-                        stu300_wr8(val, dev->virtbase + I2C_CR);
-                }
-        }
        spin_unlock(&dev->cmd_issue_lock);
+        clk_disable(dev->clk);
        return IRQ_HANDLED;
 }
@@ -308,7 +349,6 @@ static int stu300_start_and_await_event(struct stu300_dev *dev,
        stu300_wr8(cr_value, dev->virtbase + I2C_CR);
        ret = wait_for_completion_interruptible_timeout(&dev->cmd_complete,
                                                        STU300_TIMEOUT);
        if (ret < 0) {
                dev_err(&dev->pdev->dev,
                       "wait_for_completion_interruptible_timeout() "
@@ -342,7 +382,6 @@ static int stu300_await_event(struct stu300_dev *dev,
                                enum stu300_event mr_event)
 {
        int ret;
-        u32 val;
        if (unlikely(irqs_disabled())) {
                /* TODO: implement polling for this case if need be. */
@@ -354,36 +393,18 @@ static int stu300_await_event(struct stu300_dev *dev,
        /* Is it already here? */
        spin_lock_irq(&dev->cmd_issue_lock);
        dev->cmd_err = STU300_ERROR_NONE;
-        if (stu300_event_occurred(dev, mr_event)) {
-                spin_unlock_irq(&dev->cmd_issue_lock);
-                goto exit_await_check_err;
-        }
-        init_completion(&dev->cmd_complete);
-        dev->cmd_err = STU300_ERROR_NONE;
        dev->cmd_event = mr_event;
-        /* Turn on the I2C interrupt for current operation */
+        init_completion(&dev->cmd_complete);
-        val = stu300_r8(dev->virtbase + I2C_CR);
-        val |= I2C_CR_INTERRUPT_ENABLE;
-        stu300_wr8(val, dev->virtbase + I2C_CR);
-        /* Twice paranoia (possible HW glitch) */
-        stu300_wr8(val, dev->virtbase + I2C_CR);
-        /* Check again: is it already here? */
+        /* Turn on the I2C interrupt for current operation */
-        if (unlikely(stu300_event_occurred(dev, mr_event))) {
+        stu300_irq_enable(dev);
-                /* Disable IRQ again. */
-                val &= ~I2C_CR_INTERRUPT_ENABLE;
-                stu300_wr8(val, dev->virtbase + I2C_CR);
-                spin_unlock_irq(&dev->cmd_issue_lock);
-                goto exit_await_check_err;
-        }
        /* Unlock the command block and wait for the event to occur */
        spin_unlock_irq(&dev->cmd_issue_lock);
        ret = wait_for_completion_interruptible_timeout(&dev->cmd_complete,
                                                        STU300_TIMEOUT);
        if (ret < 0) {
                dev_err(&dev->pdev->dev,
                       "wait_for_completion_interruptible_timeout()"
@@ -401,7 +422,6 @@ static int stu300_await_event(struct stu300_dev *dev,
                return -ETIMEDOUT;
        }
- exit_await_check_err:
        if (dev->cmd_err != STU300_ERROR_NONE) {
                if (mr_event != STU300_EVENT_6) {
                        dev_err(&dev->pdev->dev, "controller "
@@ -457,18 +477,19 @@ struct stu300_clkset {
 };
 static const struct stu300_clkset stu300_clktable[] = {
-        { 0, 0xFFU },
+        { 0,         0xFFU },
-        { 2500000, I2C_OAR2_FR_25_10MHZ },
+        { 2500000,   I2C_OAR2_FR_25_10MHZ },
-        { 10000000, I2C_OAR2_FR_10_1667MHZ },
+        { 10000000,  I2C_OAR2_FR_10_1667MHZ },
-        { 16670000, I2C_OAR2_FR_1667_2667MHZ },
+        { 16670000,  I2C_OAR2_FR_1667_2667MHZ },
-        { 26670000, I2C_OAR2_FR_2667_40MHZ },
+        { 26670000,  I2C_OAR2_FR_2667_40MHZ },
-        { 40000000, I2C_OAR2_FR_40_5333MHZ },
+        { 40000000,  I2C_OAR2_FR_40_5333MHZ },
-        { 53330000, I2C_OAR2_FR_5333_66MHZ },
+        { 53330000,  I2C_OAR2_FR_5333_66MHZ },
-        { 66000000, I2C_OAR2_FR_66_80MHZ },
+        { 66000000,  I2C_OAR2_FR_66_80MHZ },
-        { 80000000, I2C_OAR2_FR_80_100MHZ },
+        { 80000000,  I2C_OAR2_FR_80_100MHZ },
        { 100000000, 0xFFU },
 };
 static int stu300_set_clk(struct stu300_dev *dev, unsigned long clkrate)
 {
@@ -494,10 +515,10 @@ static int stu300_set_clk(struct stu300_dev *dev, unsigned long clkrate)
        if (dev->speed > 100000)
                /* Fast Mode I2C */
-                val = ((clkrate/dev->speed)-9)/3;
+                val = ((clkrate/dev->speed) - 9)/3 + 1;
        else
                /* Standard Mode I2C */
-                val = ((clkrate/dev->speed)-7)/2;
+                val = ((clkrate/dev->speed) - 7)/2 + 1;
        /* According to spec the divider must be > 2 */
        if (val < 0x002) {
@@ -557,6 +578,7 @@ static int stu300_init_hw(struct stu300_dev *dev)
         */
        clkrate = clk_get_rate(dev->clk);
        ret = stu300_set_clk(dev, clkrate);
        if (ret)
                return ret;
        /*
@@ -641,7 +663,6 @@ static int stu300_xfer_msg(struct i2c_adapter *adap,
        int attempts = 0;
        struct stu300_dev *dev = i2c_get_adapdata(adap);
        clk_enable(dev->clk);
        /* Remove this if (0) to trace each and every message. */
@@ -715,14 +736,15 @@ static int stu300_xfer_msg(struct i2c_adapter *adap,
        if (attempts < NUM_ADDR_RESEND_ATTEMPTS && attempts > 0) {
                dev_dbg(&dev->pdev->dev, "managed to get address "
-                       "through after %d attempts\n", attempts);
+                        "through after %d attempts\n", attempts);
        } else if (attempts == NUM_ADDR_RESEND_ATTEMPTS) {
                dev_dbg(&dev->pdev->dev, "I give up, tried %d times "
-                       "to resend address.\n",
+                        "to resend address.\n",
-                       NUM_ADDR_RESEND_ATTEMPTS);
+                        NUM_ADDR_RESEND_ATTEMPTS);
                goto exit_disable;
        }
        if (msg->flags & I2C_M_RD) {
                /* READ: we read the actual bytes one at a time */
                for (i = 0; i < msg->len; i++) {
@@ -804,8 +826,10 @@ static int stu300_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
 {
        int ret = -1;
        int i;
        struct stu300_dev *dev = i2c_get_adapdata(adap);
        dev->msg_len = num;
        for (i = 0; i < num; i++) {
                /*
                 * Another driver appears to send stop for each message,
@@ -817,6 +841,7 @@ static int stu300_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs,
                dev->msg_index = i;
                ret = stu300_xfer_msg(adap, &msgs[i], (i == (num - 1)));
                if (ret != 0) {
                        num = ret;
                        break;
@@ -845,6 +870,7 @@ stu300_probe(struct platform_device *pdev)
        struct resource *res;
        int bus_nr;
        int ret = 0;
+        char clk_name[] = "I2C0";
        dev = kzalloc(sizeof(struct stu300_dev), GFP_KERNEL);
        if (!dev) {
@@ -854,7 +880,8 @@ stu300_probe(struct platform_device *pdev)
        }
        bus_nr = pdev->id;
-        dev->clk = clk_get(&pdev->dev, NULL);
+        clk_name[3] += (char)bus_nr;
+        dev->clk = clk_get(&pdev->dev, clk_name);
        if (IS_ERR(dev->clk)) {
                ret = PTR_ERR(dev->clk);
                dev_err(&pdev->dev, "could not retrieve i2c bus clock\n");
diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
index 4cfd084fa897..9a1d55b74d7a 100644
--- a/drivers/input/joydev.c
+++ b/drivers/input/joydev.c
@@ -456,8 +456,11 @@ static int joydev_ioctl_common(struct joydev *joydev,
                                unsigned int cmd, void __user *argp)
 {
        struct input_dev *dev = joydev->handle.dev;
+        size_t len;
        int i, j;
+        const char *name;
+        /* Process fixed-sized commands. */
        switch (cmd) {
        case JS_SET_CAL:
@@ -499,9 +502,22 @@ static int joydev_ioctl_common(struct joydev *joydev,
                return copy_to_user(argp, joydev->corr,
                        sizeof(joydev->corr[0]) * joydev->nabs) ? -EFAULT : 0;
-        case JSIOCSAXMAP:
+        }
-                if (copy_from_user(joydev->abspam, argp,
-                                   sizeof(__u8) * (ABS_MAX + 1)))
+        /*
+         * Process variable-sized commands (the axis and button map commands
+         * are considered variable-sized to decouple them from the values of
+         * ABS_MAX and KEY_MAX).
+         */
+        switch (cmd & ~IOCSIZE_MASK) {
+        case (JSIOCSAXMAP & ~IOCSIZE_MASK):
+                len = min_t(size_t, _IOC_SIZE(cmd), sizeof(joydev->abspam));
+                /*
+                 * FIXME: we should not copy into our axis map before
+                 * validating the data.
+                 */
+                if (copy_from_user(joydev->abspam, argp, len))
                        return -EFAULT;
                for (i = 0; i < joydev->nabs; i++) {
@@ -511,13 +527,17 @@ static int joydev_ioctl_common(struct joydev *joydev,
                }
                return 0;
-        case JSIOCGAXMAP:
+        case (JSIOCGAXMAP & ~IOCSIZE_MASK):
-                return copy_to_user(argp, joydev->abspam,
+                len = min_t(size_t, _IOC_SIZE(cmd), sizeof(joydev->abspam));
-                        sizeof(__u8) * (ABS_MAX + 1)) ? -EFAULT : 0;
+                return copy_to_user(argp, joydev->abspam, len) ? -EFAULT : 0;
-        case JSIOCSBTNMAP:
+        case (JSIOCSBTNMAP & ~IOCSIZE_MASK):
-                if (copy_from_user(joydev->keypam, argp,
+                len = min_t(size_t, _IOC_SIZE(cmd), sizeof(joydev->keypam));
-                                   sizeof(__u16) * (KEY_MAX - BTN_MISC + 1)))
+                /*
+                 * FIXME: we should not copy into our keymap before
+                 * validating the data.
+                 */
+                if (copy_from_user(joydev->keypam, argp, len))
                        return -EFAULT;
                for (i = 0; i < joydev->nkey; i++) {
@@ -529,25 +549,19 @@ static int joydev_ioctl_common(struct joydev *joydev,
                return 0;
-        case JSIOCGBTNMAP:
+        case (JSIOCGBTNMAP & ~IOCSIZE_MASK):
-                return copy_to_user(argp, joydev->keypam,
+                len = min_t(size_t, _IOC_SIZE(cmd), sizeof(joydev->keypam));
-                        sizeof(__u16) * (KEY_MAX - BTN_MISC + 1)) ? -EFAULT : 0;
+                return copy_to_user(argp, joydev->keypam, len) ? -EFAULT : 0;
-        default:
+        case JSIOCGNAME(0):
-                if ((cmd & ~IOCSIZE_MASK) == JSIOCGNAME(0)) {
+                name = dev->name;
-                        int len;
+                if (!name)
-                        const char *name = dev->name;
+                        return 0;
-                        if (!name)
+                len = min_t(size_t, _IOC_SIZE(cmd), strlen(name) + 1);
-                                return 0;
+                return copy_to_user(argp, name, len) ? -EFAULT : len;
-                        len = strlen(name) + 1;
-                        if (len > _IOC_SIZE(cmd))
-                                len = _IOC_SIZE(cmd);
-                        if (copy_to_user(argp, name, len))
-                                return -EFAULT;
-                        return len;
-                }
        }
        return -EINVAL;
 }
diff --git a/drivers/input/joystick/iforce/iforce-main.c b/drivers/input/joystick/iforce/iforce-main.c
index baabf8302645..f6c688cae334 100644
--- a/drivers/input/joystick/iforce/iforce-main.c
+++ b/drivers/input/joystick/iforce/iforce-main.c
@@ -74,6 +74,7 @@ static struct iforce_device iforce_device[] = {
        { 0x05ef, 0x8884, "AVB Mag Turbo Force",                        btn_avb_wheel, abs_wheel, ff_iforce },
        { 0x05ef, 0x8888, "AVB Top Shot Force Feedback Racing Wheel",   btn_avb_tw, abs_wheel, ff_iforce }, //?
        { 0x061c, 0xc0a4, "ACT LABS Force RS",                          btn_wheel, abs_wheel, ff_iforce }, //?
+        { 0x061c, 0xc084, "ACT LABS Force RS",                          btn_wheel, abs_wheel, ff_iforce },
        { 0x06f8, 0x0001, "Guillemot Race Leader Force Feedback",       btn_wheel, abs_wheel, ff_iforce }, //?
        { 0x06f8, 0x0004, "Guillemot Force Feedback Racing Wheel",      btn_wheel, abs_wheel, ff_iforce }, //?
        { 0x06f8, 0x0004, "Gullemot Jet Leader 3D",                     btn_joystick, abs_joystick, ff_iforce }, //?
diff --git a/drivers/input/joystick/iforce/iforce-usb.c b/drivers/input/joystick/iforce/iforce-usb.c
index f83185aeb511..9f289d8f52c6 100644
--- a/drivers/input/joystick/iforce/iforce-usb.c
+++ b/drivers/input/joystick/iforce/iforce-usb.c
@@ -223,6 +223,7 @@ static struct usb_device_id iforce_usb_ids [] = {
        { USB_DEVICE(0x05ef, 0x8884) },         /* AVB Mag Turbo Force */
        { USB_DEVICE(0x05ef, 0x8888) },         /* AVB Top Shot FFB Racing Wheel */
        { USB_DEVICE(0x061c, 0xc0a4) },         /* ACT LABS Force RS */
+        { USB_DEVICE(0x061c, 0xc084) },         /* ACT LABS Force RS */
        { USB_DEVICE(0x06f8, 0x0001) },         /* Guillemot Race Leader Force Feedback */
        { USB_DEVICE(0x06f8, 0x0004) },         /* Guillemot Force Feedback Racing Wheel */
        { USB_DEVICE(0x06f8, 0xa302) },         /* Guillemot Jet Leader 3D */
diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index 95fe0452dae4..6c6a09b1c0fe 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -880,6 +880,14 @@ static unsigned int atkbd_hp_zv6100_forced_release_keys[] = {
 };
 /*
+ * Perform fixup for HP (Compaq) Presario R4000 R4100 R4200 that don't generate
+ * release for their volume buttons
+ */
+static unsigned int atkbd_hp_r4000_forced_release_keys[] = {
+        0xae, 0xb0, -1U
+};
+/*
 * Samsung NC10,NC20 with Fn+F? key release not working
 */
 static unsigned int atkbd_samsung_forced_release_keys[] = {
@@ -1537,6 +1545,33 @@ static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = {
                .driver_data = atkbd_hp_zv6100_forced_release_keys,
        },
        {
+                .ident = "HP Presario R4000",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Presario R4000"),
+                },
+                .callback = atkbd_setup_forced_release,
+                .driver_data = atkbd_hp_r4000_forced_release_keys,
+        },
+        {
+                .ident = "HP Presario R4100",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Presario R4100"),
+                },
+                .callback = atkbd_setup_forced_release,
+                .driver_data = atkbd_hp_r4000_forced_release_keys,
+        },
+        {
+                .ident = "HP Presario R4200",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Presario R4200"),
+                },
+                .callback = atkbd_setup_forced_release,
+                .driver_data = atkbd_hp_r4000_forced_release_keys,
+        },
+        {
                .ident = "Inventec Symphony",
                .matches = {
                        DMI_MATCH(DMI_SYS_VENDOR, "INVENTEC"),
diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
index ae04d8a494e5..ccbf23ece8e3 100644
--- a/drivers/input/serio/i8042-x86ia64io.h
+++ b/drivers/input/serio/i8042-x86ia64io.h
@@ -382,6 +382,14 @@ static struct dmi_system_id __initdata i8042_dmi_nomux_table[] = {
                        DMI_MATCH(DMI_PRODUCT_NAME, "Vostro1510"),
                },
        },
+        {
+                .ident = "Acer Aspire 5536",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 5536"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "0100"),
+                },
+        },
        { }
 };
diff --git a/drivers/input/tablet/wacom_sys.c b/drivers/input/tablet/wacom_sys.c
index a9d5031b855e..ea30c983a33e 100644
--- a/drivers/input/tablet/wacom_sys.c
+++ b/drivers/input/tablet/wacom_sys.c
@@ -388,6 +388,32 @@ static int wacom_parse_hid(struct usb_interface *intf, struct hid_descriptor *hi
        return result;
 }
+static int wacom_query_tablet_data(struct usb_interface *intf)
+{
+        unsigned char *rep_data;
+        int limit = 0;
+        int error;
+        rep_data = kmalloc(2, GFP_KERNEL);
+        if (!rep_data)
+                return -ENOMEM;
+        do {
+                rep_data[0] = 2;
+                rep_data[1] = 2;
+                error = usb_set_report(intf, WAC_HID_FEATURE_REPORT,
+                                        2, rep_data, 2);
+                if (error >= 0)
+                        error = usb_get_report(intf,
+                                                WAC_HID_FEATURE_REPORT, 2,
+                                                rep_data, 2);
+        } while ((error < 0 || rep_data[1] != 2) && limit++ < 5);
+        kfree(rep_data);
+        return error < 0 ? error : 0;
+}
 static int wacom_probe(struct usb_interface *intf, const struct usb_device_id *id)
 {
        struct usb_device *dev = interface_to_usbdev(intf);
@@ -398,7 +424,6 @@ static int wacom_probe(struct usb_interface *intf, const struct usb_device_id *i
        struct wacom_features *features;
        struct input_dev *input_dev;
        int error = -ENOMEM;
-        char rep_data[2], limit = 0;
        struct hid_descriptor *hid_desc;
        wacom = kzalloc(sizeof(struct wacom), GFP_KERNEL);
@@ -489,20 +514,10 @@ static int wacom_probe(struct usb_interface *intf, const struct usb_device_id *i
        /*
         * Ask the tablet to report tablet data if it is not a Tablet PC.
-         * Repeat until it succeeds
+         * Note that if query fails it is not a hard failure.
         */
-        if (wacom_wac->features->type != TABLETPC) {
+        if (wacom_wac->features->type != TABLETPC)
-                do {
+                wacom_query_tablet_data(intf);
-                        rep_data[0] = 2;
-                        rep_data[1] = 2;
-                        error = usb_set_report(intf, WAC_HID_FEATURE_REPORT,
-                                                2, rep_data, 2);
-                        if (error >= 0)
-                                error = usb_get_report(intf,
-                                                WAC_HID_FEATURE_REPORT, 2,
-                                                rep_data, 2);
-                } while ((error < 0 || rep_data[1] != 2) && limit++ < 5);
-        }
        usb_set_intfdata(intf, wacom);
        return 0;
diff --git a/drivers/input/touchscreen/ucb1400_ts.c b/drivers/input/touchscreen/ucb1400_ts.c
index 6954f5500108..3a7a58222f83 100644
--- a/drivers/input/touchscreen/ucb1400_ts.c
+++ b/drivers/input/touchscreen/ucb1400_ts.c
@@ -170,11 +170,11 @@ static void ucb1400_handle_pending_irq(struct ucb1400_ts *ucb)
        ucb1400_reg_write(ucb->ac97, UCB_IE_CLEAR, isr);
        ucb1400_reg_write(ucb->ac97, UCB_IE_CLEAR, 0);
-        if (isr & UCB_IE_TSPX) {
+        if (isr & UCB_IE_TSPX)
                ucb1400_ts_irq_disable(ucb->ac97);
-                enable_irq(ucb->irq);
+        else
-        } else
+                dev_dbg(&ucb->ts_idev->dev, "ucb1400: unexpected IE_STATUS = %#x\n", isr);
-                printk(KERN_ERR "ucb1400: unexpected IE_STATUS = %#x\n", isr);
+        enable_irq(ucb->irq);
 }
 static int ucb1400_ts_thread(void *_ucb)
@@ -345,6 +345,7 @@ static int ucb1400_ts_detect_irq(struct ucb1400_ts *ucb)
 static int ucb1400_ts_probe(struct platform_device *dev)
 {
        int error, x_res, y_res;
+        u16 fcsr;
        struct ucb1400_ts *ucb = dev->dev.platform_data;
        ucb->ts_idev = input_allocate_device();
@@ -382,6 +383,14 @@ static int ucb1400_ts_probe(struct platform_device *dev)
        ucb->ts_idev->evbit[0]          = BIT_MASK(EV_ABS) | BIT_MASK(EV_KEY);
        ucb->ts_idev->keybit[BIT_WORD(BTN_TOUCH)] = BIT_MASK(BTN_TOUCH);
+        /*
+         * Enable ADC filter to prevent horrible jitter on Colibri.
+         * This also further reduces jitter on boards where ADCSYNC
+         * pin is connected.
+         */
+        fcsr = ucb1400_reg_read(ucb->ac97, UCB_FCSR);
+        ucb1400_reg_write(ucb->ac97, UCB_FCSR, fcsr | UCB_FCSR_AVE);
        ucb1400_adc_enable(ucb->ac97);
        x_res = ucb1400_ts_read_xres(ucb);
        y_res = ucb1400_ts_read_yres(ucb);
diff --git a/drivers/leds/ledtrig-gpio.c b/drivers/leds/ledtrig-gpio.c
index a247ae63374f..1bc5db4ece0d 100644
--- a/drivers/leds/ledtrig-gpio.c
+++ b/drivers/leds/ledtrig-gpio.c
@@ -117,6 +117,9 @@ static ssize_t gpio_trig_inverted_store(struct device *dev,
        gpio_data->inverted = !!inverted;
+        /* After inverting, we need to update the LED. */
+        schedule_work(&gpio_data->work);
        return n;
 }
 static DEVICE_ATTR(inverted, 0644, gpio_trig_inverted_show,
@@ -146,20 +149,26 @@ static ssize_t gpio_trig_gpio_store(struct device *dev,
                return -EINVAL;
        }
+        if (gpio_data->gpio == gpio)
+                return n;
        if (!gpio) {
-                free_irq(gpio_to_irq(gpio_data->gpio), led);
+                if (gpio_data->gpio != 0)
+                        free_irq(gpio_to_irq(gpio_data->gpio), led);
+                gpio_data->gpio = 0;
                return n;
        }
-        if (gpio_data->gpio > 0 && gpio_data->gpio != gpio)
-                free_irq(gpio_to_irq(gpio_data->gpio), led);
-        gpio_data->gpio = gpio;
        ret = request_irq(gpio_to_irq(gpio), gpio_trig_irq,
                        IRQF_SHARED | IRQF_TRIGGER_RISING
                        | IRQF_TRIGGER_FALLING, "ledtrig-gpio", led);
-        if (ret)
+        if (ret) {
                dev_err(dev, "request_irq failed with error %d\n", ret);
+        } else {
+                if (gpio_data->gpio != 0)
+                        free_irq(gpio_to_irq(gpio_data->gpio), led);
+                gpio_data->gpio = gpio;
+        }
        return ret ? ret : n;
 }
@@ -211,7 +220,8 @@ static void gpio_trig_deactivate(struct led_classdev *led)
                device_remove_file(led->dev, &dev_attr_inverted);
                device_remove_file(led->dev, &dev_attr_desired_brightness);
                flush_work(&gpio_data->work);
-                free_irq(gpio_to_irq(gpio_data->gpio),led);
+                if (gpio_data->gpio != 0)
+                        free_irq(gpio_to_irq(gpio_data->gpio), led);
                kfree(gpio_data);
        }
 }
diff --git a/drivers/macintosh/via-maciisi.c b/drivers/macintosh/via-maciisi.c
index 4d686c0bdea0..9ab5b0c34f0d 100644
--- a/drivers/macintosh/via-maciisi.c
+++ b/drivers/macintosh/via-maciisi.c
@@ -288,7 +288,7 @@ static void maciisi_sync(struct adb_request *req)
        }
        /* This could be BAD... when the ADB controller doesn't respond
         * for this long, it's probably not coming back :-( */
-        if(count >= 50) /* Hopefully shouldn't happen */
+        if (count > 50) /* Hopefully shouldn't happen */
                printk(KERN_ERR "maciisi_send_request: poll timed out!\n");
 }
diff --git a/drivers/md/dm-exception-store.c b/drivers/md/dm-exception-store.c
index 3710ff88fc10..556acff3952f 100644
--- a/drivers/md/dm-exception-store.c
+++ b/drivers/md/dm-exception-store.c
@@ -171,6 +171,14 @@ static int set_chunk_size(struct dm_exception_store *store,
         */
        chunk_size_ulong = round_up(chunk_size_ulong, PAGE_SIZE >> 9);
+        return dm_exception_store_set_chunk_size(store, chunk_size_ulong,
+                                                 error);
+}
+int dm_exception_store_set_chunk_size(struct dm_exception_store *store,
+                                      unsigned long chunk_size_ulong,
+                                      char **error)
+{
        /* Check chunk_size is a power of 2 */
        if (!is_power_of_2(chunk_size_ulong)) {
                *error = "Chunk size is not a power of 2";
@@ -183,6 +191,11 @@ static int set_chunk_size(struct dm_exception_store *store,
                return -EINVAL;
        }
+        if (chunk_size_ulong > INT_MAX >> SECTOR_SHIFT) {
+                *error = "Chunk size is too high";
+                return -EINVAL;
+        }
        store->chunk_size = chunk_size_ulong;
        store->chunk_mask = chunk_size_ulong - 1;
        store->chunk_shift = ffs(chunk_size_ulong) - 1;
diff --git a/drivers/md/dm-exception-store.h b/drivers/md/dm-exception-store.h
index 2442c8c07898..812c71872ba0 100644
--- a/drivers/md/dm-exception-store.h
+++ b/drivers/md/dm-exception-store.h
@@ -168,6 +168,10 @@ static inline chunk_t sector_to_chunk(struct dm_exception_store *store,
 int dm_exception_store_type_register(struct dm_exception_store_type *type);
 int dm_exception_store_type_unregister(struct dm_exception_store_type *type);
+int dm_exception_store_set_chunk_size(struct dm_exception_store *store,
+                                      unsigned long chunk_size_ulong,
+                                      char **error);
 int dm_exception_store_create(struct dm_target *ti, int argc, char **argv,
                              unsigned *args_used,
                              struct dm_exception_store **store);
diff --git a/drivers/md/dm-log-userspace-base.c b/drivers/md/dm-log-userspace-base.c
index e69b96560997..6e186b1a062d 100644
--- a/drivers/md/dm-log-userspace-base.c
+++ b/drivers/md/dm-log-userspace-base.c
@@ -21,6 +21,7 @@ struct log_c {
        struct dm_target *ti;
        uint32_t region_size;
        region_t region_count;
+        uint64_t luid;
        char uuid[DM_UUID_LEN];
        char *usr_argv_str;
@@ -63,7 +64,7 @@ static int userspace_do_request(struct log_c *lc, const char *uuid,
         * restored.
         */
 retry:
-        r = dm_consult_userspace(uuid, request_type, data,
+        r = dm_consult_userspace(uuid, lc->luid, request_type, data,
                                 data_size, rdata, rdata_size);
        if (r != -ESRCH)
@@ -74,14 +75,15 @@ retry:
                set_current_state(TASK_INTERRUPTIBLE);
                schedule_timeout(2*HZ);
                DMWARN("Attempting to contact userspace log server...");
-                r = dm_consult_userspace(uuid, DM_ULOG_CTR, lc->usr_argv_str,
+                r = dm_consult_userspace(uuid, lc->luid, DM_ULOG_CTR,
+                                         lc->usr_argv_str,
                                         strlen(lc->usr_argv_str) + 1,
                                         NULL, NULL);
                if (!r)
                        break;
        }
        DMINFO("Reconnected to userspace log server... DM_ULOG_CTR complete");
-        r = dm_consult_userspace(uuid, DM_ULOG_RESUME, NULL,
+        r = dm_consult_userspace(uuid, lc->luid, DM_ULOG_RESUME, NULL,
                                 0, NULL, NULL);
        if (!r)
                goto retry;
@@ -111,10 +113,9 @@ static int build_constructor_string(struct dm_target *ti,
                return -ENOMEM;
        }
-        for (i = 0, str_size = 0; i < argc; i++)
+        str_size = sprintf(str, "%llu", (unsigned long long)ti->len);
-                str_size += sprintf(str + str_size, "%s ", argv[i]);
+        for (i = 0; i < argc; i++)
-        str_size += sprintf(str + str_size, "%llu",
+                str_size += sprintf(str + str_size, " %s", argv[i]);
-                            (unsigned long long)ti->len);
        *ctr_str = str;
        return str_size;
@@ -154,6 +155,9 @@ static int userspace_ctr(struct dm_dirty_log *log, struct dm_target *ti,
                return -ENOMEM;
        }
+        /* The ptr value is sufficient for local unique id */
+        lc->luid = (uint64_t)lc;
        lc->ti = ti;
        if (strlen(argv[0]) > (DM_UUID_LEN - 1)) {
@@ -173,7 +177,7 @@ static int userspace_ctr(struct dm_dirty_log *log, struct dm_target *ti,
        }
        /* Send table string */
-        r = dm_consult_userspace(lc->uuid, DM_ULOG_CTR,
+        r = dm_consult_userspace(lc->uuid, lc->luid, DM_ULOG_CTR,
                                 ctr_str, str_size, NULL, NULL);
        if (r == -ESRCH) {
@@ -183,7 +187,7 @@ static int userspace_ctr(struct dm_dirty_log *log, struct dm_target *ti,
        /* Since the region size does not change, get it now */
        rdata_size = sizeof(rdata);
-        r = dm_consult_userspace(lc->uuid, DM_ULOG_GET_REGION_SIZE,
+        r = dm_consult_userspace(lc->uuid, lc->luid, DM_ULOG_GET_REGION_SIZE,
                                 NULL, 0, (char *)&rdata, &rdata_size);
        if (r) {
@@ -212,7 +216,7 @@ static void userspace_dtr(struct dm_dirty_log *log)
        int r;
        struct log_c *lc = log->context;
-        r = dm_consult_userspace(lc->uuid, DM_ULOG_DTR,
+        r = dm_consult_userspace(lc->uuid, lc->luid, DM_ULOG_DTR,
                                 NULL, 0,
                                 NULL, NULL);
@@ -227,7 +231,7 @@ static int userspace_presuspend(struct dm_dirty_log *log)
        int r;
        struct log_c *lc = log->context;
-        r = dm_consult_userspace(lc->uuid, DM_ULOG_PRESUSPEND,
+        r = dm_consult_userspace(lc->uuid, lc->luid, DM_ULOG_PRESUSPEND,
                                 NULL, 0,
                                 NULL, NULL);
@@ -239,7 +243,7 @@ static int userspace_postsuspend(struct dm_dirty_log *log)
        int r;
        struct log_c *lc = log->context;
-        r = dm_consult_userspace(lc->uuid, DM_ULOG_POSTSUSPEND,
+        r = dm_consult_userspace(lc->uuid, lc->luid, DM_ULOG_POSTSUSPEND,
                                 NULL, 0,
                                 NULL, NULL);
@@ -252,7 +256,7 @@ static int userspace_resume(struct dm_dirty_log *log)
        struct log_c *lc = log->context;
        lc->in_sync_hint = 0;
-        r = dm_consult_userspace(lc->uuid, DM_ULOG_RESUME,
+        r = dm_consult_userspace(lc->uuid, lc->luid, DM_ULOG_RESUME,
                                 NULL, 0,
                                 NULL, NULL);
@@ -561,6 +565,7 @@ static int userspace_status(struct dm_dirty_log *log, status_type_t status_type,
                            char *result, unsigned maxlen)
 {
        int r = 0;
+        char *table_args;
        size_t sz = (size_t)maxlen;
        struct log_c *lc = log->context;
@@ -577,8 +582,12 @@ static int userspace_status(struct dm_dirty_log *log, status_type_t status_type,
                break;
        case STATUSTYPE_TABLE:
                sz = 0;
-                DMEMIT("%s %u %s %s", log->type->name, lc->usr_argc + 1,
+                table_args = strstr(lc->usr_argv_str, " ");
-                       lc->uuid, lc->usr_argv_str);
+                BUG_ON(!table_args); /* There will always be a ' ' */
+                table_args++;
+                DMEMIT("%s %u %s %s ", log->type->name, lc->usr_argc,
+                       lc->uuid, table_args);
                break;
        }
        return (r) ? 0 : (int)sz;
diff --git a/drivers/md/dm-log-userspace-transfer.c b/drivers/md/dm-log-userspace-transfer.c
index 0ca1ee768a1f..ba0edad2d048 100644
--- a/drivers/md/dm-log-userspace-transfer.c
+++ b/drivers/md/dm-log-userspace-transfer.c
@@ -108,7 +108,7 @@ static int fill_pkg(struct cn_msg *msg, struct dm_ulog_request *tfr)
                                *(pkg->data_size) = 0;
                } else if (tfr->data_size > *(pkg->data_size)) {
                        DMERR("Insufficient space to receive package [%u] "
-                              "(%u vs %lu)", tfr->request_type,
+                              "(%u vs %zu)", tfr->request_type,
                              tfr->data_size, *(pkg->data_size));
                        *(pkg->data_size) = 0;
@@ -147,7 +147,8 @@ static void cn_ulog_callback(void *data)
 /**
 * dm_consult_userspace
- * @uuid: log's uuid (must be DM_UUID_LEN in size)
+ * @uuid: log's universal unique identifier (must be DM_UUID_LEN in size)
+ * @luid: log's local unique identifier
 * @request_type:  found in include/linux/dm-log-userspace.h
 * @data: data to tx to the server
 * @data_size: size of data in bytes
@@ -163,7 +164,7 @@ static void cn_ulog_callback(void *data)
 *
 * Returns: 0 on success, -EXXX on failure
 **/
-int dm_consult_userspace(const char *uuid, int request_type,
+int dm_consult_userspace(const char *uuid, uint64_t luid, int request_type,
                         char *data, size_t data_size,
                         char *rdata, size_t *rdata_size)
 {
@@ -190,6 +191,7 @@ resend:
        memset(tfr, 0, DM_ULOG_PREALLOCED_SIZE - overhead_size);
        memcpy(tfr->uuid, uuid, DM_UUID_LEN);
+        tfr->luid = luid;
        tfr->seq = dm_ulog_seq++;
        /*
diff --git a/drivers/md/dm-log-userspace-transfer.h b/drivers/md/dm-log-userspace-transfer.h
index c26d8e4e2710..04ee874f9153 100644
--- a/drivers/md/dm-log-userspace-transfer.h
+++ b/drivers/md/dm-log-userspace-transfer.h
@@ -11,7 +11,7 @@
 int dm_ulog_tfr_init(void);
 void dm_ulog_tfr_exit(void);
-int dm_consult_userspace(const char *uuid, int request_type,
+int dm_consult_userspace(const char *uuid, uint64_t luid, int request_type,
                         char *data, size_t data_size,
                         char *rdata, size_t *rdata_size);
diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
index 9726577cde49..33f179e66bf5 100644
--- a/drivers/md/dm-raid1.c
+++ b/drivers/md/dm-raid1.c
@@ -648,7 +648,13 @@ static void do_writes(struct mirror_set *ms, struct bio_list *writes)
         */
        dm_rh_inc_pending(ms->rh, &sync);
        dm_rh_inc_pending(ms->rh, &nosync);
-        ms->log_failure = dm_rh_flush(ms->rh) ? 1 : 0;
+        /*
+         * If the flush fails on a previous call and succeeds here,
+         * we must not reset the log_failure variable.  We need
+         * userspace interaction to do that.
+         */
+        ms->log_failure = dm_rh_flush(ms->rh) ? 1 : ms->log_failure;
        /*
         * Dispatch io.
diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c
index 6e3fe4f14934..d5b2e08750d5 100644
--- a/drivers/md/dm-snap-persistent.c
+++ b/drivers/md/dm-snap-persistent.c
@@ -106,6 +106,13 @@ struct pstore {
        void *zero_area;
        /*
+         * An area used for header. The header can be written
+         * concurrently with metadata (when invalidating the snapshot),
+         * so it needs a separate buffer.
+         */
+        void *header_area;
+        /*
         * Used to keep track of which metadata area the data in
         * 'chunk' refers to.
         */
@@ -148,16 +155,27 @@ static int alloc_area(struct pstore *ps)
         */
        ps->area = vmalloc(len);
        if (!ps->area)
-                return r;
+                goto err_area;
        ps->zero_area = vmalloc(len);
-        if (!ps->zero_area) {
+        if (!ps->zero_area)
-                vfree(ps->area);
+                goto err_zero_area;
-                return r;
-        }
        memset(ps->zero_area, 0, len);
+        ps->header_area = vmalloc(len);
+        if (!ps->header_area)
+                goto err_header_area;
        return 0;
+err_header_area:
+        vfree(ps->zero_area);
+err_zero_area:
+        vfree(ps->area);
+err_area:
+        return r;
 }
 static void free_area(struct pstore *ps)
@@ -169,6 +187,10 @@ static void free_area(struct pstore *ps)
        if (ps->zero_area)
                vfree(ps->zero_area);
        ps->zero_area = NULL;
+        if (ps->header_area)
+                vfree(ps->header_area);
+        ps->header_area = NULL;
 }
 struct mdata_req {
@@ -188,7 +210,8 @@ static void do_metadata(struct work_struct *work)
 /*
 * Read or write a chunk aligned and sized block of data from a device.
 */
-static int chunk_io(struct pstore *ps, chunk_t chunk, int rw, int metadata)
+static int chunk_io(struct pstore *ps, void *area, chunk_t chunk, int rw,
+                    int metadata)
 {
        struct dm_io_region where = {
                .bdev = ps->store->cow->bdev,
@@ -198,7 +221,7 @@ static int chunk_io(struct pstore *ps, chunk_t chunk, int rw, int metadata)
        struct dm_io_request io_req = {
                .bi_rw = rw,
                .mem.type = DM_IO_VMA,
-                .mem.ptr.vma = ps->area,
+                .mem.ptr.vma = area,
                .client = ps->io_client,
                .notify.fn = NULL,
        };
@@ -240,7 +263,7 @@ static int area_io(struct pstore *ps, int rw)
        chunk = area_location(ps, ps->current_area);
-        r = chunk_io(ps, chunk, rw, 0);
+        r = chunk_io(ps, ps->area, chunk, rw, 0);
        if (r)
                return r;
@@ -254,20 +277,7 @@ static void zero_memory_area(struct pstore *ps)
 static int zero_disk_area(struct pstore *ps, chunk_t area)
 {
-        struct dm_io_region where = {
+        return chunk_io(ps, ps->zero_area, area_location(ps, area), WRITE, 0);
-                .bdev = ps->store->cow->bdev,
-                .sector = ps->store->chunk_size * area_location(ps, area),
-                .count = ps->store->chunk_size,
-        };
-        struct dm_io_request io_req = {
-                .bi_rw = WRITE,
-                .mem.type = DM_IO_VMA,
-                .mem.ptr.vma = ps->zero_area,
-                .client = ps->io_client,
-                .notify.fn = NULL,
-        };
-        return dm_io(&io_req, 1, &where, NULL);
 }
 static int read_header(struct pstore *ps, int *new_snapshot)
@@ -276,6 +286,7 @@ static int read_header(struct pstore *ps, int *new_snapshot)
        struct disk_header *dh;
        chunk_t chunk_size;
        int chunk_size_supplied = 1;
+        char *chunk_err;
        /*
         * Use default chunk size (or hardsect_size, if larger) if none supplied
@@ -297,11 +308,11 @@ static int read_header(struct pstore *ps, int *new_snapshot)
        if (r)
                return r;
-        r = chunk_io(ps, 0, READ, 1);
+        r = chunk_io(ps, ps->header_area, 0, READ, 1);
        if (r)
                goto bad;
-        dh = (struct disk_header *) ps->area;
+        dh = ps->header_area;
        if (le32_to_cpu(dh->magic) == 0) {
                *new_snapshot = 1;
@@ -319,20 +330,25 @@ static int read_header(struct pstore *ps, int *new_snapshot)
        ps->version = le32_to_cpu(dh->version);
        chunk_size = le32_to_cpu(dh->chunk_size);
-        if (!chunk_size_supplied || ps->store->chunk_size == chunk_size)
+        if (ps->store->chunk_size == chunk_size)
                return 0;
-        DMWARN("chunk size %llu in device metadata overrides "
+        if (chunk_size_supplied)
-               "table chunk size of %llu.",
+                DMWARN("chunk size %llu in device metadata overrides "
-               (unsigned long long)chunk_size,
+                       "table chunk size of %llu.",
-               (unsigned long long)ps->store->chunk_size);
+                       (unsigned long long)chunk_size,
+                       (unsigned long long)ps->store->chunk_size);
        /* We had a bogus chunk_size. Fix stuff up. */
        free_area(ps);
-        ps->store->chunk_size = chunk_size;
+        r = dm_exception_store_set_chunk_size(ps->store, chunk_size,
-        ps->store->chunk_mask = chunk_size - 1;
+                                              &chunk_err);
-        ps->store->chunk_shift = ffs(chunk_size) - 1;
+        if (r) {
+                DMERR("invalid on-disk chunk size %llu: %s.",
+                      (unsigned long long)chunk_size, chunk_err);
+                return r;
+        }
        r = dm_io_client_resize(sectors_to_pages(ps->store->chunk_size),
                                ps->io_client);
@@ -351,15 +367,15 @@ static int write_header(struct pstore *ps)
 {
        struct disk_header *dh;
-        memset(ps->area, 0, ps->store->chunk_size << SECTOR_SHIFT);
+        memset(ps->header_area, 0, ps->store->chunk_size << SECTOR_SHIFT);
-        dh = (struct disk_header *) ps->area;
+        dh = ps->header_area;
        dh->magic = cpu_to_le32(SNAP_MAGIC);
        dh->valid = cpu_to_le32(ps->valid);
        dh->version = cpu_to_le32(ps->version);
        dh->chunk_size = cpu_to_le32(ps->store->chunk_size);
-        return chunk_io(ps, 0, WRITE, 1);
+        return chunk_io(ps, ps->header_area, 0, WRITE, 1);
 }
 /*
@@ -679,6 +695,8 @@ static int persistent_ctr(struct dm_exception_store *store,
        ps->valid = 1;
        ps->version = SNAPSHOT_DISK_VERSION;
        ps->area = NULL;
+        ps->zero_area = NULL;
+        ps->header_area = NULL;
        ps->next_free = 2;      /* skipping the header and first area */
        ps->current_committed = 0;
diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
index d573165cd2b7..57f1bf7f3b7a 100644
--- a/drivers/md/dm-snap.c
+++ b/drivers/md/dm-snap.c
@@ -1176,6 +1176,15 @@ static int snapshot_status(struct dm_target *ti, status_type_t type,
        return 0;
 }
+static int snapshot_iterate_devices(struct dm_target *ti,
+                                    iterate_devices_callout_fn fn, void *data)
+{
+        struct dm_snapshot *snap = ti->private;
+        return fn(ti, snap->origin, 0, ti->len, data);
+}
 /*-----------------------------------------------------------------
 * Origin methods
 *---------------------------------------------------------------*/
@@ -1410,20 +1419,29 @@ static int origin_status(struct dm_target *ti, status_type_t type, char *result,
        return 0;
 }
+static int origin_iterate_devices(struct dm_target *ti,
+                                  iterate_devices_callout_fn fn, void *data)
+{
+        struct dm_dev *dev = ti->private;
+        return fn(ti, dev, 0, ti->len, data);
+}
 static struct target_type origin_target = {
        .name    = "snapshot-origin",
-        .version = {1, 6, 0},
+        .version = {1, 7, 0},
        .module  = THIS_MODULE,
        .ctr     = origin_ctr,
        .dtr     = origin_dtr,
        .map     = origin_map,
        .resume  = origin_resume,
        .status  = origin_status,
+        .iterate_devices = origin_iterate_devices,
 };
 static struct target_type snapshot_target = {
        .name    = "snapshot",
-        .version = {1, 6, 0},
+        .version = {1, 7, 0},
        .module  = THIS_MODULE,
        .ctr     = snapshot_ctr,
        .dtr     = snapshot_dtr,
@@ -1431,6 +1449,7 @@ static struct target_type snapshot_target = {
        .end_io  = snapshot_end_io,
        .resume  = snapshot_resume,
        .status  = snapshot_status,
+        .iterate_devices = snapshot_iterate_devices,
 };
 static int __init dm_snapshot_init(void)
diff --git a/drivers/md/dm-stripe.c b/drivers/md/dm-stripe.c
index 4e0e5937e42a..3e563d251733 100644
--- a/drivers/md/dm-stripe.c
+++ b/drivers/md/dm-stripe.c
@@ -329,9 +329,19 @@ static int stripe_iterate_devices(struct dm_target *ti,
        return ret;
 }
+static void stripe_io_hints(struct dm_target *ti,
+                            struct queue_limits *limits)
+{
+        struct stripe_c *sc = ti->private;
+        unsigned chunk_size = (sc->chunk_mask + 1) << 9;
+        blk_limits_io_min(limits, chunk_size);
+        limits->io_opt = chunk_size * sc->stripes;
+}
 static struct target_type stripe_target = {
        .name   = "striped",
-        .version = {1, 2, 0},
+        .version = {1, 3, 0},
        .module = THIS_MODULE,
        .ctr    = stripe_ctr,
        .dtr    = stripe_dtr,
@@ -339,6 +349,7 @@ static struct target_type stripe_target = {
        .end_io = stripe_end_io,
        .status = stripe_status,
        .iterate_devices = stripe_iterate_devices,
+        .io_hints = stripe_io_hints,
 };
 int __init dm_stripe_init(void)
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index d952b3441913..1a6cb3c7822e 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -343,10 +343,10 @@ static void close_dev(struct dm_dev_internal *d, struct mapped_device *md)
 }
 /*
- * If possible, this checks an area of a destination device is valid.
+ * If possible, this checks an area of a destination device is invalid.
 */
-static int device_area_is_valid(struct dm_target *ti, struct dm_dev *dev,
+static int device_area_is_invalid(struct dm_target *ti, struct dm_dev *dev,
-                                sector_t start, sector_t len, void *data)
+                                  sector_t start, sector_t len, void *data)
 {
        struct queue_limits *limits = data;
        struct block_device *bdev = dev->bdev;
@@ -357,36 +357,40 @@ static int device_area_is_valid(struct dm_target *ti, struct dm_dev *dev,
        char b[BDEVNAME_SIZE];
        if (!dev_size)
-                return 1;
+                return 0;
        if ((start >= dev_size) || (start + len > dev_size)) {
-                DMWARN("%s: %s too small for target",
+                DMWARN("%s: %s too small for target: "
-                       dm_device_name(ti->table->md), bdevname(bdev, b));
+                       "start=%llu, len=%llu, dev_size=%llu",
-                return 0;
+                       dm_device_name(ti->table->md), bdevname(bdev, b),
+                       (unsigned long long)start,
+                       (unsigned long long)len,
+                       (unsigned long long)dev_size);
+                return 1;
        }
        if (logical_block_size_sectors <= 1)
-                return 1;
+                return 0;
        if (start & (logical_block_size_sectors - 1)) {
                DMWARN("%s: start=%llu not aligned to h/w "
-                       "logical block size %hu of %s",
+                       "logical block size %u of %s",
                       dm_device_name(ti->table->md),
                       (unsigned long long)start,
                       limits->logical_block_size, bdevname(bdev, b));
-                return 0;
+                return 1;
        }
        if (len & (logical_block_size_sectors - 1)) {
                DMWARN("%s: len=%llu not aligned to h/w "
-                       "logical block size %hu of %s",
+                       "logical block size %u of %s",
                       dm_device_name(ti->table->md),
                       (unsigned long long)len,
                       limits->logical_block_size, bdevname(bdev, b));
-                return 0;
+                return 1;
        }
-        return 1;
+        return 0;
 }
 /*
@@ -496,8 +500,15 @@ int dm_set_device_limits(struct dm_target *ti, struct dm_dev *dev,
        }
        if (blk_stack_limits(limits, &q->limits, start << 9) < 0)
-                DMWARN("%s: target device %s is misaligned",
+                DMWARN("%s: target device %s is misaligned: "
-                       dm_device_name(ti->table->md), bdevname(bdev, b));
+                       "physical_block_size=%u, logical_block_size=%u, "
+                       "alignment_offset=%u, start=%llu",
+                       dm_device_name(ti->table->md), bdevname(bdev, b),
+                       q->limits.physical_block_size,
+                       q->limits.logical_block_size,
+                       q->limits.alignment_offset,
+                       (unsigned long long) start << 9);
        /*
         * Check if merge fn is supported.
@@ -698,7 +709,7 @@ static int validate_hardware_logical_block_alignment(struct dm_table *table,
        if (remaining) {
                DMWARN("%s: table line %u (start sect %llu len %llu) "
-                       "not aligned to h/w logical block size %hu",
+                       "not aligned to h/w logical block size %u",
                       dm_device_name(table->md), i,
                       (unsigned long long) ti->begin,
                       (unsigned long long) ti->len,
@@ -996,12 +1007,16 @@ int dm_calculate_queue_limits(struct dm_table *table,
                ti->type->iterate_devices(ti, dm_set_device_limits,
                                          &ti_limits);
+                /* Set I/O hints portion of queue limits */
+                if (ti->type->io_hints)
+                        ti->type->io_hints(ti, &ti_limits);
                /*
                 * Check each device area is consistent with the target's
                 * overall queue limits.
                 */
-                if (!ti->type->iterate_devices(ti, device_area_is_valid,
+                if (ti->type->iterate_devices(ti, device_area_is_invalid,
-                                               &ti_limits))
+                                              &ti_limits))
                        return -EINVAL;
 combine_limits:
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 8a311ea0d441..b4845b14740d 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -738,16 +738,22 @@ static void rq_completed(struct mapped_device *md, int run_queue)
        dm_put(md);
 }
+static void free_rq_clone(struct request *clone)
+{
+        struct dm_rq_target_io *tio = clone->end_io_data;
+        blk_rq_unprep_clone(clone);
+        free_rq_tio(tio);
+}
 static void dm_unprep_request(struct request *rq)
 {
        struct request *clone = rq->special;
-        struct dm_rq_target_io *tio = clone->end_io_data;
        rq->special = NULL;
        rq->cmd_flags &= ~REQ_DONTPREP;
-        blk_rq_unprep_clone(clone);
+        free_rq_clone(clone);
-        free_rq_tio(tio);
 }
 /*
@@ -825,8 +831,7 @@ static void dm_end_request(struct request *clone, int error)
                        rq->sense_len = clone->sense_len;
        }
-        BUG_ON(clone->bio);
+        free_rq_clone(clone);
-        free_rq_tio(tio);
        blk_end_request_all(rq, error);
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 5b98bea4ff9b..9dd872000cec 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -359,6 +359,7 @@ static mddev_t * mddev_find(dev_t unit)
        else
                new->md_minor = MINOR(unit) >> MdpMinorShift;
+        mutex_init(&new->open_mutex);
        mutex_init(&new->reconfig_mutex);
        INIT_LIST_HEAD(&new->disks);
        INIT_LIST_HEAD(&new->all_mddevs);
@@ -1974,17 +1975,14 @@ repeat:
                /* otherwise we have to go forward and ... */
                mddev->events ++;
                if (!mddev->in_sync || mddev->recovery_cp != MaxSector) { /* not clean */
-                        /* .. if the array isn't clean, insist on an odd 'events' */
+                        /* .. if the array isn't clean, an 'even' event must also go
-                        if ((mddev->events&1)==0) {
+                         * to spares. */
-                                mddev->events++;
+                        if ((mddev->events&1)==0)
                                nospares = 0;
-                        }
                } else {
-                        /* otherwise insist on an even 'events' (for clean states) */
+                        /* otherwise an 'odd' event must go to spares */
-                        if ((mddev->events&1)) {
+                        if ((mddev->events&1))
-                                mddev->events++;
                                nospares = 0;
-                        }
                }
        }
@@ -3601,6 +3599,7 @@ max_sync_store(mddev_t *mddev, const char *buf, size_t len)
                if (max < mddev->resync_min)
                        return -EINVAL;
                if (max < mddev->resync_max &&
+                    mddev->ro == 0 &&
                    test_bit(MD_RECOVERY_RUNNING, &mddev->recovery))
                        return -EBUSY;
@@ -4304,12 +4303,11 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
        struct gendisk *disk = mddev->gendisk;
        mdk_rdev_t *rdev;
+        mutex_lock(&mddev->open_mutex);
        if (atomic_read(&mddev->openers) > is_open) {
                printk("md: %s still in use.\n",mdname(mddev));
-                return -EBUSY;
+                err = -EBUSY;
-        }
+        } else if (mddev->pers) {
-        if (mddev->pers) {
                if (mddev->sync_thread) {
                        set_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
@@ -4366,8 +4364,12 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
                if (mode == 1)
                        set_disk_ro(disk, 1);
                clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery);
+                err = 0;
        }
+out:
+        mutex_unlock(&mddev->open_mutex);
+        if (err)
+                return err;
        /*
         * Free resources if final stop
         */
@@ -4433,7 +4435,6 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
        blk_integrity_unregister(disk);
        md_new_event(mddev);
        sysfs_notify_dirent(mddev->sysfs_state);
-out:
        return err;
 }
@@ -5518,12 +5519,12 @@ static int md_open(struct block_device *bdev, fmode_t mode)
        }
        BUG_ON(mddev != bdev->bd_disk->private_data);
-        if ((err = mutex_lock_interruptible_nested(&mddev->reconfig_mutex, 1)))
+        if ((err = mutex_lock_interruptible(&mddev->open_mutex)))
                goto out;
        err = 0;
        atomic_inc(&mddev->openers);
-        mddev_unlock(mddev);
+        mutex_unlock(&mddev->open_mutex);
        check_disk_change(bdev);
 out:
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 78f03168baf9..f8fc188bc762 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -223,6 +223,16 @@ struct mddev_s
                                                            * so we don't loop trying */
        int                             in_sync;        /* know to not need resync */
+        /* 'open_mutex' avoids races between 'md_open' and 'do_md_stop', so
+         * that we are never stopping an array while it is open.
+         * 'reconfig_mutex' protects all other reconfiguration.
+         * These locks are separate due to conflicting interactions
+         * with bdev->bd_mutex.
+         * Lock ordering is:
+         *  reconfig_mutex -> bd_mutex : e.g. do_md_run -> revalidate_disk
+         *  bd_mutex -> open_mutex:  e.g. __blkdev_get -> md_open
+         */
+        struct mutex                    open_mutex;
        struct mutex                    reconfig_mutex;
        atomic_t                        active;         /* general refcount */
        atomic_t                        openers;        /* number of active opens */
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 2b521ee67dfa..b8a2c5dc67ba 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3785,7 +3785,7 @@ static sector_t reshape_request(mddev_t *mddev, sector_t sector_nr, int *skipped
                    conf->reshape_progress < raid5_size(mddev, 0, 0)) {
                        sector_nr = raid5_size(mddev, 0, 0)
                                - conf->reshape_progress;
-                } else if (mddev->delta_disks > 0 &&
+                } else if (mddev->delta_disks >= 0 &&
                           conf->reshape_progress > 0)
                        sector_nr = conf->reshape_progress;
                sector_div(sector_nr, new_data_disks);
@@ -4509,7 +4509,26 @@ static int run(mddev_t *mddev)
                           (old_disks-max_degraded));
                /* here_old is the first stripe that we might need to read
                 * from */
-                if (here_new >= here_old) {
+                if (mddev->delta_disks == 0) {
+                        /* We cannot be sure it is safe to start an in-place
+                         * reshape.  It is only safe if user-space if monitoring
+                         * and taking constant backups.
+                         * mdadm always starts a situation like this in
+                         * readonly mode so it can take control before
+                         * allowing any writes.  So just check for that.
+                         */
+                        if ((here_new * mddev->new_chunk_sectors != 
+                             here_old * mddev->chunk_sectors) ||
+                            mddev->ro == 0) {
+                                printk(KERN_ERR "raid5: in-place reshape must be started"
+                                       " in read-only mode - aborting\n");
+                                return -EINVAL;
+                        }
+                } else if (mddev->delta_disks < 0
+                    ? (here_new * mddev->new_chunk_sectors <=
+                       here_old * mddev->chunk_sectors)
+                    : (here_new * mddev->new_chunk_sectors >=
+                       here_old * mddev->chunk_sectors)) {
                        /* Reading from the same stripe as writing to - bad */
                        printk(KERN_ERR "raid5: reshape_position too early for "
                               "auto-recovery - aborting.\n");
@@ -5078,8 +5097,15 @@ static void raid5_finish_reshape(mddev_t *mddev)
                                        mddev->degraded--;
                        for (d = conf->raid_disks ;
                             d < conf->raid_disks - mddev->delta_disks;
-                             d++)
+                             d++) {
-                                raid5_remove_disk(mddev, d);
+                                mdk_rdev_t *rdev = conf->disks[d].rdev;
+                                if (rdev && raid5_remove_disk(mddev, d) == 0) {
+                                        char nm[20];
+                                        sprintf(nm, "rd%d", rdev->raid_disk);
+                                        sysfs_remove_link(&mddev->kobj, nm);
+                                        rdev->raid_disk = -1;
+                                }
+                        }
                }
                mddev->layout = conf->algorithm;
                mddev->chunk_sectors = conf->chunk_sectors;
diff --git a/drivers/media/common/tuners/qt1010.c b/drivers/media/common/tuners/qt1010.c
index 825aa1412e6f..9f5dba244cb8 100644
--- a/drivers/media/common/tuners/qt1010.c
+++ b/drivers/media/common/tuners/qt1010.c
@@ -64,24 +64,22 @@ static int qt1010_writereg(struct qt1010_priv *priv, u8 reg, u8 val)
 /* dump all registers */
 static void qt1010_dump_regs(struct qt1010_priv *priv)
 {
-        char buf[52], buf2[4];
        u8 reg, val;
        for (reg = 0; ; reg++) {
                if (reg % 16 == 0) {
                        if (reg)
-                                printk("%s\n", buf);
+                                printk(KERN_CONT "\n");
-                        sprintf(buf, "%02x: ", reg);
+                        printk(KERN_DEBUG "%02x:", reg);
                }
                if (qt1010_readreg(priv, reg, &val) == 0)
-                        sprintf(buf2, "%02x ", val);
+                        printk(KERN_CONT " %02x", val);
                else
-                        strcpy(buf2, "-- ");
+                        printk(KERN_CONT " --");
-                strcat(buf, buf2);
                if (reg == 0x2f)
                        break;
        }
-        printk("%s\n", buf);
+        printk(KERN_CONT "\n");
 }
 static int qt1010_set_params(struct dvb_frontend *fe,
diff --git a/drivers/media/common/tuners/tuner-xc2028.c b/drivers/media/common/tuners/tuner-xc2028.c
index aa20ce8cc668..f270e605da83 100644
--- a/drivers/media/common/tuners/tuner-xc2028.c
+++ b/drivers/media/common/tuners/tuner-xc2028.c
@@ -1119,8 +1119,8 @@ static int xc2028_sleep(struct dvb_frontend *fe)
        struct xc2028_data *priv = fe->tuner_priv;
        int rc = 0;
-        /* Avoid firmware reload on slow devices */
+        /* Avoid firmware reload on slow devices or if PM disabled */
-        if (no_poweroff)
+        if (no_poweroff || priv->ctrl.disable_power_mgmt)
                return 0;
        tuner_dbg("Putting xc2028/3028 into poweroff mode.\n");
diff --git a/drivers/media/common/tuners/tuner-xc2028.h b/drivers/media/common/tuners/tuner-xc2028.h
index 19de7928a74e..a90c35d50add 100644
--- a/drivers/media/common/tuners/tuner-xc2028.h
+++ b/drivers/media/common/tuners/tuner-xc2028.h
@@ -38,6 +38,7 @@ struct xc2028_ctrl {
        unsigned int            input1:1;
        unsigned int            vhfbw7:1;
        unsigned int            uhfbw8:1;
+        unsigned int            disable_power_mgmt:1;
        unsigned int            demod;
        enum firmware_type      type:2;
 };
diff --git a/drivers/media/dvb/dvb-usb/af9015.c b/drivers/media/dvb/dvb-usb/af9015.c
index 4cb31e7c13c2..26690dfb3260 100644
--- a/drivers/media/dvb/dvb-usb/af9015.c
+++ b/drivers/media/dvb/dvb-usb/af9015.c
@@ -81,7 +81,6 @@ static int af9015_rw_udev(struct usb_device *udev, struct req_t *req)
        switch (req->cmd) {
        case GET_CONFIG:
-        case BOOT:
        case READ_MEMORY:
        case RECONNECT_USB:
        case GET_IR_CODE:
@@ -100,6 +99,7 @@ static int af9015_rw_udev(struct usb_device *udev, struct req_t *req)
        case WRITE_VIRTUAL_MEMORY:
        case COPY_FIRMWARE:
        case DOWNLOAD_FIRMWARE:
+        case BOOT:
                break;
        default:
                err("unknown command:%d", req->cmd);
diff --git a/drivers/media/dvb/frontends/cx22700.c b/drivers/media/dvb/frontends/cx22700.c
index ace5cb17165d..fbd838eca268 100644
--- a/drivers/media/dvb/frontends/cx22700.c
+++ b/drivers/media/dvb/frontends/cx22700.c
@@ -380,7 +380,7 @@ struct dvb_frontend* cx22700_attach(const struct cx22700_config* config,
        struct cx22700_state* state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct cx22700_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct cx22700_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* setup the state */
diff --git a/drivers/media/dvb/frontends/cx22702.c b/drivers/media/dvb/frontends/cx22702.c
index 5d1abe34bddb..00b5c7e91d5d 100644
--- a/drivers/media/dvb/frontends/cx22702.c
+++ b/drivers/media/dvb/frontends/cx22702.c
@@ -580,7 +580,7 @@ struct dvb_frontend *cx22702_attach(const struct cx22702_config *config,
        struct cx22702_state *state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct cx22702_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct cx22702_state), GFP_KERNEL);
        if (state == NULL)
                goto error;
diff --git a/drivers/media/dvb/frontends/cx24110.c b/drivers/media/dvb/frontends/cx24110.c
index 87ae29db024f..ffbcfabd83f0 100644
--- a/drivers/media/dvb/frontends/cx24110.c
+++ b/drivers/media/dvb/frontends/cx24110.c
@@ -598,7 +598,7 @@ struct dvb_frontend* cx24110_attach(const struct cx24110_config* config,
        int ret;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct cx24110_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct cx24110_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* setup the state */
diff --git a/drivers/media/dvb/frontends/dvb_dummy_fe.c b/drivers/media/dvb/frontends/dvb_dummy_fe.c
index db8a937cc630..a7fc7e53a551 100644
--- a/drivers/media/dvb/frontends/dvb_dummy_fe.c
+++ b/drivers/media/dvb/frontends/dvb_dummy_fe.c
@@ -117,7 +117,7 @@ struct dvb_frontend* dvb_dummy_fe_ofdm_attach(void)
        struct dvb_dummy_fe_state* state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct dvb_dummy_fe_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct dvb_dummy_fe_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* create dvb_frontend */
@@ -137,7 +137,7 @@ struct dvb_frontend *dvb_dummy_fe_qpsk_attach(void)
        struct dvb_dummy_fe_state* state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct dvb_dummy_fe_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct dvb_dummy_fe_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* create dvb_frontend */
@@ -157,7 +157,7 @@ struct dvb_frontend *dvb_dummy_fe_qam_attach(void)
        struct dvb_dummy_fe_state* state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct dvb_dummy_fe_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct dvb_dummy_fe_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* create dvb_frontend */
diff --git a/drivers/media/dvb/frontends/l64781.c b/drivers/media/dvb/frontends/l64781.c
index e1e70e9e0cb9..3051b64aa17c 100644
--- a/drivers/media/dvb/frontends/l64781.c
+++ b/drivers/media/dvb/frontends/l64781.c
@@ -501,7 +501,7 @@ struct dvb_frontend* l64781_attach(const struct l64781_config* config,
                           { .addr = config->demod_address, .flags = I2C_M_RD, .buf = b1, .len = 1 } };
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct l64781_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct l64781_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* setup the state */
diff --git a/drivers/media/dvb/frontends/lgs8gl5.c b/drivers/media/dvb/frontends/lgs8gl5.c
index 855852fddf22..bb37ed289a05 100644
--- a/drivers/media/dvb/frontends/lgs8gl5.c
+++ b/drivers/media/dvb/frontends/lgs8gl5.c
@@ -387,7 +387,7 @@ lgs8gl5_attach(const struct lgs8gl5_config *config, struct i2c_adapter *i2c)
        dprintk("%s\n", __func__);
        /* Allocate memory for the internal state */
-        state = kmalloc(sizeof(struct lgs8gl5_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct lgs8gl5_state), GFP_KERNEL);
        if (state == NULL)
                goto error;
diff --git a/drivers/media/dvb/frontends/mt312.c b/drivers/media/dvb/frontends/mt312.c
index a621f727935f..f69daaac78c9 100644
--- a/drivers/media/dvb/frontends/mt312.c
+++ b/drivers/media/dvb/frontends/mt312.c
@@ -782,7 +782,7 @@ struct dvb_frontend *mt312_attach(const struct mt312_config *config,
        struct mt312_state *state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct mt312_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct mt312_state), GFP_KERNEL);
        if (state == NULL)
                goto error;
diff --git a/drivers/media/dvb/frontends/nxt6000.c b/drivers/media/dvb/frontends/nxt6000.c
index 0eef22dbf8a0..a763ec756f7f 100644
--- a/drivers/media/dvb/frontends/nxt6000.c
+++ b/drivers/media/dvb/frontends/nxt6000.c
@@ -545,7 +545,7 @@ struct dvb_frontend* nxt6000_attach(const struct nxt6000_config* config,
        struct nxt6000_state* state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct nxt6000_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct nxt6000_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* setup the state */
diff --git a/drivers/media/dvb/frontends/or51132.c b/drivers/media/dvb/frontends/or51132.c
index 8133ea3cddd7..38e67accb8c3 100644
--- a/drivers/media/dvb/frontends/or51132.c
+++ b/drivers/media/dvb/frontends/or51132.c
@@ -562,7 +562,7 @@ struct dvb_frontend* or51132_attach(const struct or51132_config* config,
        struct or51132_state* state = NULL;
        /* Allocate memory for the internal state */
-        state = kmalloc(sizeof(struct or51132_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct or51132_state), GFP_KERNEL);
        if (state == NULL)
                return NULL;
diff --git a/drivers/media/dvb/frontends/or51211.c b/drivers/media/dvb/frontends/or51211.c
index 16cf2fdd5d7d..c709ce6771c8 100644
--- a/drivers/media/dvb/frontends/or51211.c
+++ b/drivers/media/dvb/frontends/or51211.c
@@ -527,7 +527,7 @@ struct dvb_frontend* or51211_attach(const struct or51211_config* config,
        struct or51211_state* state = NULL;
        /* Allocate memory for the internal state */
-        state = kmalloc(sizeof(struct or51211_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct or51211_state), GFP_KERNEL);
        if (state == NULL)
                return NULL;
diff --git a/drivers/media/dvb/frontends/s5h1409.c b/drivers/media/dvb/frontends/s5h1409.c
index 3e08d985d6e5..fb3011518427 100644
--- a/drivers/media/dvb/frontends/s5h1409.c
+++ b/drivers/media/dvb/frontends/s5h1409.c
@@ -796,7 +796,7 @@ struct dvb_frontend *s5h1409_attach(const struct s5h1409_config *config,
        u16 reg;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct s5h1409_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct s5h1409_state), GFP_KERNEL);
        if (state == NULL)
                goto error;
diff --git a/drivers/media/dvb/frontends/s5h1411.c b/drivers/media/dvb/frontends/s5h1411.c
index 66e2dd6d6fe4..d8adf1e32019 100644
--- a/drivers/media/dvb/frontends/s5h1411.c
+++ b/drivers/media/dvb/frontends/s5h1411.c
@@ -844,7 +844,7 @@ struct dvb_frontend *s5h1411_attach(const struct s5h1411_config *config,
        u16 reg;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct s5h1411_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct s5h1411_state), GFP_KERNEL);
        if (state == NULL)
                goto error;
diff --git a/drivers/media/dvb/frontends/si21xx.c b/drivers/media/dvb/frontends/si21xx.c
index 0bd16af8a6cd..9552a22ccffb 100644
--- a/drivers/media/dvb/frontends/si21xx.c
+++ b/drivers/media/dvb/frontends/si21xx.c
@@ -928,7 +928,7 @@ struct dvb_frontend *si21xx_attach(const struct si21xx_config *config,
        dprintk("%s\n", __func__);
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct si21xx_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct si21xx_state), GFP_KERNEL);
        if (state == NULL)
                goto error;
diff --git a/drivers/media/dvb/frontends/sp8870.c b/drivers/media/dvb/frontends/sp8870.c
index 1c9a9b4051b9..b85eb60a893e 100644
--- a/drivers/media/dvb/frontends/sp8870.c
+++ b/drivers/media/dvb/frontends/sp8870.c
@@ -557,7 +557,7 @@ struct dvb_frontend* sp8870_attach(const struct sp8870_config* config,
        struct sp8870_state* state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct sp8870_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct sp8870_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* setup the state */
diff --git a/drivers/media/dvb/frontends/sp887x.c b/drivers/media/dvb/frontends/sp887x.c
index 559509ab4dab..4a7c3d842608 100644
--- a/drivers/media/dvb/frontends/sp887x.c
+++ b/drivers/media/dvb/frontends/sp887x.c
@@ -557,7 +557,7 @@ struct dvb_frontend* sp887x_attach(const struct sp887x_config* config,
        struct sp887x_state* state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct sp887x_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct sp887x_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* setup the state */
diff --git a/drivers/media/dvb/frontends/stv0288.c b/drivers/media/dvb/frontends/stv0288.c
index ff1194de34c0..2930a5d6768a 100644
--- a/drivers/media/dvb/frontends/stv0288.c
+++ b/drivers/media/dvb/frontends/stv0288.c
@@ -570,7 +570,7 @@ struct dvb_frontend *stv0288_attach(const struct stv0288_config *config,
        int id;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct stv0288_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct stv0288_state), GFP_KERNEL);
        if (state == NULL)
                goto error;
diff --git a/drivers/media/dvb/frontends/stv0297.c b/drivers/media/dvb/frontends/stv0297.c
index 62caf802ed99..4fd7479bb62b 100644
--- a/drivers/media/dvb/frontends/stv0297.c
+++ b/drivers/media/dvb/frontends/stv0297.c
@@ -663,7 +663,7 @@ struct dvb_frontend *stv0297_attach(const struct stv0297_config *config,
        struct stv0297_state *state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct stv0297_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct stv0297_state), GFP_KERNEL);
        if (state == NULL)
                goto error;
diff --git a/drivers/media/dvb/frontends/stv0299.c b/drivers/media/dvb/frontends/stv0299.c
index 6c1cb1973c6e..968874469726 100644
--- a/drivers/media/dvb/frontends/stv0299.c
+++ b/drivers/media/dvb/frontends/stv0299.c
@@ -667,7 +667,7 @@ struct dvb_frontend* stv0299_attach(const struct stv0299_config* config,
        int id;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct stv0299_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct stv0299_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* setup the state */
diff --git a/drivers/media/dvb/frontends/tda10021.c b/drivers/media/dvb/frontends/tda10021.c
index f648fdb64bb7..f5d7b3277a2f 100644
--- a/drivers/media/dvb/frontends/tda10021.c
+++ b/drivers/media/dvb/frontends/tda10021.c
@@ -413,7 +413,7 @@ struct dvb_frontend* tda10021_attach(const struct tda1002x_config* config,
        u8 id;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct tda10021_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct tda10021_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* setup the state */
diff --git a/drivers/media/dvb/frontends/tda10048.c b/drivers/media/dvb/frontends/tda10048.c
index cc8862ce4aae..4e2a7c8b2f62 100644
--- a/drivers/media/dvb/frontends/tda10048.c
+++ b/drivers/media/dvb/frontends/tda10048.c
@@ -1095,7 +1095,7 @@ struct dvb_frontend *tda10048_attach(const struct tda10048_config *config,
        dprintk(1, "%s()\n", __func__);
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct tda10048_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct tda10048_state), GFP_KERNEL);
        if (state == NULL)
                goto error;
diff --git a/drivers/media/dvb/frontends/tda1004x.c b/drivers/media/dvb/frontends/tda1004x.c
index 4981cef8b444..f2a8abe0a243 100644
--- a/drivers/media/dvb/frontends/tda1004x.c
+++ b/drivers/media/dvb/frontends/tda1004x.c
@@ -1269,7 +1269,7 @@ struct dvb_frontend* tda10045_attach(const struct tda1004x_config* config,
        int id;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct tda1004x_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct tda1004x_state), GFP_KERNEL);
        if (!state) {
                printk(KERN_ERR "Can't alocate memory for tda10045 state\n");
                return NULL;
@@ -1339,7 +1339,7 @@ struct dvb_frontend* tda10046_attach(const struct tda1004x_config* config,
        int id;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct tda1004x_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct tda1004x_state), GFP_KERNEL);
        if (!state) {
                printk(KERN_ERR "Can't alocate memory for tda10046 state\n");
                return NULL;
diff --git a/drivers/media/dvb/frontends/tda10086.c b/drivers/media/dvb/frontends/tda10086.c
index a17ce3c4ad86..f2c8faac6f36 100644
--- a/drivers/media/dvb/frontends/tda10086.c
+++ b/drivers/media/dvb/frontends/tda10086.c
@@ -745,7 +745,7 @@ struct dvb_frontend* tda10086_attach(const struct tda10086_config* config,
        dprintk ("%s\n", __func__);
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct tda10086_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct tda10086_state), GFP_KERNEL);
        if (!state)
                return NULL;
diff --git a/drivers/media/dvb/frontends/tda8083.c b/drivers/media/dvb/frontends/tda8083.c
index 5b843b2e67e8..9369f7442f27 100644
--- a/drivers/media/dvb/frontends/tda8083.c
+++ b/drivers/media/dvb/frontends/tda8083.c
@@ -417,7 +417,7 @@ struct dvb_frontend* tda8083_attach(const struct tda8083_config* config,
        struct tda8083_state* state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct tda8083_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct tda8083_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* setup the state */
diff --git a/drivers/media/dvb/frontends/ves1820.c b/drivers/media/dvb/frontends/ves1820.c
index a184597f1d9b..6e78e4865515 100644
--- a/drivers/media/dvb/frontends/ves1820.c
+++ b/drivers/media/dvb/frontends/ves1820.c
@@ -374,7 +374,7 @@ struct dvb_frontend* ves1820_attach(const struct ves1820_config* config,
        struct ves1820_state* state = NULL;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct ves1820_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct ves1820_state), GFP_KERNEL);
        if (state == NULL)
                goto error;
diff --git a/drivers/media/dvb/frontends/ves1x93.c b/drivers/media/dvb/frontends/ves1x93.c
index bd558960bd87..8d7854c2fb0c 100644
--- a/drivers/media/dvb/frontends/ves1x93.c
+++ b/drivers/media/dvb/frontends/ves1x93.c
@@ -456,7 +456,7 @@ struct dvb_frontend* ves1x93_attach(const struct ves1x93_config* config,
        u8 identity;
        /* allocate memory for the internal state */
-        state = kmalloc(sizeof(struct ves1x93_state), GFP_KERNEL);
+        state = kzalloc(sizeof(struct ves1x93_state), GFP_KERNEL);
        if (state == NULL) goto error;
        /* setup the state */
diff --git a/drivers/media/dvb/frontends/zl10353.c b/drivers/media/dvb/frontends/zl10353.c
index 148b6f7f6cb2..66f5c1fb3074 100644
--- a/drivers/media/dvb/frontends/zl10353.c
+++ b/drivers/media/dvb/frontends/zl10353.c
@@ -98,7 +98,6 @@ static int zl10353_read_register(struct zl10353_state *state, u8 reg)
 static void zl10353_dump_regs(struct dvb_frontend *fe)
 {
        struct zl10353_state *state = fe->demodulator_priv;
-        char buf[52], buf2[4];
        int ret;
        u8 reg;
@@ -106,19 +105,18 @@ static void zl10353_dump_regs(struct dvb_frontend *fe)
        for (reg = 0; ; reg++) {
                if (reg % 16 == 0) {
                        if (reg)
-                                printk(KERN_DEBUG "%s\n", buf);
+                                printk(KERN_CONT "\n");
-                        sprintf(buf, "%02x: ", reg);
+                        printk(KERN_DEBUG "%02x:", reg);
                }
                ret = zl10353_read_register(state, reg);
                if (ret >= 0)
-                        sprintf(buf2, "%02x ", (u8)ret);
+                        printk(KERN_CONT " %02x", (u8)ret);
                else
-                        strcpy(buf2, "-- ");
+                        printk(KERN_CONT " --");
-                strcat(buf, buf2);
                if (reg == 0xff)
                        break;
        }
-        printk(KERN_DEBUG "%s\n", buf);
+        printk(KERN_CONT "\n");
 }
 static void zl10353_calc_nominal_rate(struct dvb_frontend *fe,
diff --git a/drivers/media/dvb/siano/Kconfig b/drivers/media/dvb/siano/Kconfig
index dd863f261672..8c1aed77ea30 100644
--- a/drivers/media/dvb/siano/Kconfig
+++ b/drivers/media/dvb/siano/Kconfig
@@ -2,25 +2,33 @@
 # Siano Mobile Silicon Digital TV device configuration
 #
-config DVB_SIANO_SMS1XXX
+config SMS_SIANO_MDTV
-        tristate "Siano SMS1XXX USB dongle support"
+        tristate "Siano SMS1xxx based MDTV receiver"
-        depends on DVB_CORE && USB
+        depends on DVB_CORE && INPUT
        ---help---
-          Choose Y here if you have a USB dongle with a SMS1XXX chipset.
+          Choose Y or M here if you have MDTV receiver with a Siano chipset.
-          To compile this driver as a module, choose M here: the
+          To compile this driver as a module, choose M here
-          module will be called sms1xxx.
+          (The module will be called smsmdtv).
-config DVB_SIANO_SMS1XXX_SMS_IDS
+          Further documentation on this driver can be found on the WWW
-        bool "Enable support for Siano Mobile Silicon default USB IDs"
+          at http://www.siano-ms.com/
-        depends on DVB_SIANO_SMS1XXX
-        default y
+if SMS_SIANO_MDTV
-        ---help---
+menu "Siano module components"
-          Choose Y here if you have a USB dongle with a SMS1XXX chipset
-          that uses Siano Mobile Silicon's default usb vid:pid.
-          Choose N here if you would prefer to use Siano's external driver.
+# Hardware interfaces support
-          Further documentation on this driver can be found on the WWW at
+config SMS_USB_DRV
-          <http://www.siano-ms.com/>.
+        tristate "USB interface support"
+        depends on DVB_CORE && USB
+        ---help---
+          Choose if you would like to have Siano's support for USB interface
+config SMS_SDIO_DRV
+        tristate "SDIO interface support"
+        depends on DVB_CORE && MMC
+        ---help---
+          Choose if you would like to have Siano's support for SDIO interface
+endmenu
+endif # SMS_SIANO_MDTV
diff --git a/drivers/media/dvb/siano/Makefile b/drivers/media/dvb/siano/Makefile
index c6644d909433..c54140b5ab5a 100644
--- a/drivers/media/dvb/siano/Makefile
+++ b/drivers/media/dvb/siano/Makefile
@@ -1,8 +1,9 @@
-sms1xxx-objs := smscoreapi.o sms-cards.o smsendian.o smsir.o
-obj-$(CONFIG_DVB_SIANO_SMS1XXX) += sms1xxx.o
+smsmdtv-objs := smscoreapi.o sms-cards.o smsendian.o smsir.o
-obj-$(CONFIG_DVB_SIANO_SMS1XXX) += smsusb.o
-obj-$(CONFIG_DVB_SIANO_SMS1XXX) += smsdvb.o
+obj-$(CONFIG_SMS_SIANO_MDTV) += smsmdtv.o smsdvb.o
+obj-$(CONFIG_SMS_USB_DRV) += smsusb.o
+obj-$(CONFIG_SMS_SDIO_DRV) += smssdio.o
 EXTRA_CFLAGS += -Idrivers/media/dvb/dvb-core
diff --git a/drivers/media/dvb/siano/sms-cards.c b/drivers/media/dvb/siano/sms-cards.c
index d8b15d583bde..0420e2885e75 100644
--- a/drivers/media/dvb/siano/sms-cards.c
+++ b/drivers/media/dvb/siano/sms-cards.c
@@ -116,99 +116,21 @@ static inline void sms_gpio_assign_11xx_default_led_config(
 int sms_board_event(struct smscore_device_t *coredev,
                enum SMS_BOARD_EVENTS gevent) {
-        int board_id = smscore_get_board_id(coredev);
-        struct sms_board *board = sms_get_board(board_id);
        struct smscore_gpio_config MyGpioConfig;
        sms_gpio_assign_11xx_default_led_config(&MyGpioConfig);
        switch (gevent) {
        case BOARD_EVENT_POWER_INIT: /* including hotplug */
-                switch (board_id) {
-                case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
-                        /* set I/O and turn off all LEDs */
-                        smscore_gpio_configure(coredev,
-                                        board->board_cfg.leds_power,
-                                        &MyGpioConfig);
-                        smscore_gpio_set_level(coredev,
-                                        board->board_cfg.leds_power, 0);
-                        smscore_gpio_configure(coredev, board->board_cfg.led0,
-                                        &MyGpioConfig);
-                        smscore_gpio_set_level(coredev,
-                                        board->board_cfg.led0, 0);
-                        smscore_gpio_configure(coredev, board->board_cfg.led1,
-                                        &MyGpioConfig);
-                        smscore_gpio_set_level(coredev,
-                                        board->board_cfg.led1, 0);
-                        break;
-                case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD_R2:
-                case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD:
-                        /* set I/O and turn off LNA */
-                        smscore_gpio_configure(coredev,
-                                        board->board_cfg.foreign_lna0_ctrl,
-                                        &MyGpioConfig);
-                        smscore_gpio_set_level(coredev,
-                                        board->board_cfg.foreign_lna0_ctrl,
-                                        0);
-                        break;
-                }
                break; /* BOARD_EVENT_BIND */
        case BOARD_EVENT_POWER_SUSPEND:
-                switch (board_id) {
-                case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.leds_power, 0);
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.led0, 0);
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.led1, 0);
-                        break;
-                case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD_R2:
-                case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD:
-                        smscore_gpio_set_level(coredev,
-                                        board->board_cfg.foreign_lna0_ctrl,
-                                        0);
-                        break;
-                }
                break; /* BOARD_EVENT_POWER_SUSPEND */
        case BOARD_EVENT_POWER_RESUME:
-                switch (board_id) {
-                case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.leds_power, 1);
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.led0, 1);
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.led1, 0);
-                        break;
-                case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD_R2:
-                case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD:
-                        smscore_gpio_set_level(coredev,
-                                        board->board_cfg.foreign_lna0_ctrl,
-                                        1);
-                        break;
-                }
                break; /* BOARD_EVENT_POWER_RESUME */
        case BOARD_EVENT_BIND:
-                switch (board_id) {
-                case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
-                        smscore_gpio_set_level(coredev,
-                                board->board_cfg.leds_power, 1);
-                        smscore_gpio_set_level(coredev,
-                                board->board_cfg.led0, 1);
-                        smscore_gpio_set_level(coredev,
-                                board->board_cfg.led1, 0);
-                        break;
-                case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD_R2:
-                case SMS1XXX_BOARD_HAUPPAUGE_TIGER_MINICARD:
-                        smscore_gpio_set_level(coredev,
-                                        board->board_cfg.foreign_lna0_ctrl,
-                                        1);
-                        break;
-                }
                break; /* BOARD_EVENT_BIND */
        case BOARD_EVENT_SCAN_PROG:
@@ -218,20 +140,8 @@ int sms_board_event(struct smscore_device_t *coredev,
        case BOARD_EVENT_EMERGENCY_WARNING_SIGNAL:
                break; /* BOARD_EVENT_EMERGENCY_WARNING_SIGNAL */
        case BOARD_EVENT_FE_LOCK:
-                switch (board_id) {
-                case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
-                        smscore_gpio_set_level(coredev,
-                        board->board_cfg.led1, 1);
-                        break;
-                }
                break; /* BOARD_EVENT_FE_LOCK */
        case BOARD_EVENT_FE_UNLOCK:
-                switch (board_id) {
-                case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.led1, 0);
-                        break;
-                }
                break; /* BOARD_EVENT_FE_UNLOCK */
        case BOARD_EVENT_DEMOD_LOCK:
                break; /* BOARD_EVENT_DEMOD_LOCK */
@@ -248,20 +158,8 @@ int sms_board_event(struct smscore_device_t *coredev,
        case BOARD_EVENT_RECEPTION_LOST_0:
                break; /* BOARD_EVENT_RECEPTION_LOST_0 */
        case BOARD_EVENT_MULTIPLEX_OK:
-                switch (board_id) {
-                case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.led1, 1);
-                        break;
-                }
                break; /* BOARD_EVENT_MULTIPLEX_OK */
        case BOARD_EVENT_MULTIPLEX_ERRORS:
-                switch (board_id) {
-                case SMS1XXX_BOARD_HAUPPAUGE_WINDHAM:
-                        smscore_gpio_set_level(coredev,
-                                                board->board_cfg.led1, 0);
-                        break;
-                }
                break; /* BOARD_EVENT_MULTIPLEX_ERRORS */
        default:
diff --git a/drivers/media/dvb/siano/smscoreapi.c b/drivers/media/dvb/siano/smscoreapi.c
index a246903c3341..bd9ab9d0d12a 100644
--- a/drivers/media/dvb/siano/smscoreapi.c
+++ b/drivers/media/dvb/siano/smscoreapi.c
@@ -816,7 +816,7 @@ int smscore_set_device_mode(struct smscore_device_t *coredev, int mode)
        sms_debug("set device mode to %d", mode);
        if (coredev->device_flags & SMS_DEVICE_FAMILY2) {
-                if (mode < DEVICE_MODE_DVBT || mode > DEVICE_MODE_RAW_TUNER) {
+                if (mode < DEVICE_MODE_DVBT || mode >= DEVICE_MODE_RAW_TUNER) {
                        sms_err("invalid mode specified %d", mode);
                        return -EINVAL;
                }
diff --git a/drivers/media/dvb/siano/smsdvb.c b/drivers/media/dvb/siano/smsdvb.c
index 3ee1c3902c56..266033ae2784 100644
--- a/drivers/media/dvb/siano/smsdvb.c
+++ b/drivers/media/dvb/siano/smsdvb.c
@@ -325,6 +325,16 @@ static int smsdvb_sendrequest_and_wait(struct smsdvb_client_t *client,
                                                0 : -ETIME;
 }
+static inline int led_feedback(struct smsdvb_client_t *client)
+{
+        if (client->fe_status & FE_HAS_LOCK)
+                return sms_board_led_feedback(client->coredev,
+                        (client->sms_stat_dvb.ReceptionData.BER
+                        == 0) ? SMS_LED_HI : SMS_LED_LO);
+        else
+                return sms_board_led_feedback(client->coredev, SMS_LED_OFF);
+}
 static int smsdvb_read_status(struct dvb_frontend *fe, fe_status_t *stat)
 {
        struct smsdvb_client_t *client;
@@ -332,6 +342,8 @@ static int smsdvb_read_status(struct dvb_frontend *fe, fe_status_t *stat)
        *stat = client->fe_status;
+        led_feedback(client);
        return 0;
 }
@@ -342,6 +354,8 @@ static int smsdvb_read_ber(struct dvb_frontend *fe, u32 *ber)
        *ber = client->sms_stat_dvb.ReceptionData.BER;
+        led_feedback(client);
        return 0;
 }
@@ -359,6 +373,8 @@ static int smsdvb_read_signal_strength(struct dvb_frontend *fe, u16 *strength)
                                (client->sms_stat_dvb.ReceptionData.InBandPwr
                                + 95) * 3 / 2;
+        led_feedback(client);
        return 0;
 }
@@ -369,6 +385,8 @@ static int smsdvb_read_snr(struct dvb_frontend *fe, u16 *snr)
        *snr = client->sms_stat_dvb.ReceptionData.SNR;
+        led_feedback(client);
        return 0;
 }
@@ -379,6 +397,8 @@ static int smsdvb_read_ucblocks(struct dvb_frontend *fe, u32 *ucblocks)
        *ucblocks = client->sms_stat_dvb.ReceptionData.ErrorTSPackets;
+        led_feedback(client);
        return 0;
 }
@@ -404,6 +424,8 @@ static int smsdvb_set_frontend(struct dvb_frontend *fe,
                u32             Data[3];
        } Msg;
+        int ret;
        client->fe_status = FE_HAS_SIGNAL;
        client->event_fe_state = -1;
        client->event_unc_state = -1;
@@ -426,6 +448,23 @@ static int smsdvb_set_frontend(struct dvb_frontend *fe,
        case BANDWIDTH_AUTO: return -EOPNOTSUPP;
        default: return -EINVAL;
        }
+        /* Disable LNA, if any. An error is returned if no LNA is present */
+        ret = sms_board_lna_control(client->coredev, 0);
+        if (ret == 0) {
+                fe_status_t status;
+                /* tune with LNA off at first */
+                ret = smsdvb_sendrequest_and_wait(client, &Msg, sizeof(Msg),
+                                                  &client->tune_done);
+                smsdvb_read_status(fe, &status);
+                if (status & FE_HAS_LOCK)
+                        return ret;
+                /* previous tune didnt lock - enable LNA and tune again */
+                sms_board_lna_control(client->coredev, 1);
+        }
        return smsdvb_sendrequest_and_wait(client, &Msg, sizeof(Msg),
                                           &client->tune_done);
@@ -451,6 +490,8 @@ static int smsdvb_init(struct dvb_frontend *fe)
        struct smsdvb_client_t *client =
                container_of(fe, struct smsdvb_client_t, frontend);
+        sms_board_power(client->coredev, 1);
        sms_board_dvb3_event(client, DVB3_EVENT_INIT);
        return 0;
 }
@@ -460,6 +501,9 @@ static int smsdvb_sleep(struct dvb_frontend *fe)
        struct smsdvb_client_t *client =
                container_of(fe, struct smsdvb_client_t, frontend);
+        sms_board_led_feedback(client->coredev, SMS_LED_OFF);
+        sms_board_power(client->coredev, 0);
        sms_board_dvb3_event(client, DVB3_EVENT_SLEEP);
        return 0;
diff --git a/drivers/media/dvb/siano/smssdio.c b/drivers/media/dvb/siano/smssdio.c
index dfaa49a53f32..d1d652e7f890 100644
--- a/drivers/media/dvb/siano/smssdio.c
+++ b/drivers/media/dvb/siano/smssdio.c
@@ -46,6 +46,7 @@
 #define SMSSDIO_DATA            0x00
 #define SMSSDIO_INT             0x04
+#define SMSSDIO_BLOCK_SIZE      128
 static const struct sdio_device_id smssdio_ids[] = {
        {SDIO_DEVICE(SDIO_VENDOR_ID_SIANO, SDIO_DEVICE_ID_SIANO_STELLAR),
@@ -85,7 +86,8 @@ static int smssdio_sendrequest(void *context, void *buffer, size_t size)
        sdio_claim_host(smsdev->func);
        while (size >= smsdev->func->cur_blksize) {
-                ret = sdio_write_blocks(smsdev->func, SMSSDIO_DATA, buffer, 1);
+                ret = sdio_memcpy_toio(smsdev->func, SMSSDIO_DATA,
+                                        buffer, smsdev->func->cur_blksize);
                if (ret)
                        goto out;
@@ -94,8 +96,8 @@ static int smssdio_sendrequest(void *context, void *buffer, size_t size)
        }
        if (size) {
-                ret = sdio_write_bytes(smsdev->func, SMSSDIO_DATA,
+                ret = sdio_memcpy_toio(smsdev->func, SMSSDIO_DATA,
-                                       buffer, size);
+                                        buffer, size);
        }
 out:
@@ -125,23 +127,23 @@ static void smssdio_interrupt(struct sdio_func *func)
         */
        isr = sdio_readb(func, SMSSDIO_INT, &ret);
        if (ret) {
-                dev_err(&smsdev->func->dev,
+                sms_err("Unable to read interrupt register!\n");
-                        "Unable to read interrupt register!\n");
                return;
        }
        if (smsdev->split_cb == NULL) {
                cb = smscore_getbuffer(smsdev->coredev);
                if (!cb) {
-                        dev_err(&smsdev->func->dev,
+                        sms_err("Unable to allocate data buffer!\n");
-                                "Unable to allocate data buffer!\n");
                        return;
                }
-                ret = sdio_read_blocks(smsdev->func, cb->p, SMSSDIO_DATA, 1);
+                ret = sdio_memcpy_fromio(smsdev->func,
+                                         cb->p,
+                                         SMSSDIO_DATA,
+                                         SMSSDIO_BLOCK_SIZE);
                if (ret) {
-                        dev_err(&smsdev->func->dev,
+                        sms_err("Error %d reading initial block!\n", ret);
-                                "Error %d reading initial block!\n", ret);
                        return;
                }
@@ -152,7 +154,10 @@ static void smssdio_interrupt(struct sdio_func *func)
                        return;
                }
-                size = hdr->msgLength - smsdev->func->cur_blksize;
+                if (hdr->msgLength > smsdev->func->cur_blksize)
+                        size = hdr->msgLength - smsdev->func->cur_blksize;
+                else
+                        size = 0;
        } else {
                cb = smsdev->split_cb;
                hdr = cb->p;
@@ -162,23 +167,24 @@ static void smssdio_interrupt(struct sdio_func *func)
                smsdev->split_cb = NULL;
        }
-        if (hdr->msgLength > smsdev->func->cur_blksize) {
+        if (size) {
                void *buffer;
-                size = ALIGN(size, 128);
+                buffer = cb->p + (hdr->msgLength - size);
-                buffer = cb->p + hdr->msgLength;
+                size = ALIGN(size, SMSSDIO_BLOCK_SIZE);
-                BUG_ON(smsdev->func->cur_blksize != 128);
+                BUG_ON(smsdev->func->cur_blksize != SMSSDIO_BLOCK_SIZE);
                /*
                 * First attempt to transfer all of it in one go...
                 */
-                ret = sdio_read_blocks(smsdev->func, buffer,
+                ret = sdio_memcpy_fromio(smsdev->func,
-                                       SMSSDIO_DATA, size / 128);
+                                         buffer,
+                                         SMSSDIO_DATA,
+                                         size);
                if (ret && ret != -EINVAL) {
                        smscore_putbuffer(smsdev->coredev, cb);
-                        dev_err(&smsdev->func->dev,
+                        sms_err("Error %d reading data from card!\n", ret);
-                                "Error %d reading data from card!\n", ret);
                        return;
                }
@@ -191,12 +197,12 @@ static void smssdio_interrupt(struct sdio_func *func)
                 */
                if (ret == -EINVAL) {
                        while (size) {
-                                ret = sdio_read_blocks(smsdev->func,
+                                ret = sdio_memcpy_fromio(smsdev->func,
-                                                       buffer, SMSSDIO_DATA, 1);
+                                                  buffer, SMSSDIO_DATA,
+                                                  smsdev->func->cur_blksize);
                                if (ret) {
                                        smscore_putbuffer(smsdev->coredev, cb);
-                                        dev_err(&smsdev->func->dev,
+                                        sms_err("Error %d reading "
-                                                "Error %d reading "
                                                "data from card!\n", ret);
                                        return;
                                }
@@ -269,7 +275,7 @@ static int smssdio_probe(struct sdio_func *func,
        if (ret)
                goto release;
-        ret = sdio_set_block_size(func, 128);
+        ret = sdio_set_block_size(func, SMSSDIO_BLOCK_SIZE);
        if (ret)
                goto disable;
diff --git a/drivers/media/video/Kconfig b/drivers/media/video/Kconfig
index 84b6fc15519d..dcf9fa9264bb 100644
--- a/drivers/media/video/Kconfig
+++ b/drivers/media/video/Kconfig
@@ -920,6 +920,8 @@ source "drivers/media/video/pwc/Kconfig"
 config USB_ZR364XX
        tristate "USB ZR364XX Camera support"
        depends on VIDEO_V4L2
+        select VIDEOBUF_GEN
+        select VIDEOBUF_VMALLOC
        ---help---
          Say Y here if you want to connect this type of camera to your
          computer's USB port.
diff --git a/drivers/media/video/bw-qcam.c b/drivers/media/video/bw-qcam.c
index 10dbd4a11b30..9e39bc5f7b00 100644
--- a/drivers/media/video/bw-qcam.c
+++ b/drivers/media/video/bw-qcam.c
@@ -992,7 +992,7 @@ static int accept_bwqcam(struct parport *port)
        if (parport[0] && strncmp(parport[0], "auto", 4) != 0) {
                /* user gave parport parameters */
-                for(n=0; parport[n] && n<MAX_CAMS; n++){
+                for (n = 0; n < MAX_CAMS && parport[n]; n++) {
                        char *ep;
                        unsigned long r;
                        r = simple_strtoul(parport[n], &ep, 0);
diff --git a/drivers/media/video/cx18/cx18-controls.c b/drivers/media/video/cx18/cx18-controls.c
index 5136df198338..93f0dae01350 100644
--- a/drivers/media/video/cx18/cx18-controls.c
+++ b/drivers/media/video/cx18/cx18-controls.c
@@ -20,6 +20,7 @@
 *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
 *  02111-1307  USA
 */
+#include <linux/kernel.h>
 #include "cx18-driver.h"
 #include "cx18-cards.h"
@@ -317,7 +318,7 @@ int cx18_s_ext_ctrls(struct file *file, void *fh, struct v4l2_ext_controls *c)
                idx = p.audio_properties & 0x03;
                /* The audio clock of the digitizer must match the codec sample
                   rate otherwise you get some very strange effects. */
-                if (idx < sizeof(freqs))
+                if (idx < ARRAY_SIZE(freqs))
                        cx18_call_all(cx, audio, s_clock_freq, freqs[idx]);
                return err;
        }
diff --git a/drivers/media/video/cx23885/cx23885-417.c b/drivers/media/video/cx23885/cx23885-417.c
index e0cf21e0b1bf..1a1048b18f70 100644
--- a/drivers/media/video/cx23885/cx23885-417.c
+++ b/drivers/media/video/cx23885/cx23885-417.c
@@ -1715,6 +1715,8 @@ static struct video_device cx23885_mpeg_template = {
        .fops          = &mpeg_fops,
        .ioctl_ops     = &mpeg_ioctl_ops,
        .minor         = -1,
+        .tvnorms       = CX23885_NORMS,
+        .current_norm  = V4L2_STD_NTSC_M,
 };
 void cx23885_417_unregister(struct cx23885_dev *dev)
diff --git a/drivers/media/video/cx88/cx88-cards.c b/drivers/media/video/cx88/cx88-cards.c
index a5cc1c1fc2d6..39465301ec94 100644
--- a/drivers/media/video/cx88/cx88-cards.c
+++ b/drivers/media/video/cx88/cx88-cards.c
@@ -3003,6 +3003,14 @@ void cx88_setup_xc3028(struct cx88_core *core, struct xc2028_ctrl *ctl)
        case CX88_BOARD_DVICO_FUSIONHDTV_5_PCI_NANO:
                ctl->demod = XC3028_FE_OREN538;
                break;
+        case CX88_BOARD_GENIATECH_X8000_MT:
+                /* FIXME: For this board, the xc3028 never recovers after being
+                   powered down (the reset GPIO probably is not set properly).
+                   We don't have access to the hardware so we cannot determine
+                   which GPIO is used for xc3028, so just disable power xc3028
+                   power management for now */
+                ctl->disable_power_mgmt = 1;
+                break;
        case CX88_BOARD_WINFAST_TV2000_XP_GLOBAL:
        case CX88_BOARD_PROLINK_PV_GLOBAL_XTREME:
        case CX88_BOARD_PROLINK_PV_8000GT:
diff --git a/drivers/media/video/cx88/cx88-dvb.c b/drivers/media/video/cx88/cx88-dvb.c
index c44e87600219..e237b507659b 100644
--- a/drivers/media/video/cx88/cx88-dvb.c
+++ b/drivers/media/video/cx88/cx88-dvb.c
@@ -501,6 +501,7 @@ static struct zl10353_config cx88_pinnacle_hybrid_pctv = {
 static struct zl10353_config cx88_geniatech_x8000_mt = {
       .demod_address = (0x1e >> 1),
       .no_tuner = 1,
+       .disable_i2c_gate_ctrl = 1,
 };
 static struct s5h1411_config dvico_fusionhdtv7_config = {
diff --git a/drivers/media/video/cx88/cx88-mpeg.c b/drivers/media/video/cx88/cx88-mpeg.c
index da4e3912cd37..7172dcf2a4fa 100644
--- a/drivers/media/video/cx88/cx88-mpeg.c
+++ b/drivers/media/video/cx88/cx88-mpeg.c
@@ -116,6 +116,10 @@ static int cx8802_start_dma(struct cx8802_dev    *dev,
                        udelay(100);
                        break;
                case CX88_BOARD_HAUPPAUGE_HVR1300:
+                        /* Enable MPEG parallel IO and video signal pins */
+                        cx_write(MO_PINMUX_IO, 0x88);
+                        cx_write(TS_SOP_STAT, 0);
+                        cx_write(TS_VALERR_CNTRL, 0);
                        break;
                case CX88_BOARD_PINNACLE_PCTV_HD_800i:
                        /* Enable MPEG parallel IO and video signal pins */
diff --git a/drivers/media/video/em28xx/em28xx-cards.c b/drivers/media/video/em28xx/em28xx-cards.c
index 320f1f60276e..1c2e544eda73 100644
--- a/drivers/media/video/em28xx/em28xx-cards.c
+++ b/drivers/media/video/em28xx/em28xx-cards.c
@@ -218,7 +218,7 @@ static struct em28xx_reg_seq silvercrest_reg_seq[] = {
 struct em28xx_board em28xx_boards[] = {
        [EM2750_BOARD_UNKNOWN] = {
                .name          = "EM2710/EM2750/EM2751 webcam grabber",
-                .xclk          = EM28XX_XCLK_FREQUENCY_48MHZ,
+                .xclk          = EM28XX_XCLK_FREQUENCY_20MHZ,
                .tuner_type    = TUNER_ABSENT,
                .is_webcam     = 1,
                .input         = { {
@@ -622,22 +622,27 @@ struct em28xx_board em28xx_boards[] = {
        },
        [EM2861_BOARD_PLEXTOR_PX_TV100U] = {
                .name         = "Plextor ConvertX PX-TV100U",
-                .valid        = EM28XX_BOARD_NOT_VALIDATED,
                .tuner_type   = TUNER_TNF_5335MF,
+                .xclk         = EM28XX_XCLK_I2S_MSB_TIMING |
+                                EM28XX_XCLK_FREQUENCY_12MHZ,
                .tda9887_conf = TDA9887_PRESENT,
                .decoder      = EM28XX_TVP5150,
+                .has_msp34xx  = 1,
                .input        = { {
                        .type     = EM28XX_VMUX_TELEVISION,
                        .vmux     = TVP5150_COMPOSITE0,
                        .amux     = EM28XX_AMUX_LINE_IN,
+                        .gpio     = pinnacle_hybrid_pro_analog,
                }, {
                        .type     = EM28XX_VMUX_COMPOSITE1,
                        .vmux     = TVP5150_COMPOSITE1,
                        .amux     = EM28XX_AMUX_LINE_IN,
+                        .gpio     = pinnacle_hybrid_pro_analog,
                }, {
                        .type     = EM28XX_VMUX_SVIDEO,
                        .vmux     = TVP5150_SVIDEO,
                        .amux     = EM28XX_AMUX_LINE_IN,
+                        .gpio     = pinnacle_hybrid_pro_analog,
                } },
        },
@@ -1544,6 +1549,8 @@ struct usb_device_id em28xx_id_table[] = {
                        .driver_info = EM2750_BOARD_UNKNOWN },
        { USB_DEVICE(0xeb1a, 0x2800),
                        .driver_info = EM2800_BOARD_UNKNOWN },
+        { USB_DEVICE(0xeb1a, 0x2710),
+                        .driver_info = EM2820_BOARD_UNKNOWN },
        { USB_DEVICE(0xeb1a, 0x2820),
                        .driver_info = EM2820_BOARD_UNKNOWN },
        { USB_DEVICE(0xeb1a, 0x2821),
@@ -1723,6 +1730,25 @@ static inline void em28xx_set_model(struct em28xx *dev)
                                       EM28XX_I2C_FREQ_100_KHZ;
 }
+/* FIXME: Should be replaced by a proper mt9m111 driver */
+static int em28xx_initialize_mt9m111(struct em28xx *dev)
+{
+        int i;
+        unsigned char regs[][3] = {
+                { 0x0d, 0x00, 0x01, },  /* reset and use defaults */
+                { 0x0d, 0x00, 0x00, },
+                { 0x0a, 0x00, 0x21, },
+                { 0x21, 0x04, 0x00, },  /* full readout speed, no row/col skipping */
+        };
+        for (i = 0; i < ARRAY_SIZE(regs); i++)
+                i2c_master_send(&dev->i2c_client, &regs[i][0], 3);
+        return 0;
+}
 /* FIXME: Should be replaced by a proper mt9m001 driver */
 static int em28xx_initialize_mt9m001(struct em28xx *dev)
 {
@@ -1751,7 +1777,7 @@ static int em28xx_initialize_mt9m001(struct em28xx *dev)
 /* HINT method: webcam I2C chips
 *
- * This method work for webcams with Micron sensors
+ * This method works for webcams with Micron sensors
 */
 static int em28xx_hint_sensor(struct em28xx *dev)
 {
@@ -1761,6 +1787,7 @@ static int em28xx_hint_sensor(struct em28xx *dev)
        __be16 version_be;
        u16 version;
+        /* Micron sensor detection */
        dev->i2c_client.addr = 0xba >> 1;
        cmd = 0;
        i2c_master_send(&dev->i2c_client, &cmd, 1);
@@ -1769,23 +1796,54 @@ static int em28xx_hint_sensor(struct em28xx *dev)
                return -EINVAL;
        version = be16_to_cpu(version_be);
        switch (version) {
-        case 0x8243:            /* mt9v011 640x480 1.3 Mpix sensor */
+        case 0x8232:            /* mt9v011 640x480 1.3 Mpix sensor */
+        case 0x8243:            /* mt9v011 rev B 640x480 1.3 Mpix sensor */
                dev->model = EM2820_BOARD_SILVERCREST_WEBCAM;
+                em28xx_set_model(dev);
                sensor_name = "mt9v011";
                dev->em28xx_sensor = EM28XX_MT9V011;
                dev->sensor_xres = 640;
                dev->sensor_yres = 480;
-                dev->sensor_xtal = 6300000;
+                /*
+                 * FIXME: mt9v011 uses I2S speed as xtal clk - at least with
+                 * the Silvercrest cam I have here for testing - for higher
+                 * resolutions, a high clock cause horizontal artifacts, so we
+                 * need to use a lower xclk frequency.
+                 * Yet, it would be possible to adjust xclk depending on the
+                 * desired resolution, since this affects directly the
+                 * frame rate.
+                 */
+                dev->board.xclk = EM28XX_XCLK_FREQUENCY_4_3MHZ;
+                dev->sensor_xtal = 4300000;
                /* probably means GRGB 16 bit bayer */
                dev->vinmode = 0x0d;
                dev->vinctl = 0x00;
                break;
+        case 0x143a:    /* MT9M111 as found in the ECS G200 */
+                dev->model = EM2750_BOARD_UNKNOWN;
+                em28xx_set_model(dev);
+                sensor_name = "mt9m111";
+                dev->board.xclk = EM28XX_XCLK_FREQUENCY_48MHZ;
+                dev->em28xx_sensor = EM28XX_MT9M111;
+                em28xx_initialize_mt9m111(dev);
+                dev->sensor_xres = 640;
+                dev->sensor_yres = 512;
+                dev->vinmode = 0x0a;
+                dev->vinctl = 0x00;
+                break;
        case 0x8431:
                dev->model = EM2750_BOARD_UNKNOWN;
+                em28xx_set_model(dev);
                sensor_name = "mt9m001";
                dev->em28xx_sensor = EM28XX_MT9M001;
                em28xx_initialize_mt9m001(dev);
@@ -1798,10 +1856,13 @@ static int em28xx_hint_sensor(struct em28xx *dev)
                break;
        default:
-                printk("Unknown Micron Sensor 0x%04x\n", be16_to_cpu(version));
+                printk("Unknown Micron Sensor 0x%04x\n", version);
                return -EINVAL;
        }
+        /* Setup webcam defaults */
+        em28xx_pre_card_setup(dev);
        em28xx_errdev("Sensor is %s, using model %s entry.\n",
                      sensor_name, em28xx_boards[dev->model].name);
@@ -1813,60 +1874,6 @@ static int em28xx_hint_sensor(struct em28xx *dev)
 */
 void em28xx_pre_card_setup(struct em28xx *dev)
 {
-        int rc;
-        em28xx_set_model(dev);
-        em28xx_info("Identified as %s (card=%d)\n",
-                    dev->board.name, dev->model);
-        /* Set the default GPO/GPIO for legacy devices */
-        dev->reg_gpo_num = EM2880_R04_GPO;
-        dev->reg_gpio_num = EM28XX_R08_GPIO;
-        dev->wait_after_write = 5;
-        /* Based on the Chip ID, set the device configuration */
-        rc = em28xx_read_reg(dev, EM28XX_R0A_CHIPID);
-        if (rc > 0) {
-                dev->chip_id = rc;
-                switch (dev->chip_id) {
-                case CHIP_ID_EM2750:
-                        em28xx_info("chip ID is em2750\n");
-                        break;
-                case CHIP_ID_EM2820:
-                        em28xx_info("chip ID is em2710 or em2820\n");
-                        break;
-                case CHIP_ID_EM2840:
-                        em28xx_info("chip ID is em2840\n");
-                        break;
-                case CHIP_ID_EM2860:
-                        em28xx_info("chip ID is em2860\n");
-                        break;
-                case CHIP_ID_EM2870:
-                        em28xx_info("chip ID is em2870\n");
-                        dev->wait_after_write = 0;
-                        break;
-                case CHIP_ID_EM2874:
-                        em28xx_info("chip ID is em2874\n");
-                        dev->reg_gpio_num = EM2874_R80_GPIO;
-                        dev->wait_after_write = 0;
-                        break;
-                case CHIP_ID_EM2883:
-                        em28xx_info("chip ID is em2882/em2883\n");
-                        dev->wait_after_write = 0;
-                        break;
-                default:
-                        em28xx_info("em28xx chip ID = %d\n", dev->chip_id);
-                }
-        }
-        /* Prepopulate cached GPO register content */
-        rc = em28xx_read_reg(dev, dev->reg_gpo_num);
-        if (rc >= 0)
-                dev->reg_gpo = rc;
        /* Set the initial XCLK and I2C clock values based on the board
           definition */
        em28xx_write_reg(dev, EM28XX_R0F_XCLK, dev->board.xclk & 0x7f);
@@ -1876,9 +1883,8 @@ void em28xx_pre_card_setup(struct em28xx *dev)
        /* request some modules */
        switch (dev->model) {
        case EM2861_BOARD_PLEXTOR_PX_TV100U:
-                /* FIXME guess */
+                /* Sets the msp34xx I2S speed */
-                /* Turn on analog audio output */
+                dev->i2s_speed = 2048000;
-                em28xx_write_reg(dev, EM28XX_R08_GPIO, 0xfd);
                break;
        case EM2861_BOARD_KWORLD_PVRTV_300U:
        case EM2880_BOARD_KWORLD_DVB_305U:
@@ -2216,7 +2222,20 @@ void em28xx_register_i2c_ir(struct em28xx *dev)
 void em28xx_card_setup(struct em28xx *dev)
 {
-        em28xx_set_model(dev);
+        /*
+         * If the device can be a webcam, seek for a sensor.
+         * If sensor is not found, then it isn't a webcam.
+         */
+        if (dev->board.is_webcam) {
+                if (em28xx_hint_sensor(dev) < 0)
+                        dev->board.is_webcam = 0;
+                else
+                        dev->progressive = 1;
+        } else
+                em28xx_set_model(dev);
+        em28xx_info("Identified as %s (card=%d)\n",
+                    dev->board.name, dev->model);
        dev->tuner_type = em28xx_boards[dev->model].tuner_type;
        if (em28xx_boards[dev->model].tuner_addr)
@@ -2290,10 +2309,6 @@ void em28xx_card_setup(struct em28xx *dev)
                em28xx_gpio_set(dev, dev->board.tuner_gpio);
                em28xx_set_mode(dev, EM28XX_ANALOG_MODE);
                break;
-        case EM2820_BOARD_SILVERCREST_WEBCAM:
-                /* FIXME: need to document the registers bellow */
-                em28xx_write_reg(dev, 0x0d, 0x42);
-                em28xx_write_reg(dev, 0x13, 0x08);
        }
        if (dev->board.has_snapshot_button)
@@ -2367,7 +2382,9 @@ void em28xx_card_setup(struct em28xx *dev)
        }
        em28xx_tuner_setup(dev);
-        em28xx_ir_init(dev);
+        if(!disable_ir)
+                em28xx_ir_init(dev);
 }
@@ -2433,7 +2450,7 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
                           int minor)
 {
        struct em28xx *dev = *devhandle;
-        int retval = -ENOMEM;
+        int retval;
        int errCode;
        dev->udev = udev;
@@ -2450,6 +2467,58 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
        dev->em28xx_read_reg_req = em28xx_read_reg_req;
        dev->board.is_em2800 = em28xx_boards[dev->model].is_em2800;
+        em28xx_set_model(dev);
+        /* Set the default GPO/GPIO for legacy devices */
+        dev->reg_gpo_num = EM2880_R04_GPO;
+        dev->reg_gpio_num = EM28XX_R08_GPIO;
+        dev->wait_after_write = 5;
+        /* Based on the Chip ID, set the device configuration */
+        retval = em28xx_read_reg(dev, EM28XX_R0A_CHIPID);
+        if (retval > 0) {
+                dev->chip_id = retval;
+                switch (dev->chip_id) {
+                case CHIP_ID_EM2710:
+                        em28xx_info("chip ID is em2710\n");
+                        break;
+                case CHIP_ID_EM2750:
+                        em28xx_info("chip ID is em2750\n");
+                        break;
+                case CHIP_ID_EM2820:
+                        em28xx_info("chip ID is em2820 (or em2710)\n");
+                        break;
+                case CHIP_ID_EM2840:
+                        em28xx_info("chip ID is em2840\n");
+                        break;
+                case CHIP_ID_EM2860:
+                        em28xx_info("chip ID is em2860\n");
+                        break;
+                case CHIP_ID_EM2870:
+                        em28xx_info("chip ID is em2870\n");
+                        dev->wait_after_write = 0;
+                        break;
+                case CHIP_ID_EM2874:
+                        em28xx_info("chip ID is em2874\n");
+                        dev->reg_gpio_num = EM2874_R80_GPIO;
+                        dev->wait_after_write = 0;
+                        break;
+                case CHIP_ID_EM2883:
+                        em28xx_info("chip ID is em2882/em2883\n");
+                        dev->wait_after_write = 0;
+                        break;
+                default:
+                        em28xx_info("em28xx chip ID = %d\n", dev->chip_id);
+                }
+        }
+        /* Prepopulate cached GPO register content */
+        retval = em28xx_read_reg(dev, dev->reg_gpo_num);
+        if (retval >= 0)
+                dev->reg_gpo = retval;
        em28xx_pre_card_setup(dev);
        if (!dev->board.is_em2800) {
@@ -2484,14 +2553,6 @@ static int em28xx_init_dev(struct em28xx **devhandle, struct usb_device *udev,
        dev->vinmode = 0x10;
        dev->vinctl  = 0x11;
-        /*
-         * If the device can be a webcam, seek for a sensor.
-         * If sensor is not found, then it isn't a webcam.
-         */
-        if (dev->board.is_webcam)
-                if (em28xx_hint_sensor(dev) < 0)
-                        dev->board.is_webcam = 0;
        /* Do board specific init and eeprom reading */
        em28xx_card_setup(dev);
diff --git a/drivers/media/video/em28xx/em28xx-core.c b/drivers/media/video/em28xx/em28xx-core.c
index 5b78e199abd1..98e140b5d95e 100644
--- a/drivers/media/video/em28xx/em28xx-core.c
+++ b/drivers/media/video/em28xx/em28xx-core.c
@@ -632,6 +632,9 @@ int em28xx_capture_start(struct em28xx *dev, int start)
                return rc;
        }
+        if (dev->board.is_webcam)
+                rc = em28xx_write_reg(dev, 0x13, 0x0c);
        /* enable video capture */
        rc = em28xx_write_reg(dev, 0x48, 0x00);
@@ -720,7 +723,10 @@ int em28xx_resolution_set(struct em28xx *dev)
 {
        int width, height;
        width = norm_maxw(dev);
-        height = norm_maxh(dev) >> 1;
+        height = norm_maxh(dev);
+        if (!dev->progressive)
+                height >>= norm_maxh(dev);
        em28xx_set_outfmt(dev);
diff --git a/drivers/media/video/em28xx/em28xx-dvb.c b/drivers/media/video/em28xx/em28xx-dvb.c
index cf0ac7f2a30d..d603575431b4 100644
--- a/drivers/media/video/em28xx/em28xx-dvb.c
+++ b/drivers/media/video/em28xx/em28xx-dvb.c
@@ -478,7 +478,6 @@ static int dvb_init(struct em28xx *dev)
                }
                break;
        case EM2880_BOARD_KWORLD_DVB_310U:
-        case EM2880_BOARD_EMPIRE_DUAL_TV:
                dvb->frontend = dvb_attach(zl10353_attach,
                                           &em28xx_zl10353_with_xc3028,
                                           &dev->i2c_adap);
@@ -488,6 +487,7 @@ static int dvb_init(struct em28xx *dev)
                }
                break;
        case EM2880_BOARD_HAUPPAUGE_WINTV_HVR_900:
+        case EM2880_BOARD_EMPIRE_DUAL_TV:
                dvb->frontend = dvb_attach(zl10353_attach,
                                           &em28xx_zl10353_xc3028_no_i2c_gate,
                                           &dev->i2c_adap);
diff --git a/drivers/media/video/em28xx/em28xx-reg.h b/drivers/media/video/em28xx/em28xx-reg.h
index a2676d63cfd0..6bf84bd787df 100644
--- a/drivers/media/video/em28xx/em28xx-reg.h
+++ b/drivers/media/video/em28xx/em28xx-reg.h
@@ -176,7 +176,8 @@
 /* FIXME: Need to be populated with the other chip ID's */
 enum em28xx_chip_id {
-        CHIP_ID_EM2820 = 18,    /* Also used by em2710 */
+        CHIP_ID_EM2710 = 17,
+        CHIP_ID_EM2820 = 18,    /* Also used by some em2710 */
        CHIP_ID_EM2840 = 20,
        CHIP_ID_EM2750 = 33,
        CHIP_ID_EM2860 = 34,
diff --git a/drivers/media/video/em28xx/em28xx-video.c b/drivers/media/video/em28xx/em28xx-video.c
index ff37b4c15f44..ab079d9256c4 100644
--- a/drivers/media/video/em28xx/em28xx-video.c
+++ b/drivers/media/video/em28xx/em28xx-video.c
@@ -194,15 +194,24 @@ static void em28xx_copy_video(struct em28xx *dev,
        startread = p;
        remain = len;
-        /* Interlaces frame */
+        if (dev->progressive)
-        if (buf->top_field)
                fieldstart = outp;
-        else
+        else {
-                fieldstart = outp + bytesperline;
+                /* Interlaces two half frames */
+                if (buf->top_field)
+                        fieldstart = outp;
+                else
+                        fieldstart = outp + bytesperline;
+        }
        linesdone = dma_q->pos / bytesperline;
        currlinedone = dma_q->pos % bytesperline;
-        offset = linesdone * bytesperline * 2 + currlinedone;
+        if (dev->progressive)
+                offset = linesdone * bytesperline + currlinedone;
+        else
+                offset = linesdone * bytesperline * 2 + currlinedone;
        startwrite = fieldstart + offset;
        lencopy = bytesperline - currlinedone;
        lencopy = lencopy > remain ? remain : lencopy;
@@ -376,7 +385,7 @@ static inline int em28xx_isoc_copy(struct em28xx *dev, struct urb *urb)
                        em28xx_isocdbg("Video frame %d, length=%i, %s\n", p[2],
                                       len, (p[2] & 1) ? "odd" : "even");
-                        if (!(p[2] & 1)) {
+                        if (dev->progressive || !(p[2] & 1)) {
                                if (buf != NULL)
                                        buffer_filled(dev, dma_q, buf);
                                get_next_buf(dma_q, &buf);
@@ -689,7 +698,10 @@ static int vidioc_g_fmt_vid_cap(struct file *file, void *priv,
        f->fmt.pix.colorspace = V4L2_COLORSPACE_SMPTE170M;
        /* FIXME: TOP? NONE? BOTTOM? ALTENATE? */
-        f->fmt.pix.field = dev->interlaced ?
+        if (dev->progressive)
+                f->fmt.pix.field = V4L2_FIELD_NONE;
+        else
+                f->fmt.pix.field = dev->interlaced ?
                           V4L2_FIELD_INTERLACED : V4L2_FIELD_TOP;
        mutex_unlock(&dev->lock);
@@ -753,7 +765,11 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv,
        f->fmt.pix.bytesperline = (dev->width * fmt->depth + 7) >> 3;
        f->fmt.pix.sizeimage = f->fmt.pix.bytesperline * height;
        f->fmt.pix.colorspace = V4L2_COLORSPACE_SMPTE170M;
-        f->fmt.pix.field = V4L2_FIELD_INTERLACED;
+        if (dev->progressive)
+                f->fmt.pix.field = V4L2_FIELD_NONE;
+        else
+                f->fmt.pix.field = dev->interlaced ?
+                           V4L2_FIELD_INTERLACED : V4L2_FIELD_TOP;
        return 0;
 }
@@ -846,6 +862,41 @@ static int vidioc_s_std(struct file *file, void *priv, v4l2_std_id *norm)
        return 0;
 }
+static int vidioc_g_parm(struct file *file, void *priv,
+                         struct v4l2_streamparm *p)
+{
+        struct em28xx_fh   *fh  = priv;
+        struct em28xx      *dev = fh->dev;
+        int rc = 0;
+        if (p->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                return -EINVAL;
+        if (dev->board.is_webcam)
+                rc = v4l2_device_call_until_err(&dev->v4l2_dev, 0,
+                                                video, g_parm, p);
+        else
+                v4l2_video_std_frame_period(dev->norm,
+                                                 &p->parm.capture.timeperframe);
+        return rc;
+}
+static int vidioc_s_parm(struct file *file, void *priv,
+                         struct v4l2_streamparm *p)
+{
+        struct em28xx_fh   *fh  = priv;
+        struct em28xx      *dev = fh->dev;
+        if (!dev->board.is_webcam)
+                return -EINVAL;
+        if (p->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                return -EINVAL;
+        return v4l2_device_call_until_err(&dev->v4l2_dev, 0, video, s_parm, p);
+}
 static const char *iname[] = {
        [EM28XX_VMUX_COMPOSITE1] = "Composite1",
        [EM28XX_VMUX_COMPOSITE2] = "Composite2",
@@ -1624,6 +1675,7 @@ static int em28xx_v4l2_open(struct file *filp)
        struct em28xx *dev;
        enum v4l2_buf_type fh_type;
        struct em28xx_fh *fh;
+        enum v4l2_field field;
        dev = em28xx_get_device(minor, &fh_type, &radio);
@@ -1665,8 +1717,13 @@ static int em28xx_v4l2_open(struct file *filp)
        dev->users++;
+        if (dev->progressive)
+                field = V4L2_FIELD_NONE;
+        else
+                field = V4L2_FIELD_INTERLACED;
        videobuf_queue_vmalloc_init(&fh->vb_vidq, &em28xx_video_qops,
-                        NULL, &dev->slock, fh->type, V4L2_FIELD_INTERLACED,
+                        NULL, &dev->slock, fh->type, field,
                        sizeof(struct em28xx_buffer), fh);
        mutex_unlock(&dev->lock);
@@ -1885,6 +1942,8 @@ static const struct v4l2_ioctl_ops video_ioctl_ops = {
        .vidioc_qbuf                = vidioc_qbuf,
        .vidioc_dqbuf               = vidioc_dqbuf,
        .vidioc_s_std               = vidioc_s_std,
+        .vidioc_g_parm              = vidioc_g_parm,
+        .vidioc_s_parm              = vidioc_s_parm,
        .vidioc_enum_input          = vidioc_enum_input,
        .vidioc_g_input             = vidioc_g_input,
        .vidioc_s_input             = vidioc_s_input,
diff --git a/drivers/media/video/em28xx/em28xx.h b/drivers/media/video/em28xx/em28xx.h
index 45bd513f62dc..a2add61f7d59 100644
--- a/drivers/media/video/em28xx/em28xx.h
+++ b/drivers/media/video/em28xx/em28xx.h
@@ -367,6 +367,7 @@ enum em28xx_sensor {
        EM28XX_NOSENSOR = 0,
        EM28XX_MT9V011,
        EM28XX_MT9M001,
+        EM28XX_MT9M111,
 };
 enum em28xx_adecoder {
@@ -484,6 +485,9 @@ struct em28xx {
        int sensor_xres, sensor_yres;
        int sensor_xtal;
+        /* Allows progressive (e. g. non-interlaced) mode */
+        int progressive;
        /* Vinmode/Vinctl used at the driver */
        int vinmode, vinctl;
diff --git a/drivers/media/video/gspca/Kconfig b/drivers/media/video/gspca/Kconfig
index 34f46f2bc040..e994dcac43ff 100644
--- a/drivers/media/video/gspca/Kconfig
+++ b/drivers/media/video/gspca/Kconfig
@@ -114,7 +114,7 @@ config USB_GSPCA_SN9C20X
 config USB_GSPCA_SN9C20X_EVDEV
       bool "Enable evdev support"
-       depends on USB_GSPCA_SN9C20X
+        depends on USB_GSPCA_SN9C20X && INPUT
       ---help---
         Say Y here in order to enable evdev support for sn9c20x webcam button.
diff --git a/drivers/media/video/hdpvr/hdpvr-video.c b/drivers/media/video/hdpvr/hdpvr-video.c
index ccd47f57f42c..d678765cbba2 100644
--- a/drivers/media/video/hdpvr/hdpvr-video.c
+++ b/drivers/media/video/hdpvr/hdpvr-video.c
@@ -1220,6 +1220,8 @@ static const struct video_device hdpvr_video_template = {
                V4L2_STD_PAL_G | V4L2_STD_PAL_H | V4L2_STD_PAL_I |
                V4L2_STD_PAL_D | V4L2_STD_PAL_M | V4L2_STD_PAL_N |
                V4L2_STD_PAL_60,
+        .current_norm           = V4L2_STD_NTSC | V4L2_STD_PAL_M |
+                V4L2_STD_PAL_60,
 };
 int hdpvr_register_videodev(struct hdpvr_device *dev, struct device *parent,
diff --git a/drivers/media/video/ivtv/ivtv-controls.c b/drivers/media/video/ivtv/ivtv-controls.c
index a3b77ed3f089..4a9c8ce0ecb3 100644
--- a/drivers/media/video/ivtv/ivtv-controls.c
+++ b/drivers/media/video/ivtv/ivtv-controls.c
@@ -17,6 +17,7 @@
    along with this program; if not, write to the Free Software
    Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */
+#include <linux/kernel.h>
 #include "ivtv-driver.h"
 #include "ivtv-cards.h"
@@ -281,7 +282,7 @@ int ivtv_s_ext_ctrls(struct file *file, void *fh, struct v4l2_ext_controls *c)
                idx = p.audio_properties & 0x03;
                /* The audio clock of the digitizer must match the codec sample
                   rate otherwise you get some very strange effects. */
-                if (idx < sizeof(freqs))
+                if (idx < ARRAY_SIZE(freqs))
                        ivtv_call_all(itv, audio, s_clock_freq, freqs[idx]);
                return err;
        }
diff --git a/drivers/media/video/mt9v011.c b/drivers/media/video/mt9v011.c
index b2260de645f0..cc85f77a5706 100644
--- a/drivers/media/video/mt9v011.c
+++ b/drivers/media/video/mt9v011.c
@@ -52,13 +52,34 @@ static struct v4l2_queryctrl mt9v011_qctrl[] = {
                .step = 1,
                .default_value = 0,
                .flags = 0,
-        },
+        }, {
+                .id      = V4L2_CID_HFLIP,
+                .type    = V4L2_CTRL_TYPE_BOOLEAN,
+                .name    = "Mirror",
+                .minimum = 0,
+                .maximum = 1,
+                .step    = 1,
+                .default_value = 0,
+                .flags = 0,
+        }, {
+                .id      = V4L2_CID_VFLIP,
+                .type    = V4L2_CTRL_TYPE_BOOLEAN,
+                .name    = "Vflip",
+                .minimum = 0,
+                .maximum = 1,
+                .step    = 1,
+                .default_value = 0,
+                .flags = 0,
+        }, {
+        }
 };
 struct mt9v011 {
        struct v4l2_subdev sd;
        unsigned width, height;
        unsigned xtal;
+        unsigned hflip:1;
+        unsigned vflip:1;
        u16 global_gain, red_bal, blue_bal;
 };
@@ -131,7 +152,6 @@ static const struct i2c_reg_value mt9v011_init_default[] = {
                { R0A_MT9V011_CLK_SPEED, 0x0000 },
                { R1E_MT9V011_DIGITAL_ZOOM,  0x0000 },
-                { R20_MT9V011_READ_MODE, 0x1000 },
                { R07_MT9V011_OUT_CTRL, 0x0002 },       /* chip enable */
 };
@@ -156,7 +176,7 @@ static void set_balance(struct v4l2_subdev *sd)
        mt9v011_write(sd, R2D_MT9V011_RED_GAIN, red_gain);
 }
-static void calc_fps(struct v4l2_subdev *sd)
+static void calc_fps(struct v4l2_subdev *sd, u32 *numerator, u32 *denominator)
 {
        struct mt9v011 *core = to_mt9v011(sd);
        unsigned height, width, hblank, vblank, speed;
@@ -179,6 +199,51 @@ static void calc_fps(struct v4l2_subdev *sd)
        v4l2_dbg(1, debug, sd, "Programmed to %u.%03u fps (%d pixel clcks)\n",
                tmp / 1000, tmp % 1000, t_time);
+        if (numerator && denominator) {
+                *numerator = 1000;
+                *denominator = (u32)frames_per_ms;
+        }
+}
+static u16 calc_speed(struct v4l2_subdev *sd, u32 numerator, u32 denominator)
+{
+        struct mt9v011 *core = to_mt9v011(sd);
+        unsigned height, width, hblank, vblank;
+        unsigned row_time, line_time;
+        u64 t_time, speed;
+        /* Avoid bogus calculus */
+        if (!numerator || !denominator)
+                return 0;
+        height = mt9v011_read(sd, R03_MT9V011_HEIGHT);
+        width = mt9v011_read(sd, R04_MT9V011_WIDTH);
+        hblank = mt9v011_read(sd, R05_MT9V011_HBLANK);
+        vblank = mt9v011_read(sd, R06_MT9V011_VBLANK);
+        row_time = width + 113 + hblank;
+        line_time = height + vblank + 1;
+        t_time = core->xtal * ((u64)numerator);
+        /* round to the closest value */
+        t_time += denominator / 2;
+        do_div(t_time, denominator);
+        speed = t_time;
+        do_div(speed, row_time * line_time);
+        /* Avoid having a negative value for speed */
+        if (speed < 2)
+                speed = 0;
+        else
+                speed -= 2;
+        /* Avoid speed overflow */
+        if (speed > 15)
+                return 15;
+        return (u16)speed;
 }
 static void set_res(struct v4l2_subdev *sd)
@@ -207,9 +272,23 @@ static void set_res(struct v4l2_subdev *sd)
        mt9v011_write(sd, R03_MT9V011_HEIGHT, core->height);
        mt9v011_write(sd, R06_MT9V011_VBLANK, 508 - core->height);
-        calc_fps(sd);
+        calc_fps(sd, NULL, NULL);
 };
+static void set_read_mode(struct v4l2_subdev *sd)
+{
+        struct mt9v011 *core = to_mt9v011(sd);
+        unsigned mode = 0x1000;
+        if (core->hflip)
+                mode |= 0x4000;
+        if (core->vflip)
+                mode |= 0x8000;
+        mt9v011_write(sd, R20_MT9V011_READ_MODE, mode);
+}
 static int mt9v011_reset(struct v4l2_subdev *sd, u32 val)
 {
        int i;
@@ -220,6 +299,7 @@ static int mt9v011_reset(struct v4l2_subdev *sd, u32 val)
        set_balance(sd);
        set_res(sd);
+        set_read_mode(sd);
        return 0;
 };
@@ -240,6 +320,12 @@ static int mt9v011_g_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
        case V4L2_CID_BLUE_BALANCE:
                ctrl->value = core->blue_bal;
                return 0;
+        case V4L2_CID_HFLIP:
+                ctrl->value = core->hflip ? 1 : 0;
+                return 0;
+        case V4L2_CID_VFLIP:
+                ctrl->value = core->vflip ? 1 : 0;
+                return 0;
        }
        return -EINVAL;
 }
@@ -288,6 +374,14 @@ static int mt9v011_s_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
        case V4L2_CID_BLUE_BALANCE:
                core->blue_bal = ctrl->value;
                break;
+        case V4L2_CID_HFLIP:
+                core->hflip = ctrl->value;
+                set_read_mode(sd);
+                return 0;
+        case V4L2_CID_VFLIP:
+                core->vflip = ctrl->value;
+                set_read_mode(sd);
+                return 0;
        default:
                return -EINVAL;
        }
@@ -322,6 +416,44 @@ static int mt9v011_try_fmt(struct v4l2_subdev *sd, struct v4l2_format *fmt)
        return 0;
 }
+static int mt9v011_g_parm(struct v4l2_subdev *sd, struct v4l2_streamparm *parms)
+{
+        struct v4l2_captureparm *cp = &parms->parm.capture;
+        if (parms->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                return -EINVAL;
+        memset(cp, 0, sizeof(struct v4l2_captureparm));
+        cp->capability = V4L2_CAP_TIMEPERFRAME;
+        calc_fps(sd,
+                 &cp->timeperframe.numerator,
+                 &cp->timeperframe.denominator);
+        return 0;
+}
+static int mt9v011_s_parm(struct v4l2_subdev *sd, struct v4l2_streamparm *parms)
+{
+        struct v4l2_captureparm *cp = &parms->parm.capture;
+        struct v4l2_fract *tpf = &cp->timeperframe;
+        u16 speed;
+        if (parms->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                return -EINVAL;
+        if (cp->extendedmode != 0)
+                return -EINVAL;
+        speed = calc_speed(sd, tpf->numerator, tpf->denominator);
+        mt9v011_write(sd, R0A_MT9V011_CLK_SPEED, speed);
+        v4l2_dbg(1, debug, sd, "Setting speed to %d\n", speed);
+        /* Recalculate and update fps info */
+        calc_fps(sd, &tpf->numerator, &tpf->denominator);
+        return 0;
+}
 static int mt9v011_s_fmt(struct v4l2_subdev *sd, struct v4l2_format *fmt)
 {
        struct v4l2_pix_format *pix = &fmt->fmt.pix;
@@ -393,10 +525,13 @@ static int mt9v011_s_register(struct v4l2_subdev *sd,
 static int mt9v011_g_chip_ident(struct v4l2_subdev *sd,
                                struct v4l2_dbg_chip_ident *chip)
 {
+        u16 version;
        struct i2c_client *client = v4l2_get_subdevdata(sd);
+        version = mt9v011_read(sd, R00_MT9V011_CHIP_VERSION);
        return v4l2_chip_ident_i2c_client(client, chip, V4L2_IDENT_MT9V011,
-                                          MT9V011_VERSION);
+                                          version);
 }
 static const struct v4l2_subdev_core_ops mt9v011_core_ops = {
@@ -416,6 +551,8 @@ static const struct v4l2_subdev_video_ops mt9v011_video_ops = {
        .enum_fmt = mt9v011_enum_fmt,
        .try_fmt = mt9v011_try_fmt,
        .s_fmt = mt9v011_s_fmt,
+        .g_parm = mt9v011_g_parm,
+        .s_parm = mt9v011_s_parm,
 };
 static const struct v4l2_subdev_ops mt9v011_ops = {
@@ -449,8 +586,9 @@ static int mt9v011_probe(struct i2c_client *c,
        /* Check if the sensor is really a MT9V011 */
        version = mt9v011_read(sd, R00_MT9V011_CHIP_VERSION);
-        if (version != MT9V011_VERSION) {
+        if ((version != MT9V011_VERSION) &&
-                v4l2_info(sd, "*** unknown micron chip detected (0x%04x.\n",
+            (version != MT9V011_REV_B_VERSION)) {
+                v4l2_info(sd, "*** unknown micron chip detected (0x%04x).\n",
                          version);
                kfree(core);
                return -EINVAL;
@@ -461,8 +599,8 @@ static int mt9v011_probe(struct i2c_client *c,
        core->height = 480;
        core->xtal = 27000000;  /* Hz */
-        v4l_info(c, "chip found @ 0x%02x (%s)\n",
+        v4l_info(c, "chip found @ 0x%02x (%s - chip version 0x%04x)\n",
-                 c->addr << 1, c->adapter->name);
+                 c->addr << 1, c->adapter->name, version);
        return 0;
 }
diff --git a/drivers/media/video/mt9v011.h b/drivers/media/video/mt9v011.h
index 9e443ee30558..3350fd6083c3 100644
--- a/drivers/media/video/mt9v011.h
+++ b/drivers/media/video/mt9v011.h
@@ -30,6 +30,7 @@
 #define R35_MT9V011_GLOBAL_GAIN         0x35
 #define RF1_MT9V011_CHIP_ENABLE         0xf1
-#define MT9V011_VERSION                 0x8243
+#define MT9V011_VERSION                 0x8232
+#define MT9V011_REV_B_VERSION           0x8243
 #endif
diff --git a/drivers/media/video/mx1_camera.c b/drivers/media/video/mx1_camera.c
index 2d075205bdfe..736c31d23194 100644
--- a/drivers/media/video/mx1_camera.c
+++ b/drivers/media/video/mx1_camera.c
@@ -234,6 +234,7 @@ static int mx1_camera_setup_dma(struct mx1_camera_dev *pcdev)
        return ret;
 }
+/* Called under spinlock_irqsave(&pcdev->lock, ...) */
 static void mx1_videobuf_queue(struct videobuf_queue *vq,
                                                struct videobuf_buffer *vb)
 {
@@ -241,13 +242,10 @@ static void mx1_videobuf_queue(struct videobuf_queue *vq,
        struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent);
        struct mx1_camera_dev *pcdev = ici->priv;
        struct mx1_buffer *buf = container_of(vb, struct mx1_buffer, vb);
-        unsigned long flags;
        dev_dbg(&icd->dev, "%s (vb=0x%p) 0x%08lx %d\n", __func__,
                vb, vb->baddr, vb->bsize);
-        spin_lock_irqsave(&pcdev->lock, flags);
        list_add_tail(&vb->queue, &pcdev->capture);
        vb->state = VIDEOBUF_ACTIVE;
@@ -264,8 +262,6 @@ static void mx1_videobuf_queue(struct videobuf_queue *vq,
                        __raw_writel(temp, pcdev->base + CSICR1);
                }
        }
-        spin_unlock_irqrestore(&pcdev->lock, flags);
 }
 static void mx1_videobuf_release(struct videobuf_queue *vq,
diff --git a/drivers/media/video/mx3_camera.c b/drivers/media/video/mx3_camera.c
index e605c076ed89..9770cb7932ca 100644
--- a/drivers/media/video/mx3_camera.c
+++ b/drivers/media/video/mx3_camera.c
@@ -332,7 +332,10 @@ static enum pixel_fmt fourcc_to_ipu_pix(__u32 fourcc)
        }
 }
-/* Called with .vb_lock held */
+/*
+ * Called with .vb_lock mutex held and
+ * under spinlock_irqsave(&mx3_cam->lock, ...)
+ */
 static void mx3_videobuf_queue(struct videobuf_queue *vq,
                               struct videobuf_buffer *vb)
 {
@@ -346,7 +349,8 @@ static void mx3_videobuf_queue(struct videobuf_queue *vq,
        struct idmac_video_param *video = &ichan->params.video;
        const struct soc_camera_data_format *data_fmt = icd->current_fmt;
        dma_cookie_t cookie;
-        unsigned long flags;
+        BUG_ON(!irqs_disabled());
        /* This is the configuration of one sg-element */
        video->out_pixel_fmt    = fourcc_to_ipu_pix(data_fmt->fourcc);
@@ -359,8 +363,6 @@ static void mx3_videobuf_queue(struct videobuf_queue *vq,
        memset((void *)vb->baddr, 0xaa, vb->bsize);
 #endif
-        spin_lock_irqsave(&mx3_cam->lock, flags);
        list_add_tail(&vb->queue, &mx3_cam->capture);
        if (!mx3_cam->active) {
@@ -370,24 +372,23 @@ static void mx3_videobuf_queue(struct videobuf_queue *vq,
                vb->state = VIDEOBUF_QUEUED;
        }
-        spin_unlock_irqrestore(&mx3_cam->lock, flags);
+        spin_unlock_irq(&mx3_cam->lock);
        cookie = txd->tx_submit(txd);
        dev_dbg(&icd->dev, "Submitted cookie %d DMA 0x%08x\n", cookie, sg_dma_address(&buf->sg));
+        spin_lock_irq(&mx3_cam->lock);
        if (cookie >= 0)
                return;
        /* Submit error */
        vb->state = VIDEOBUF_PREPARED;
-        spin_lock_irqsave(&mx3_cam->lock, flags);
        list_del_init(&vb->queue);
        if (mx3_cam->active == buf)
                mx3_cam->active = NULL;
-        spin_unlock_irqrestore(&mx3_cam->lock, flags);
 }
 /* Called with .vb_lock held */
diff --git a/drivers/media/video/pxa_camera.c b/drivers/media/video/pxa_camera.c
index 46e0d8ad880f..016bb45ba0c3 100644
--- a/drivers/media/video/pxa_camera.c
+++ b/drivers/media/video/pxa_camera.c
@@ -612,6 +612,7 @@ static void pxa_camera_stop_capture(struct pxa_camera_dev *pcdev)
        dev_dbg(pcdev->soc_host.dev, "%s\n", __func__);
 }
+/* Called under spinlock_irqsave(&pcdev->lock, ...) */
 static void pxa_videobuf_queue(struct videobuf_queue *vq,
                               struct videobuf_buffer *vb)
 {
@@ -619,13 +620,10 @@ static void pxa_videobuf_queue(struct videobuf_queue *vq,
        struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent);
        struct pxa_camera_dev *pcdev = ici->priv;
        struct pxa_buffer *buf = container_of(vb, struct pxa_buffer, vb);
-        unsigned long flags;
        dev_dbg(&icd->dev, "%s (vb=0x%p) 0x%08lx %d active=%p\n", __func__,
                vb, vb->baddr, vb->bsize, pcdev->active);
-        spin_lock_irqsave(&pcdev->lock, flags);
        list_add_tail(&vb->queue, &pcdev->capture);
        vb->state = VIDEOBUF_ACTIVE;
@@ -633,8 +631,6 @@ static void pxa_videobuf_queue(struct videobuf_queue *vq,
        if (!pcdev->active)
                pxa_camera_start_capture(pcdev);
-        spin_unlock_irqrestore(&pcdev->lock, flags);
 }
 static void pxa_videobuf_release(struct videobuf_queue *vq,
@@ -1579,6 +1575,7 @@ static int __devinit pxa_camera_probe(struct platform_device *pdev)
                pcdev->mclk = 20000000;
        }
+        pcdev->soc_host.dev = &pdev->dev;
        pcdev->mclk_divisor = mclk_get_divisor(pcdev);
        INIT_LIST_HEAD(&pcdev->capture);
@@ -1644,7 +1641,6 @@ static int __devinit pxa_camera_probe(struct platform_device *pdev)
        pcdev->soc_host.drv_name        = PXA_CAM_DRV_NAME;
        pcdev->soc_host.ops             = &pxa_soc_camera_host_ops;
        pcdev->soc_host.priv            = pcdev;
-        pcdev->soc_host.dev             = &pdev->dev;
        pcdev->soc_host.nr              = pdev->id;
        err = soc_camera_host_register(&pcdev->soc_host);
diff --git a/drivers/media/video/saa7134/saa7134-cards.c b/drivers/media/video/saa7134/saa7134-cards.c
index 06861b782b95..6eebe3ef97d3 100644
--- a/drivers/media/video/saa7134/saa7134-cards.c
+++ b/drivers/media/video/saa7134/saa7134-cards.c
@@ -3331,8 +3331,8 @@ struct saa7134_board saa7134_boards[] = {
                        .gpio = 0x0200100,
                },
        },
-        [SAA7134_BOARD_HAUPPAUGE_HVR1120] = {
+        [SAA7134_BOARD_HAUPPAUGE_HVR1150] = {
-                .name           = "Hauppauge WinTV-HVR1120 ATSC/QAM-Hybrid",
+                .name           = "Hauppauge WinTV-HVR1150 ATSC/QAM-Hybrid",
                .audio_clock    = 0x00187de7,
                .tuner_type     = TUNER_PHILIPS_TDA8290,
                .radio_type     = UNSET,
@@ -3363,8 +3363,8 @@ struct saa7134_board saa7134_boards[] = {
                        .gpio = 0x0800100, /* GPIO 23 HI for FM */
                },
        },
-        [SAA7134_BOARD_HAUPPAUGE_HVR1110R3] = {
+        [SAA7134_BOARD_HAUPPAUGE_HVR1120] = {
-                .name           = "Hauppauge WinTV-HVR1110r3 DVB-T/Hybrid",
+                .name           = "Hauppauge WinTV-HVR1120 DVB-T/Hybrid",
                .audio_clock    = 0x00187de7,
                .tuner_type     = TUNER_PHILIPS_TDA8290,
                .radio_type     = UNSET,
@@ -5862,31 +5862,31 @@ struct pci_device_id saa7134_pci_tbl[] = {
                .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
                .subvendor    = 0x0070,
                .subdevice    = 0x6706,
-                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1120,
+                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1150,
        },{
                .vendor       = PCI_VENDOR_ID_PHILIPS,
                .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
                .subvendor    = 0x0070,
                .subdevice    = 0x6707,
-                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1110R3,
+                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1120,
        },{
                .vendor       = PCI_VENDOR_ID_PHILIPS,
                .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
                .subvendor    = 0x0070,
                .subdevice    = 0x6708,
-                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1120,
+                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1150,
        },{
                .vendor       = PCI_VENDOR_ID_PHILIPS,
                .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
                .subvendor    = 0x0070,
                .subdevice    = 0x6709,
-                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1110R3,
+                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1120,
        },{
                .vendor       = PCI_VENDOR_ID_PHILIPS,
                .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
                .subvendor    = 0x0070,
                .subdevice    = 0x670a,
-                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1110R3,
+                .driver_data  = SAA7134_BOARD_HAUPPAUGE_HVR1120,
        },{
                .vendor       = PCI_VENDOR_ID_PHILIPS,
                .device       = PCI_DEVICE_ID_PHILIPS_SAA7133,
@@ -6363,8 +6363,8 @@ static int saa7134_tda8290_18271_callback(struct saa7134_dev *dev,
        switch (command) {
        case TDA18271_CALLBACK_CMD_AGC_ENABLE: /* 0 */
                switch (dev->board) {
+                case SAA7134_BOARD_HAUPPAUGE_HVR1150:
                case SAA7134_BOARD_HAUPPAUGE_HVR1120:
-                case SAA7134_BOARD_HAUPPAUGE_HVR1110R3:
                        ret = saa7134_tda18271_hvr11x0_toggle_agc(dev, arg);
                        break;
                default:
@@ -6384,8 +6384,8 @@ static int saa7134_tda8290_callback(struct saa7134_dev *dev,
        int ret;
        switch (dev->board) {
+        case SAA7134_BOARD_HAUPPAUGE_HVR1150:
        case SAA7134_BOARD_HAUPPAUGE_HVR1120:
-        case SAA7134_BOARD_HAUPPAUGE_HVR1110R3:
                /* tda8290 + tda18271 */
                ret = saa7134_tda8290_18271_callback(dev, command, arg);
                break;
@@ -6427,7 +6427,7 @@ static void hauppauge_eeprom(struct saa7134_dev *dev, u8 *eeprom_data)
        switch (tv.model) {
        case 67019: /* WinTV-HVR1110 (Retail, IR Blaster, hybrid, FM, SVid/Comp, 3.5mm audio in) */
        case 67109: /* WinTV-HVR1000 (Retail, IR Receive, analog, no FM, SVid/Comp, 3.5mm audio in) */
-        case 67201: /* WinTV-HVR1120 (Retail, IR Receive, hybrid, FM, SVid/Comp, 3.5mm audio in) */
+        case 67201: /* WinTV-HVR1150 (Retail, IR Receive, hybrid, FM, SVid/Comp, 3.5mm audio in) */
        case 67301: /* WinTV-HVR1000 (Retail, IR Receive, analog, no FM, SVid/Comp, 3.5mm audio in) */
        case 67209: /* WinTV-HVR1110 (Retail, IR Receive, hybrid, FM, SVid/Comp, 3.5mm audio in) */
        case 67559: /* WinTV-HVR1110 (OEM, no IR, hybrid, FM, SVid/Comp, RCA aud) */
@@ -6435,7 +6435,7 @@ static void hauppauge_eeprom(struct saa7134_dev *dev, u8 *eeprom_data)
        case 67579: /* WinTV-HVR1110 (OEM, no IR, hybrid, no FM) */
        case 67589: /* WinTV-HVR1110 (OEM, no IR, hybrid, no FM, SVid/Comp, RCA aud) */
        case 67599: /* WinTV-HVR1110 (OEM, no IR, hybrid, no FM, SVid/Comp, RCA aud) */
-        case 67651: /* WinTV-HVR1120 (OEM, no IR, hybrid, FM, SVid/Comp, RCA aud) */
+        case 67651: /* WinTV-HVR1150 (OEM, no IR, hybrid, FM, SVid/Comp, RCA aud) */
        case 67659: /* WinTV-HVR1110 (OEM, no IR, hybrid, FM, SVid/Comp, RCA aud) */
                break;
        default:
@@ -6625,8 +6625,8 @@ int saa7134_board_init1(struct saa7134_dev *dev)
                saa_writeb (SAA7134_PRODUCTION_TEST_MODE, 0x00);
                break;
+        case SAA7134_BOARD_HAUPPAUGE_HVR1150:
        case SAA7134_BOARD_HAUPPAUGE_HVR1120:
-        case SAA7134_BOARD_HAUPPAUGE_HVR1110R3:
                /* GPIO 26 high for digital, low for analog */
                saa7134_set_gpio(dev, 26, 0);
                msleep(1);
@@ -6891,8 +6891,8 @@ int saa7134_board_init2(struct saa7134_dev *dev)
                       dev->name, saa7134_boards[dev->board].name);
               }
               break;
+        case SAA7134_BOARD_HAUPPAUGE_HVR1150:
        case SAA7134_BOARD_HAUPPAUGE_HVR1120:
-        case SAA7134_BOARD_HAUPPAUGE_HVR1110R3:
                hauppauge_eeprom(dev, dev->eedata+0x80);
                break;
        case SAA7134_BOARD_HAUPPAUGE_HVR1110:
diff --git a/drivers/media/video/saa7134/saa7134-dvb.c b/drivers/media/video/saa7134/saa7134-dvb.c
index 31930f26ffc7..98f3efd1e944 100644
--- a/drivers/media/video/saa7134/saa7134-dvb.c
+++ b/drivers/media/video/saa7134/saa7134-dvb.c
@@ -1119,7 +1119,7 @@ static int dvb_init(struct saa7134_dev *dev)
                                         &tda827x_cfg_2) < 0)
                        goto dettach_frontend;
                break;
-        case SAA7134_BOARD_HAUPPAUGE_HVR1110R3:
+        case SAA7134_BOARD_HAUPPAUGE_HVR1120:
                fe0->dvb.frontend = dvb_attach(tda10048_attach,
                                               &hcw_tda10048_config,
                                               &dev->i2c_adap);
@@ -1147,7 +1147,7 @@ static int dvb_init(struct saa7134_dev *dev)
                                         &tda827x_cfg_1) < 0)
                        goto dettach_frontend;
                break;
-        case SAA7134_BOARD_HAUPPAUGE_HVR1120:
+        case SAA7134_BOARD_HAUPPAUGE_HVR1150:
                fe0->dvb.frontend = dvb_attach(lgdt3305_attach,
                                               &hcw_lgdt3305_config,
                                               &dev->i2c_adap);
diff --git a/drivers/media/video/saa7134/saa7134.h b/drivers/media/video/saa7134/saa7134.h
index 82268848f26a..fb564f14887c 100644
--- a/drivers/media/video/saa7134/saa7134.h
+++ b/drivers/media/video/saa7134/saa7134.h
@@ -278,8 +278,8 @@ struct saa7134_format {
 #define SAA7134_BOARD_ASUSTeK_TIGER         152
 #define SAA7134_BOARD_KWORLD_PLUS_TV_ANALOG 153
 #define SAA7134_BOARD_AVERMEDIA_GO_007_FM_PLUS 154
-#define SAA7134_BOARD_HAUPPAUGE_HVR1120     155
+#define SAA7134_BOARD_HAUPPAUGE_HVR1150     155
-#define SAA7134_BOARD_HAUPPAUGE_HVR1110R3   156
+#define SAA7134_BOARD_HAUPPAUGE_HVR1120   156
 #define SAA7134_BOARD_AVERMEDIA_STUDIO_507UA 157
 #define SAA7134_BOARD_AVERMEDIA_CARDBUS_501 158
 #define SAA7134_BOARD_BEHOLD_505RDS         159
diff --git a/drivers/media/video/sh_mobile_ceu_camera.c b/drivers/media/video/sh_mobile_ceu_camera.c
index 0db88a53d92c..e86878deea71 100644
--- a/drivers/media/video/sh_mobile_ceu_camera.c
+++ b/drivers/media/video/sh_mobile_ceu_camera.c
@@ -282,27 +282,24 @@ out:
        return ret;
 }
+/* Called under spinlock_irqsave(&pcdev->lock, ...) */
 static void sh_mobile_ceu_videobuf_queue(struct videobuf_queue *vq,
                                         struct videobuf_buffer *vb)
 {
        struct soc_camera_device *icd = vq->priv_data;
        struct soc_camera_host *ici = to_soc_camera_host(icd->dev.parent);
        struct sh_mobile_ceu_dev *pcdev = ici->priv;
-        unsigned long flags;
        dev_dbg(&icd->dev, "%s (vb=0x%p) 0x%08lx %zd\n", __func__,
                vb, vb->baddr, vb->bsize);
        vb->state = VIDEOBUF_QUEUED;
-        spin_lock_irqsave(&pcdev->lock, flags);
        list_add_tail(&vb->queue, &pcdev->capture);
        if (!pcdev->active) {
                pcdev->active = vb;
                sh_mobile_ceu_capture(pcdev);
        }
-        spin_unlock_irqrestore(&pcdev->lock, flags);
 }
 static void sh_mobile_ceu_videobuf_release(struct videobuf_queue *vq,
diff --git a/drivers/media/video/stk-webcam.c b/drivers/media/video/stk-webcam.c
index 4d6785e63455..b154bd961e3b 100644
--- a/drivers/media/video/stk-webcam.c
+++ b/drivers/media/video/stk-webcam.c
@@ -1050,8 +1050,8 @@ static int stk_setup_format(struct stk_camera *dev)
                depth = 1;
        else
                depth = 2;
-        while (stk_sizes[i].m != dev->vsettings.mode
+        while (i < ARRAY_SIZE(stk_sizes) &&
-                        && i < ARRAY_SIZE(stk_sizes))
+                        stk_sizes[i].m != dev->vsettings.mode)
                i++;
        if (i == ARRAY_SIZE(stk_sizes)) {
                STK_ERROR("Something is broken in %s\n", __func__);
diff --git a/drivers/media/video/uvc/uvc_driver.c b/drivers/media/video/uvc/uvc_driver.c
index 89927b7aec28..04b47832fa0a 100644
--- a/drivers/media/video/uvc/uvc_driver.c
+++ b/drivers/media/video/uvc/uvc_driver.c
@@ -1845,11 +1845,29 @@ static struct usb_device_id uvc_ids[] = {
          .bInterfaceSubClass   = 1,
          .bInterfaceProtocol   = 0,
          .driver_info          = UVC_QUIRK_STREAM_NO_FID },
-        /* ViMicro */
+        /* ViMicro Vega */
-        { .match_flags          = USB_DEVICE_ID_MATCH_VENDOR
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+                                | USB_DEVICE_ID_MATCH_INT_INFO,
+          .idVendor             = 0x0ac8,
+          .idProduct            = 0x332d,
+          .bInterfaceClass      = USB_CLASS_VIDEO,
+          .bInterfaceSubClass   = 1,
+          .bInterfaceProtocol   = 0,
+          .driver_info          = UVC_QUIRK_FIX_BANDWIDTH },
+        /* ViMicro - Minoru3D */
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+                                | USB_DEVICE_ID_MATCH_INT_INFO,
+          .idVendor             = 0x0ac8,
+          .idProduct            = 0x3410,
+          .bInterfaceClass      = USB_CLASS_VIDEO,
+          .bInterfaceSubClass   = 1,
+          .bInterfaceProtocol   = 0,
+          .driver_info          = UVC_QUIRK_FIX_BANDWIDTH },
+        /* ViMicro Venus - Minoru3D */
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
                                | USB_DEVICE_ID_MATCH_INT_INFO,
          .idVendor             = 0x0ac8,
-          .idProduct            = 0x0000,
+          .idProduct            = 0x3420,
          .bInterfaceClass      = USB_CLASS_VIDEO,
          .bInterfaceSubClass   = 1,
          .bInterfaceProtocol   = 0,
diff --git a/drivers/media/video/uvc/uvc_status.c b/drivers/media/video/uvc/uvc_status.c
index f152a9903862..1ca6dff73612 100644
--- a/drivers/media/video/uvc/uvc_status.c
+++ b/drivers/media/video/uvc/uvc_status.c
@@ -145,8 +145,8 @@ static void uvc_status_complete(struct urb *urb)
                        break;
                default:
-                        uvc_printk(KERN_INFO, "unknown event type %u.\n",
+                        uvc_trace(UVC_TRACE_STATUS, "Unknown status event "
-                                dev->status[0]);
+                                "type %u.\n", dev->status[0]);
                        break;
                }
        }
diff --git a/drivers/media/video/v4l2-ioctl.c b/drivers/media/video/v4l2-ioctl.c
index be64a502ea27..f2afc4e08379 100644
--- a/drivers/media/video/v4l2-ioctl.c
+++ b/drivers/media/video/v4l2-ioctl.c
@@ -1081,8 +1081,10 @@ static long __video_do_ioctl(struct file *file,
                /* Calls the specific handler */
                if (ops->vidioc_g_std)
                        ret = ops->vidioc_g_std(file, fh, id);
-                else
+                else if (vfd->current_norm)
                        *id = vfd->current_norm;
+                else
+                        ret = -EINVAL;
                if (!ret)
                        dbgarg(cmd, "std=0x%08Lx\n", (long long unsigned)*id);
@@ -1553,12 +1555,19 @@ static long __video_do_ioctl(struct file *file,
                                break;
                        ret = ops->vidioc_g_parm(file, fh, p);
                } else {
+                        v4l2_std_id std = vfd->current_norm;
                        if (p->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
                                return -EINVAL;
-                        v4l2_video_std_frame_period(vfd->current_norm,
-                                                    &p->parm.capture.timeperframe);
                        ret = 0;
+                        if (ops->vidioc_g_std)
+                                ret = ops->vidioc_g_std(file, fh, &std);
+                        else if (std == 0)
+                                ret = -EINVAL;
+                        if (ret == 0)
+                                v4l2_video_std_frame_period(std,
+                                                    &p->parm.capture.timeperframe);
                }
                dbgarg(cmd, "type=%d\n", p->type);
diff --git a/drivers/media/video/zr364xx.c b/drivers/media/video/zr364xx.c
index fc976f42f432..2622a6e63da1 100644
--- a/drivers/media/video/zr364xx.c
+++ b/drivers/media/video/zr364xx.c
@@ -695,7 +695,7 @@ static int zr364xx_release(struct file *file)
        for (i = 0; i < 2; i++) {
                err =
                    send_control_msg(udev, 1, init[cam->method][i].value,
-                                     0, init[i][cam->method].bytes,
+                                     0, init[cam->method][i].bytes,
                                     init[cam->method][i].size);
                if (err < 0) {
                        dev_err(&udev->dev, "error during release sequence\n");
diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
index ae5fe91867e1..10ed195c0c1c 100644
--- a/drivers/mtd/devices/m25p80.c
+++ b/drivers/mtd/devices/m25p80.c
@@ -736,7 +736,7 @@ static int __devinit m25p_probe(struct spi_device *spi)
                        flash->partitioned = 1;
                        return add_mtd_partitions(&flash->mtd, parts, nr_parts);
                }
-        } else if (data->nr_parts)
+        } else if (data && data->nr_parts)
                dev_warn(&spi->dev, "ignoring %d default partitions on %s\n",
                                data->nr_parts, data->name);
diff --git a/drivers/mtd/maps/sbc8240.c b/drivers/mtd/maps/sbc8240.c
deleted file mode 100644
index e69de29bb2d1..000000000000
--- a/drivers/mtd/maps/sbc8240.c
+++ /dev/null
diff --git a/drivers/mtd/nand/orion_nand.c b/drivers/mtd/nand/orion_nand.c
index 7ad972229db4..0d9d4bc9c762 100644
--- a/drivers/mtd/nand/orion_nand.c
+++ b/drivers/mtd/nand/orion_nand.c
@@ -61,7 +61,7 @@ static void orion_nand_read_buf(struct mtd_info *mtd, uint8_t *buf, int len)
        buf64 = (uint64_t *)buf;
        while (i < len/8) {
                uint64_t x;
-                asm ("ldrd\t%0, [%1]" : "=r" (x) : "r" (io_base));
+                asm volatile ("ldrd\t%0, [%1]" : "=&r" (x) : "r" (io_base));
                buf64[i++] = x;
        }
        i *= 8;
diff --git a/drivers/mtd/nftlcore.c b/drivers/mtd/nftlcore.c
index fb86cacd5bdb..1002e1882996 100644
--- a/drivers/mtd/nftlcore.c
+++ b/drivers/mtd/nftlcore.c
@@ -135,16 +135,17 @@ static void nftl_remove_dev(struct mtd_blktrans_dev *dev)
 int nftl_read_oob(struct mtd_info *mtd, loff_t offs, size_t len,
                  size_t *retlen, uint8_t *buf)
 {
+        loff_t mask = mtd->writesize - 1;
        struct mtd_oob_ops ops;
        int res;
        ops.mode = MTD_OOB_PLACE;
-        ops.ooboffs = offs & (mtd->writesize - 1);
+        ops.ooboffs = offs & mask;
        ops.ooblen = len;
        ops.oobbuf = buf;
        ops.datbuf = NULL;
-        res = mtd->read_oob(mtd, offs & ~(mtd->writesize - 1), &ops);
+        res = mtd->read_oob(mtd, offs & ~mask, &ops);
        *retlen = ops.oobretlen;
        return res;
 }
@@ -155,16 +156,17 @@ int nftl_read_oob(struct mtd_info *mtd, loff_t offs, size_t len,
 int nftl_write_oob(struct mtd_info *mtd, loff_t offs, size_t len,
                   size_t *retlen, uint8_t *buf)
 {
+        loff_t mask = mtd->writesize - 1;
        struct mtd_oob_ops ops;
        int res;
        ops.mode = MTD_OOB_PLACE;
-        ops.ooboffs = offs & (mtd->writesize - 1);
+        ops.ooboffs = offs & mask;
        ops.ooblen = len;
        ops.oobbuf = buf;
        ops.datbuf = NULL;
-        res = mtd->write_oob(mtd, offs & ~(mtd->writesize - 1), &ops);
+        res = mtd->write_oob(mtd, offs & ~mask, &ops);
        *retlen = ops.oobretlen;
        return res;
 }
@@ -177,17 +179,18 @@ int nftl_write_oob(struct mtd_info *mtd, loff_t offs, size_t len,
 static int nftl_write(struct mtd_info *mtd, loff_t offs, size_t len,
                      size_t *retlen, uint8_t *buf, uint8_t *oob)
 {
+        loff_t mask = mtd->writesize - 1;
        struct mtd_oob_ops ops;
        int res;
        ops.mode = MTD_OOB_PLACE;
-        ops.ooboffs = offs;
+        ops.ooboffs = offs & mask;
        ops.ooblen = mtd->oobsize;
        ops.oobbuf = oob;
        ops.datbuf = buf;
        ops.len = len;
-        res = mtd->write_oob(mtd, offs & ~(mtd->writesize - 1), &ops);
+        res = mtd->write_oob(mtd, offs & ~mask, &ops);
        *retlen = ops.retlen;
        return res;
 }
diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
index c20416850948..45675889850b 100644
--- a/drivers/net/3c59x.c
+++ b/drivers/net/3c59x.c
@@ -235,6 +235,7 @@ enum vortex_chips {
        CH_3C900B_FL,
        CH_3C905_1,
        CH_3C905_2,
+        CH_3C905B_TX,
        CH_3C905B_1,
        CH_3C905B_2,
@@ -307,6 +308,8 @@ static struct vortex_chip_info {
         PCI_USES_MASTER, IS_BOOMERANG|HAS_MII|EEPROM_RESET, 64, },
        {"3c905 Boomerang 100baseT4",
         PCI_USES_MASTER, IS_BOOMERANG|HAS_MII|EEPROM_RESET, 64, },
+        {"3C905B-TX Fast Etherlink XL PCI",
+         PCI_USES_MASTER, IS_CYCLONE|HAS_NWAY|HAS_HWCKSM|EXTRA_PREAMBLE, 128, },
        {"3c905B Cyclone 100baseTx",
         PCI_USES_MASTER, IS_CYCLONE|HAS_NWAY|HAS_HWCKSM|EXTRA_PREAMBLE, 128, },
@@ -389,6 +392,7 @@ static struct pci_device_id vortex_pci_tbl[] = {
        { 0x10B7, 0x900A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CH_3C900B_FL },
        { 0x10B7, 0x9050, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CH_3C905_1 },
        { 0x10B7, 0x9051, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CH_3C905_2 },
+        { 0x10B7, 0x9054, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CH_3C905B_TX },
        { 0x10B7, 0x9055, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CH_3C905B_1 },
        { 0x10B7, 0x9058, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CH_3C905B_2 },
diff --git a/drivers/net/8139cp.c b/drivers/net/8139cp.c
index 50efde11ea6c..d0dbbf39349a 100644
--- a/drivers/net/8139cp.c
+++ b/drivers/net/8139cp.c
@@ -515,7 +515,7 @@ rx_status_loop:
                dma_addr_t mapping;
                struct sk_buff *skb, *new_skb;
                struct cp_desc *desc;
-                unsigned buflen;
+                const unsigned buflen = cp->rx_buf_sz;
                skb = cp->rx_skb[rx_tail];
                BUG_ON(!skb);
@@ -549,8 +549,7 @@ rx_status_loop:
                        pr_debug("%s: rx slot %d status 0x%x len %d\n",
                               dev->name, rx_tail, status, len);
-                buflen = cp->rx_buf_sz + NET_IP_ALIGN;
+                new_skb = netdev_alloc_skb(dev, buflen + NET_IP_ALIGN);
-                new_skb = netdev_alloc_skb(dev, buflen);
                if (!new_skb) {
                        dev->stats.rx_dropped++;
                        goto rx_next;
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 5f6509a5f640..5ce7cbabd7a7 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -1727,12 +1727,14 @@ config KS8842
        tristate "Micrel KSZ8842"
        depends on HAS_IOMEM
        help
-          This platform driver is for Micrel KSZ8842 chip.
+          This platform driver is for Micrel KSZ8842 / KS8842
+          2-port ethernet switch chip (managed, VLAN, QoS).
 config KS8851
       tristate "Micrel KS8851 SPI"
       depends on SPI
       select MII
+        select CRC32
       help
         SPI driver for Micrel KS8851 SPI attached network chip.
diff --git a/drivers/net/arm/w90p910_ether.c b/drivers/net/arm/w90p910_ether.c
index 616fb7985a34..ddd231cb54b7 100644
--- a/drivers/net/arm/w90p910_ether.c
+++ b/drivers/net/arm/w90p910_ether.c
@@ -1080,7 +1080,7 @@ static struct platform_driver w90p910_ether_driver = {
        .probe          = w90p910_ether_probe,
        .remove         = __devexit_p(w90p910_ether_remove),
        .driver         = {
-                .name   = "w90p910-emc",
+                .name   = "nuc900-emc",
                .owner  = THIS_MODULE,
        },
 };
@@ -1101,5 +1101,5 @@ module_exit(w90p910_ether_exit);
 MODULE_AUTHOR("Wan ZongShun <mcuos.com@gmail.com>");
 MODULE_DESCRIPTION("w90p910 MAC driver!");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("platform:w90p910-emc");
+MODULE_ALIAS("platform:nuc900-emc");
diff --git a/drivers/net/atl1c/atl1c_ethtool.c b/drivers/net/atl1c/atl1c_ethtool.c
index 607007d75b6f..00d11b480af3 100644
--- a/drivers/net/atl1c/atl1c_ethtool.c
+++ b/drivers/net/atl1c/atl1c_ethtool.c
@@ -232,11 +232,11 @@ static void atl1c_get_drvinfo(struct net_device *netdev,
 {
        struct atl1c_adapter *adapter = netdev_priv(netdev);
-        strncpy(drvinfo->driver,  atl1c_driver_name, sizeof(drvinfo->driver));
+        strlcpy(drvinfo->driver,  atl1c_driver_name, sizeof(drvinfo->driver));
-        strncpy(drvinfo->version, atl1c_driver_version,
+        strlcpy(drvinfo->version, atl1c_driver_version,
                sizeof(drvinfo->version));
-        strncpy(drvinfo->fw_version, "N/A", sizeof(drvinfo->fw_version));
+        strlcpy(drvinfo->fw_version, "N/A", sizeof(drvinfo->fw_version));
-        strncpy(drvinfo->bus_info, pci_name(adapter->pdev),
+        strlcpy(drvinfo->bus_info, pci_name(adapter->pdev),
                sizeof(drvinfo->bus_info));
        drvinfo->n_stats = 0;
        drvinfo->testinfo_len = 0;
diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c
index 94d7325caf4f..8bca12f71390 100644
--- a/drivers/net/atlx/atl1.c
+++ b/drivers/net/atlx/atl1.c
@@ -3378,11 +3378,11 @@ static void atl1_get_drvinfo(struct net_device *netdev,
 {
        struct atl1_adapter *adapter = netdev_priv(netdev);
-        strncpy(drvinfo->driver, ATLX_DRIVER_NAME, sizeof(drvinfo->driver));
+        strlcpy(drvinfo->driver, ATLX_DRIVER_NAME, sizeof(drvinfo->driver));
-        strncpy(drvinfo->version, ATLX_DRIVER_VERSION,
+        strlcpy(drvinfo->version, ATLX_DRIVER_VERSION,
                sizeof(drvinfo->version));
-        strncpy(drvinfo->fw_version, "N/A", sizeof(drvinfo->fw_version));
+        strlcpy(drvinfo->fw_version, "N/A", sizeof(drvinfo->fw_version));
-        strncpy(drvinfo->bus_info, pci_name(adapter->pdev),
+        strlcpy(drvinfo->bus_info, pci_name(adapter->pdev),
                sizeof(drvinfo->bus_info));
        drvinfo->eedump_len = ATL1_EEDUMP_LEN;
 }
diff --git a/drivers/net/b44.c b/drivers/net/b44.c
index 36d4d377ec2f..bafca672ea7d 100644
--- a/drivers/net/b44.c
+++ b/drivers/net/b44.c
@@ -952,9 +952,10 @@ static int b44_start_xmit(struct sk_buff *skb, struct net_device *dev)
        int rc = NETDEV_TX_OK;
        dma_addr_t mapping;
        u32 len, entry, ctrl;
+        unsigned long flags;
        len = skb->len;
-        spin_lock_irq(&bp->lock);
+        spin_lock_irqsave(&bp->lock, flags);
        /* This is a hard error, log it. */
        if (unlikely(TX_BUFFS_AVAIL(bp) < 1)) {
@@ -1027,7 +1028,7 @@ static int b44_start_xmit(struct sk_buff *skb, struct net_device *dev)
        dev->trans_start = jiffies;
 out_unlock:
-        spin_unlock_irq(&bp->lock);
+        spin_unlock_irqrestore(&bp->lock, flags);
        return rc;
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index b70cc99962fc..06b901152d44 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -399,9 +399,11 @@ static int bnx2_unregister_cnic(struct net_device *dev)
        struct bnx2_napi *bnapi = &bp->bnx2_napi[0];
        struct cnic_eth_dev *cp = &bp->cnic_eth_dev;
+        mutex_lock(&bp->cnic_lock);
        cp->drv_state = 0;
        bnapi->cnic_present = 0;
        rcu_assign_pointer(bp->cnic_ops, NULL);
+        mutex_unlock(&bp->cnic_lock);
        synchronize_rcu();
        return 0;
 }
@@ -429,13 +431,13 @@ bnx2_cnic_stop(struct bnx2 *bp)
        struct cnic_ops *c_ops;
        struct cnic_ctl_info info;
-        rcu_read_lock();
+        mutex_lock(&bp->cnic_lock);
-        c_ops = rcu_dereference(bp->cnic_ops);
+        c_ops = bp->cnic_ops;
        if (c_ops) {
                info.cmd = CNIC_CTL_STOP_CMD;
                c_ops->cnic_ctl(bp->cnic_data, &info);
        }
-        rcu_read_unlock();
+        mutex_unlock(&bp->cnic_lock);
 }
 static void
@@ -444,8 +446,8 @@ bnx2_cnic_start(struct bnx2 *bp)
        struct cnic_ops *c_ops;
        struct cnic_ctl_info info;
-        rcu_read_lock();
+        mutex_lock(&bp->cnic_lock);
-        c_ops = rcu_dereference(bp->cnic_ops);
+        c_ops = bp->cnic_ops;
        if (c_ops) {
                if (!(bp->flags & BNX2_FLAG_USING_MSIX)) {
                        struct bnx2_napi *bnapi = &bp->bnx2_napi[0];
@@ -455,7 +457,7 @@ bnx2_cnic_start(struct bnx2 *bp)
                info.cmd = CNIC_CTL_START_CMD;
                c_ops->cnic_ctl(bp->cnic_data, &info);
        }
-        rcu_read_unlock();
+        mutex_unlock(&bp->cnic_lock);
 }
 #else
@@ -7663,6 +7665,9 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
        spin_lock_init(&bp->phy_lock);
        spin_lock_init(&bp->indirect_lock);
+#ifdef BCM_CNIC
+        mutex_init(&bp->cnic_lock);
+#endif
        INIT_WORK(&bp->reset_task, bnx2_reset_task);
        dev->base_addr = dev->mem_start = pci_resource_start(pdev, 0);
diff --git a/drivers/net/bnx2.h b/drivers/net/bnx2.h
index f1edfaa9e56a..a4f12fd0ecd2 100644
--- a/drivers/net/bnx2.h
+++ b/drivers/net/bnx2.h
@@ -6902,6 +6902,7 @@ struct bnx2 {
        u32                     idle_chk_status_idx;
 #ifdef BCM_CNIC
+        struct mutex            cnic_lock;
        struct cnic_eth_dev     cnic_eth_dev;
 #endif
diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
index 9e4283aff828..e1a4f8214239 100644
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -611,11 +611,18 @@ nla_put_failure:
        return -EMSGSIZE;
 }
+static int can_newlink(struct net_device *dev,
+                       struct nlattr *tb[], struct nlattr *data[])
+{
+        return -EOPNOTSUPP;
+}
 static struct rtnl_link_ops can_link_ops __read_mostly = {
        .kind           = "can",
        .maxtype        = IFLA_CAN_MAX,
        .policy         = can_policy,
        .setup          = can_setup,
+        .newlink        = can_newlink,
        .changelink     = can_changelink,
        .fill_info      = can_fill_info,
        .fill_xstats    = can_fill_xstats,
diff --git a/drivers/net/cnic.c b/drivers/net/cnic.c
index 4869d77cbe91..74c342959b7b 100644
--- a/drivers/net/cnic.c
+++ b/drivers/net/cnic.c
@@ -138,6 +138,16 @@ static struct cnic_dev *cnic_from_netdev(struct net_device *netdev)
        return NULL;
 }
+static inline void ulp_get(struct cnic_ulp_ops *ulp_ops)
+{
+        atomic_inc(&ulp_ops->ref_count);
+}
+static inline void ulp_put(struct cnic_ulp_ops *ulp_ops)
+{
+        atomic_dec(&ulp_ops->ref_count);
+}
 static void cnic_ctx_wr(struct cnic_dev *dev, u32 cid_addr, u32 off, u32 val)
 {
        struct cnic_local *cp = dev->cnic_priv;
@@ -358,6 +368,7 @@ int cnic_register_driver(int ulp_type, struct cnic_ulp_ops *ulp_ops)
        }
        read_unlock(&cnic_dev_lock);
+        atomic_set(&ulp_ops->ref_count, 0);
        rcu_assign_pointer(cnic_ulp_tbl[ulp_type], ulp_ops);
        mutex_unlock(&cnic_lock);
@@ -379,6 +390,8 @@ int cnic_register_driver(int ulp_type, struct cnic_ulp_ops *ulp_ops)
 int cnic_unregister_driver(int ulp_type)
 {
        struct cnic_dev *dev;
+        struct cnic_ulp_ops *ulp_ops;
+        int i = 0;
        if (ulp_type >= MAX_CNIC_ULP_TYPE) {
                printk(KERN_ERR PFX "cnic_unregister_driver: Bad type %d\n",
@@ -386,7 +399,8 @@ int cnic_unregister_driver(int ulp_type)
                return -EINVAL;
        }
        mutex_lock(&cnic_lock);
-        if (!cnic_ulp_tbl[ulp_type]) {
+        ulp_ops = cnic_ulp_tbl[ulp_type];
+        if (!ulp_ops) {
                printk(KERN_ERR PFX "cnic_unregister_driver: Type %d has not "
                                    "been registered\n", ulp_type);
                goto out_unlock;
@@ -411,6 +425,14 @@ int cnic_unregister_driver(int ulp_type)
        mutex_unlock(&cnic_lock);
        synchronize_rcu();
+        while ((atomic_read(&ulp_ops->ref_count) != 0) && (i < 20)) {
+                msleep(100);
+                i++;
+        }
+        if (atomic_read(&ulp_ops->ref_count) != 0)
+                printk(KERN_WARNING PFX "%s: Failed waiting for ref count to go"
+                                        " to zero.\n", dev->netdev->name);
        return 0;
 out_unlock:
@@ -466,6 +488,7 @@ EXPORT_SYMBOL(cnic_register_driver);
 static int cnic_unregister_device(struct cnic_dev *dev, int ulp_type)
 {
        struct cnic_local *cp = dev->cnic_priv;
+        int i = 0;
        if (ulp_type >= MAX_CNIC_ULP_TYPE) {
                printk(KERN_ERR PFX "cnic_unregister_device: Bad type %d\n",
@@ -486,6 +509,15 @@ static int cnic_unregister_device(struct cnic_dev *dev, int ulp_type)
        synchronize_rcu();
+        while (test_bit(ULP_F_CALL_PENDING, &cp->ulp_flags[ulp_type]) &&
+               i < 20) {
+                msleep(100);
+                i++;
+        }
+        if (test_bit(ULP_F_CALL_PENDING, &cp->ulp_flags[ulp_type]))
+                printk(KERN_WARNING PFX "%s: Failed waiting for ULP up call"
+                                        " to complete.\n", dev->netdev->name);
        return 0;
 }
 EXPORT_SYMBOL(cnic_unregister_driver);
@@ -1076,18 +1108,23 @@ static void cnic_ulp_stop(struct cnic_dev *dev)
        if (cp->cnic_uinfo)
                cnic_send_nlmsg(cp, ISCSI_KEVENT_IF_DOWN, NULL);
-        rcu_read_lock();
        for (if_type = 0; if_type < MAX_CNIC_ULP_TYPE; if_type++) {
                struct cnic_ulp_ops *ulp_ops;
-                ulp_ops = rcu_dereference(cp->ulp_ops[if_type]);
+                mutex_lock(&cnic_lock);
-                if (!ulp_ops)
+                ulp_ops = cp->ulp_ops[if_type];
+                if (!ulp_ops) {
+                        mutex_unlock(&cnic_lock);
                        continue;
+                }
+                set_bit(ULP_F_CALL_PENDING, &cp->ulp_flags[if_type]);
+                mutex_unlock(&cnic_lock);
                if (test_and_clear_bit(ULP_F_START, &cp->ulp_flags[if_type]))
                        ulp_ops->cnic_stop(cp->ulp_handle[if_type]);
+                clear_bit(ULP_F_CALL_PENDING, &cp->ulp_flags[if_type]);
        }
-        rcu_read_unlock();
 }
 static void cnic_ulp_start(struct cnic_dev *dev)
@@ -1095,18 +1132,23 @@ static void cnic_ulp_start(struct cnic_dev *dev)
        struct cnic_local *cp = dev->cnic_priv;
        int if_type;
-        rcu_read_lock();
        for (if_type = 0; if_type < MAX_CNIC_ULP_TYPE; if_type++) {
                struct cnic_ulp_ops *ulp_ops;
-                ulp_ops = rcu_dereference(cp->ulp_ops[if_type]);
+                mutex_lock(&cnic_lock);
-                if (!ulp_ops || !ulp_ops->cnic_start)
+                ulp_ops = cp->ulp_ops[if_type];
+                if (!ulp_ops || !ulp_ops->cnic_start) {
+                        mutex_unlock(&cnic_lock);
                        continue;
+                }
+                set_bit(ULP_F_CALL_PENDING, &cp->ulp_flags[if_type]);
+                mutex_unlock(&cnic_lock);
                if (!test_and_set_bit(ULP_F_START, &cp->ulp_flags[if_type]))
                        ulp_ops->cnic_start(cp->ulp_handle[if_type]);
+                clear_bit(ULP_F_CALL_PENDING, &cp->ulp_flags[if_type]);
        }
-        rcu_read_unlock();
 }
 static int cnic_ctl(void *data, struct cnic_ctl_info *info)
@@ -1116,22 +1158,18 @@ static int cnic_ctl(void *data, struct cnic_ctl_info *info)
        switch (info->cmd) {
        case CNIC_CTL_STOP_CMD:
                cnic_hold(dev);
-                mutex_lock(&cnic_lock);
                cnic_ulp_stop(dev);
                cnic_stop_hw(dev);
-                mutex_unlock(&cnic_lock);
                cnic_put(dev);
                break;
        case CNIC_CTL_START_CMD:
                cnic_hold(dev);
-                mutex_lock(&cnic_lock);
                if (!cnic_start_hw(dev))
                        cnic_ulp_start(dev);
-                mutex_unlock(&cnic_lock);
                cnic_put(dev);
                break;
        default:
@@ -1145,19 +1183,23 @@ static void cnic_ulp_init(struct cnic_dev *dev)
        int i;
        struct cnic_local *cp = dev->cnic_priv;
-        rcu_read_lock();
        for (i = 0; i < MAX_CNIC_ULP_TYPE_EXT; i++) {
                struct cnic_ulp_ops *ulp_ops;
-                ulp_ops = rcu_dereference(cnic_ulp_tbl[i]);
+                mutex_lock(&cnic_lock);
-                if (!ulp_ops || !ulp_ops->cnic_init)
+                ulp_ops = cnic_ulp_tbl[i];
+                if (!ulp_ops || !ulp_ops->cnic_init) {
+                        mutex_unlock(&cnic_lock);
                        continue;
+                }
+                ulp_get(ulp_ops);
+                mutex_unlock(&cnic_lock);
                if (!test_and_set_bit(ULP_F_INIT, &cp->ulp_flags[i]))
                        ulp_ops->cnic_init(dev);
+                ulp_put(ulp_ops);
        }
-        rcu_read_unlock();
 }
 static void cnic_ulp_exit(struct cnic_dev *dev)
@@ -1165,19 +1207,23 @@ static void cnic_ulp_exit(struct cnic_dev *dev)
        int i;
        struct cnic_local *cp = dev->cnic_priv;
-        rcu_read_lock();
        for (i = 0; i < MAX_CNIC_ULP_TYPE_EXT; i++) {
                struct cnic_ulp_ops *ulp_ops;
-                ulp_ops = rcu_dereference(cnic_ulp_tbl[i]);
+                mutex_lock(&cnic_lock);
-                if (!ulp_ops || !ulp_ops->cnic_exit)
+                ulp_ops = cnic_ulp_tbl[i];
+                if (!ulp_ops || !ulp_ops->cnic_exit) {
+                        mutex_unlock(&cnic_lock);
                        continue;
+                }
+                ulp_get(ulp_ops);
+                mutex_unlock(&cnic_lock);
                if (test_and_clear_bit(ULP_F_INIT, &cp->ulp_flags[i]))
                        ulp_ops->cnic_exit(dev);
+                ulp_put(ulp_ops);
        }
-        rcu_read_unlock();
 }
 static int cnic_cm_offload_pg(struct cnic_sock *csk)
@@ -2393,21 +2439,45 @@ static int cnic_start_bnx2_hw(struct cnic_dev *dev)
        return 0;
 }
-static int cnic_start_hw(struct cnic_dev *dev)
+static int cnic_register_netdev(struct cnic_dev *dev)
 {
        struct cnic_local *cp = dev->cnic_priv;
        struct cnic_eth_dev *ethdev = cp->ethdev;
        int err;
-        if (test_bit(CNIC_F_CNIC_UP, &dev->flags))
+        if (!ethdev)
-                return -EALREADY;
+                return -ENODEV;
+        if (ethdev->drv_state & CNIC_DRV_STATE_REGD)
+                return 0;
        err = ethdev->drv_register_cnic(dev->netdev, cp->cnic_ops, dev);
-        if (err) {
+        if (err)
                printk(KERN_ERR PFX "%s: register_cnic failed\n",
                       dev->netdev->name);
-                goto err2;
-        }
+        return err;
+}
+static void cnic_unregister_netdev(struct cnic_dev *dev)
+{
+        struct cnic_local *cp = dev->cnic_priv;
+        struct cnic_eth_dev *ethdev = cp->ethdev;
+        if (!ethdev)
+                return;
+        ethdev->drv_unregister_cnic(dev->netdev);
+}
+static int cnic_start_hw(struct cnic_dev *dev)
+{
+        struct cnic_local *cp = dev->cnic_priv;
+        struct cnic_eth_dev *ethdev = cp->ethdev;
+        int err;
+        if (test_bit(CNIC_F_CNIC_UP, &dev->flags))
+                return -EALREADY;
        dev->regview = ethdev->io_base;
        cp->chip_id = ethdev->chip_id;
@@ -2438,18 +2508,13 @@ static int cnic_start_hw(struct cnic_dev *dev)
        return 0;
 err1:
-        ethdev->drv_unregister_cnic(dev->netdev);
        cp->free_resc(dev);
        pci_dev_put(dev->pcidev);
-err2:
        return err;
 }
 static void cnic_stop_bnx2_hw(struct cnic_dev *dev)
 {
-        struct cnic_local *cp = dev->cnic_priv;
-        struct cnic_eth_dev *ethdev = cp->ethdev;
        cnic_disable_bnx2_int_sync(dev);
        cnic_reg_wr_ind(dev, BNX2_CP_SCRATCH + 0x20, 0);
@@ -2461,8 +2526,6 @@ static void cnic_stop_bnx2_hw(struct cnic_dev *dev)
        cnic_setup_5709_context(dev, 0);
        cnic_free_irq(dev);
-        ethdev->drv_unregister_cnic(dev->netdev);
        cnic_free_resc(dev);
 }
@@ -2543,7 +2606,7 @@ static struct cnic_dev *init_bnx2_cnic(struct net_device *dev)
        probe = symbol_get(bnx2_cnic_probe);
        if (probe) {
                ethdev = (*probe)(dev);
-                symbol_put_addr(probe);
+                symbol_put(bnx2_cnic_probe);
        }
        if (!ethdev)
                return NULL;
@@ -2646,10 +2709,12 @@ static int cnic_netdev_event(struct notifier_block *this, unsigned long event,
                else if (event == NETDEV_UNREGISTER)
                        cnic_ulp_exit(dev);
                else if (event == NETDEV_UP) {
-                        mutex_lock(&cnic_lock);
+                        if (cnic_register_netdev(dev) != 0) {
+                                cnic_put(dev);
+                                goto done;
+                        }
                        if (!cnic_start_hw(dev))
                                cnic_ulp_start(dev);
-                        mutex_unlock(&cnic_lock);
                }
                rcu_read_lock();
@@ -2668,10 +2733,9 @@ static int cnic_netdev_event(struct notifier_block *this, unsigned long event,
                rcu_read_unlock();
                if (event == NETDEV_GOING_DOWN) {
-                        mutex_lock(&cnic_lock);
                        cnic_ulp_stop(dev);
                        cnic_stop_hw(dev);
-                        mutex_unlock(&cnic_lock);
+                        cnic_unregister_netdev(dev);
                } else if (event == NETDEV_UNREGISTER) {
                        write_lock(&cnic_dev_lock);
                        list_del_init(&dev->list);
@@ -2703,6 +2767,7 @@ static void cnic_release(void)
                }
                cnic_ulp_exit(dev);
+                cnic_unregister_netdev(dev);
                list_del_init(&dev->list);
                cnic_free_dev(dev);
        }
diff --git a/drivers/net/cnic.h b/drivers/net/cnic.h
index 5192d4a9df5a..a94b302bb464 100644
--- a/drivers/net/cnic.h
+++ b/drivers/net/cnic.h
@@ -176,6 +176,7 @@ struct cnic_local {
        unsigned long ulp_flags[MAX_CNIC_ULP_TYPE];
 #define ULP_F_INIT      0
 #define ULP_F_START     1
+#define ULP_F_CALL_PENDING      2
        struct cnic_ulp_ops *ulp_ops[MAX_CNIC_ULP_TYPE];
        /* protected by ulp_lock */
diff --git a/drivers/net/cnic_if.h b/drivers/net/cnic_if.h
index d1bce27ee99e..a49235739eef 100644
--- a/drivers/net/cnic_if.h
+++ b/drivers/net/cnic_if.h
@@ -290,6 +290,7 @@ struct cnic_ulp_ops {
        void (*iscsi_nl_send_msg)(struct cnic_dev *dev, u32 msg_type,
                                  char *data, u16 data_size);
        struct module *owner;
+        atomic_t ref_count;
 };
 extern int cnic_register_driver(int ulp_type, struct cnic_ulp_ops *ulp_ops);
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index 41b648a67fec..3a6735dc9f6a 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -1899,7 +1899,7 @@ static int e100_rx_indicate(struct nic *nic, struct rx *rx,
                                nic->ru_running = RU_SUSPENDED;
                pci_dma_sync_single_for_device(nic->pdev, rx->dma_addr,
                                               sizeof(struct rfd),
-                                               PCI_DMA_BIDIRECTIONAL);
+                                               PCI_DMA_FROMDEVICE);
                return -ENODATA;
        }
diff --git a/drivers/net/e1000e/ich8lan.c b/drivers/net/e1000e/ich8lan.c
index d56c7473144a..99df2abf82a9 100644
--- a/drivers/net/e1000e/ich8lan.c
+++ b/drivers/net/e1000e/ich8lan.c
@@ -338,10 +338,7 @@ static s32 e1000_init_nvm_params_ich8lan(struct e1000_hw *hw)
 {
        struct e1000_nvm_info *nvm = &hw->nvm;
        struct e1000_dev_spec_ich8lan *dev_spec = &hw->dev_spec.ich8lan;
-        union ich8_hws_flash_status hsfsts;
+        u32 gfpreg, sector_base_addr, sector_end_addr;
-        u32 gfpreg;
-        u32 sector_base_addr;
-        u32 sector_end_addr;
        u16 i;
        /* Can't read flash registers if the register set isn't mapped. */
@@ -375,20 +372,6 @@ static s32 e1000_init_nvm_params_ich8lan(struct e1000_hw *hw)
        /* Adjust to word count */
        nvm->flash_bank_size /= sizeof(u16);
-        /*
-         * Make sure the flash bank size does not overwrite the 4k
-         * sector ranges. We may have 64k allotted to us but we only care
-         * about the first 2 4k sectors. Therefore, if we have anything less
-         * than 64k set in the HSFSTS register, we will reduce the bank size
-         * down to 4k and let the rest remain unused. If berasesz == 3, then
-         * we are working in 64k mode. Otherwise we are not.
-         */
-        if (nvm->flash_bank_size > E1000_ICH8_SHADOW_RAM_WORDS) {
-                hsfsts.regval = er16flash(ICH_FLASH_HSFSTS);
-                if (hsfsts.hsf_status.berasesz != 3)
-                        nvm->flash_bank_size = E1000_ICH8_SHADOW_RAM_WORDS;
-        }
        nvm->word_size = E1000_ICH8_SHADOW_RAM_WORDS;
        /* Clear shadow ram */
@@ -594,8 +577,8 @@ static DEFINE_MUTEX(nvm_mutex);
 **/
 static s32 e1000_acquire_swflag_ich8lan(struct e1000_hw *hw)
 {
-        u32 extcnf_ctrl;
+        u32 extcnf_ctrl, timeout = PHY_CFG_TIMEOUT;
-        u32 timeout = PHY_CFG_TIMEOUT;
+        s32 ret_val = 0;
        might_sleep();
@@ -603,28 +586,46 @@ static s32 e1000_acquire_swflag_ich8lan(struct e1000_hw *hw)
        while (timeout) {
                extcnf_ctrl = er32(EXTCNF_CTRL);
+                if (!(extcnf_ctrl & E1000_EXTCNF_CTRL_SWFLAG))
+                        break;
-                if (!(extcnf_ctrl & E1000_EXTCNF_CTRL_SWFLAG)) {
+                mdelay(1);
-                        extcnf_ctrl |= E1000_EXTCNF_CTRL_SWFLAG;
+                timeout--;
-                        ew32(EXTCNF_CTRL, extcnf_ctrl);
+        }
+        if (!timeout) {
+                hw_dbg(hw, "SW/FW/HW has locked the resource for too long.\n");
+                ret_val = -E1000_ERR_CONFIG;
+                goto out;
+        }
+        timeout = PHY_CFG_TIMEOUT * 2;
+        extcnf_ctrl |= E1000_EXTCNF_CTRL_SWFLAG;
+        ew32(EXTCNF_CTRL, extcnf_ctrl);
+        while (timeout) {
+                extcnf_ctrl = er32(EXTCNF_CTRL);
+                if (extcnf_ctrl & E1000_EXTCNF_CTRL_SWFLAG)
+                        break;
-                        extcnf_ctrl = er32(EXTCNF_CTRL);
-                        if (extcnf_ctrl & E1000_EXTCNF_CTRL_SWFLAG)
-                                break;
-                }
                mdelay(1);
                timeout--;
        }
        if (!timeout) {
-                hw_dbg(hw, "FW or HW has locked the resource for too long.\n");
+                hw_dbg(hw, "Failed to acquire the semaphore.\n");
                extcnf_ctrl &= ~E1000_EXTCNF_CTRL_SWFLAG;
                ew32(EXTCNF_CTRL, extcnf_ctrl);
-                mutex_unlock(&nvm_mutex);
+                ret_val = -E1000_ERR_CONFIG;
-                return -E1000_ERR_CONFIG;
+                goto out;
        }
-        return 0;
+out:
+        if (ret_val)
+                mutex_unlock(&nvm_mutex);
+        return ret_val;
 }
 /**
@@ -1306,7 +1307,7 @@ static s32 e1000_read_nvm_ich8lan(struct e1000_hw *hw, u16 offset, u16 words,
        struct e1000_nvm_info *nvm = &hw->nvm;
        struct e1000_dev_spec_ich8lan *dev_spec = &hw->dev_spec.ich8lan;
        u32 act_offset;
-        s32 ret_val;
+        s32 ret_val = 0;
        u32 bank = 0;
        u16 i, word;
@@ -1321,12 +1322,15 @@ static s32 e1000_read_nvm_ich8lan(struct e1000_hw *hw, u16 offset, u16 words,
                goto out;
        ret_val = e1000_valid_nvm_bank_detect_ich8lan(hw, &bank);
-        if (ret_val)
+        if (ret_val) {
-                goto release;
+                hw_dbg(hw, "Could not detect valid bank, assuming bank 0\n");
+                bank = 0;
+        }
        act_offset = (bank) ? nvm->flash_bank_size : 0;
        act_offset += offset;
+        ret_val = 0;
        for (i = 0; i < words; i++) {
                if ((dev_spec->shadow_ram) &&
                    (dev_spec->shadow_ram[offset+i].modified)) {
@@ -1341,7 +1345,6 @@ static s32 e1000_read_nvm_ich8lan(struct e1000_hw *hw, u16 offset, u16 words,
                }
        }
-release:
        e1000_release_swflag_ich8lan(hw);
 out:
@@ -1592,7 +1595,6 @@ static s32 e1000_write_nvm_ich8lan(struct e1000_hw *hw, u16 offset, u16 words,
 {
        struct e1000_nvm_info *nvm = &hw->nvm;
        struct e1000_dev_spec_ich8lan *dev_spec = &hw->dev_spec.ich8lan;
-        s32 ret_val;
        u16 i;
        if ((offset >= nvm->word_size) || (words > nvm->word_size - offset) ||
@@ -1601,17 +1603,11 @@ static s32 e1000_write_nvm_ich8lan(struct e1000_hw *hw, u16 offset, u16 words,
                return -E1000_ERR_NVM;
        }
-        ret_val = e1000_acquire_swflag_ich8lan(hw);
-        if (ret_val)
-                return ret_val;
        for (i = 0; i < words; i++) {
                dev_spec->shadow_ram[offset+i].modified = 1;
                dev_spec->shadow_ram[offset+i].value = data[i];
        }
-        e1000_release_swflag_ich8lan(hw);
        return 0;
 }
@@ -1652,8 +1648,8 @@ static s32 e1000_update_nvm_checksum_ich8lan(struct e1000_hw *hw)
         */
        ret_val =  e1000_valid_nvm_bank_detect_ich8lan(hw, &bank);
        if (ret_val) {
-                e1000_release_swflag_ich8lan(hw);
+                hw_dbg(hw, "Could not detect valid bank, assuming bank 0\n");
-                goto out;
+                bank = 0;
        }
        if (bank == 0) {
@@ -2039,12 +2035,8 @@ static s32 e1000_erase_flash_bank_ich8lan(struct e1000_hw *hw, u32 bank)
                iteration = 1;
                break;
        case 2:
-                if (hw->mac.type == e1000_ich9lan) {
+                sector_size = ICH_FLASH_SEG_SIZE_8K;
-                        sector_size = ICH_FLASH_SEG_SIZE_8K;
+                iteration = 1;
-                        iteration = flash_bank_size / ICH_FLASH_SEG_SIZE_8K;
-                } else {
-                        return -E1000_ERR_NVM;
-                }
                break;
        case 3:
                sector_size = ICH_FLASH_SEG_SIZE_64K;
@@ -2056,7 +2048,7 @@ static s32 e1000_erase_flash_bank_ich8lan(struct e1000_hw *hw, u32 bank)
        /* Start with the base address, then add the sector offset. */
        flash_linear_addr = hw->nvm.flash_base_addr;
-        flash_linear_addr += (bank) ? (sector_size * iteration) : 0;
+        flash_linear_addr += (bank) ? flash_bank_size : 0;
        for (j = 0; j < iteration ; j++) {
                do {
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 63415bb6f48f..fa92a683aefd 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -4538,8 +4538,7 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool *enable_wake)
                /* Allow time for pending master requests to run */
                e1000e_disable_pcie_master(&adapter->hw);
-                if ((adapter->flags2 & FLAG2_HAS_PHY_WAKEUP) &&
+                if (adapter->flags2 & FLAG2_HAS_PHY_WAKEUP) {
-                    !(hw->mac.ops.check_mng_mode(hw))) {
                        /* enable wakeup by the PHY */
                        retval = e1000_init_phy_wakeup(adapter, wufc);
                        if (retval)
@@ -4557,7 +4556,8 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool *enable_wake)
        *enable_wake = !!wufc;
        /* make sure adapter isn't asleep if manageability is enabled */
-        if (adapter->flags & FLAG_MNG_PT_ENABLED)
+        if ((adapter->flags & FLAG_MNG_PT_ENABLED) ||
+            (hw->mac.ops.check_mng_mode(hw)))
                *enable_wake = true;
        if (adapter->hw.phy.type == e1000_phy_igp_3)
@@ -4670,14 +4670,6 @@ static int e1000_resume(struct pci_dev *pdev)
                return err;
        }
-        /* AER (Advanced Error Reporting) hooks */
-        err = pci_enable_pcie_error_reporting(pdev);
-        if (err) {
-                dev_err(&pdev->dev, "pci_enable_pcie_error_reporting failed "
-                                    "0x%x\n", err);
-                /* non-fatal, continue */
-        }
        pci_set_master(pdev);
        pci_enable_wake(pdev, PCI_D3hot, 0);
@@ -4990,6 +4982,14 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
        if (err)
                goto err_pci_reg;
+        /* AER (Advanced Error Reporting) hooks */
+        err = pci_enable_pcie_error_reporting(pdev);
+        if (err) {
+                dev_err(&pdev->dev, "pci_enable_pcie_error_reporting failed "
+                        "0x%x\n", err);
+                /* non-fatal, continue */
+        }
        pci_set_master(pdev);
        /* PCI config space info */
        err = pci_save_state(pdev);
diff --git a/drivers/net/fec.c b/drivers/net/fec.c
index d4b98074b1b7..c9fd82d3a80d 100644
--- a/drivers/net/fec.c
+++ b/drivers/net/fec.c
@@ -285,6 +285,7 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
        struct fec_enet_private *fep = netdev_priv(dev);
        struct bufdesc *bdp;
+        void *bufaddr;
        unsigned short  status;
        unsigned long flags;
@@ -312,7 +313,7 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
        status &= ~BD_ENET_TX_STATS;
        /* Set buffer length and buffer pointer */
-        bdp->cbd_bufaddr = __pa(skb->data);
+        bufaddr = skb->data;
        bdp->cbd_datlen = skb->len;
        /*
@@ -320,11 +321,11 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
         * 4-byte boundaries. Use bounce buffers to copy data
         * and get it aligned. Ugh.
         */
-        if (bdp->cbd_bufaddr & FEC_ALIGNMENT) {
+        if (((unsigned long) bufaddr) & FEC_ALIGNMENT) {
                unsigned int index;
                index = bdp - fep->tx_bd_base;
                memcpy(fep->tx_bounce[index], (void *)skb->data, skb->len);
-                bdp->cbd_bufaddr = __pa(fep->tx_bounce[index]);
+                bufaddr = fep->tx_bounce[index];
        }
        /* Save skb pointer */
@@ -336,7 +337,7 @@ fec_enet_start_xmit(struct sk_buff *skb, struct net_device *dev)
        /* Push the data cache so the CPM does not get stale memory
         * data.
         */
-        bdp->cbd_bufaddr = dma_map_single(&dev->dev, skb->data,
+        bdp->cbd_bufaddr = dma_map_single(&dev->dev, bufaddr,
                        FEC_ENET_TX_FRSIZE, DMA_TO_DEVICE);
        /* Send it on its way.  Tell FEC it's ready, interrupt when done,
diff --git a/drivers/net/fec_mpc52xx.c b/drivers/net/fec_mpc52xx.c
index cc786333d95c..c40113f58963 100644
--- a/drivers/net/fec_mpc52xx.c
+++ b/drivers/net/fec_mpc52xx.c
@@ -309,6 +309,7 @@ static int mpc52xx_fec_start_xmit(struct sk_buff *skb, struct net_device *dev)
 {
        struct mpc52xx_fec_priv *priv = netdev_priv(dev);
        struct bcom_fec_bd *bd;
+        unsigned long flags;
        if (bcom_queue_full(priv->tx_dmatsk)) {
                if (net_ratelimit())
@@ -316,7 +317,7 @@ static int mpc52xx_fec_start_xmit(struct sk_buff *skb, struct net_device *dev)
                return NETDEV_TX_BUSY;
        }
-        spin_lock_irq(&priv->lock);
+        spin_lock_irqsave(&priv->lock, flags);
        dev->trans_start = jiffies;
        bd = (struct bcom_fec_bd *)
@@ -332,7 +333,7 @@ static int mpc52xx_fec_start_xmit(struct sk_buff *skb, struct net_device *dev)
                netif_stop_queue(dev);
        }
-        spin_unlock_irq(&priv->lock);
+        spin_unlock_irqrestore(&priv->lock, flags);
        return NETDEV_TX_OK;
 }
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index f8ffcbf0bc39..24f7ca5e17de 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -491,6 +491,7 @@ static int gfar_remove(struct of_device *ofdev)
        dev_set_drvdata(&ofdev->dev, NULL);
+        unregister_netdev(dev);
        iounmap(priv->regs);
        free_netdev(priv->ndev);
@@ -936,6 +937,7 @@ int startup_gfar(struct net_device *dev)
        struct gfar __iomem *regs = priv->regs;
        int err = 0;
        u32 rctrl = 0;
+        u32 tctrl = 0;
        u32 attrs = 0;
        gfar_write(&regs->imask, IMASK_INIT_CLEAR);
@@ -1111,11 +1113,19 @@ int startup_gfar(struct net_device *dev)
                rctrl |= RCTRL_PADDING(priv->padding);
        }
+        /* keep vlan related bits if it's enabled */
+        if (priv->vlgrp) {
+                rctrl |= RCTRL_VLEX | RCTRL_PRSDEP_INIT;
+                tctrl |= TCTRL_VLINS;
+        }
        /* Init rctrl based on our settings */
        gfar_write(&priv->regs->rctrl, rctrl);
        if (dev->features & NETIF_F_IP_CSUM)
-                gfar_write(&priv->regs->tctrl, TCTRL_INIT_CSUM);
+                tctrl |= TCTRL_INIT_CSUM;
+        gfar_write(&priv->regs->tctrl, tctrl);
        /* Set the extraction length and index */
        attrs = ATTRELI_EL(priv->rx_stash_size) |
@@ -1450,7 +1460,6 @@ static void gfar_vlan_rx_register(struct net_device *dev,
                /* Enable VLAN tag extraction */
                tempval = gfar_read(&priv->regs->rctrl);
-                tempval |= RCTRL_VLEX;
                tempval |= (RCTRL_VLEX | RCTRL_PRSDEP_INIT);
                gfar_write(&priv->regs->rctrl, tempval);
        } else {
diff --git a/drivers/net/ibm_newemac/core.c b/drivers/net/ibm_newemac/core.c
index beb84213b671..f0f890803710 100644
--- a/drivers/net/ibm_newemac/core.c
+++ b/drivers/net/ibm_newemac/core.c
@@ -1305,6 +1305,8 @@ static int emac_close(struct net_device *ndev)
        free_irq(dev->emac_irq, dev);
+        netif_carrier_off(ndev);
        return 0;
 }
diff --git a/drivers/net/irda/au1k_ir.c b/drivers/net/irda/au1k_ir.c
index c4361d466597..ee1cff5c9b21 100644
--- a/drivers/net/irda/au1k_ir.c
+++ b/drivers/net/irda/au1k_ir.c
@@ -23,7 +23,6 @@
 #include <linux/init.h>
 #include <linux/errno.h>
 #include <linux/netdevice.h>
-#include <linux/etherdevice.h>
 #include <linux/slab.h>
 #include <linux/rtnetlink.h>
 #include <linux/interrupt.h>
@@ -205,9 +204,6 @@ static const struct net_device_ops au1k_irda_netdev_ops = {
        .ndo_start_xmit         = au1k_irda_hard_xmit,
        .ndo_tx_timeout         = au1k_tx_timeout,
        .ndo_do_ioctl           = au1k_irda_ioctl,
-        .ndo_change_mtu         = eth_change_mtu,
-        .ndo_validate_addr      = eth_validate_addr,
-        .ndo_set_mac_address    = eth_mac_addr,
 };
 static int au1k_irda_net_init(struct net_device *dev)
diff --git a/drivers/net/irda/pxaficp_ir.c b/drivers/net/irda/pxaficp_ir.c
index 3376a4f39e0a..77d10edefd25 100644
--- a/drivers/net/irda/pxaficp_ir.c
+++ b/drivers/net/irda/pxaficp_ir.c
@@ -803,9 +803,6 @@ static const struct net_device_ops pxa_irda_netdev_ops = {
        .ndo_stop               = pxa_irda_stop,
        .ndo_start_xmit         = pxa_irda_hard_xmit,
        .ndo_do_ioctl           = pxa_irda_ioctl,
-        .ndo_change_mtu         = eth_change_mtu,
-        .ndo_validate_addr      = eth_validate_addr,
-        .ndo_set_mac_address    = eth_mac_addr,
 };
 static int pxa_irda_probe(struct platform_device *pdev)
@@ -830,6 +827,7 @@ static int pxa_irda_probe(struct platform_device *pdev)
        if (!dev)
                goto err_mem_3;
+        SET_NETDEV_DEV(dev, &pdev->dev);
        si = netdev_priv(dev);
        si->dev = &pdev->dev;
        si->pdata = pdev->dev.platform_data;
diff --git a/drivers/net/irda/sa1100_ir.c b/drivers/net/irda/sa1100_ir.c
index 2aeb2e6aec1b..b039cb081e94 100644
--- a/drivers/net/irda/sa1100_ir.c
+++ b/drivers/net/irda/sa1100_ir.c
@@ -24,7 +24,6 @@
 #include <linux/init.h>
 #include <linux/errno.h>
 #include <linux/netdevice.h>
-#include <linux/etherdevice.h>
 #include <linux/slab.h>
 #include <linux/rtnetlink.h>
 #include <linux/interrupt.h>
@@ -881,9 +880,6 @@ static const struct net_device_ops sa1100_irda_netdev_ops = {
        .ndo_stop               = sa1100_irda_stop,
        .ndo_start_xmit         = sa1100_irda_hard_xmit,
        .ndo_do_ioctl           = sa1100_irda_ioctl,
-        .ndo_change_mtu         = eth_change_mtu,
-        .ndo_validate_addr      = eth_validate_addr,
-        .ndo_set_mac_address    = eth_mac_addr,
 };
 static int sa1100_irda_probe(struct platform_device *pdev)
diff --git a/drivers/net/irda/w83977af_ir.c b/drivers/net/irda/w83977af_ir.c
index d0883835b0c6..fe4f2b2bff96 100644
--- a/drivers/net/irda/w83977af_ir.c
+++ b/drivers/net/irda/w83977af_ir.c
@@ -115,7 +115,7 @@ static int __init w83977af_init(void)
        IRDA_DEBUG(0, "%s()\n", __func__ );
-        for (i=0; (io[i] < 2000) && (i < ARRAY_SIZE(dev_self)); i++) {
+        for (i=0; i < ARRAY_SIZE(dev_self) && io[i] < 2000; i++) {
                if (w83977af_open(i, io[i], irq[i], dma[i]) == 0)
                        return 0;
        }
diff --git a/drivers/net/ixgbe/ixgbe.h b/drivers/net/ixgbe/ixgbe.h
index e11d83d5852b..2c4dc8221dcd 100644
--- a/drivers/net/ixgbe/ixgbe.h
+++ b/drivers/net/ixgbe/ixgbe.h
@@ -136,6 +136,8 @@ struct ixgbe_ring {
        u8 queue_index; /* needed for multiqueue queue management */
+#define IXGBE_RING_RX_PS_ENABLED                (u8)(1)
+        u8 flags;                       /* per ring feature flags */
        u16 head;
        u16 tail;
diff --git a/drivers/net/ixgbe/ixgbe_ethtool.c b/drivers/net/ixgbe/ixgbe_ethtool.c
index 79144e950a34..dff8dfac7ed9 100644
--- a/drivers/net/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ixgbe/ixgbe_ethtool.c
@@ -1948,6 +1948,7 @@ static int ixgbe_set_coalesce(struct net_device *netdev,
                              struct ethtool_coalesce *ec)
 {
        struct ixgbe_adapter *adapter = netdev_priv(netdev);
+        struct ixgbe_q_vector *q_vector;
        int i;
        if (ec->tx_max_coalesced_frames_irq)
@@ -1982,14 +1983,24 @@ static int ixgbe_set_coalesce(struct net_device *netdev,
                adapter->itr_setting = 0;
        }
-        for (i = 0; i < adapter->num_msix_vectors - NON_Q_VECTORS; i++) {
+        /* MSI/MSIx Interrupt Mode */
-                struct ixgbe_q_vector *q_vector = adapter->q_vector[i];
+        if (adapter->flags &
-                if (q_vector->txr_count && !q_vector->rxr_count)
+            (IXGBE_FLAG_MSIX_ENABLED | IXGBE_FLAG_MSI_ENABLED)) {
-                        /* tx vector gets half the rate */
+                int num_vectors = adapter->num_msix_vectors - NON_Q_VECTORS;
-                        q_vector->eitr = (adapter->eitr_param >> 1);
+                for (i = 0; i < num_vectors; i++) {
-                else
+                        q_vector = adapter->q_vector[i];
-                        /* rx only or mixed */
+                        if (q_vector->txr_count && !q_vector->rxr_count)
-                        q_vector->eitr = adapter->eitr_param;
+                                /* tx vector gets half the rate */
+                                q_vector->eitr = (adapter->eitr_param >> 1);
+                        else
+                                /* rx only or mixed */
+                                q_vector->eitr = adapter->eitr_param;
+                        ixgbe_write_eitr(q_vector);
+                }
+        /* Legacy Interrupt Mode */
+        } else {
+                q_vector = adapter->q_vector[0];
+                q_vector->eitr = adapter->eitr_param;
                ixgbe_write_eitr(q_vector);
        }
diff --git a/drivers/net/ixgbe/ixgbe_fcoe.c b/drivers/net/ixgbe/ixgbe_fcoe.c
index fa9f24e23683..28cf104e36cc 100644
--- a/drivers/net/ixgbe/ixgbe_fcoe.c
+++ b/drivers/net/ixgbe/ixgbe_fcoe.c
@@ -336,7 +336,7 @@ int ixgbe_fcoe_ddp(struct ixgbe_adapter *adapter,
                /* return 0 to bypass going to ULD for DDPed data */
                if (fcstat == IXGBE_RXDADV_STAT_FCSTAT_DDP)
                        rc = 0;
-                else
+                else if (ddp->len)
                        rc = ddp->len;
        }
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 110c65ab5cb5..77b0381a2b5c 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -492,12 +492,12 @@ static void ixgbe_receive_skb(struct ixgbe_q_vector *q_vector,
        skb_record_rx_queue(skb, ring->queue_index);
        if (!(adapter->flags & IXGBE_FLAG_IN_NETPOLL)) {
-                if (adapter->vlgrp && is_vlan && (tag != 0))
+                if (adapter->vlgrp && is_vlan && (tag & VLAN_VID_MASK))
                        vlan_gro_receive(napi, adapter->vlgrp, tag, skb);
                else
                        napi_gro_receive(napi, skb);
        } else {
-                if (adapter->vlgrp && is_vlan && (tag != 0))
+                if (adapter->vlgrp && is_vlan && (tag & VLAN_VID_MASK))
                        vlan_hwaccel_rx(skb, adapter->vlgrp, tag);
                else
                        netif_rx(skb);
@@ -585,7 +585,7 @@ static void ixgbe_alloc_rx_buffers(struct ixgbe_adapter *adapter,
                rx_desc = IXGBE_RX_DESC_ADV(*rx_ring, i);
                if (!bi->page_dma &&
-                    (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED)) {
+                    (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED)) {
                        if (!bi->page) {
                                bi->page = alloc_page(GFP_ATOMIC);
                                if (!bi->page) {
@@ -629,7 +629,7 @@ static void ixgbe_alloc_rx_buffers(struct ixgbe_adapter *adapter,
                }
                /* Refresh the desc even if buffer_addrs didn't change because
                 * each write-back erases this info. */
-                if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
+                if (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED) {
                        rx_desc->read.pkt_addr = cpu_to_le64(bi->page_dma);
                        rx_desc->read.hdr_addr = cpu_to_le64(bi->dma);
                } else {
@@ -726,7 +726,7 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                        break;
                (*work_done)++;
-                if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
+                if (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED) {
                        hdr_info = le16_to_cpu(ixgbe_get_hdr_info(rx_desc));
                        len = (hdr_info & IXGBE_RXDADV_HDRBUFLEN_MASK) >>
                               IXGBE_RXDADV_HDRBUFLEN_SHIFT;
@@ -798,7 +798,7 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                        rx_ring->stats.packets++;
                        rx_ring->stats.bytes += skb->len;
                } else {
-                        if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
+                        if (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED) {
                                rx_buffer_info->skb = next_buffer->skb;
                                rx_buffer_info->dma = next_buffer->dma;
                                next_buffer->skb = skb;
@@ -1898,46 +1898,19 @@ static void ixgbe_configure_tx(struct ixgbe_adapter *adapter)
 #define IXGBE_SRRCTL_BSIZEHDRSIZE_SHIFT 2
-static void ixgbe_configure_srrctl(struct ixgbe_adapter *adapter, int index)
+static void ixgbe_configure_srrctl(struct ixgbe_adapter *adapter,
+                                   struct ixgbe_ring *rx_ring)
 {
-        struct ixgbe_ring *rx_ring;
        u32 srrctl;
-        int queue0 = 0;
+        int index;
-        unsigned long mask;
        struct ixgbe_ring_feature *feature = adapter->ring_feature;
-        if (adapter->hw.mac.type == ixgbe_mac_82599EB) {
+        index = rx_ring->reg_idx;
-                if (adapter->flags & IXGBE_FLAG_DCB_ENABLED) {
+        if (adapter->hw.mac.type == ixgbe_mac_82598EB) {
-                        int dcb_i = feature[RING_F_DCB].indices;
+                unsigned long mask;
-                        if (dcb_i == 8)
-                                queue0 = index >> 4;
-                        else if (dcb_i == 4)
-                                queue0 = index >> 5;
-                        else
-                                dev_err(&adapter->pdev->dev, "Invalid DCB "
-                                        "configuration\n");
-#ifdef IXGBE_FCOE
-                        if (adapter->flags & IXGBE_FLAG_FCOE_ENABLED) {
-                                struct ixgbe_ring_feature *f;
-                                rx_ring = &adapter->rx_ring[queue0];
-                                f = &adapter->ring_feature[RING_F_FCOE];
-                                if ((queue0 == 0) && (index > rx_ring->reg_idx))
-                                        queue0 = f->mask + index -
-                                                 rx_ring->reg_idx - 1;
-                        }
-#endif /* IXGBE_FCOE */
-                } else {
-                        queue0 = index;
-                }
-        } else {
                mask = (unsigned long) feature[RING_F_RSS].mask;
-                queue0 = index & mask;
                index = index & mask;
        }
-        rx_ring = &adapter->rx_ring[queue0];
        srrctl = IXGBE_READ_REG(&adapter->hw, IXGBE_SRRCTL(index));
        srrctl &= ~IXGBE_SRRCTL_BSIZEHDR_MASK;
@@ -1946,7 +1919,7 @@ static void ixgbe_configure_srrctl(struct ixgbe_adapter *adapter, int index)
        srrctl |= (IXGBE_RX_HDR_SIZE << IXGBE_SRRCTL_BSIZEHDRSIZE_SHIFT) &
                  IXGBE_SRRCTL_BSIZEHDR_MASK;
-        if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
+        if (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED) {
 #if (PAGE_SIZE / 2) > IXGBE_MAX_RXBUFFER
                srrctl |= IXGBE_MAX_RXBUFFER >> IXGBE_SRRCTL_BSIZEPKT_SHIFT;
 #else
@@ -2002,6 +1975,7 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
 {
        u64 rdba;
        struct ixgbe_hw *hw = &adapter->hw;
+        struct ixgbe_ring *rx_ring;
        struct net_device *netdev = adapter->netdev;
        int max_frame = netdev->mtu + ETH_HLEN + ETH_FCS_LEN;
        int i, j;
@@ -2018,11 +1992,6 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
        /* Decide whether to use packet split mode or not */
        adapter->flags |= IXGBE_FLAG_RX_PS_ENABLED;
-#ifdef IXGBE_FCOE
-        if (adapter->flags & IXGBE_FLAG_FCOE_ENABLED)
-                adapter->flags &= ~IXGBE_FLAG_RX_PS_ENABLED;
-#endif /* IXGBE_FCOE */
        /* Set the RX buffer length according to the mode */
        if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
                rx_buf_len = IXGBE_RX_HDR_SIZE;
@@ -2070,29 +2039,35 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
         * the Base and Length of the Rx Descriptor Ring
         */
        for (i = 0; i < adapter->num_rx_queues; i++) {
-                rdba = adapter->rx_ring[i].dma;
+                rx_ring = &adapter->rx_ring[i];
-                j = adapter->rx_ring[i].reg_idx;
+                rdba = rx_ring->dma;
+                j = rx_ring->reg_idx;
                IXGBE_WRITE_REG(hw, IXGBE_RDBAL(j), (rdba & DMA_BIT_MASK(32)));
                IXGBE_WRITE_REG(hw, IXGBE_RDBAH(j), (rdba >> 32));
                IXGBE_WRITE_REG(hw, IXGBE_RDLEN(j), rdlen);
                IXGBE_WRITE_REG(hw, IXGBE_RDH(j), 0);
                IXGBE_WRITE_REG(hw, IXGBE_RDT(j), 0);
-                adapter->rx_ring[i].head = IXGBE_RDH(j);
+                rx_ring->head = IXGBE_RDH(j);
-                adapter->rx_ring[i].tail = IXGBE_RDT(j);
+                rx_ring->tail = IXGBE_RDT(j);
-                adapter->rx_ring[i].rx_buf_len = rx_buf_len;
+                rx_ring->rx_buf_len = rx_buf_len;
+                if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED)
+                        rx_ring->flags |= IXGBE_RING_RX_PS_ENABLED;
 #ifdef IXGBE_FCOE
                if (adapter->flags & IXGBE_FLAG_FCOE_ENABLED) {
                        struct ixgbe_ring_feature *f;
                        f = &adapter->ring_feature[RING_F_FCOE];
-                        if ((rx_buf_len < IXGBE_FCOE_JUMBO_FRAME_SIZE) &&
+                        if ((i >= f->mask) && (i < f->mask + f->indices)) {
-                            (i >= f->mask) && (i < f->mask + f->indices))
+                                rx_ring->flags &= ~IXGBE_RING_RX_PS_ENABLED;
-                                adapter->rx_ring[i].rx_buf_len =
+                                if (rx_buf_len < IXGBE_FCOE_JUMBO_FRAME_SIZE)
-                                        IXGBE_FCOE_JUMBO_FRAME_SIZE;
+                                        rx_ring->rx_buf_len =
+                                                IXGBE_FCOE_JUMBO_FRAME_SIZE;
+                        }
                }
 #endif /* IXGBE_FCOE */
-                ixgbe_configure_srrctl(adapter, j);
+                ixgbe_configure_srrctl(adapter, rx_ring);
        }
        if (hw->mac.type == ixgbe_mac_82598EB) {
@@ -2168,7 +2143,8 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
        if (adapter->flags2 & IXGBE_FLAG2_RSC_ENABLED) {
                /* Enable 82599 HW-RSC */
                for (i = 0; i < adapter->num_rx_queues; i++) {
-                        j = adapter->rx_ring[i].reg_idx;
+                        rx_ring = &adapter->rx_ring[i];
+                        j = rx_ring->reg_idx;
                        rscctrl = IXGBE_READ_REG(hw, IXGBE_RSCCTL(j));
                        rscctrl |= IXGBE_RSCCTL_RSCEN;
                        /*
@@ -2176,7 +2152,7 @@ static void ixgbe_configure_rx(struct ixgbe_adapter *adapter)
                         * total size of max desc * buf_len is not greater
                         * than 65535
                         */
-                        if (adapter->flags & IXGBE_FLAG_RX_PS_ENABLED) {
+                        if (rx_ring->flags & IXGBE_RING_RX_PS_ENABLED) {
 #if (MAX_SKB_FRAGS > 16)
                                rscctrl |= IXGBE_RSCCTL_MAXDESC_16;
 #elif (MAX_SKB_FRAGS > 8)
diff --git a/drivers/net/ixp2000/ixpdev.c b/drivers/net/ixp2000/ixpdev.c
index 2a0174b62e96..92fb8235c766 100644
--- a/drivers/net/ixp2000/ixpdev.c
+++ b/drivers/net/ixp2000/ixpdev.c
@@ -41,6 +41,7 @@ static int ixpdev_xmit(struct sk_buff *skb, struct net_device *dev)
        struct ixpdev_priv *ip = netdev_priv(dev);
        struct ixpdev_tx_desc *desc;
        int entry;
+        unsigned long flags;
        if (unlikely(skb->len > PAGE_SIZE)) {
                /* @@@ Count drops.  */
@@ -63,11 +64,11 @@ static int ixpdev_xmit(struct sk_buff *skb, struct net_device *dev)
        dev->trans_start = jiffies;
-        local_irq_disable();
+        local_irq_save(flags);
        ip->tx_queue_entries++;
        if (ip->tx_queue_entries == TX_BUF_COUNT_PER_CHAN)
                netif_stop_queue(dev);
-        local_irq_enable();
+        local_irq_restore(flags);
        return 0;
 }
diff --git a/drivers/net/macb.c b/drivers/net/macb.c
index 5b5c25368d1e..e3601cf3f931 100644
--- a/drivers/net/macb.c
+++ b/drivers/net/macb.c
@@ -620,6 +620,7 @@ static int macb_start_xmit(struct sk_buff *skb, struct net_device *dev)
        dma_addr_t mapping;
        unsigned int len, entry;
        u32 ctrl;
+        unsigned long flags;
 #ifdef DEBUG
        int i;
@@ -635,12 +636,12 @@ static int macb_start_xmit(struct sk_buff *skb, struct net_device *dev)
 #endif
        len = skb->len;
-        spin_lock_irq(&bp->lock);
+        spin_lock_irqsave(&bp->lock, flags);
        /* This is a hard error, log it. */
        if (TX_BUFFS_AVAIL(bp) < 1) {
                netif_stop_queue(dev);
-                spin_unlock_irq(&bp->lock);
+                spin_unlock_irqrestore(&bp->lock, flags);
                dev_err(&bp->pdev->dev,
                        "BUG! Tx Ring full when queue awake!\n");
                dev_dbg(&bp->pdev->dev, "tx_head = %u, tx_tail = %u\n",
@@ -674,7 +675,7 @@ static int macb_start_xmit(struct sk_buff *skb, struct net_device *dev)
        if (TX_BUFFS_AVAIL(bp) < 1)
                netif_stop_queue(dev);
-        spin_unlock_irq(&bp->lock);
+        spin_unlock_irqrestore(&bp->lock, flags);
        dev->trans_start = jiffies;
diff --git a/drivers/net/mlx4/en_rx.c b/drivers/net/mlx4/en_rx.c
index 91bdfdfd431f..3ac0404d0d11 100644
--- a/drivers/net/mlx4/en_rx.c
+++ b/drivers/net/mlx4/en_rx.c
@@ -506,8 +506,9 @@ static int mlx4_en_complete_rx_desc(struct mlx4_en_priv *priv,
                                 PCI_DMA_FROMDEVICE);
        }
        /* Adjust size of last fragment to match actual length */
-        skb_frags_rx[nr - 1].size = length -
+        if (nr > 0)
-                priv->frag_info[nr - 1].frag_prefix_size;
+                skb_frags_rx[nr - 1].size = length -
+                        priv->frag_info[nr - 1].frag_prefix_size;
        return nr;
 fail:
diff --git a/drivers/net/mlx4/en_tx.c b/drivers/net/mlx4/en_tx.c
index 5a88b3f57693..62208401c4df 100644
--- a/drivers/net/mlx4/en_tx.c
+++ b/drivers/net/mlx4/en_tx.c
@@ -437,6 +437,7 @@ static inline void mlx4_en_xmit_poll(struct mlx4_en_priv *priv, int tx_ind)
 {
        struct mlx4_en_cq *cq = &priv->tx_cq[tx_ind];
        struct mlx4_en_tx_ring *ring = &priv->tx_ring[tx_ind];
+        unsigned long flags;
        /* If we don't have a pending timer, set one up to catch our recent
           post in case the interface becomes idle */
@@ -445,9 +446,9 @@ static inline void mlx4_en_xmit_poll(struct mlx4_en_priv *priv, int tx_ind)
        /* Poll the CQ every mlx4_en_TX_MODER_POLL packets */
        if ((++ring->poll_cnt & (MLX4_EN_TX_POLL_MODER - 1)) == 0)
-                if (spin_trylock_irq(&ring->comp_lock)) {
+                if (spin_trylock_irqsave(&ring->comp_lock, flags)) {
                        mlx4_en_process_tx_cq(priv->dev, cq);
-                        spin_unlock_irq(&ring->comp_lock);
+                        spin_unlock_irqrestore(&ring->comp_lock, flags);
                }
 }
diff --git a/drivers/net/netxen/netxen_nic.h b/drivers/net/netxen/netxen_nic.h
index f86e05047d19..a9c1fcca5e75 100644
--- a/drivers/net/netxen/netxen_nic.h
+++ b/drivers/net/netxen/netxen_nic.h
@@ -1254,7 +1254,7 @@ struct netxen_adapter {
        u8 mc_enabled;
        u8 max_mc_count;
        u8 rss_supported;
-        u8 resv2;
+        u8 link_changed;
        u32 resv3;
        u8 has_link_events;
diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index 7acf204e38c9..5d3343ef3d86 100644
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -184,13 +184,6 @@ void netxen_free_sw_resources(struct netxen_adapter *adapter)
        kfree(recv_ctx->rds_rings);
 skip_rds:
-        if (recv_ctx->sds_rings == NULL)
-                goto skip_sds;
-        for(ring = 0; ring < adapter->max_sds_rings; ring++)
-                recv_ctx->sds_rings[ring].consumer = 0;
-skip_sds:
        if (adapter->tx_ring == NULL)
                return;
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 3cd8cfcf627b..28f270f5ac78 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -94,10 +94,6 @@ static struct pci_device_id netxen_pci_tbl[] __devinitdata = {
 MODULE_DEVICE_TABLE(pci, netxen_pci_tbl);
-static struct workqueue_struct *netxen_workq;
-#define SCHEDULE_WORK(tp)       queue_work(netxen_workq, tp)
-#define FLUSH_SCHEDULED_WORK()  flush_workqueue(netxen_workq)
 static void netxen_watchdog(unsigned long);
 static uint32_t crb_cmd_producer[4] = {
@@ -171,6 +167,8 @@ netxen_free_sds_rings(struct netxen_recv_context *recv_ctx)
 {
        if (recv_ctx->sds_rings != NULL)
                kfree(recv_ctx->sds_rings);
+        recv_ctx->sds_rings = NULL;
 }
 static int
@@ -193,6 +191,21 @@ netxen_napi_add(struct netxen_adapter *adapter, struct net_device *netdev)
 }
 static void
+netxen_napi_del(struct netxen_adapter *adapter)
+{
+        int ring;
+        struct nx_host_sds_ring *sds_ring;
+        struct netxen_recv_context *recv_ctx = &adapter->recv_ctx;
+        for (ring = 0; ring < adapter->max_sds_rings; ring++) {
+                sds_ring = &recv_ctx->sds_rings[ring];
+                netif_napi_del(&sds_ring->napi);
+        }
+        netxen_free_sds_rings(&adapter->recv_ctx);
+}
+static void
 netxen_napi_enable(struct netxen_adapter *adapter)
 {
        int ring;
@@ -260,7 +273,7 @@ nx_update_dma_mask(struct netxen_adapter *adapter)
        change = 0;
        shift = NXRD32(adapter, CRB_DMA_SHIFT);
-        if (shift >= 32)
+        if (shift > 32)
                return 0;
        if (NX_IS_REVISION_P3(adapter->ahw.revision_id) && (shift > 9))
@@ -272,7 +285,7 @@ nx_update_dma_mask(struct netxen_adapter *adapter)
                old_mask = pdev->dma_mask;
                old_cmask = pdev->dev.coherent_dma_mask;
-                mask = (1ULL<<(32+shift)) - 1;
+                mask = DMA_BIT_MASK(32+shift);
                err = pci_set_dma_mask(pdev, mask);
                if (err)
@@ -880,7 +893,6 @@ netxen_nic_down(struct netxen_adapter *adapter, struct net_device *netdev)
        spin_unlock(&adapter->tx_clean_lock);
        del_timer_sync(&adapter->watchdog_timer);
-        FLUSH_SCHEDULED_WORK();
 }
@@ -894,10 +906,12 @@ netxen_nic_attach(struct netxen_adapter *adapter)
        struct nx_host_tx_ring *tx_ring;
        err = netxen_init_firmware(adapter);
-        if (err != 0) {
+        if (err)
-                printk(KERN_ERR "Failed to init firmware\n");
+                return err;
-                return -EIO;
-        }
+        err = netxen_napi_add(adapter, netdev);
+        if (err)
+                return err;
        if (adapter->fw_major < 4)
                adapter->max_rds_rings = 3;
@@ -961,6 +975,7 @@ netxen_nic_detach(struct netxen_adapter *adapter)
        netxen_free_hw_resources(adapter);
        netxen_release_rx_buffers(adapter);
        netxen_nic_free_irq(adapter);
+        netxen_napi_del(adapter);
        netxen_free_sw_resources(adapter);
        adapter->is_up = 0;
@@ -1105,9 +1120,6 @@ netxen_nic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
        netdev->irq = adapter->msix_entries[0].vector;
-        if (netxen_napi_add(adapter, netdev))
-                goto err_out_disable_msi;
        init_timer(&adapter->watchdog_timer);
        adapter->watchdog_timer.function = &netxen_watchdog;
        adapter->watchdog_timer.data = (unsigned long)adapter;
@@ -1177,6 +1189,9 @@ static void __devexit netxen_nic_remove(struct pci_dev *pdev)
        unregister_netdev(netdev);
+        cancel_work_sync(&adapter->watchdog_task);
+        cancel_work_sync(&adapter->tx_timeout_task);
        if (adapter->is_up == NETXEN_ADAPTER_UP_MAGIC) {
                netxen_nic_detach(adapter);
        }
@@ -1185,7 +1200,6 @@ static void __devexit netxen_nic_remove(struct pci_dev *pdev)
                netxen_free_adapter_offload(adapter);
        netxen_teardown_intr(adapter);
-        netxen_free_sds_rings(&adapter->recv_ctx);
        netxen_cleanup_pci_map(adapter);
@@ -1211,6 +1225,9 @@ netxen_nic_suspend(struct pci_dev *pdev, pm_message_t state)
        if (netif_running(netdev))
                netxen_nic_down(adapter, netdev);
+        cancel_work_sync(&adapter->watchdog_task);
+        cancel_work_sync(&adapter->tx_timeout_task);
        if (adapter->is_up == NETXEN_ADAPTER_UP_MAGIC)
                netxen_nic_detach(adapter);
@@ -1549,11 +1566,6 @@ static int netxen_nic_check_temp(struct netxen_adapter *adapter)
                       "%s: Device temperature %d degrees C exceeds"
                       " maximum allowed. Hardware has been shut down.\n",
                       netdev->name, temp_val);
-                netif_device_detach(netdev);
-                netxen_nic_down(adapter, netdev);
-                netxen_nic_detach(adapter);
                rv = 1;
        } else if (temp_state == NX_TEMP_WARN) {
                if (adapter->temp == NX_TEMP_NORMAL) {
@@ -1587,10 +1599,7 @@ void netxen_advert_link_change(struct netxen_adapter *adapter, int linkup)
                        netif_carrier_off(netdev);
                        netif_stop_queue(netdev);
                }
+                adapter->link_changed = !adapter->has_link_events;
-                if (!adapter->has_link_events)
-                        netxen_nic_set_link_parameters(adapter);
        } else if (!adapter->ahw.linkup && linkup) {
                printk(KERN_INFO "%s: %s NIC Link is up\n",
                       netxen_nic_driver_name, netdev->name);
@@ -1599,9 +1608,7 @@ void netxen_advert_link_change(struct netxen_adapter *adapter, int linkup)
                        netif_carrier_on(netdev);
                        netif_wake_queue(netdev);
                }
+                adapter->link_changed = !adapter->has_link_events;
-                if (!adapter->has_link_events)
-                        netxen_nic_set_link_parameters(adapter);
        }
 }
@@ -1628,11 +1635,36 @@ static void netxen_nic_handle_phy_intr(struct netxen_adapter *adapter)
        netxen_advert_link_change(adapter, linkup);
 }
+static void netxen_nic_thermal_shutdown(struct netxen_adapter *adapter)
+{
+        struct net_device *netdev = adapter->netdev;
+        netif_device_detach(netdev);
+        netxen_nic_down(adapter, netdev);
+        netxen_nic_detach(adapter);
+}
 static void netxen_watchdog(unsigned long v)
 {
        struct netxen_adapter *adapter = (struct netxen_adapter *)v;
-        SCHEDULE_WORK(&adapter->watchdog_task);
+        if (netxen_nic_check_temp(adapter))
+                goto do_sched;
+        if (!adapter->has_link_events) {
+                netxen_nic_handle_phy_intr(adapter);
+                if (adapter->link_changed)
+                        goto do_sched;
+        }
+        if (netif_running(adapter->netdev))
+                mod_timer(&adapter->watchdog_timer, jiffies + 2 * HZ);
+        return;
+do_sched:
+        schedule_work(&adapter->watchdog_task);
 }
 void netxen_watchdog_task(struct work_struct *work)
@@ -1640,11 +1672,13 @@ void netxen_watchdog_task(struct work_struct *work)
        struct netxen_adapter *adapter =
                container_of(work, struct netxen_adapter, watchdog_task);
-        if (netxen_nic_check_temp(adapter))
+        if (adapter->temp == NX_TEMP_PANIC) {
+                netxen_nic_thermal_shutdown(adapter);
                return;
+        }
-        if (!adapter->has_link_events)
+        if (adapter->link_changed)
-                netxen_nic_handle_phy_intr(adapter);
+                netxen_nic_set_link_parameters(adapter);
        if (netif_running(adapter->netdev))
                mod_timer(&adapter->watchdog_timer, jiffies + 2 * HZ);
@@ -1652,9 +1686,8 @@ void netxen_watchdog_task(struct work_struct *work)
 static void netxen_tx_timeout(struct net_device *netdev)
 {
-        struct netxen_adapter *adapter = (struct netxen_adapter *)
+        struct netxen_adapter *adapter = netdev_priv(netdev);
-                                                netdev_priv(netdev);
+        schedule_work(&adapter->tx_timeout_task);
-        SCHEDULE_WORK(&adapter->tx_timeout_task);
 }
 static void netxen_tx_timeout_task(struct work_struct *work)
@@ -1811,9 +1844,6 @@ static int __init netxen_init_module(void)
 {
        printk(KERN_INFO "%s\n", netxen_nic_driver_string);
-        if ((netxen_workq = create_singlethread_workqueue("netxen")) == NULL)
-                return -ENOMEM;
        return pci_register_driver(&netxen_driver);
 }
@@ -1822,7 +1852,6 @@ module_init(netxen_init_module);
 static void __exit netxen_exit_module(void)
 {
        pci_unregister_driver(&netxen_driver);
-        destroy_workqueue(netxen_workq);
 }
 module_exit(netxen_exit_module);
diff --git a/drivers/net/pcnet32.c b/drivers/net/pcnet32.c
index a646a445fda9..23e1a0750fe0 100644
--- a/drivers/net/pcnet32.c
+++ b/drivers/net/pcnet32.c
@@ -1839,7 +1839,7 @@ pcnet32_probe1(unsigned long ioaddr, int shared, struct pci_dev *pdev)
        lp->chip_version = chip_version;
        lp->msg_enable = pcnet32_debug;
        if ((cards_found >= MAX_UNITS)
-            || (options[cards_found] > sizeof(options_mapping)))
+            || (options[cards_found] >= sizeof(options_mapping)))
                lp->options = PCNET32_PORT_ASEL;
        else
                lp->options = options_mapping[options[cards_found]];
diff --git a/drivers/net/smc91x.c b/drivers/net/smc91x.c
index 1c70e999cc50..7567f510eff5 100644
--- a/drivers/net/smc91x.c
+++ b/drivers/net/smc91x.c
@@ -196,21 +196,23 @@ static void PRINT_PKT(u_char *buf, int length)
 /* this enables an interrupt in the interrupt mask register */
 #define SMC_ENABLE_INT(lp, x) do {                                      \
        unsigned char mask;                                             \
-        spin_lock_irq(&lp->lock);                                       \
+        unsigned long smc_enable_flags;                                 \
+        spin_lock_irqsave(&lp->lock, smc_enable_flags);                 \
        mask = SMC_GET_INT_MASK(lp);                                    \
        mask |= (x);                                                    \
        SMC_SET_INT_MASK(lp, mask);                                     \
-        spin_unlock_irq(&lp->lock);                                     \
+        spin_unlock_irqrestore(&lp->lock, smc_enable_flags);            \
 } while (0)
 /* this disables an interrupt from the interrupt mask register */
 #define SMC_DISABLE_INT(lp, x) do {                                     \
        unsigned char mask;                                             \
-        spin_lock_irq(&lp->lock);                                       \
+        unsigned long smc_disable_flags;                                \
+        spin_lock_irqsave(&lp->lock, smc_disable_flags);                \
        mask = SMC_GET_INT_MASK(lp);                                    \
        mask &= ~(x);                                                   \
        SMC_SET_INT_MASK(lp, mask);                                     \
-        spin_unlock_irq(&lp->lock);                                     \
+        spin_unlock_irqrestore(&lp->lock, smc_disable_flags);           \
 } while (0)
 /*
@@ -520,21 +522,21 @@ static inline void  smc_rcv(struct net_device *dev)
 * any other concurrent access and C would always interrupt B. But life
 * isn't that easy in a SMP world...
 */
-#define smc_special_trylock(lock)                                       \
+#define smc_special_trylock(lock, flags)                                \
 ({                                                                      \
        int __ret;                                                      \
-        local_irq_disable();                                            \
+        local_irq_save(flags);                                          \
        __ret = spin_trylock(lock);                                     \
        if (!__ret)                                                     \
-                local_irq_enable();                                     \
+                local_irq_restore(flags);                               \
        __ret;                                                          \
 })
-#define smc_special_lock(lock)          spin_lock_irq(lock)
+#define smc_special_lock(lock, flags)           spin_lock_irqsave(lock, flags)
-#define smc_special_unlock(lock)        spin_unlock_irq(lock)
+#define smc_special_unlock(lock, flags)         spin_unlock_irqrestore(lock, flags)
 #else
-#define smc_special_trylock(lock)       (1)
+#define smc_special_trylock(lock, flags)        (1)
-#define smc_special_lock(lock)          do { } while (0)
+#define smc_special_lock(lock, flags)           do { } while (0)
-#define smc_special_unlock(lock)        do { } while (0)
+#define smc_special_unlock(lock, flags) do { } while (0)
 #endif
 /*
@@ -548,10 +550,11 @@ static void smc_hardware_send_pkt(unsigned long data)
        struct sk_buff *skb;
        unsigned int packet_no, len;
        unsigned char *buf;
+        unsigned long flags;
        DBG(3, "%s: %s\n", dev->name, __func__);
-        if (!smc_special_trylock(&lp->lock)) {
+        if (!smc_special_trylock(&lp->lock, flags)) {
                netif_stop_queue(dev);
                tasklet_schedule(&lp->tx_task);
                return;
@@ -559,7 +562,7 @@ static void smc_hardware_send_pkt(unsigned long data)
        skb = lp->pending_tx_skb;
        if (unlikely(!skb)) {
-                smc_special_unlock(&lp->lock);
+                smc_special_unlock(&lp->lock, flags);
                return;
        }
        lp->pending_tx_skb = NULL;
@@ -569,7 +572,7 @@ static void smc_hardware_send_pkt(unsigned long data)
                printk("%s: Memory allocation failed.\n", dev->name);
                dev->stats.tx_errors++;
                dev->stats.tx_fifo_errors++;
-                smc_special_unlock(&lp->lock);
+                smc_special_unlock(&lp->lock, flags);
                goto done;
        }
@@ -608,7 +611,7 @@ static void smc_hardware_send_pkt(unsigned long data)
        /* queue the packet for TX */
        SMC_SET_MMU_CMD(lp, MC_ENQUEUE);
-        smc_special_unlock(&lp->lock);
+        smc_special_unlock(&lp->lock, flags);
        dev->trans_start = jiffies;
        dev->stats.tx_packets++;
@@ -633,6 +636,7 @@ static int smc_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
        struct smc_local *lp = netdev_priv(dev);
        void __iomem *ioaddr = lp->base;
        unsigned int numPages, poll_count, status;
+        unsigned long flags;
        DBG(3, "%s: %s\n", dev->name, __func__);
@@ -658,7 +662,7 @@ static int smc_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
                return 0;
        }
-        smc_special_lock(&lp->lock);
+        smc_special_lock(&lp->lock, flags);
        /* now, try to allocate the memory */
        SMC_SET_MMU_CMD(lp, MC_ALLOC | numPages);
@@ -676,7 +680,7 @@ static int smc_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
                }
        } while (--poll_count);
-        smc_special_unlock(&lp->lock);
+        smc_special_unlock(&lp->lock, flags);
        lp->pending_tx_skb = skb;
        if (!poll_count) {
diff --git a/drivers/net/tulip/tulip_core.c b/drivers/net/tulip/tulip_core.c
index 99a63649f4fc..4cf9a6588751 100644
--- a/drivers/net/tulip/tulip_core.c
+++ b/drivers/net/tulip/tulip_core.c
@@ -652,8 +652,9 @@ tulip_start_xmit(struct sk_buff *skb, struct net_device *dev)
        int entry;
        u32 flag;
        dma_addr_t mapping;
+        unsigned long flags;
-        spin_lock_irq(&tp->lock);
+        spin_lock_irqsave(&tp->lock, flags);
        /* Calculate the next Tx descriptor entry. */
        entry = tp->cur_tx % TX_RING_SIZE;
@@ -688,7 +689,7 @@ tulip_start_xmit(struct sk_buff *skb, struct net_device *dev)
        /* Trigger an immediate transmit demand. */
        iowrite32(0, tp->base_addr + CSR1);
-        spin_unlock_irq(&tp->lock);
+        spin_unlock_irqrestore(&tp->lock, flags);
        dev->trans_start = jiffies;
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 027f7aba26af..42b6c6319bc2 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1048,20 +1048,15 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
        return err;
 }
-static int tun_get_iff(struct net *net, struct file *file, struct ifreq *ifr)
+static int tun_get_iff(struct net *net, struct tun_struct *tun,
+                       struct ifreq *ifr)
 {
-        struct tun_struct *tun = tun_get(file);
-        if (!tun)
-                return -EBADFD;
        DBG(KERN_INFO "%s: tun_get_iff\n", tun->dev->name);
        strcpy(ifr->ifr_name, tun->dev->name);
        ifr->ifr_flags = tun_flags(tun);
-        tun_put(tun);
        return 0;
 }
@@ -1105,8 +1100,8 @@ static int set_offload(struct net_device *dev, unsigned long arg)
        return 0;
 }
-static int tun_chr_ioctl(struct inode *inode, struct file *file,
+static long tun_chr_ioctl(struct file *file, unsigned int cmd,
-                         unsigned int cmd, unsigned long arg)
+                          unsigned long arg)
 {
        struct tun_file *tfile = file->private_data;
        struct tun_struct *tun;
@@ -1128,34 +1123,32 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
                                (unsigned int __user*)argp);
        }
+        rtnl_lock();
        tun = __tun_get(tfile);
        if (cmd == TUNSETIFF && !tun) {
-                int err;
                ifr.ifr_name[IFNAMSIZ-1] = '\0';
-                rtnl_lock();
+                ret = tun_set_iff(tfile->net, file, &ifr);
-                err = tun_set_iff(tfile->net, file, &ifr);
-                rtnl_unlock();
-                if (err)
+                if (ret)
-                        return err;
+                        goto unlock;
                if (copy_to_user(argp, &ifr, sizeof(ifr)))
-                        return -EFAULT;
+                        ret = -EFAULT;
-                return 0;
+                goto unlock;
        }
+        ret = -EBADFD;
        if (!tun)
-                return -EBADFD;
+                goto unlock;
        DBG(KERN_INFO "%s: tun_chr_ioctl cmd %d\n", tun->dev->name, cmd);
        ret = 0;
        switch (cmd) {
        case TUNGETIFF:
-                ret = tun_get_iff(current->nsproxy->net_ns, file, &ifr);
+                ret = tun_get_iff(current->nsproxy->net_ns, tun, &ifr);
                if (ret)
                        break;
@@ -1201,7 +1194,6 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
        case TUNSETLINK:
                /* Only allow setting the type when the interface is down */
-                rtnl_lock();
                if (tun->dev->flags & IFF_UP) {
                        DBG(KERN_INFO "%s: Linktype set failed because interface is up\n",
                                tun->dev->name);
@@ -1211,7 +1203,6 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
                        DBG(KERN_INFO "%s: linktype set to %d\n", tun->dev->name, tun->dev->type);
                        ret = 0;
                }
-                rtnl_unlock();
                break;
 #ifdef TUN_DEBUG
@@ -1220,9 +1211,7 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
                break;
 #endif
        case TUNSETOFFLOAD:
-                rtnl_lock();
                ret = set_offload(tun->dev, arg);
-                rtnl_unlock();
                break;
        case TUNSETTXFILTER:
@@ -1230,9 +1219,7 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
                ret = -EINVAL;
                if ((tun->flags & TUN_TYPE_MASK) != TUN_TAP_DEV)
                        break;
-                rtnl_lock();
                ret = update_filter(&tun->txflt, (void __user *)arg);
-                rtnl_unlock();
                break;
        case SIOCGIFHWADDR:
@@ -1248,9 +1235,7 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
                DBG(KERN_DEBUG "%s: set hw address: %pM\n",
                        tun->dev->name, ifr.ifr_hwaddr.sa_data);
-                rtnl_lock();
                ret = dev_set_mac_address(tun->dev, &ifr.ifr_hwaddr);
-                rtnl_unlock();
                break;
        case TUNGETSNDBUF:
@@ -1273,7 +1258,10 @@ static int tun_chr_ioctl(struct inode *inode, struct file *file,
                break;
        };
-        tun_put(tun);
+unlock:
+        rtnl_unlock();
+        if (tun)
+                tun_put(tun);
        return ret;
 }
@@ -1361,7 +1349,7 @@ static const struct file_operations tun_fops = {
        .write = do_sync_write,
        .aio_write = tun_chr_aio_write,
        .poll   = tun_chr_poll,
-        .ioctl  = tun_chr_ioctl,
+        .unlocked_ioctl = tun_chr_ioctl,
        .open   = tun_chr_open,
        .release = tun_chr_close,
        .fasync = tun_chr_fasync
diff --git a/drivers/net/ucc_geth.c b/drivers/net/ucc_geth.c
index 3b957e6412ee..8a7b8c7bd781 100644
--- a/drivers/net/ucc_geth.c
+++ b/drivers/net/ucc_geth.c
@@ -3111,10 +3111,11 @@ static int ucc_geth_start_xmit(struct sk_buff *skb, struct net_device *dev)
        u8 __iomem *bd;                 /* BD pointer */
        u32 bd_status;
        u8 txQ = 0;
+        unsigned long flags;
        ugeth_vdbg("%s: IN", __func__);
-        spin_lock_irq(&ugeth->lock);
+        spin_lock_irqsave(&ugeth->lock, flags);
        dev->stats.tx_bytes += skb->len;
@@ -3171,7 +3172,7 @@ static int ucc_geth_start_xmit(struct sk_buff *skb, struct net_device *dev)
        uccf = ugeth->uccf;
        out_be16(uccf->p_utodr, UCC_FAST_TOD);
 #endif
-        spin_unlock_irq(&ugeth->lock);
+        spin_unlock_irqrestore(&ugeth->lock, flags);
        return 0;
 }
diff --git a/drivers/net/usb/pegasus.h b/drivers/net/usb/pegasus.h
index c7467823cd1c..f968c834ff63 100644
--- a/drivers/net/usb/pegasus.h
+++ b/drivers/net/usb/pegasus.h
@@ -250,6 +250,8 @@ PEGASUS_DEV( "IO DATA USB ET/TX", VENDOR_IODATA, 0x0904,
                DEFAULT_GPIO_RESET )
 PEGASUS_DEV( "IO DATA USB ET/TX-S", VENDOR_IODATA, 0x0913,
                DEFAULT_GPIO_RESET | PEGASUS_II )
+PEGASUS_DEV( "IO DATA USB ETX-US2", VENDOR_IODATA, 0x092a,
+                DEFAULT_GPIO_RESET | PEGASUS_II )
 PEGASUS_DEV( "Kingston KNU101TX Ethernet", VENDOR_KINGSTON, 0x000a,
                DEFAULT_GPIO_RESET)
 PEGASUS_DEV( "LANEED USB Ethernet LD-USB/TX", VENDOR_LANEED, 0x4002,
diff --git a/drivers/net/via-rhine.c b/drivers/net/via-rhine.c
index 88c30a58b4bd..934f7671650a 100644
--- a/drivers/net/via-rhine.c
+++ b/drivers/net/via-rhine.c
@@ -1218,6 +1218,7 @@ static int rhine_start_tx(struct sk_buff *skb, struct net_device *dev)
        struct rhine_private *rp = netdev_priv(dev);
        void __iomem *ioaddr = rp->base;
        unsigned entry;
+        unsigned long flags;
        /* Caution: the write order is important here, set the field
           with the "ownership" bits last. */
@@ -1261,7 +1262,7 @@ static int rhine_start_tx(struct sk_buff *skb, struct net_device *dev)
                cpu_to_le32(TXDESC | (skb->len >= ETH_ZLEN ? skb->len : ETH_ZLEN));
        /* lock eth irq */
-        spin_lock_irq(&rp->lock);
+        spin_lock_irqsave(&rp->lock, flags);
        wmb();
        rp->tx_ring[entry].tx_status = cpu_to_le32(DescOwn);
        wmb();
@@ -1280,7 +1281,7 @@ static int rhine_start_tx(struct sk_buff *skb, struct net_device *dev)
        dev->trans_start = jiffies;
-        spin_unlock_irq(&rp->lock);
+        spin_unlock_irqrestore(&rp->lock, flags);
        if (debug > 4) {
                printk(KERN_DEBUG "%s: Transmit frame #%d queued in slot %d.\n",
diff --git a/drivers/net/via-velocity.c b/drivers/net/via-velocity.c
index 3ba35956327a..cee08a1e497a 100644
--- a/drivers/net/via-velocity.c
+++ b/drivers/net/via-velocity.c
@@ -1778,7 +1778,7 @@ static void velocity_error(struct velocity_info *vptr, int status)
                         *       mode
                         */
                        if (vptr->rev_id < REV_ID_VT3216_A0) {
-                                if (vptr->mii_status | VELOCITY_DUPLEX_FULL)
+                                if (vptr->mii_status & VELOCITY_DUPLEX_FULL)
                                        BYTE_REG_BITS_ON(TCR_TB2BDIS, &regs->TCR);
                                else
                                        BYTE_REG_BITS_OFF(TCR_TB2BDIS, &regs->TCR);
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 2a6e81d5b579..bbedf03a2124 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -70,6 +70,9 @@ struct virtnet_info
        struct sk_buff_head recv;
        struct sk_buff_head send;
+        /* Work struct for refilling if we run low on memory. */
+        struct delayed_work refill;
        /* Chain pages by the private ptr. */
        struct page *pages;
 };
@@ -273,19 +276,22 @@ drop:
        dev_kfree_skb(skb);
 }
-static void try_fill_recv_maxbufs(struct virtnet_info *vi)
+static bool try_fill_recv_maxbufs(struct virtnet_info *vi, gfp_t gfp)
 {
        struct sk_buff *skb;
        struct scatterlist sg[2+MAX_SKB_FRAGS];
        int num, err, i;
+        bool oom = false;
        sg_init_table(sg, 2+MAX_SKB_FRAGS);
        for (;;) {
                struct virtio_net_hdr *hdr;
                skb = netdev_alloc_skb(vi->dev, MAX_PACKET_LEN + NET_IP_ALIGN);
-                if (unlikely(!skb))
+                if (unlikely(!skb)) {
+                        oom = true;
                        break;
+                }
                skb_reserve(skb, NET_IP_ALIGN);
                skb_put(skb, MAX_PACKET_LEN);
@@ -296,7 +302,7 @@ static void try_fill_recv_maxbufs(struct virtnet_info *vi)
                if (vi->big_packets) {
                        for (i = 0; i < MAX_SKB_FRAGS; i++) {
                                skb_frag_t *f = &skb_shinfo(skb)->frags[i];
-                                f->page = get_a_page(vi, GFP_ATOMIC);
+                                f->page = get_a_page(vi, gfp);
                                if (!f->page)
                                        break;
@@ -325,31 +331,35 @@ static void try_fill_recv_maxbufs(struct virtnet_info *vi)
        if (unlikely(vi->num > vi->max))
                vi->max = vi->num;
        vi->rvq->vq_ops->kick(vi->rvq);
+        return !oom;
 }
-static void try_fill_recv(struct virtnet_info *vi)
+/* Returns false if we couldn't fill entirely (OOM). */
+static bool try_fill_recv(struct virtnet_info *vi, gfp_t gfp)
 {
        struct sk_buff *skb;
        struct scatterlist sg[1];
        int err;
+        bool oom = false;
-        if (!vi->mergeable_rx_bufs) {
+        if (!vi->mergeable_rx_bufs)
-                try_fill_recv_maxbufs(vi);
+                return try_fill_recv_maxbufs(vi, gfp);
-                return;
-        }
        for (;;) {
                skb_frag_t *f;
                skb = netdev_alloc_skb(vi->dev, GOOD_COPY_LEN + NET_IP_ALIGN);
-                if (unlikely(!skb))
+                if (unlikely(!skb)) {
+                        oom = true;
                        break;
+                }
                skb_reserve(skb, NET_IP_ALIGN);
                f = &skb_shinfo(skb)->frags[0];
-                f->page = get_a_page(vi, GFP_ATOMIC);
+                f->page = get_a_page(vi, gfp);
                if (!f->page) {
+                        oom = true;
                        kfree_skb(skb);
                        break;
                }
@@ -373,6 +383,7 @@ static void try_fill_recv(struct virtnet_info *vi)
        if (unlikely(vi->num > vi->max))
                vi->max = vi->num;
        vi->rvq->vq_ops->kick(vi->rvq);
+        return !oom;
 }
 static void skb_recv_done(struct virtqueue *rvq)
@@ -385,6 +396,23 @@ static void skb_recv_done(struct virtqueue *rvq)
        }
 }
+static void refill_work(struct work_struct *work)
+{
+        struct virtnet_info *vi;
+        bool still_empty;
+        vi = container_of(work, struct virtnet_info, refill.work);
+        napi_disable(&vi->napi);
+        try_fill_recv(vi, GFP_KERNEL);
+        still_empty = (vi->num == 0);
+        napi_enable(&vi->napi);
+        /* In theory, this can happen: if we don't get any buffers in
+         * we will *never* try to fill again. */
+        if (still_empty)
+                schedule_delayed_work(&vi->refill, HZ/2);
+}
 static int virtnet_poll(struct napi_struct *napi, int budget)
 {
        struct virtnet_info *vi = container_of(napi, struct virtnet_info, napi);
@@ -400,10 +428,10 @@ again:
                received++;
        }
-        /* FIXME: If we oom and completely run out of inbufs, we need
+        if (vi->num < vi->max / 2) {
-         * to start a timer trying to fill more. */
+                if (!try_fill_recv(vi, GFP_ATOMIC))
-        if (vi->num < vi->max / 2)
+                        schedule_delayed_work(&vi->refill, 0);
-                try_fill_recv(vi);
+        }
        /* Out of packets? */
        if (received < budget) {
@@ -893,6 +921,7 @@ static int virtnet_probe(struct virtio_device *vdev)
        vi->vdev = vdev;
        vdev->priv = vi;
        vi->pages = NULL;
+        INIT_DELAYED_WORK(&vi->refill, refill_work);
        /* If they give us a callback when all buffers are done, we don't need
         * the timer. */
@@ -941,7 +970,7 @@ static int virtnet_probe(struct virtio_device *vdev)
        }
        /* Last of all, set up some receive buffers. */
-        try_fill_recv(vi);
+        try_fill_recv(vi, GFP_KERNEL);
        /* If we didn't even get one input buffer, we're useless. */
        if (vi->num == 0) {
@@ -958,6 +987,7 @@ static int virtnet_probe(struct virtio_device *vdev)
 unregister:
        unregister_netdev(dev);
+        cancel_delayed_work_sync(&vi->refill);
 free_vqs:
        vdev->config->del_vqs(vdev);
 free:
@@ -986,6 +1016,7 @@ static void virtnet_remove(struct virtio_device *vdev)
        BUG_ON(vi->num != 0);
        unregister_netdev(vi->dev);
+        cancel_delayed_work_sync(&vi->refill);
        vdev->config->del_vqs(vi->vdev);
diff --git a/drivers/net/wireless/ath/ar9170/main.c b/drivers/net/wireless/ath/ar9170/main.c
index 9d38cf60a0db..88c3d8573869 100644
--- a/drivers/net/wireless/ath/ar9170/main.c
+++ b/drivers/net/wireless/ath/ar9170/main.c
@@ -1967,13 +1967,14 @@ static int ar9170_conf_tx(struct ieee80211_hw *hw, u16 queue,
        int ret;
        mutex_lock(&ar->mutex);
-        if ((param) && !(queue > __AR9170_NUM_TXQ)) {
+        if (queue < __AR9170_NUM_TXQ) {
                memcpy(&ar->edcf[ar9170_qos_hwmap[queue]],
                       param, sizeof(*param));
                ret = ar9170_set_qos(ar);
-        } else
+        } else {
                ret = -EINVAL;
+        }
        mutex_unlock(&ar->mutex);
        return ret;
diff --git a/drivers/net/wireless/ath/ar9170/usb.c b/drivers/net/wireless/ath/ar9170/usb.c
index 754b1f8d8da9..007eb85fc67e 100644
--- a/drivers/net/wireless/ath/ar9170/usb.c
+++ b/drivers/net/wireless/ath/ar9170/usb.c
@@ -598,11 +598,15 @@ static int ar9170_usb_request_firmware(struct ar9170_usb *aru)
        err = request_firmware(&aru->init_values, "ar9170-1.fw",
                               &aru->udev->dev);
+        if (err) {
+                dev_err(&aru->udev->dev, "file with init values not found.\n");
+                return err;
+        }
        err = request_firmware(&aru->firmware, "ar9170-2.fw", &aru->udev->dev);
        if (err) {
                release_firmware(aru->init_values);
-                dev_err(&aru->udev->dev, "file with init values not found.\n");
+                dev_err(&aru->udev->dev, "firmware file not found.\n");
                return err;
        }
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 44c29b3f6728..f593fbbb4e52 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -2874,45 +2874,27 @@ static int ipw_fw_dma_add_command_block(struct ipw_priv *priv,
        return 0;
 }
-static int ipw_fw_dma_add_buffer(struct ipw_priv *priv,
+static int ipw_fw_dma_add_buffer(struct ipw_priv *priv, dma_addr_t *src_address,
-                                 u32 src_phys, u32 dest_address, u32 length)
+                                 int nr, u32 dest_address, u32 len)
 {
-        u32 bytes_left = length;
+        int ret, i;
-        u32 src_offset = 0;
+        u32 size;
-        u32 dest_offset = 0;
-        int status = 0;
        IPW_DEBUG_FW(">> \n");
-        IPW_DEBUG_FW_INFO("src_phys=0x%x dest_address=0x%x length=0x%x\n",
+        IPW_DEBUG_FW_INFO("nr=%d dest_address=0x%x len=0x%x\n",
-                          src_phys, dest_address, length);
+                          nr, dest_address, len);
-        while (bytes_left > CB_MAX_LENGTH) {
-                status = ipw_fw_dma_add_command_block(priv,
+        for (i = 0; i < nr; i++) {
-                                                      src_phys + src_offset,
+                size = min_t(u32, len - i * CB_MAX_LENGTH, CB_MAX_LENGTH);
-                                                      dest_address +
+                ret = ipw_fw_dma_add_command_block(priv, src_address[i],
-                                                      dest_offset,
+                                                   dest_address +
-                                                      CB_MAX_LENGTH, 0, 0);
+                                                   i * CB_MAX_LENGTH, size,
-                if (status) {
+                                                   0, 0);
+                if (ret) {
                        IPW_DEBUG_FW_INFO(": Failed\n");
                        return -1;
                } else
                        IPW_DEBUG_FW_INFO(": Added new cb\n");
-                src_offset += CB_MAX_LENGTH;
-                dest_offset += CB_MAX_LENGTH;
-                bytes_left -= CB_MAX_LENGTH;
-        }
-        /* add the buffer tail */
-        if (bytes_left > 0) {
-                status =
-                    ipw_fw_dma_add_command_block(priv, src_phys + src_offset,
-                                                 dest_address + dest_offset,
-                                                 bytes_left, 0, 0);
-                if (status) {
-                        IPW_DEBUG_FW_INFO(": Failed on the buffer tail\n");
-                        return -1;
-                } else
-                        IPW_DEBUG_FW_INFO
-                            (": Adding new cb - the buffer tail\n");
        }
        IPW_DEBUG_FW("<< \n");
@@ -3160,59 +3142,91 @@ static int ipw_load_ucode(struct ipw_priv *priv, u8 * data, size_t len)
 static int ipw_load_firmware(struct ipw_priv *priv, u8 * data, size_t len)
 {
-        int rc = -1;
+        int ret = -1;
        int offset = 0;
        struct fw_chunk *chunk;
-        dma_addr_t shared_phys;
+        int total_nr = 0;
-        u8 *shared_virt;
+        int i;
+        struct pci_pool *pool;
+        u32 *virts[CB_NUMBER_OF_ELEMENTS_SMALL];
+        dma_addr_t phys[CB_NUMBER_OF_ELEMENTS_SMALL];
        IPW_DEBUG_TRACE("<< : \n");
-        shared_virt = pci_alloc_consistent(priv->pci_dev, len, &shared_phys);
-        if (!shared_virt)
+        pool = pci_pool_create("ipw2200", priv->pci_dev, CB_MAX_LENGTH, 0, 0);
+        if (!pool) {
+                IPW_ERROR("pci_pool_create failed\n");
                return -ENOMEM;
+        }
-        memmove(shared_virt, data, len);
        /* Start the Dma */
-        rc = ipw_fw_dma_enable(priv);
+        ret = ipw_fw_dma_enable(priv);
        /* the DMA is already ready this would be a bug. */
        BUG_ON(priv->sram_desc.last_cb_index > 0);
        do {
+                u32 chunk_len;
+                u8 *start;
+                int size;
+                int nr = 0;
                chunk = (struct fw_chunk *)(data + offset);
                offset += sizeof(struct fw_chunk);
+                chunk_len = le32_to_cpu(chunk->length);
+                start = data + offset;
+                nr = (chunk_len + CB_MAX_LENGTH - 1) / CB_MAX_LENGTH;
+                for (i = 0; i < nr; i++) {
+                        virts[total_nr] = pci_pool_alloc(pool, GFP_KERNEL,
+                                                         &phys[total_nr]);
+                        if (!virts[total_nr]) {
+                                ret = -ENOMEM;
+                                goto out;
+                        }
+                        size = min_t(u32, chunk_len - i * CB_MAX_LENGTH,
+                                     CB_MAX_LENGTH);
+                        memcpy(virts[total_nr], start, size);
+                        start += size;
+                        total_nr++;
+                        /* We don't support fw chunk larger than 64*8K */
+                        BUG_ON(total_nr > CB_NUMBER_OF_ELEMENTS_SMALL);
+                }
                /* build DMA packet and queue up for sending */
                /* dma to chunk->address, the chunk->length bytes from data +
                 * offeset*/
                /* Dma loading */
-                rc = ipw_fw_dma_add_buffer(priv, shared_phys + offset,
+                ret = ipw_fw_dma_add_buffer(priv, &phys[total_nr - nr],
-                                           le32_to_cpu(chunk->address),
+                                            nr, le32_to_cpu(chunk->address),
-                                           le32_to_cpu(chunk->length));
+                                            chunk_len);
-                if (rc) {
+                if (ret) {
                        IPW_DEBUG_INFO("dmaAddBuffer Failed\n");
                        goto out;
                }
-                offset += le32_to_cpu(chunk->length);
+                offset += chunk_len;
        } while (offset < len);
        /* Run the DMA and wait for the answer */
-        rc = ipw_fw_dma_kick(priv);
+        ret = ipw_fw_dma_kick(priv);
-        if (rc) {
+        if (ret) {
                IPW_ERROR("dmaKick Failed\n");
                goto out;
        }
-        rc = ipw_fw_dma_wait(priv);
+        ret = ipw_fw_dma_wait(priv);
-        if (rc) {
+        if (ret) {
                IPW_ERROR("dmaWaitSync Failed\n");
                goto out;
        }
-      out:
+ out:
-        pci_free_consistent(priv->pci_dev, len, shared_virt, shared_phys);
+        for (i = 0; i < total_nr; i++)
-        return rc;
+                pci_pool_free(pool, virts[i], phys[i]);
+        pci_pool_destroy(pool);
+        return ret;
 }
 /* stop nic */
@@ -6226,7 +6240,7 @@ static void ipw_add_scan_channels(struct ipw_priv *priv,
                        };
                        u8 channel;
-                        while (channel_index < IPW_SCAN_CHANNELS) {
+                        while (channel_index < IPW_SCAN_CHANNELS - 1) {
                                channel =
                                    priv->speed_scan[priv->speed_scan_pos];
                                if (channel == 0) {
diff --git a/drivers/net/wireless/libertas/assoc.c b/drivers/net/wireless/libertas/assoc.c
index d6997371c27e..b9b374119033 100644
--- a/drivers/net/wireless/libertas/assoc.c
+++ b/drivers/net/wireless/libertas/assoc.c
@@ -1,7 +1,6 @@
 /* Copyright (C) 2006, Red Hat, Inc. */
 #include <linux/types.h>
-#include <linux/kernel.h>
 #include <linux/etherdevice.h>
 #include <linux/ieee80211.h>
 #include <linux/if_arp.h>
@@ -44,21 +43,21 @@ static int get_common_rates(struct lbs_private *priv,
        u16 *rates_size)
 {
        u8 *card_rates = lbs_bg_rates;
+        size_t num_card_rates = sizeof(lbs_bg_rates);
        int ret = 0, i, j;
-        u8 tmp[(ARRAY_SIZE(lbs_bg_rates) - 1) * (*rates_size - 1)];
+        u8 tmp[30];
        size_t tmp_size = 0;
        /* For each rate in card_rates that exists in rate1, copy to tmp */
-        for (i = 0; i < ARRAY_SIZE(lbs_bg_rates) && card_rates[i]; i++) {
+        for (i = 0; card_rates[i] && (i < num_card_rates); i++) {
-                for (j = 0; j < *rates_size && rates[j]; j++) {
+                for (j = 0; rates[j] && (j < *rates_size); j++) {
                        if (rates[j] == card_rates[i])
                                tmp[tmp_size++] = card_rates[i];
                }
        }
        lbs_deb_hex(LBS_DEB_JOIN, "AP rates    ", rates, *rates_size);
-        lbs_deb_hex(LBS_DEB_JOIN, "card rates  ", card_rates,
+        lbs_deb_hex(LBS_DEB_JOIN, "card rates  ", card_rates, num_card_rates);
-                        ARRAY_SIZE(lbs_bg_rates));
        lbs_deb_hex(LBS_DEB_JOIN, "common rates", tmp, tmp_size);
        lbs_deb_join("TX data rate 0x%02x\n", priv->cur_rate);
@@ -70,7 +69,10 @@ static int get_common_rates(struct lbs_private *priv,
                lbs_pr_alert("Previously set fixed data rate %#x isn't "
                       "compatible with the network.\n", priv->cur_rate);
                ret = -1;
+                goto done;
        }
+        ret = 0;
 done:
        memset(rates, 0, *rates_size);
        *rates_size = min_t(int, tmp_size, *rates_size);
@@ -320,7 +322,7 @@ static int lbs_associate(struct lbs_private *priv,
        rates = (struct mrvl_ie_rates_param_set *) pos;
        rates->header.type = cpu_to_le16(TLV_TYPE_RATES);
        memcpy(&rates->rates, &bss->rates, MAX_RATES);
-        tmplen = min_t(u16, ARRAY_SIZE(rates->rates), MAX_RATES);
+        tmplen = MAX_RATES;
        if (get_common_rates(priv, rates->rates, &tmplen)) {
                ret = -1;
                goto done;
@@ -596,7 +598,7 @@ static int lbs_adhoc_join(struct lbs_private *priv,
        /* Copy Data rates from the rates recorded in scan response */
        memset(cmd.bss.rates, 0, sizeof(cmd.bss.rates));
-        ratesize = min_t(u16, ARRAY_SIZE(cmd.bss.rates), MAX_RATES);
+        ratesize = min_t(u16, sizeof(cmd.bss.rates), MAX_RATES);
        memcpy(cmd.bss.rates, bss->rates, ratesize);
        if (get_common_rates(priv, cmd.bss.rates, &ratesize)) {
                lbs_deb_join("ADHOC_JOIN: get_common_rates returned error.\n");
diff --git a/drivers/net/wireless/libertas/hostcmd.h b/drivers/net/wireless/libertas/hostcmd.h
index 0a2e29140add..c8a1998d4744 100644
--- a/drivers/net/wireless/libertas/hostcmd.h
+++ b/drivers/net/wireless/libertas/hostcmd.h
@@ -56,8 +56,8 @@ struct rxpd {
                        u8 bss_type;
                        /* BSS number */
                        u8 bss_num;
-                } bss;
+                } __attribute__ ((packed)) bss;
-        } u;
+        } __attribute__ ((packed)) u;
        /* SNR */
        u8 snr;
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index a263d5c84c08..83967afe0821 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -261,7 +261,7 @@ struct mwl8k_vif {
         */
 };
-#define MWL8K_VIF(_vif) (struct mwl8k_vif *)(&((_vif)->drv_priv))
+#define MWL8K_VIF(_vif) ((struct mwl8k_vif *)&((_vif)->drv_priv))
 static const struct ieee80211_channel mwl8k_channels[] = {
        { .center_freq = 2412, .hw_value = 1, },
@@ -1012,6 +1012,8 @@ static int rxq_process(struct ieee80211_hw *hw, int index, int limit)
                rmb();
                skb = rxq->rx_skb[rxq->rx_head];
+                if (skb == NULL)
+                        break;
                rxq->rx_skb[rxq->rx_head] = NULL;
                rxq->rx_head = (rxq->rx_head + 1) % MWL8K_RX_DESCS;
@@ -1591,6 +1593,9 @@ static int mwl8k_post_cmd(struct ieee80211_hw *hw, struct mwl8k_cmd_pkt *cmd)
        timeout = wait_for_completion_timeout(&cmd_wait,
                                msecs_to_jiffies(MWL8K_CMD_TIMEOUT_MS));
+        pci_unmap_single(priv->pdev, dma_addr, dma_size,
+                                        PCI_DMA_BIDIRECTIONAL);
        result = &cmd->result;
        if (!timeout) {
                spin_lock_irq(&priv->fw_lock);
@@ -1610,8 +1615,6 @@ static int mwl8k_post_cmd(struct ieee80211_hw *hw, struct mwl8k_cmd_pkt *cmd)
                               *result);
        }
-        pci_unmap_single(priv->pdev, dma_addr, dma_size,
-                                        PCI_DMA_BIDIRECTIONAL);
        return rc;
 }
@@ -1654,18 +1657,18 @@ static int mwl8k_cmd_get_hw_spec(struct ieee80211_hw *hw)
        memset(cmd->perm_addr, 0xff, sizeof(cmd->perm_addr));
        cmd->ps_cookie = cpu_to_le32(priv->cookie_dma);
        cmd->rx_queue_ptr = cpu_to_le32(priv->rxq[0].rx_desc_dma);
-        cmd->num_tx_queues = MWL8K_TX_QUEUES;
+        cmd->num_tx_queues = cpu_to_le32(MWL8K_TX_QUEUES);
        for (i = 0; i < MWL8K_TX_QUEUES; i++)
                cmd->tx_queue_ptrs[i] = cpu_to_le32(priv->txq[i].tx_desc_dma);
-        cmd->num_tx_desc_per_queue = MWL8K_TX_DESCS;
+        cmd->num_tx_desc_per_queue = cpu_to_le32(MWL8K_TX_DESCS);
-        cmd->total_rx_desc = MWL8K_RX_DESCS;
+        cmd->total_rx_desc = cpu_to_le32(MWL8K_RX_DESCS);
        rc = mwl8k_post_cmd(hw, &cmd->header);
        if (!rc) {
                SET_IEEE80211_PERM_ADDR(hw, cmd->perm_addr);
                priv->num_mcaddrs = le16_to_cpu(cmd->num_mcaddrs);
-                priv->fw_rev = cmd->fw_rev;
+                priv->fw_rev = le32_to_cpu(cmd->fw_rev);
                priv->hw_rev = cmd->hw_rev;
                priv->region_code = le16_to_cpu(cmd->region_code);
        }
@@ -3216,15 +3219,19 @@ static int mwl8k_configure_filter_wt(struct work_struct *wt)
        struct dev_addr_list *mclist = worker->mclist;
        struct mwl8k_priv *priv = hw->priv;
-        struct mwl8k_vif *mv_vif;
        int rc = 0;
        if (changed_flags & FIF_BCN_PRBRESP_PROMISC) {
                if (*total_flags & FIF_BCN_PRBRESP_PROMISC)
                        rc = mwl8k_cmd_set_pre_scan(hw);
                else {
-                        mv_vif = MWL8K_VIF(priv->vif);
+                        u8 *bssid;
-                        rc = mwl8k_cmd_set_post_scan(hw, mv_vif->bssid);
+                        bssid = "\x00\x00\x00\x00\x00\x00";
+                        if (priv->vif != NULL)
+                                bssid = MWL8K_VIF(priv->vif)->bssid;
+                        rc = mwl8k_cmd_set_post_scan(hw, bssid);
                }
        }
@@ -3726,6 +3733,8 @@ static void __devexit mwl8k_remove(struct pci_dev *pdev)
        ieee80211_stop_queues(hw);
+        ieee80211_unregister_hw(hw);
        /* Remove tx reclaim tasklet */
        tasklet_kill(&priv->tx_reclaim_task);
@@ -3739,8 +3748,6 @@ static void __devexit mwl8k_remove(struct pci_dev *pdev)
        for (i = 0; i < MWL8K_TX_QUEUES; i++)
                mwl8k_txq_reclaim(hw, i, 1);
-        ieee80211_unregister_hw(hw);
        for (i = 0; i < MWL8K_TX_QUEUES; i++)
                mwl8k_txq_deinit(hw, i);
diff --git a/drivers/net/wireless/orinoco/hw.c b/drivers/net/wireless/orinoco/hw.c
index 632fac86a308..b3946272c72e 100644
--- a/drivers/net/wireless/orinoco/hw.c
+++ b/drivers/net/wireless/orinoco/hw.c
@@ -70,7 +70,7 @@ int orinoco_hw_get_tkip_iv(struct orinoco_private *priv, int key, u8 *tsc)
        int err = 0;
        u8 tsc_arr[4][IW_ENCODE_SEQ_MAX_SIZE];
-        if ((key < 0) || (key > 4))
+        if ((key < 0) || (key >= 4))
                return -EINVAL;
        err = hermes_read_ltv(hw, USER_BAP, HERMES_RID_CURRENT_TKIP_IV,
diff --git a/drivers/net/wireless/rt2x00/rt2x00.h b/drivers/net/wireless/rt2x00/rt2x00.h
index a498dde024e1..49c9e2c1433d 100644
--- a/drivers/net/wireless/rt2x00/rt2x00.h
+++ b/drivers/net/wireless/rt2x00/rt2x00.h
@@ -849,13 +849,15 @@ struct rt2x00_dev {
 static inline void rt2x00_rf_read(struct rt2x00_dev *rt2x00dev,
                                  const unsigned int word, u32 *data)
 {
-        *data = rt2x00dev->rf[word];
+        BUG_ON(word < 1 || word > rt2x00dev->ops->rf_size / sizeof(u32));
+        *data = rt2x00dev->rf[word - 1];
 }
 static inline void rt2x00_rf_write(struct rt2x00_dev *rt2x00dev,
                                   const unsigned int word, u32 data)
 {
-        rt2x00dev->rf[word] = data;
+        BUG_ON(word < 1 || word > rt2x00dev->ops->rf_size / sizeof(u32));
+        rt2x00dev->rf[word - 1] = data;
 }
 /*
diff --git a/drivers/net/wireless/rtl818x/rtl8187_dev.c b/drivers/net/wireless/rtl818x/rtl8187_dev.c
index 294250e294dd..87a95588a8e3 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_dev.c
@@ -869,6 +869,9 @@ static int rtl8187b_init_hw(struct ieee80211_hw *dev)
        priv->aifsn[3] = 3; /* AIFSN[AC_BE] */
        rtl818x_iowrite8(priv, &priv->map->ACM_CONTROL, 0);
+        /* ENEDCA flag must always be set, transmit issues? */
+        rtl818x_iowrite8(priv, &priv->map->MSR, RTL818X_MSR_ENEDCA);
        return 0;
 }
@@ -1173,13 +1176,16 @@ static void rtl8187_bss_info_changed(struct ieee80211_hw *dev,
                        rtl818x_iowrite8(priv, &priv->map->BSSID[i],
                                         info->bssid[i]);
+                if (priv->is_rtl8187b)
+                        reg = RTL818X_MSR_ENEDCA;
+                else
+                        reg = 0;
                if (is_valid_ether_addr(info->bssid)) {
-                        reg = RTL818X_MSR_INFRA;
+                        reg |= RTL818X_MSR_INFRA;
-                        if (priv->is_rtl8187b)
-                                reg |= RTL818X_MSR_ENEDCA;
                        rtl818x_iowrite8(priv, &priv->map->MSR, reg);
                } else {
-                        reg = RTL818X_MSR_NO_LINK;
+                        reg |= RTL818X_MSR_NO_LINK;
                        rtl818x_iowrite8(priv, &priv->map->MSR, reg);
                }
diff --git a/drivers/net/yellowfin.c b/drivers/net/yellowfin.c
index a07580138e81..c2fd6187773f 100644
--- a/drivers/net/yellowfin.c
+++ b/drivers/net/yellowfin.c
@@ -346,7 +346,7 @@ static int netdev_ioctl(struct net_device *dev, struct ifreq *rq, int cmd);
 static int yellowfin_open(struct net_device *dev);
 static void yellowfin_timer(unsigned long data);
 static void yellowfin_tx_timeout(struct net_device *dev);
-static void yellowfin_init_ring(struct net_device *dev);
+static int yellowfin_init_ring(struct net_device *dev);
 static int yellowfin_start_xmit(struct sk_buff *skb, struct net_device *dev);
 static irqreturn_t yellowfin_interrupt(int irq, void *dev_instance);
 static int yellowfin_rx(struct net_device *dev);
@@ -573,19 +573,24 @@ static int yellowfin_open(struct net_device *dev)
 {
        struct yellowfin_private *yp = netdev_priv(dev);
        void __iomem *ioaddr = yp->base;
-        int i;
+        int i, ret;
        /* Reset the chip. */
        iowrite32(0x80000000, ioaddr + DMACtrl);
-        i = request_irq(dev->irq, &yellowfin_interrupt, IRQF_SHARED, dev->name, dev);
+        ret = request_irq(dev->irq, &yellowfin_interrupt, IRQF_SHARED, dev->name, dev);
-        if (i) return i;
+        if (ret)
+                return ret;
        if (yellowfin_debug > 1)
                printk(KERN_DEBUG "%s: yellowfin_open() irq %d.\n",
                           dev->name, dev->irq);
-        yellowfin_init_ring(dev);
+        ret = yellowfin_init_ring(dev);
+        if (ret) {
+                free_irq(dev->irq, dev);
+                return ret;
+        }
        iowrite32(yp->rx_ring_dma, ioaddr + RxPtr);
        iowrite32(yp->tx_ring_dma, ioaddr + TxPtr);
@@ -725,10 +730,10 @@ static void yellowfin_tx_timeout(struct net_device *dev)
 }
 /* Initialize the Rx and Tx rings, along with various 'dev' bits. */
-static void yellowfin_init_ring(struct net_device *dev)
+static int yellowfin_init_ring(struct net_device *dev)
 {
        struct yellowfin_private *yp = netdev_priv(dev);
-        int i;
+        int i, j;
        yp->tx_full = 0;
        yp->cur_rx = yp->cur_tx = 0;
@@ -753,6 +758,11 @@ static void yellowfin_init_ring(struct net_device *dev)
                yp->rx_ring[i].addr = cpu_to_le32(pci_map_single(yp->pci_dev,
                        skb->data, yp->rx_buf_sz, PCI_DMA_FROMDEVICE));
        }
+        if (i != RX_RING_SIZE) {
+                for (j = 0; j < i; j++)
+                        dev_kfree_skb(yp->rx_skbuff[j]);
+                return -ENOMEM;
+        }
        yp->rx_ring[i-1].dbdma_cmd = cpu_to_le32(CMD_STOP);
        yp->dirty_rx = (unsigned int)(i - RX_RING_SIZE);
@@ -769,8 +779,6 @@ static void yellowfin_init_ring(struct net_device *dev)
        yp->tx_ring[--i].dbdma_cmd = cpu_to_le32(CMD_STOP | BRANCH_ALWAYS);
 #else
 {
-        int j;
        /* Tx ring needs a pair of descriptors, the second for the status. */
        for (i = 0; i < TX_RING_SIZE; i++) {
                j = 2*i;
@@ -805,7 +813,7 @@ static void yellowfin_init_ring(struct net_device *dev)
 }
 #endif
        yp->tx_tail_desc = &yp->tx_status[0];
-        return;
+        return 0;
 }
 static int yellowfin_start_xmit(struct sk_buff *skb, struct net_device *dev)
diff --git a/drivers/net/zorro8390.c b/drivers/net/zorro8390.c
index 37c84e3b8be0..81c753a617ab 100644
--- a/drivers/net/zorro8390.c
+++ b/drivers/net/zorro8390.c
@@ -120,6 +120,9 @@ static int __devinit zorro8390_init_one(struct zorro_dev *z,
    for (i = ARRAY_SIZE(cards)-1; i >= 0; i--)
        if (z->id == cards[i].id)
            break;
+    if (i < 0)
+        return -ENODEV;
    board = z->resource.start;
    ioaddr = board+cards[i].offset;
    dev = alloc_ei_netdev();
diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c
index e3a87210e947..e03fe98f0619 100644
--- a/drivers/pci/iov.c
+++ b/drivers/pci/iov.c
@@ -598,6 +598,29 @@ int pci_iov_resource_bar(struct pci_dev *dev, int resno,
 }
 /**
+ * pci_sriov_resource_alignment - get resource alignment for VF BAR
+ * @dev: the PCI device
+ * @resno: the resource number
+ *
+ * Returns the alignment of the VF BAR found in the SR-IOV capability.
+ * This is not the same as the resource size which is defined as
+ * the VF BAR size multiplied by the number of VFs.  The alignment
+ * is just the VF BAR size.
+ */
+int pci_sriov_resource_alignment(struct pci_dev *dev, int resno)
+{
+        struct resource tmp;
+        enum pci_bar_type type;
+        int reg = pci_iov_resource_bar(dev, resno, &type);
+        
+        if (!reg)
+                return 0;
+         __pci_read_base(dev, type, &tmp, reg);
+        return resource_alignment(&tmp);
+}
+/**
 * pci_restore_iov_state - restore the state of the IOV capability
 * @dev: the PCI device
 */
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index d76c4c85367e..f99bc7f089f1 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -508,7 +508,7 @@ static int pci_restore_standard_config(struct pci_dev *pci_dev)
                        return error;
        }
-        return pci_dev->state_saved ? pci_restore_state(pci_dev) : 0;
+        return pci_restore_state(pci_dev);
 }
 static void pci_pm_default_resume_noirq(struct pci_dev *pci_dev)
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index dbd0f947f497..7b70312181d7 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -846,6 +846,8 @@ pci_restore_state(struct pci_dev *dev)
        int i;
        u32 val;
+        if (!dev->state_saved)
+                return 0;
        /* PCI Express register must be restored first */
        pci_restore_pcie_state(dev);
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index f73bcbedf37c..5ff4d25bf0e9 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -243,6 +243,7 @@ extern int pci_iov_init(struct pci_dev *dev);
 extern void pci_iov_release(struct pci_dev *dev);
 extern int pci_iov_resource_bar(struct pci_dev *dev, int resno,
                                enum pci_bar_type *type);
+extern int pci_sriov_resource_alignment(struct pci_dev *dev, int resno);
 extern void pci_restore_iov_state(struct pci_dev *dev);
 extern int pci_iov_bus_range(struct pci_bus *bus);
@@ -298,4 +299,16 @@ static inline int pci_ats_enabled(struct pci_dev *dev)
 }
 #endif /* CONFIG_PCI_IOV */
+static inline int pci_resource_alignment(struct pci_dev *dev,
+                                         struct resource *res)
+{
+#ifdef CONFIG_PCI_IOV
+        int resno = res - dev->resource;
+        if (resno >= PCI_IOV_RESOURCES && resno <= PCI_IOV_RESOURCE_END)
+                return pci_sriov_resource_alignment(dev, resno);
+#endif
+        return resource_alignment(res);
+}
 #endif /* DRIVERS_PCI_H */
diff --git a/drivers/pci/setup-bus.c b/drivers/pci/setup-bus.c
index b636e245445d..7c443b4583ab 100644
--- a/drivers/pci/setup-bus.c
+++ b/drivers/pci/setup-bus.c
@@ -25,7 +25,7 @@
 #include <linux/ioport.h>
 #include <linux/cache.h>
 #include <linux/slab.h>
+#include "pci.h"
 static void pbus_assign_resources_sorted(const struct pci_bus *bus)
 {
@@ -384,7 +384,7 @@ static int pbus_size_mem(struct pci_bus *bus, unsigned long mask, unsigned long
                                continue;
                        r_size = resource_size(r);
                        /* For bridges size != alignment */
-                        align = resource_alignment(r);
+                        align = pci_resource_alignment(dev, r);
                        order = __ffs(align) - 20;
                        if (order > 11) {
                                dev_warn(&dev->dev, "BAR %d bad alignment %llx: "
diff --git a/drivers/pci/setup-res.c b/drivers/pci/setup-res.c
index 1898c7b47907..88cdd1a937d6 100644
--- a/drivers/pci/setup-res.c
+++ b/drivers/pci/setup-res.c
@@ -144,7 +144,7 @@ static int __pci_assign_resource(struct pci_bus *bus, struct pci_dev *dev,
        size = resource_size(res);
        min = (res->flags & IORESOURCE_IO) ? PCIBIOS_MIN_IO : PCIBIOS_MIN_MEM;
-        align = resource_alignment(res);
+        align = pci_resource_alignment(dev, res);
        /* First, try exact prefetching match.. */
        ret = pci_bus_alloc_resource(bus, res, size, align, min,
@@ -178,7 +178,7 @@ int pci_assign_resource(struct pci_dev *dev, int resno)
        struct pci_bus *bus;
        int ret;
-        align = resource_alignment(res);
+        align = pci_resource_alignment(dev, res);
        if (!align) {
                dev_info(&dev->dev, "BAR %d: can't allocate resource (bogus "
                        "alignment) %pR flags %#lx\n",
@@ -259,7 +259,7 @@ void pdev_sort_resources(struct pci_dev *dev, struct resource_list *head)
                if (!(r->flags) || r->parent)
                        continue;
-                r_align = resource_alignment(r);
+                r_align = pci_resource_alignment(dev, r);
                if (!r_align) {
                        dev_warn(&dev->dev, "BAR %d: bogus alignment "
                                "%pR flags %#lx\n",
@@ -271,7 +271,7 @@ void pdev_sort_resources(struct pci_dev *dev, struct resource_list *head)
                        struct resource_list *ln = list->next;
                        if (ln)
-                                align = resource_alignment(ln->res);
+                                align = pci_resource_alignment(ln->dev, ln->res);
                        if (r_align > align) {
                                tmp = kmalloc(sizeof(*tmp), GFP_KERNEL);
diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
index 81d31ea507d1..51c0a8bee414 100644
--- a/drivers/platform/x86/toshiba_acpi.c
+++ b/drivers/platform/x86/toshiba_acpi.c
@@ -335,6 +335,7 @@ static void bt_rfkill_poll(struct rfkill *rfkill, void *data)
        if (hci_result != HCI_SUCCESS) {
                /* Can't do anything useful */
                mutex_unlock(&dev->mutex);
+                return;
        }
        new_rfk_state = value;
diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index 043b208d971d..f215a5919192 100644
--- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -270,7 +270,7 @@ u32 method_id, const struct acpi_buffer *in, struct acpi_buffer *out)
        acpi_status status;
        struct acpi_object_list input;
        union acpi_object params[3];
-        char method[4] = "WM";
+        char method[5] = "WM";
        if (!find_guid(guid_string, &wblock))
                return AE_ERROR;
@@ -328,8 +328,8 @@ struct acpi_buffer *out)
        acpi_status status, wc_status = AE_ERROR;
        struct acpi_object_list input, wc_input;
        union acpi_object wc_params[1], wq_params[1];
-        char method[4];
+        char method[5];
-        char wc_method[4] = "WC";
+        char wc_method[5] = "WC";
        if (!guid_string || !out)
                return AE_BAD_PARAMETER;
@@ -410,7 +410,7 @@ const struct acpi_buffer *in)
        acpi_handle handle;
        struct acpi_object_list input;
        union acpi_object params[2];
-        char method[4] = "WS";
+        char method[5] = "WS";
        if (!guid_string || !in)
                return AE_BAD_DATA;
diff --git a/drivers/pps/pps.c b/drivers/pps/pps.c
index ac8cc8cea1e3..fea17e7805e9 100644
--- a/drivers/pps/pps.c
+++ b/drivers/pps/pps.c
@@ -244,7 +244,7 @@ int pps_register_cdev(struct pps_device *pps)
        }
        pps->dev = device_create(pps_class, pps->info.dev, pps->devno, NULL,
                                                        "pps%d", pps->id);
-        if (err)
+        if (IS_ERR(pps->dev))
                goto del_cdev;
        dev_set_drvdata(pps->dev, pps);
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 749836668655..3f62dd50bbbe 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -2135,9 +2135,9 @@ static int dasd_getgeo(struct block_device *bdev, struct hd_geometry *geo)
        struct dasd_device *base;
        block = bdev->bd_disk->private_data;
-        base = block->base;
        if (!block)
                return -ENODEV;
+        base = block->base;
        if (!base->discipline ||
            !base->discipline->fill_geometry)
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index 3c57c1a18bb8..d593bc76afe3 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -772,10 +772,8 @@ static struct ccw_device * io_subchannel_create_ccwdev(struct subchannel *sch)
        cdev = io_subchannel_allocate_dev(sch);
        if (!IS_ERR(cdev)) {
                ret = io_subchannel_initialize_dev(sch, cdev);
-                if (ret) {
+                if (ret)
-                        kfree(cdev);
                        cdev = ERR_PTR(ret);
-                }
        }
        return cdev;
 }
diff --git a/drivers/sbus/char/bbc_envctrl.c b/drivers/sbus/char/bbc_envctrl.c
index 15dab96d05e3..7c815d3327f7 100644
--- a/drivers/sbus/char/bbc_envctrl.c
+++ b/drivers/sbus/char/bbc_envctrl.c
@@ -537,8 +537,12 @@ int bbc_envctrl_init(struct bbc_i2c_bus *bp)
        }
        if (temp_index != 0 && fan_index != 0) {
                kenvctrld_task = kthread_run(kenvctrld, NULL, "kenvctrld");
-                if (IS_ERR(kenvctrld_task))
+                if (IS_ERR(kenvctrld_task)) {
-                        return PTR_ERR(kenvctrld_task);
+                        int err = PTR_ERR(kenvctrld_task);
+                        kenvctrld_task = NULL;
+                        return err;
+                }
        }
        return 0;
@@ -561,7 +565,8 @@ void bbc_envctrl_cleanup(struct bbc_i2c_bus *bp)
        struct bbc_cpu_temperature *tp, *tpos;
        struct bbc_fan_control *fp, *fpos;
-        kthread_stop(kenvctrld_task);
+        if (kenvctrld_task)
+                kthread_stop(kenvctrld_task);
        list_for_each_entry_safe(tp, tpos, &bp->temps, bp_list) {
                list_del(&tp->bp_list);
diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.c b/drivers/scsi/mpt2sas/mpt2sas_base.c
index f3da592f7bcc..35a13867495e 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_base.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_base.c
@@ -119,6 +119,64 @@ _base_fault_reset_work(struct work_struct *work)
        spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
 }
+/**
+ * mpt2sas_base_start_watchdog - start the fault_reset_work_q
+ * @ioc: pointer to scsi command object
+ * Context: sleep.
+ *
+ * Return nothing.
+ */
+void
+mpt2sas_base_start_watchdog(struct MPT2SAS_ADAPTER *ioc)
+{
+        unsigned long    flags;
+        if (ioc->fault_reset_work_q)
+                return;
+        /* initialize fault polling */
+        INIT_DELAYED_WORK(&ioc->fault_reset_work, _base_fault_reset_work);
+        snprintf(ioc->fault_reset_work_q_name,
+            sizeof(ioc->fault_reset_work_q_name), "poll_%d_status", ioc->id);
+        ioc->fault_reset_work_q =
+                create_singlethread_workqueue(ioc->fault_reset_work_q_name);
+        if (!ioc->fault_reset_work_q) {
+                printk(MPT2SAS_ERR_FMT "%s: failed (line=%d)\n",
+                    ioc->name, __func__, __LINE__);
+                        return;
+        }
+        spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
+        if (ioc->fault_reset_work_q)
+                queue_delayed_work(ioc->fault_reset_work_q,
+                    &ioc->fault_reset_work,
+                    msecs_to_jiffies(FAULT_POLLING_INTERVAL));
+        spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
+}
+/**
+ * mpt2sas_base_stop_watchdog - stop the fault_reset_work_q
+ * @ioc: pointer to scsi command object
+ * Context: sleep.
+ *
+ * Return nothing.
+ */
+void
+mpt2sas_base_stop_watchdog(struct MPT2SAS_ADAPTER *ioc)
+{
+        unsigned long    flags;
+        struct workqueue_struct *wq;
+        spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
+        wq = ioc->fault_reset_work_q;
+        ioc->fault_reset_work_q = NULL;
+        spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
+        if (wq) {
+                if (!cancel_delayed_work(&ioc->fault_reset_work))
+                        flush_workqueue(wq);
+                destroy_workqueue(wq);
+        }
+}
 #ifdef CONFIG_SCSI_MPT2SAS_LOGGING
 /**
 * _base_sas_ioc_info - verbose translation of the ioc status
@@ -440,6 +498,10 @@ _base_sas_log_info(struct MPT2SAS_ADAPTER *ioc , u32 log_info)
        if (sas_loginfo.dw.bus_type != 3 /*SAS*/)
                return;
+        /* each nexus loss loginfo */
+        if (log_info == 0x31170000)
+                return;
        /* eat the loginfos associated with task aborts */
        if (ioc->ignore_loginfos && (log_info == 30050000 || log_info ==
            0x31140000 || log_info == 0x31130000))
@@ -1109,7 +1171,6 @@ mpt2sas_base_map_resources(struct MPT2SAS_ADAPTER *ioc)
                }
        }
-        pci_set_drvdata(pdev, ioc->shost);
        _base_mask_interrupts(ioc);
        r = _base_enable_msix(ioc);
        if (r)
@@ -1132,7 +1193,6 @@ mpt2sas_base_map_resources(struct MPT2SAS_ADAPTER *ioc)
        ioc->pci_irq = -1;
        pci_release_selected_regions(ioc->pdev, ioc->bars);
        pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
        return r;
 }
@@ -3191,7 +3251,6 @@ mpt2sas_base_free_resources(struct MPT2SAS_ADAPTER *ioc)
        ioc->chip_phys = 0;
        pci_release_selected_regions(ioc->pdev, ioc->bars);
        pci_disable_device(pdev);
-        pci_set_drvdata(pdev, NULL);
        return;
 }
@@ -3205,7 +3264,6 @@ int
 mpt2sas_base_attach(struct MPT2SAS_ADAPTER *ioc)
 {
        int r, i;
-        unsigned long    flags;
        dinitprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s\n", ioc->name,
            __func__));
@@ -3214,6 +3272,7 @@ mpt2sas_base_attach(struct MPT2SAS_ADAPTER *ioc)
        if (r)
                return r;
+        pci_set_drvdata(ioc->pdev, ioc->shost);
        r = _base_make_ioc_ready(ioc, CAN_SLEEP, SOFT_RESET);
        if (r)
                goto out_free_resources;
@@ -3288,23 +3347,7 @@ mpt2sas_base_attach(struct MPT2SAS_ADAPTER *ioc)
        if (r)
                goto out_free_resources;
-        /* initialize fault polling */
+        mpt2sas_base_start_watchdog(ioc);
-        INIT_DELAYED_WORK(&ioc->fault_reset_work, _base_fault_reset_work);
-        snprintf(ioc->fault_reset_work_q_name,
-            sizeof(ioc->fault_reset_work_q_name), "poll_%d_status", ioc->id);
-        ioc->fault_reset_work_q =
-                create_singlethread_workqueue(ioc->fault_reset_work_q_name);
-        if (!ioc->fault_reset_work_q) {
-                printk(MPT2SAS_ERR_FMT "%s: failed (line=%d)\n",
-                    ioc->name, __func__, __LINE__);
-                        goto out_free_resources;
-        }
-        spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
-        if (ioc->fault_reset_work_q)
-                queue_delayed_work(ioc->fault_reset_work_q,
-                    &ioc->fault_reset_work,
-                    msecs_to_jiffies(FAULT_POLLING_INTERVAL));
-        spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
        return 0;
 out_free_resources:
@@ -3312,6 +3355,7 @@ mpt2sas_base_attach(struct MPT2SAS_ADAPTER *ioc)
        ioc->remove_host = 1;
        mpt2sas_base_free_resources(ioc);
        _base_release_memory_pools(ioc);
+        pci_set_drvdata(ioc->pdev, NULL);
        kfree(ioc->tm_cmds.reply);
        kfree(ioc->transport_cmds.reply);
        kfree(ioc->config_cmds.reply);
@@ -3337,22 +3381,14 @@ mpt2sas_base_attach(struct MPT2SAS_ADAPTER *ioc)
 void
 mpt2sas_base_detach(struct MPT2SAS_ADAPTER *ioc)
 {
-        unsigned long    flags;
-        struct workqueue_struct *wq;
        dexitprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s\n", ioc->name,
            __func__));
-        spin_lock_irqsave(&ioc->ioc_reset_in_progress_lock, flags);
+        mpt2sas_base_stop_watchdog(ioc);
-        wq = ioc->fault_reset_work_q;
-        ioc->fault_reset_work_q = NULL;
-        spin_unlock_irqrestore(&ioc->ioc_reset_in_progress_lock, flags);
-        if (!cancel_delayed_work(&ioc->fault_reset_work))
-                flush_workqueue(wq);
-        destroy_workqueue(wq);
        mpt2sas_base_free_resources(ioc);
        _base_release_memory_pools(ioc);
+        pci_set_drvdata(ioc->pdev, NULL);
        kfree(ioc->pfacts);
        kfree(ioc->ctl_cmds.reply);
        kfree(ioc->base_cmds.reply);
diff --git a/drivers/scsi/mpt2sas/mpt2sas_base.h b/drivers/scsi/mpt2sas/mpt2sas_base.h
index 286c185fa9e4..acdcff150a35 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_base.h
+++ b/drivers/scsi/mpt2sas/mpt2sas_base.h
@@ -69,10 +69,10 @@
 #define MPT2SAS_DRIVER_NAME             "mpt2sas"
 #define MPT2SAS_AUTHOR  "LSI Corporation <DL-MPTFusionLinux@lsi.com>"
 #define MPT2SAS_DESCRIPTION     "LSI MPT Fusion SAS 2.0 Device Driver"
-#define MPT2SAS_DRIVER_VERSION          "01.100.03.00"
+#define MPT2SAS_DRIVER_VERSION          "01.100.04.00"
 #define MPT2SAS_MAJOR_VERSION           01
 #define MPT2SAS_MINOR_VERSION           100
-#define MPT2SAS_BUILD_VERSION           03
+#define MPT2SAS_BUILD_VERSION           04
 #define MPT2SAS_RELEASE_VERSION         00
 /*
@@ -673,6 +673,8 @@ typedef void (*MPT_CALLBACK)(struct MPT2SAS_ADAPTER *ioc, u16 smid, u8 VF_ID,
 /* base shared API */
 extern struct list_head mpt2sas_ioc_list;
+void mpt2sas_base_start_watchdog(struct MPT2SAS_ADAPTER *ioc);
+void mpt2sas_base_stop_watchdog(struct MPT2SAS_ADAPTER *ioc);
 int mpt2sas_base_attach(struct MPT2SAS_ADAPTER *ioc);
 void mpt2sas_base_detach(struct MPT2SAS_ADAPTER *ioc);
diff --git a/drivers/scsi/mpt2sas/mpt2sas_config.c b/drivers/scsi/mpt2sas/mpt2sas_config.c
index 58cfb97846f7..6ddee161beb3 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_config.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_config.c
@@ -236,17 +236,25 @@ _config_request(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigRequest_t
        Mpi2ConfigRequest_t *config_request;
        int r;
        u8 retry_count;
-        u8 issue_reset;
+        u8 issue_host_reset = 0;
        u16 wait_state_count;
+        mutex_lock(&ioc->config_cmds.mutex);
        if (ioc->config_cmds.status != MPT2_CMD_NOT_USED) {
                printk(MPT2SAS_ERR_FMT "%s: config_cmd in use\n",
                    ioc->name, __func__);
+                mutex_unlock(&ioc->config_cmds.mutex);
                return -EAGAIN;
        }
        retry_count = 0;
 retry_config:
+        if (retry_count) {
+                if (retry_count > 2) /* attempt only 2 retries */
+                        return -EFAULT;
+                printk(MPT2SAS_INFO_FMT "%s: attempting retry (%d)\n",
+                    ioc->name, __func__, retry_count);
+        }
        wait_state_count = 0;
        ioc_state = mpt2sas_base_get_iocstate(ioc, 1);
        while (ioc_state != MPI2_IOC_STATE_OPERATIONAL) {
@@ -254,8 +262,8 @@ _config_request(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigRequest_t
                        printk(MPT2SAS_ERR_FMT
                            "%s: failed due to ioc not operational\n",
                            ioc->name, __func__);
-                        ioc->config_cmds.status = MPT2_CMD_NOT_USED;
+                        r = -EFAULT;
-                        return -EFAULT;
+                        goto out;
                }
                ssleep(1);
                ioc_state = mpt2sas_base_get_iocstate(ioc, 1);
@@ -271,8 +279,8 @@ _config_request(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigRequest_t
        if (!smid) {
                printk(MPT2SAS_ERR_FMT "%s: failed obtaining a smid\n",
                    ioc->name, __func__);
-                ioc->config_cmds.status = MPT2_CMD_NOT_USED;
+                r = -EAGAIN;
-                return -EAGAIN;
+                goto out;
        }
        r = 0;
@@ -292,9 +300,15 @@ _config_request(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigRequest_t
                    ioc->name, __func__);
                _debug_dump_mf(mpi_request,
                    sizeof(Mpi2ConfigRequest_t)/4);
-                if (!(ioc->config_cmds.status & MPT2_CMD_RESET))
+                retry_count++;
-                        issue_reset = 1;
+                if (ioc->config_cmds.smid == smid)
-                goto issue_host_reset;
+                        mpt2sas_base_free_smid(ioc, smid);
+                if ((ioc->shost_recovery) ||
+                    (ioc->config_cmds.status & MPT2_CMD_RESET))
+                        goto retry_config;
+                issue_host_reset = 1;
+                r = -EFAULT;
+                goto out;
        }
        if (ioc->config_cmds.status & MPT2_CMD_REPLY_VALID)
                memcpy(mpi_reply, ioc->config_cmds.reply,
@@ -302,21 +316,13 @@ _config_request(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigRequest_t
        if (retry_count)
                printk(MPT2SAS_INFO_FMT "%s: retry completed!!\n",
                    ioc->name, __func__);
+out:
        ioc->config_cmds.status = MPT2_CMD_NOT_USED;
-        return r;
+        mutex_unlock(&ioc->config_cmds.mutex);
+        if (issue_host_reset)
- issue_host_reset:
-        if (issue_reset)
                mpt2sas_base_hard_reset_handler(ioc, CAN_SLEEP,
                    FORCE_BIG_HAMMER);
-        ioc->config_cmds.status = MPT2_CMD_NOT_USED;
+        return r;
-        if (!retry_count) {
-                printk(MPT2SAS_INFO_FMT "%s: attempting retry\n",
-                    ioc->name, __func__);
-                retry_count++;
-                goto retry_config;
-        }
-        return -EFAULT;
 }
 /**
@@ -375,7 +381,6 @@ mpt2sas_config_get_manufacturing_pg0(struct MPT2SAS_ADAPTER *ioc,
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(config_page, 0, sizeof(Mpi2ManufacturingPage0_t));
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -417,7 +422,6 @@ mpt2sas_config_get_manufacturing_pg0(struct MPT2SAS_ADAPTER *ioc,
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -438,7 +442,6 @@ mpt2sas_config_get_bios_pg2(struct MPT2SAS_ADAPTER *ioc,
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(config_page, 0, sizeof(Mpi2BiosPage2_t));
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -480,7 +483,6 @@ mpt2sas_config_get_bios_pg2(struct MPT2SAS_ADAPTER *ioc,
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -501,7 +503,6 @@ mpt2sas_config_get_bios_pg3(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(config_page, 0, sizeof(Mpi2BiosPage3_t));
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -543,7 +544,6 @@ mpt2sas_config_get_bios_pg3(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -564,7 +564,6 @@ mpt2sas_config_get_iounit_pg0(struct MPT2SAS_ADAPTER *ioc,
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(config_page, 0, sizeof(Mpi2IOUnitPage0_t));
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -606,7 +605,6 @@ mpt2sas_config_get_iounit_pg0(struct MPT2SAS_ADAPTER *ioc,
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -627,7 +625,6 @@ mpt2sas_config_get_iounit_pg1(struct MPT2SAS_ADAPTER *ioc,
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(config_page, 0, sizeof(Mpi2IOUnitPage1_t));
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -669,7 +666,6 @@ mpt2sas_config_get_iounit_pg1(struct MPT2SAS_ADAPTER *ioc,
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -690,7 +686,6 @@ mpt2sas_config_set_iounit_pg1(struct MPT2SAS_ADAPTER *ioc,
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
        mpi_request.Action = MPI2_CONFIG_ACTION_PAGE_HEADER;
@@ -732,7 +727,6 @@ mpt2sas_config_set_iounit_pg1(struct MPT2SAS_ADAPTER *ioc,
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -753,7 +747,6 @@ mpt2sas_config_get_ioc_pg8(struct MPT2SAS_ADAPTER *ioc,
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(config_page, 0, sizeof(Mpi2IOCPage8_t));
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -795,7 +788,6 @@ mpt2sas_config_get_ioc_pg8(struct MPT2SAS_ADAPTER *ioc,
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -818,7 +810,6 @@ mpt2sas_config_get_sas_device_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(config_page, 0, sizeof(Mpi2SasDevicePage0_t));
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -863,7 +854,6 @@ mpt2sas_config_get_sas_device_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -886,7 +876,6 @@ mpt2sas_config_get_sas_device_pg1(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(config_page, 0, sizeof(Mpi2SasDevicePage1_t));
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -931,7 +920,6 @@ mpt2sas_config_get_sas_device_pg1(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -953,7 +941,6 @@ mpt2sas_config_get_number_hba_phys(struct MPT2SAS_ADAPTER *ioc, u8 *num_phys)
        Mpi2ConfigReply_t mpi_reply;
        Mpi2SasIOUnitPage0_t config_page;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
        mpi_request.Action = MPI2_CONFIG_ACTION_PAGE_HEADER;
@@ -1002,7 +989,6 @@ mpt2sas_config_get_number_hba_phys(struct MPT2SAS_ADAPTER *ioc, u8 *num_phys)
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -1026,8 +1012,6 @@ mpt2sas_config_get_sas_iounit_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
        Mpi2ConfigRequest_t mpi_request;
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(config_page, 0, sz);
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1070,7 +1054,6 @@ mpt2sas_config_get_sas_iounit_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -1095,7 +1078,6 @@ mpt2sas_config_get_sas_iounit_pg1(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(config_page, 0, sz);
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1138,7 +1120,6 @@ mpt2sas_config_get_sas_iounit_pg1(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -1161,7 +1142,6 @@ mpt2sas_config_get_expander_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(config_page, 0, sizeof(Mpi2ExpanderPage0_t));
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1206,7 +1186,6 @@ mpt2sas_config_get_expander_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -1230,7 +1209,6 @@ mpt2sas_config_get_expander_pg1(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(config_page, 0, sizeof(Mpi2ExpanderPage1_t));
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1277,7 +1255,6 @@ mpt2sas_config_get_expander_pg1(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -1300,7 +1277,6 @@ mpt2sas_config_get_enclosure_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(config_page, 0, sizeof(Mpi2SasEnclosurePage0_t));
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1345,7 +1321,6 @@ mpt2sas_config_get_enclosure_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -1367,7 +1342,6 @@ mpt2sas_config_get_phy_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(config_page, 0, sizeof(Mpi2SasPhyPage0_t));
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1413,7 +1387,6 @@ mpt2sas_config_get_phy_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -1435,7 +1408,6 @@ mpt2sas_config_get_phy_pg1(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(config_page, 0, sizeof(Mpi2SasPhyPage1_t));
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1481,7 +1453,6 @@ mpt2sas_config_get_phy_pg1(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -1505,7 +1476,6 @@ mpt2sas_config_get_raid_volume_pg1(struct MPT2SAS_ADAPTER *ioc,
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(config_page, 0, sizeof(Mpi2RaidVolPage1_t));
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1548,7 +1518,6 @@ mpt2sas_config_get_raid_volume_pg1(struct MPT2SAS_ADAPTER *ioc,
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -1572,7 +1541,6 @@ mpt2sas_config_get_number_pds(struct MPT2SAS_ADAPTER *ioc, u16 handle,
        struct config_request mem;
        u16 ioc_status;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        *num_pds = 0;
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1620,7 +1588,6 @@ mpt2sas_config_get_number_pds(struct MPT2SAS_ADAPTER *ioc, u16 handle,
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -1645,7 +1612,6 @@ mpt2sas_config_get_raid_volume_pg0(struct MPT2SAS_ADAPTER *ioc,
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        memset(config_page, 0, sz);
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1687,7 +1653,6 @@ mpt2sas_config_get_raid_volume_pg0(struct MPT2SAS_ADAPTER *ioc,
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -1711,7 +1676,6 @@ mpt2sas_config_get_phys_disk_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
        int r;
        struct config_request mem;
-        mutex_lock(&ioc->config_cmds.mutex);
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        memset(config_page, 0, sizeof(Mpi2RaidPhysDiskPage0_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1754,7 +1718,6 @@ mpt2sas_config_get_phys_disk_pg0(struct MPT2SAS_ADAPTER *ioc, Mpi2ConfigReply_t
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
@@ -1778,7 +1741,6 @@ mpt2sas_config_get_volume_handle(struct MPT2SAS_ADAPTER *ioc, u16 pd_handle,
        struct config_request mem;
        u16 ioc_status;
-        mutex_lock(&ioc->config_cmds.mutex);
        *volume_handle = 0;
        memset(&mpi_request, 0, sizeof(Mpi2ConfigRequest_t));
        mpi_request.Function = MPI2_FUNCTION_CONFIG;
@@ -1842,7 +1804,6 @@ mpt2sas_config_get_volume_handle(struct MPT2SAS_ADAPTER *ioc, u16 pd_handle,
                _config_free_config_dma_memory(ioc, &mem);
 out:
-        mutex_unlock(&ioc->config_cmds.mutex);
        return r;
 }
diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
index 2a01a5f2a84d..2e9a4445596f 100644
--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
@@ -2767,6 +2767,10 @@ _scsih_scsi_ioc_info(struct MPT2SAS_ADAPTER *ioc, struct scsi_cmnd *scmd,
        char *desc_ioc_state = NULL;
        char *desc_scsi_status = NULL;
        char *desc_scsi_state = ioc->tmp_string;
+        u32 log_info = le32_to_cpu(mpi_reply->IOCLogInfo);
+        if (log_info == 0x31170000)
+                return;
        switch (ioc_status) {
        case MPI2_IOCSTATUS_SUCCESS:
@@ -3426,7 +3430,7 @@ _scsih_expander_add(struct MPT2SAS_ADAPTER *ioc, u16 handle)
        __le64 sas_address;
        int i;
        unsigned long flags;
-        struct _sas_port *mpt2sas_port;
+        struct _sas_port *mpt2sas_port = NULL;
        int rc = 0;
        if (!handle)
@@ -3518,12 +3522,20 @@ _scsih_expander_add(struct MPT2SAS_ADAPTER *ioc, u16 handle)
                    &expander_pg1, i, handle))) {
                        printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
                            ioc->name, __FILE__, __LINE__, __func__);
-                        continue;
+                        rc = -1;
+                        goto out_fail;
                }
                sas_expander->phy[i].handle = handle;
                sas_expander->phy[i].phy_id = i;
-                mpt2sas_transport_add_expander_phy(ioc, &sas_expander->phy[i],
-                    expander_pg1, sas_expander->parent_dev);
+                if ((mpt2sas_transport_add_expander_phy(ioc,
+                    &sas_expander->phy[i], expander_pg1,
+                    sas_expander->parent_dev))) {
+                        printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
+                            ioc->name, __FILE__, __LINE__, __func__);
+                        rc = -1;
+                        goto out_fail;
+                }
        }
        if (sas_expander->enclosure_handle) {
@@ -3540,8 +3552,9 @@ _scsih_expander_add(struct MPT2SAS_ADAPTER *ioc, u16 handle)
 out_fail:
-        if (sas_expander)
+        if (mpt2sas_port)
-                kfree(sas_expander->phy);
+                mpt2sas_transport_port_remove(ioc, sas_expander->sas_address,
+                    sas_expander->parent_handle);
        kfree(sas_expander);
        return rc;
 }
@@ -3663,12 +3676,11 @@ _scsih_add_device(struct MPT2SAS_ADAPTER *ioc, u16 handle, u8 phy_num, u8 is_pd)
        sas_device->hidden_raid_component = is_pd;
        /* get enclosure_logical_id */
-        if (!(mpt2sas_config_get_enclosure_pg0(ioc, &mpi_reply, &enclosure_pg0,
+        if (sas_device->enclosure_handle && !(mpt2sas_config_get_enclosure_pg0(
-           MPI2_SAS_ENCLOS_PGAD_FORM_HANDLE,
+           ioc, &mpi_reply, &enclosure_pg0, MPI2_SAS_ENCLOS_PGAD_FORM_HANDLE,
-           sas_device->enclosure_handle))) {
+           sas_device->enclosure_handle)))
                sas_device->enclosure_logical_id =
                    le64_to_cpu(enclosure_pg0.EnclosureLogicalID);
-        }
        /* get device name */
        sas_device->device_name = le64_to_cpu(sas_device_pg0.DeviceName);
@@ -4250,12 +4262,6 @@ _scsih_sas_volume_add(struct MPT2SAS_ADAPTER *ioc,
        u16 handle = le16_to_cpu(element->VolDevHandle);
        int rc;
-#if 0 /* RAID_HACKS */
-        if (le32_to_cpu(event_data->Flags) &
-            MPI2_EVENT_IR_CHANGE_FLAGS_FOREIGN_CONFIG)
-                return;
-#endif
        mpt2sas_config_get_volume_wwid(ioc, handle, &wwid);
        if (!wwid) {
                printk(MPT2SAS_ERR_FMT
@@ -4310,12 +4316,6 @@ _scsih_sas_volume_delete(struct MPT2SAS_ADAPTER *ioc,
        unsigned long flags;
        struct MPT2SAS_TARGET *sas_target_priv_data;
-#if 0 /* RAID_HACKS */
-        if (le32_to_cpu(event_data->Flags) &
-            MPI2_EVENT_IR_CHANGE_FLAGS_FOREIGN_CONFIG)
-                return;
-#endif
        spin_lock_irqsave(&ioc->raid_device_lock, flags);
        raid_device = _scsih_raid_device_find_by_handle(ioc, handle);
        spin_unlock_irqrestore(&ioc->raid_device_lock, flags);
@@ -4428,14 +4428,38 @@ _scsih_sas_pd_add(struct MPT2SAS_ADAPTER *ioc,
        struct _sas_device *sas_device;
        unsigned long flags;
        u16 handle = le16_to_cpu(element->PhysDiskDevHandle);
+        Mpi2ConfigReply_t mpi_reply;
+        Mpi2SasDevicePage0_t sas_device_pg0;
+        u32 ioc_status;
        spin_lock_irqsave(&ioc->sas_device_lock, flags);
        sas_device = _scsih_sas_device_find_by_handle(ioc, handle);
        spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
-        if (sas_device)
+        if (sas_device) {
                sas_device->hidden_raid_component = 1;
-        else
+                return;
-                _scsih_add_device(ioc, handle, 0, 1);
+        }
+        if ((mpt2sas_config_get_sas_device_pg0(ioc, &mpi_reply, &sas_device_pg0,
+            MPI2_SAS_DEVICE_PGAD_FORM_HANDLE, handle))) {
+                printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
+                    ioc->name, __FILE__, __LINE__, __func__);
+                return;
+        }
+        ioc_status = le16_to_cpu(mpi_reply.IOCStatus) &
+            MPI2_IOCSTATUS_MASK;
+        if (ioc_status != MPI2_IOCSTATUS_SUCCESS) {
+                printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
+                    ioc->name, __FILE__, __LINE__, __func__);
+                return;
+        }
+        _scsih_link_change(ioc,
+            le16_to_cpu(sas_device_pg0.ParentDevHandle),
+            handle, sas_device_pg0.PhyNum, MPI2_SAS_NEG_LINK_RATE_1_5);
+        _scsih_add_device(ioc, handle, 0, 1);
 }
 #ifdef CONFIG_SCSI_MPT2SAS_LOGGING
@@ -4535,12 +4559,15 @@ _scsih_sas_ir_config_change_event(struct MPT2SAS_ADAPTER *ioc, u8 VF_ID,
 {
        Mpi2EventIrConfigElement_t *element;
        int i;
+        u8 foreign_config;
 #ifdef CONFIG_SCSI_MPT2SAS_LOGGING
        if (ioc->logging_level & MPT_DEBUG_EVENT_WORK_TASK)
                _scsih_sas_ir_config_change_event_debug(ioc, event_data);
 #endif
+        foreign_config = (le32_to_cpu(event_data->Flags) &
+            MPI2_EVENT_IR_CHANGE_FLAGS_FOREIGN_CONFIG) ? 1 : 0;
        element = (Mpi2EventIrConfigElement_t *)&event_data->ConfigElement[0];
        for (i = 0; i < event_data->NumElements; i++, element++) {
@@ -4548,11 +4575,13 @@ _scsih_sas_ir_config_change_event(struct MPT2SAS_ADAPTER *ioc, u8 VF_ID,
                switch (element->ReasonCode) {
                case MPI2_EVENT_IR_CHANGE_RC_VOLUME_CREATED:
                case MPI2_EVENT_IR_CHANGE_RC_ADDED:
-                        _scsih_sas_volume_add(ioc, element);
+                        if (!foreign_config)
+                                _scsih_sas_volume_add(ioc, element);
                        break;
                case MPI2_EVENT_IR_CHANGE_RC_VOLUME_DELETED:
                case MPI2_EVENT_IR_CHANGE_RC_REMOVED:
-                        _scsih_sas_volume_delete(ioc, element);
+                        if (!foreign_config)
+                                _scsih_sas_volume_delete(ioc, element);
                        break;
                case MPI2_EVENT_IR_CHANGE_RC_PD_CREATED:
                        _scsih_sas_pd_hide(ioc, element);
@@ -4671,6 +4700,9 @@ _scsih_sas_ir_physical_disk_event(struct MPT2SAS_ADAPTER *ioc, u8 VF_ID,
        u32 state;
        struct _sas_device *sas_device;
        unsigned long flags;
+        Mpi2ConfigReply_t mpi_reply;
+        Mpi2SasDevicePage0_t sas_device_pg0;
+        u32 ioc_status;
        if (event_data->ReasonCode != MPI2_EVENT_IR_PHYSDISK_RC_STATE_CHANGED)
                return;
@@ -4687,22 +4719,40 @@ _scsih_sas_ir_physical_disk_event(struct MPT2SAS_ADAPTER *ioc, u8 VF_ID,
        spin_unlock_irqrestore(&ioc->sas_device_lock, flags);
        switch (state) {
-#if 0
-        case MPI2_RAID_PD_STATE_OFFLINE:
-                if (sas_device)
-                        _scsih_remove_device(ioc, handle);
-                break;
-#endif
        case MPI2_RAID_PD_STATE_ONLINE:
        case MPI2_RAID_PD_STATE_DEGRADED:
        case MPI2_RAID_PD_STATE_REBUILDING:
        case MPI2_RAID_PD_STATE_OPTIMAL:
-                if (sas_device)
+                if (sas_device) {
                        sas_device->hidden_raid_component = 1;
-                else
+                        return;
-                        _scsih_add_device(ioc, handle, 0, 1);
+                }
+                if ((mpt2sas_config_get_sas_device_pg0(ioc, &mpi_reply,
+                    &sas_device_pg0, MPI2_SAS_DEVICE_PGAD_FORM_HANDLE,
+                    handle))) {
+                        printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
+                            ioc->name, __FILE__, __LINE__, __func__);
+                        return;
+                }
+                ioc_status = le16_to_cpu(mpi_reply.IOCStatus) &
+                    MPI2_IOCSTATUS_MASK;
+                if (ioc_status != MPI2_IOCSTATUS_SUCCESS) {
+                        printk(MPT2SAS_ERR_FMT "failure at %s:%d/%s()!\n",
+                            ioc->name, __FILE__, __LINE__, __func__);
+                        return;
+                }
+                _scsih_link_change(ioc,
+                    le16_to_cpu(sas_device_pg0.ParentDevHandle),
+                    handle, sas_device_pg0.PhyNum, MPI2_SAS_NEG_LINK_RATE_1_5);
+                _scsih_add_device(ioc, handle, 0, 1);
                break;
+        case MPI2_RAID_PD_STATE_OFFLINE:
        case MPI2_RAID_PD_STATE_NOT_CONFIGURED:
        case MPI2_RAID_PD_STATE_NOT_COMPATIBLE:
        case MPI2_RAID_PD_STATE_HOT_SPARE:
@@ -5774,6 +5824,7 @@ _scsih_suspend(struct pci_dev *pdev, pm_message_t state)
        struct MPT2SAS_ADAPTER *ioc = shost_priv(shost);
        u32 device_state;
+        mpt2sas_base_stop_watchdog(ioc);
        flush_scheduled_work();
        scsi_block_requests(shost);
        device_state = pci_choose_state(pdev, state);
@@ -5816,6 +5867,7 @@ _scsih_resume(struct pci_dev *pdev)
        mpt2sas_base_hard_reset_handler(ioc, CAN_SLEEP, SOFT_RESET);
        scsi_unblock_requests(shost);
+        mpt2sas_base_start_watchdog(ioc);
        return 0;
 }
 #endif /* CONFIG_PM */
diff --git a/drivers/serial/Kconfig b/drivers/serial/Kconfig
index 037c1e0b7c4c..6553833c12db 100644
--- a/drivers/serial/Kconfig
+++ b/drivers/serial/Kconfig
@@ -527,7 +527,7 @@ config SERIAL_S3C24A0
 config SERIAL_S3C6400
        tristate "Samsung S3C6400/S3C6410 Serial port support"
-        depends on SERIAL_SAMSUNG && (CPU_S3C600 || CPU_S3C6410)
+        depends on SERIAL_SAMSUNG && (CPU_S3C6400 || CPU_S3C6410)
        default y
        help
          Serial port support for the Samsung S3C6400 and S3C6410
diff --git a/drivers/spi/spi_s3c24xx.c b/drivers/spi/spi_s3c24xx.c
index e0d44af4745a..3f3119d760db 100644
--- a/drivers/spi/spi_s3c24xx.c
+++ b/drivers/spi/spi_s3c24xx.c
@@ -111,29 +111,32 @@ static int s3c24xx_spi_setupxfer(struct spi_device *spi,
        unsigned int bpw;
        unsigned int hz;
        unsigned int div;
+        unsigned long clk;
        bpw = t ? t->bits_per_word : spi->bits_per_word;
        hz  = t ? t->speed_hz : spi->max_speed_hz;
+        if (!bpw)
+                bpw = 8;
+        if (!hz)
+                hz = spi->max_speed_hz;
        if (bpw != 8) {
                dev_err(&spi->dev, "invalid bits-per-word (%d)\n", bpw);
                return -EINVAL;
        }
-        div = clk_get_rate(hw->clk) / hz;
+        clk = clk_get_rate(hw->clk);
+        div = DIV_ROUND_UP(clk, hz * 2) - 1;
-        /* is clk = pclk / (2 * (pre+1)), or is it
-         *    clk = (pclk * 2) / ( pre + 1) */
-        div /= 2;
-        if (div > 0)
-                div -= 1;
        if (div > 255)
                div = 255;
-        dev_dbg(&spi->dev, "setting pre-scaler to %d (hz %d)\n", div, hz);
+        dev_dbg(&spi->dev, "setting pre-scaler to %d (wanted %d, got %ld)\n",
+                div, hz, clk / (2 * (div + 1)));
        writeb(div, hw->regs + S3C2410_SPPRE);
        spin_lock(&hw->bitbang.lock);
diff --git a/drivers/thermal/thermal_sys.c b/drivers/thermal/thermal_sys.c
index 0a69672097a8..4e83c297ec9e 100644
--- a/drivers/thermal/thermal_sys.c
+++ b/drivers/thermal/thermal_sys.c
@@ -953,7 +953,12 @@ void thermal_zone_device_update(struct thermal_zone_device *tz)
        mutex_lock(&tz->lock);
-        tz->ops->get_temp(tz, &temp);
+        if (tz->ops->get_temp(tz, &temp)) {
+                /* get_temp failed - retry it later */
+                printk(KERN_WARNING PREFIX "failed to read out thermal zone "
+                       "%d\n", tz->id);
+                goto leave;
+        }
        for (count = 0; count < tz->trips; count++) {
                tz->ops->get_trip_type(tz, count, &trip_type);
@@ -1005,6 +1010,8 @@ void thermal_zone_device_update(struct thermal_zone_device *tz)
                                            THERMAL_TRIPS_NONE);
        tz->last_temperature = temp;
+      leave:
        if (tz->passive)
                thermal_zone_device_set_polling(tz, tz->passive_delay);
        else if (tz->polling_delay)
diff --git a/drivers/video/sh_mobile_lcdcfb.c b/drivers/video/sh_mobile_lcdcfb.c
index 8f24564f77b0..07f22b625632 100644
--- a/drivers/video/sh_mobile_lcdcfb.c
+++ b/drivers/video/sh_mobile_lcdcfb.c
@@ -481,6 +481,9 @@ static int sh_mobile_lcdc_start(struct sh_mobile_lcdc_priv *priv)
        /* tell the board code to enable the panel */
        for (k = 0; k < ARRAY_SIZE(priv->ch); k++) {
                ch = &priv->ch[k];
+                if (!ch->enabled)
+                        continue;
                board_cfg = &ch->cfg.board_cfg;
                if (board_cfg->display_on)
                        board_cfg->display_on(board_cfg->board_data);
@@ -498,6 +501,8 @@ static void sh_mobile_lcdc_stop(struct sh_mobile_lcdc_priv *priv)
        /* clean up deferred io and ask board code to disable panel */
        for (k = 0; k < ARRAY_SIZE(priv->ch); k++) {
                ch = &priv->ch[k];
+                if (!ch->enabled)
+                        continue;
                /* deferred io mode:
                 * flush frame, and wait for frame end interrupt
diff --git a/drivers/video/xen-fbfront.c b/drivers/video/xen-fbfront.c
index 15502d5e3641..54cd91610174 100644
--- a/drivers/video/xen-fbfront.c
+++ b/drivers/video/xen-fbfront.c
@@ -454,6 +454,10 @@ static int __devinit xenfb_probe(struct xenbus_device *dev,
        xenfb_init_shared_page(info, fb_info);
+        ret = xenfb_connect_backend(dev, info);
+        if (ret < 0)
+                goto error;
        ret = register_framebuffer(fb_info);
        if (ret) {
                fb_deferred_io_cleanup(fb_info);
@@ -464,10 +468,6 @@ static int __devinit xenfb_probe(struct xenbus_device *dev,
        }
        info->fb_info = fb_info;
-        ret = xenfb_connect_backend(dev, info);
-        if (ret < 0)
-                goto error;
        xenfb_make_preferred_console();
        return 0;
diff --git a/drivers/watchdog/ar7_wdt.c b/drivers/watchdog/ar7_wdt.c
index 3fe9742c23ca..2f8643efe92c 100644
--- a/drivers/watchdog/ar7_wdt.c
+++ b/drivers/watchdog/ar7_wdt.c
@@ -37,7 +37,7 @@
 #include <linux/uaccess.h>
 #include <asm/addrspace.h>
-#include <asm/ar7/ar7.h>
+#include <asm/mach-ar7/ar7.h>
 #define DRVNAME "ar7_wdt"
 #define LONGNAME "TI AR7 Watchdog Timer"