234 files changed, 4649 insertions, 961 deletions
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 9f6cfac0f2cc..228740f356c9 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -879,6 +879,8 @@ static void ata_eh_set_pending(struct ata_port *ap, int fastdrain)
 void ata_qc_schedule_eh(struct ata_queued_cmd *qc)
 {
        struct ata_port *ap = qc->ap;
+        struct request_queue *q = qc->scsicmd->device->request_queue;
+        unsigned long flags;
        WARN_ON(!ap->ops->error_handler);
@@ -890,7 +892,9 @@ void ata_qc_schedule_eh(struct ata_queued_cmd *qc)
         * Note that ATA_QCFLAG_FAILED is unconditionally set after
         * this function completes.
         */
+        spin_lock_irqsave(q->queue_lock, flags);
        blk_abort_request(qc->scsicmd->request);
+        spin_unlock_irqrestore(q->queue_lock, flags);
 }
 /**
@@ -1624,6 +1628,7 @@ void ata_eh_analyze_ncq_error(struct ata_link *link)
        }
        /* okay, this error is ours */
+        memset(&tf, 0, sizeof(tf));
        rc = ata_eh_read_log_10h(dev, &tag, &tf);
        if (rc) {
                ata_link_printk(link, KERN_ERR, "failed to read log page 10h "
diff --git a/drivers/ata/pata_pcmcia.c b/drivers/ata/pata_pcmcia.c
index 3c3172d3c34e..d94b8f0bd743 100644
--- a/drivers/ata/pata_pcmcia.c
+++ b/drivers/ata/pata_pcmcia.c
@@ -424,6 +424,8 @@ static struct pcmcia_device_id pcmcia_devices[] = {
        PCMCIA_DEVICE_PROD_ID12("Hyperstone", "Model1", 0x3d5b9ef5, 0xca6ab420),
        PCMCIA_DEVICE_PROD_ID12("IBM", "microdrive", 0xb569a6e5, 0xa6d76178),
        PCMCIA_DEVICE_PROD_ID12("IBM", "IBM17JSSFP20", 0xb569a6e5, 0xf2508753),
+        PCMCIA_DEVICE_PROD_ID12("KINGSTON", "CF CARD 1GB", 0x2e6d1829, 0x55d5bffb),
+        PCMCIA_DEVICE_PROD_ID12("KINGSTON", "CF CARD 4GB", 0x2e6d1829, 0x531e7d10),
        PCMCIA_DEVICE_PROD_ID12("KINGSTON", "CF8GB", 0x2e6d1829, 0xacbe682e),
        PCMCIA_DEVICE_PROD_ID12("IO DATA", "CBIDE2      ", 0x547e66dc, 0x8671043b),
        PCMCIA_DEVICE_PROD_ID12("IO DATA", "PCIDE", 0x547e66dc, 0x5c5ab149),
@@ -444,6 +446,8 @@ static struct pcmcia_device_id pcmcia_devices[] = {
        PCMCIA_DEVICE_PROD_ID12("TRANSCEND", "TS1GCF80", 0x709b1bf1, 0x2a54d4b1),
        PCMCIA_DEVICE_PROD_ID12("TRANSCEND", "TS2GCF120", 0x709b1bf1, 0x969aa4f2),
        PCMCIA_DEVICE_PROD_ID12("TRANSCEND", "TS4GCF120", 0x709b1bf1, 0xf54a91c8),
+        PCMCIA_DEVICE_PROD_ID12("TRANSCEND", "TS4GCF133", 0x709b1bf1, 0x7558f133),
+        PCMCIA_DEVICE_PROD_ID12("TRANSCEND", "TS8GCF133", 0x709b1bf1, 0xb2f89b47),
        PCMCIA_DEVICE_PROD_ID12("WIT", "IDE16", 0x244e5994, 0x3e232852),
        PCMCIA_DEVICE_PROD_ID12("WEIDA", "TWTTI", 0xcc7cf69c, 0x212bb918),
        PCMCIA_DEVICE_PROD_ID1("STI Flash", 0xe4a13209),
diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
index 67e0fc542249..93d1f9b469d4 100644
--- a/drivers/block/drbd/drbd_main.c
+++ b/drivers/block/drbd/drbd_main.c
@@ -1695,6 +1695,7 @@ int drbd_send_protocol(struct drbd_conf *mdev)
                        cf |= CF_DRY_RUN;
                else {
                        dev_err(DEV, "--dry-run is not supported by peer");
+                        kfree(p);
                        return 0;
                }
        }
diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
index ed9f1de24a71..3f096e7959b4 100644
--- a/drivers/block/drbd/drbd_receiver.c
+++ b/drivers/block/drbd/drbd_receiver.c
@@ -899,7 +899,8 @@ retry:
        drbd_thread_start(&mdev->asender);
-        drbd_send_protocol(mdev);
+        if (!drbd_send_protocol(mdev))
+                return -1;
        drbd_send_sync_param(mdev, &mdev->sync_conf);
        drbd_send_sizes(mdev, 0);
        drbd_send_uuids(mdev);
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index ddf19425245d..8a549db2aa78 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -48,6 +48,7 @@
 #include <linux/module.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
+#include <linux/compat.h>
 #include <linux/kthread.h>
 #include <linux/errno.h>
 #include <linux/spinlock.h>
@@ -2984,7 +2985,7 @@ static void pkt_get_status(struct pkt_ctrl_command *ctrl_cmd)
        mutex_unlock(&ctl_mutex);
 }
-static int pkt_ctl_ioctl(struct inode *inode, struct file *file, unsigned int cmd, unsigned long arg)
+static long pkt_ctl_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
 {
        void __user *argp = (void __user *)arg;
        struct pkt_ctrl_command ctrl_cmd;
@@ -3021,10 +3022,20 @@ static int pkt_ctl_ioctl(struct inode *inode, struct file *file, unsigned int cm
        return ret;
 }
+#ifdef CONFIG_COMPAT
+static long pkt_ctl_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+        return pkt_ctl_ioctl(file, cmd, (unsigned long)compat_ptr(arg));
+}
+#endif
 static const struct file_operations pkt_ctl_fops = {
-        .ioctl   = pkt_ctl_ioctl,
+        .open           = nonseekable_open,
-        .owner   = THIS_MODULE,
+        .unlocked_ioctl = pkt_ctl_ioctl,
+#ifdef CONFIG_COMPAT
+        .compat_ioctl   = pkt_ctl_compat_ioctl,
+#endif
+        .owner          = THIS_MODULE,
 };
 static struct miscdevice pkt_misc = {
diff --git a/drivers/char/isicom.c b/drivers/char/isicom.c
index 0fa2e4a0835d..c1ab303455cf 100644
--- a/drivers/char/isicom.c
+++ b/drivers/char/isicom.c
@@ -879,8 +879,8 @@ static int isicom_open(struct tty_struct *tty, struct file *filp)
        if (tport == NULL)
                return -ENODEV;
        port = container_of(tport, struct isi_port, port);
-        card = &isi_card[BOARD(tty->index)];
+        tty->driver_data = port;
        return tty_port_open(tport, tty, filp);
 }
@@ -936,7 +936,12 @@ static void isicom_shutdown(struct tty_port *port)
 static void isicom_close(struct tty_struct *tty, struct file *filp)
 {
        struct isi_port *ip = tty->driver_data;
-        struct tty_port *port = &ip->port;
+        struct tty_port *port;
+        if (ip == NULL)
+                return;
+        port = &ip->port;
        if (isicom_paranoia_check(ip, tty->name, "isicom_close"))
                return;
        tty_port_close(port, tty, filp);
diff --git a/drivers/char/istallion.c b/drivers/char/istallion.c
index 4cd6c527ee41..4e395c956a09 100644
--- a/drivers/char/istallion.c
+++ b/drivers/char/istallion.c
@@ -827,6 +827,8 @@ static int stli_open(struct tty_struct *tty, struct file *filp)
                return -ENODEV;
        if (portp->devnr < 1)
                return -ENODEV;
+        tty->driver_data = portp;
        return tty_port_open(&portp->port, tty, filp);
 }
diff --git a/drivers/char/mxser.c b/drivers/char/mxser.c
index 47023053ee85..d2692d443f7b 100644
--- a/drivers/char/mxser.c
+++ b/drivers/char/mxser.c
@@ -1011,6 +1011,7 @@ static int mxser_open(struct tty_struct *tty, struct file *filp)
        if (!info->ioaddr)
                return -ENODEV;
+        tty->driver_data = info;
        return tty_port_open(&info->port, tty, filp);
 }
@@ -1074,7 +1075,7 @@ static void mxser_close(struct tty_struct *tty, struct file *filp)
        struct mxser_port *info = tty->driver_data;
        struct tty_port *port = &info->port;
-        if (tty->index == MXSER_PORTS)
+        if (tty->index == MXSER_PORTS || info == NULL)
                return;
        if (tty_port_close_start(port, tty, filp) == 0)
                return;
diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c
index c9bc896d68af..90b199f97bec 100644
--- a/drivers/char/pcmcia/cm4000_cs.c
+++ b/drivers/char/pcmcia/cm4000_cs.c
@@ -1026,14 +1026,16 @@ static ssize_t cmm_read(struct file *filp, __user char *buf, size_t count,
        xoutb(0, REG_FLAGS1(iobase));   /* clear detectCMM */
        /* last check before exit */
-        if (!io_detect_cm4000(iobase, dev))
+        if (!io_detect_cm4000(iobase, dev)) {
-                count = -ENODEV;
+                rc = -ENODEV;
+                goto release_io;
+        }
        if (test_bit(IS_INVREV, &dev->flags) && count > 0)
                str_invert_revert(dev->rbuf, count);
        if (copy_to_user(buf, dev->rbuf, count))
-                return -EFAULT;
+                rc = -EFAULT;
 release_io:
        clear_bit(LOCK_IO, &dev->flags);
diff --git a/drivers/char/riscom8.c b/drivers/char/riscom8.c
index 0a8d1e56c993..b02332a5412f 100644
--- a/drivers/char/riscom8.c
+++ b/drivers/char/riscom8.c
@@ -909,6 +909,7 @@ static int rc_open(struct tty_struct *tty, struct file *filp)
        if (error)
                return error;
+        tty->driver_data = port;
        return tty_port_open(&port->port, tty, filp);
 }
diff --git a/drivers/char/stallion.c b/drivers/char/stallion.c
index 0e511d61f544..6049fd731924 100644
--- a/drivers/char/stallion.c
+++ b/drivers/char/stallion.c
@@ -724,7 +724,6 @@ static int stl_open(struct tty_struct *tty, struct file *filp)
 {
        struct stlport  *portp;
        struct stlbrd   *brdp;
-        struct tty_port *port;
        unsigned int    minordev, brdnr, panelnr;
        int             portnr;
@@ -754,7 +753,8 @@ static int stl_open(struct tty_struct *tty, struct file *filp)
        portp = brdp->panels[panelnr]->ports[portnr];
        if (portp == NULL)
                return -ENODEV;
-        port = &portp->port;
+        tty->driver_data = portp;
        return tty_port_open(&portp->port, tty, filp);
 }
@@ -841,7 +841,8 @@ static void stl_close(struct tty_struct *tty, struct file *filp)
        pr_debug("stl_close(tty=%p,filp=%p)\n", tty, filp);
        portp = tty->driver_data;
-        BUG_ON(portp == NULL);
+        if(portp == NULL)
+                return;
        tty_port_close(&portp->port, tty, filp);
 }
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 2d5d575e889d..75d293eeb3ee 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1113,6 +1113,8 @@ static int __cpufreq_remove_dev(struct sys_device *sys_dev)
        unsigned int cpu = sys_dev->id;
        unsigned long flags;
        struct cpufreq_policy *data;
+        struct kobject *kobj;
+        struct completion *cmp;
 #ifdef CONFIG_SMP
        struct sys_device *cpu_sys_dev;
        unsigned int j;
@@ -1141,10 +1143,11 @@ static int __cpufreq_remove_dev(struct sys_device *sys_dev)
                dprintk("removing link\n");
                cpumask_clear_cpu(cpu, data->cpus);
                spin_unlock_irqrestore(&cpufreq_driver_lock, flags);
-                sysfs_remove_link(&sys_dev->kobj, "cpufreq");
+                kobj = &sys_dev->kobj;
                cpufreq_cpu_put(data);
                cpufreq_debug_enable_ratelimit();
                unlock_policy_rwsem_write(cpu);
+                sysfs_remove_link(kobj, "cpufreq");
                return 0;
        }
 #endif
@@ -1181,7 +1184,10 @@ static int __cpufreq_remove_dev(struct sys_device *sys_dev)
                                data->governor->name, CPUFREQ_NAME_LEN);
 #endif
                        cpu_sys_dev = get_cpu_sysdev(j);
-                        sysfs_remove_link(&cpu_sys_dev->kobj, "cpufreq");
+                        kobj = &cpu_sys_dev->kobj;
+                        unlock_policy_rwsem_write(cpu);
+                        sysfs_remove_link(kobj, "cpufreq");
+                        lock_policy_rwsem_write(cpu);
                        cpufreq_cpu_put(data);
                }
        }
@@ -1192,19 +1198,22 @@ static int __cpufreq_remove_dev(struct sys_device *sys_dev)
        if (cpufreq_driver->target)
                __cpufreq_governor(data, CPUFREQ_GOV_STOP);
-        kobject_put(&data->kobj);
+        kobj = &data->kobj;
+        cmp = &data->kobj_unregister;
+        unlock_policy_rwsem_write(cpu);
+        kobject_put(kobj);
        /* we need to make sure that the underlying kobj is actually
         * not referenced anymore by anybody before we proceed with
         * unloading.
         */
        dprintk("waiting for dropping of refcount\n");
-        wait_for_completion(&data->kobj_unregister);
+        wait_for_completion(cmp);
        dprintk("wait complete\n");
+        lock_policy_rwsem_write(cpu);
        if (cpufreq_driver->exit)
                cpufreq_driver->exit(data);
        unlock_policy_rwsem_write(cpu);
        free_cpumask_var(data->related_cpus);
diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c
index 599a40b25cb0..3a147874a465 100644
--- a/drivers/cpufreq/cpufreq_conservative.c
+++ b/drivers/cpufreq/cpufreq_conservative.c
@@ -444,6 +444,7 @@ static struct attribute_group dbs_attr_group_old = {
 static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
 {
        unsigned int load = 0;
+        unsigned int max_load = 0;
        unsigned int freq_target;
        struct cpufreq_policy *policy;
@@ -501,6 +502,9 @@ static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
                        continue;
                load = 100 * (wall_time - idle_time) / wall_time;
+                if (load > max_load)
+                        max_load = load;
        }
        /*
@@ -511,7 +515,7 @@ static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
                return;
        /* Check for frequency increase */
-        if (load > dbs_tuners_ins.up_threshold) {
+        if (max_load > dbs_tuners_ins.up_threshold) {
                this_dbs_info->down_skip = 0;
                /* if we are already at full speed then break out early */
@@ -538,7 +542,7 @@ static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
         * can support the current CPU usage without triggering the up
         * policy. To be safe, we focus 10 points under the threshold.
         */
-        if (load < (dbs_tuners_ins.down_threshold - 10)) {
+        if (max_load < (dbs_tuners_ins.down_threshold - 10)) {
                freq_target = (dbs_tuners_ins.freq_step * policy->max) / 100;
                this_dbs_info->requested_freq -= freq_target;
diff --git a/drivers/dma/txx9dmac.c b/drivers/dma/txx9dmac.c
index 3ebc61067e54..75fcf1ac8bb7 100644
--- a/drivers/dma/txx9dmac.c
+++ b/drivers/dma/txx9dmac.c
@@ -1359,3 +1359,5 @@ module_exit(txx9dmac_exit);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("TXx9 DMA Controller driver");
 MODULE_AUTHOR("Atsushi Nemoto <anemo@mba.ocn.ne.jp>");
+MODULE_ALIAS("platform:txx9dmac");
+MODULE_ALIAS("platform:txx9dmac-chan");
diff --git a/drivers/edac/edac_mce_amd.c b/drivers/edac/edac_mce_amd.c
index f5b6d9fe4def..97e64bcdbc06 100644
--- a/drivers/edac/edac_mce_amd.c
+++ b/drivers/edac/edac_mce_amd.c
@@ -294,7 +294,6 @@ wrong_ls_mce:
 void amd_decode_nb_mce(int node_id, struct err_regs *regs, int handle_errors)
 {
        u32 ec  = ERROR_CODE(regs->nbsl);
-        u32 xec = EXT_ERROR_CODE(regs->nbsl);
        if (!handle_errors)
                return;
@@ -324,7 +323,7 @@ void amd_decode_nb_mce(int node_id, struct err_regs *regs, int handle_errors)
                pr_cont("\n");
        }
-        pr_emerg("%s.\n", EXT_ERR_MSG(xec));
+        pr_emerg("%s.\n", EXT_ERR_MSG(regs->nbsl));
        if (BUS_ERROR(ec) && nb_bus_decoder)
                nb_bus_decoder(node_id, regs);
@@ -374,7 +373,7 @@ static int amd_decode_mce(struct notifier_block *nb, unsigned long val,
                 ((m->status & MCI_STATUS_PCC) ? "yes" : "no"));
        /* do the two bits[14:13] together */
-        ecc = m->status & (3ULL << 45);
+        ecc = (m->status >> 45) & 0x3;
        if (ecc)
                pr_cont(", %sECC Error", ((ecc == 2) ? "C" : "U"));
diff --git a/drivers/firewire/core-iso.c b/drivers/firewire/core-iso.c
index 3784a47865b7..8f5aebfb29df 100644
--- a/drivers/firewire/core-iso.c
+++ b/drivers/firewire/core-iso.c
@@ -190,7 +190,7 @@ static int manage_bandwidth(struct fw_card *card, int irm_id, int generation,
        for (try = 0; try < 5; try++) {
                new = allocate ? old - bandwidth : old + bandwidth;
                if (new < 0 || new > BANDWIDTH_AVAILABLE_INITIAL)
-                        break;
+                        return -EBUSY;
                data[0] = cpu_to_be32(old);
                data[1] = cpu_to_be32(new);
@@ -218,7 +218,7 @@ static int manage_channel(struct fw_card *card, int irm_id, int generation,
                u32 channels_mask, u64 offset, bool allocate, __be32 data[2])
 {
        __be32 c, all, old;
-        int i, retry = 5;
+        int i, ret = -EIO, retry = 5;
        old = all = allocate ? cpu_to_be32(~0) : 0;
@@ -226,6 +226,8 @@ static int manage_channel(struct fw_card *card, int irm_id, int generation,
                if (!(channels_mask & 1 << i))
                        continue;
+                ret = -EBUSY;
                c = cpu_to_be32(1 << (31 - i));
                if ((old & c) != (all & c))
                        continue;
@@ -251,12 +253,16 @@ static int manage_channel(struct fw_card *card, int irm_id, int generation,
                        /* 1394-1995 IRM, fall through to retry. */
                default:
-                        if (retry--)
+                        if (retry) {
+                                retry--;
                                i--;
+                        } else {
+                                ret = -EIO;
+                        }
                }
        }
-        return -EIO;
+        return ret;
 }
 static void deallocate_channel(struct fw_card *card, int irm_id,
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index 0cf4d7f562c5..94b16e0340ae 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -1158,7 +1158,7 @@ static void handle_local_lock(struct fw_ohci *ohci,
                              struct fw_packet *packet, u32 csr)
 {
        struct fw_packet response;
-        int tcode, length, ext_tcode, sel;
+        int tcode, length, ext_tcode, sel, try;
        __be32 *payload, lock_old;
        u32 lock_arg, lock_data;
@@ -1185,21 +1185,26 @@ static void handle_local_lock(struct fw_ohci *ohci,
        reg_write(ohci, OHCI1394_CSRCompareData, lock_arg);
        reg_write(ohci, OHCI1394_CSRControl, sel);
-        if (reg_read(ohci, OHCI1394_CSRControl) & 0x80000000)
+        for (try = 0; try < 20; try++)
-                lock_old = cpu_to_be32(reg_read(ohci, OHCI1394_CSRData));
+                if (reg_read(ohci, OHCI1394_CSRControl) & 0x80000000) {
-        else
+                        lock_old = cpu_to_be32(reg_read(ohci,
-                fw_notify("swap not done yet\n");
+                                                        OHCI1394_CSRData));
+                        fw_fill_response(&response, packet->header,
+                                         RCODE_COMPLETE,
+                                         &lock_old, sizeof(lock_old));
+                        goto out;
+                }
+        fw_error("swap not done (CSR lock timeout)\n");
+        fw_fill_response(&response, packet->header, RCODE_BUSY, NULL, 0);
-        fw_fill_response(&response, packet->header,
-                         RCODE_COMPLETE, &lock_old, sizeof(lock_old));
 out:
        fw_core_handle_response(&ohci->card, &response);
 }
 static void handle_local_request(struct context *ctx, struct fw_packet *packet)
 {
-        u64 offset;
+        u64 offset, csr;
-        u32 csr;
        if (ctx == &ctx->ohci->at_request_ctx) {
                packet->ack = ACK_PENDING;
diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c
index 76be229c814d..eb0c3fe44b29 100644
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@ -416,7 +416,8 @@ static int gpio_setup_irq(struct gpio_desc *desc, struct device *dev,
        return 0;
 free_sd:
-        sysfs_put(pdesc->value_sd);
+        if (pdesc)
+                sysfs_put(pdesc->value_sd);
 free_id:
        idr_remove(&pdesc_idr, id);
        desc->flags &= GPIO_FLAGS_MASK;
diff --git a/drivers/gpio/pca953x.c b/drivers/gpio/pca953x.c
index 7d521e1d17e1..b827c976dc62 100644
--- a/drivers/gpio/pca953x.c
+++ b/drivers/gpio/pca953x.c
@@ -252,6 +252,18 @@ static void pca953x_irq_bus_lock(unsigned int irq)
 static void pca953x_irq_bus_sync_unlock(unsigned int irq)
 {
        struct pca953x_chip *chip = get_irq_chip_data(irq);
+        uint16_t new_irqs;
+        uint16_t level;
+        /* Look for any newly setup interrupt */
+        new_irqs = chip->irq_trig_fall | chip->irq_trig_raise;
+        new_irqs &= ~chip->reg_direction;
+        while (new_irqs) {
+                level = __ffs(new_irqs);
+                pca953x_gpio_direction_input(&chip->gpio_chip, level);
+                new_irqs &= ~(1 << level);
+        }
        mutex_unlock(&chip->irq_lock);
 }
@@ -278,7 +290,7 @@ static int pca953x_irq_set_type(unsigned int irq, unsigned int type)
        else
                chip->irq_trig_raise &= ~mask;
-        return pca953x_gpio_direction_input(&chip->gpio_chip, level);
+        return 0;
 }
 static struct irq_chip pca953x_irq_chip = {
diff --git a/drivers/gpio/pl061.c b/drivers/gpio/pl061.c
index 5ad8f778ced4..105701a1f05b 100644
--- a/drivers/gpio/pl061.c
+++ b/drivers/gpio/pl061.c
@@ -91,6 +91,12 @@ static int pl061_direction_output(struct gpio_chip *gc, unsigned offset,
        gpiodir = readb(chip->base + GPIODIR);
        gpiodir |= 1 << offset;
        writeb(gpiodir, chip->base + GPIODIR);
+        /*
+         * gpio value is set again, because pl061 doesn't allow to set value of
+         * a gpio pin before configuring it in OUT mode.
+         */
+        writeb(!!value << offset, chip->base + (1 << (offset + 2)));
        spin_unlock_irqrestore(&chip->lock, flags);
        return 0;
@@ -183,7 +189,7 @@ static int pl061_irq_type(unsigned irq, unsigned trigger)
                gpioibe &= ~(1 << offset);
                if (trigger & IRQ_TYPE_EDGE_RISING)
                        gpioiev |= 1 << offset;
-                else
+                else if (trigger & IRQ_TYPE_EDGE_FALLING)
                        gpioiev &= ~(1 << offset);
        }
        writeb(gpioibe, chip->base + GPIOIBE);
@@ -204,7 +210,7 @@ static struct irq_chip pl061_irqchip = {
 static void pl061_irq_handler(unsigned irq, struct irq_desc *desc)
 {
-        struct list_head *chip_list = get_irq_chip_data(irq);
+        struct list_head *chip_list = get_irq_data(irq);
        struct list_head *ptr;
        struct pl061_gpio *chip;
@@ -297,9 +303,9 @@ static int __init pl061_probe(struct amba_device *dev, struct amba_id *id)
                        goto iounmap;
                }
                INIT_LIST_HEAD(chip_list);
-                set_irq_chip_data(irq, chip_list);
+                set_irq_data(irq, chip_list);
        } else
-                chip_list = get_irq_chip_data(irq);
+                chip_list = get_irq_data(irq);
        list_add(&chip->list, chip_list);
        for (i = 0; i < PL061_GPIO_NR; i++) {
diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
index 3bd872761567..a263b7070fc6 100644
--- a/drivers/gpu/drm/drm_irq.c
+++ b/drivers/gpu/drm/drm_irq.c
@@ -476,6 +476,7 @@ void drm_vblank_off(struct drm_device *dev, int crtc)
        unsigned long irqflags;
        spin_lock_irqsave(&dev->vbl_lock, irqflags);
+        dev->driver->disable_vblank(dev, crtc);
        DRM_WAKEUP(&dev->vbl_queue[crtc]);
        dev->vblank_enabled[crtc] = 0;
        dev->last_vblank[crtc] = dev->driver->get_vblank_counter(dev, crtc);
diff --git a/drivers/gpu/drm/drm_memory.c b/drivers/gpu/drm/drm_memory.c
index e4865f99989c..7732268eced2 100644
--- a/drivers/gpu/drm/drm_memory.c
+++ b/drivers/gpu/drm/drm_memory.c
@@ -77,7 +77,7 @@ static void *agp_remap(unsigned long offset, unsigned long size,
                    && (agpmem->bound + (agpmem->pages << PAGE_SHIFT)) >=
                    (offset + size))
                        break;
-        if (!agpmem)
+        if (&agpmem->head == &dev->agp->memory)
                return NULL;
        /*
diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c
index b743411d8144..a0c365f2e521 100644
--- a/drivers/gpu/drm/drm_stub.c
+++ b/drivers/gpu/drm/drm_stub.c
@@ -516,8 +516,6 @@ void drm_put_dev(struct drm_device *dev)
        }
        driver = dev->driver;
-        drm_vblank_cleanup(dev);
        drm_lastclose(dev);
        if (drm_core_has_MTRR(dev) && drm_core_has_AGP(dev) &&
@@ -537,6 +535,8 @@ void drm_put_dev(struct drm_device *dev)
                dev->agp = NULL;
        }
+        drm_vblank_cleanup(dev);
        list_for_each_entry_safe(r_list, list_temp, &dev->maplist, head)
                drm_rmmap(dev, r_list->map);
        drm_ht_remove(&dev->map_hash);
diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c
index 49daf37e5043..3a3a451d0bf8 100644
--- a/drivers/gpu/drm/drm_sysfs.c
+++ b/drivers/gpu/drm/drm_sysfs.c
@@ -354,7 +354,10 @@ static struct bin_attribute edid_attr = {
 int drm_sysfs_connector_add(struct drm_connector *connector)
 {
        struct drm_device *dev = connector->dev;
-        int ret = 0, i, j;
+        int attr_cnt = 0;
+        int opt_cnt = 0;
+        int i;
+        int ret = 0;
        /* We shouldn't get called more than once for the same connector */
        BUG_ON(device_is_registered(&connector->kdev));
@@ -377,8 +380,8 @@ int drm_sysfs_connector_add(struct drm_connector *connector)
        /* Standard attributes */
-        for (i = 0; i < ARRAY_SIZE(connector_attrs); i++) {
+        for (attr_cnt = 0; attr_cnt < ARRAY_SIZE(connector_attrs); attr_cnt++) {
-                ret = device_create_file(&connector->kdev, &connector_attrs[i]);
+                ret = device_create_file(&connector->kdev, &connector_attrs[attr_cnt]);
                if (ret)
                        goto err_out_files;
        }
@@ -394,8 +397,8 @@ int drm_sysfs_connector_add(struct drm_connector *connector)
                case DRM_MODE_CONNECTOR_SVIDEO:
                case DRM_MODE_CONNECTOR_Component:
                case DRM_MODE_CONNECTOR_TV:
-                        for (i = 0; i < ARRAY_SIZE(connector_attrs_opt1); i++) {
+                        for (opt_cnt = 0; opt_cnt < ARRAY_SIZE(connector_attrs_opt1); opt_cnt++) {
-                                ret = device_create_file(&connector->kdev, &connector_attrs_opt1[i]);
+                                ret = device_create_file(&connector->kdev, &connector_attrs_opt1[opt_cnt]);
                                if (ret)
                                        goto err_out_files;
                        }
@@ -414,10 +417,10 @@ int drm_sysfs_connector_add(struct drm_connector *connector)
        return 0;
 err_out_files:
-        if (i > 0)
+        for (i = 0; i < opt_cnt; i++)
-                for (j = 0; j < i; j++)
+                device_remove_file(&connector->kdev, &connector_attrs_opt1[i]);
-                        device_remove_file(&connector->kdev,
+        for (i = 0; i < attr_cnt; i++)
-                                           &connector_attrs[i]);
+                device_remove_file(&connector->kdev, &connector_attrs[i]);
        device_unregister(&connector->kdev);
 out:
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index bf7d601fc37d..851a2f8ed6e6 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1358,17 +1358,29 @@ static void i915_setup_compression(struct drm_device *dev, int size)
        dev_priv->cfb_size = size;
        intel_disable_fbc(dev);
+        dev_priv->compressed_fb = compressed_fb;
        if (IS_GM45(dev)) {
                I915_WRITE(DPFC_CB_BASE, compressed_fb->start);
        } else {
                I915_WRITE(FBC_CFB_BASE, cfb_base);
                I915_WRITE(FBC_LL_BASE, ll_base);
+                dev_priv->compressed_llb = compressed_llb;
        }
        DRM_DEBUG("FBC base 0x%08lx, ll base 0x%08lx, size %dM\n", cfb_base,
                  ll_base, size >> 20);
 }
+static void i915_cleanup_compression(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        drm_mm_put_block(dev_priv->compressed_fb);
+        if (!IS_GM45(dev))
+                drm_mm_put_block(dev_priv->compressed_llb);
+}
 /* true = enable decode, false = disable decoder */
 static unsigned int i915_vga_set_decode(void *cookie, bool state)
 {
@@ -1788,6 +1800,8 @@ int i915_driver_unload(struct drm_device *dev)
                mutex_lock(&dev->struct_mutex);
                i915_gem_cleanup_ringbuffer(dev);
                mutex_unlock(&dev->struct_mutex);
+                if (I915_HAS_FBC(dev) && i915_powersave)
+                        i915_cleanup_compression(dev);
                drm_mm_takedown(&dev_priv->vram);
                i915_gem_lastclose(dev);
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 01e91ea5bdea..5c51e45ab68d 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -69,7 +69,8 @@ const static struct intel_device_info intel_845g_info = {
 };
 const static struct intel_device_info intel_i85x_info = {
-        .is_i8xx = 1, .is_mobile = 1, .cursor_needs_physical = 1,
+        .is_i8xx = 1, .is_i85x = 1, .is_mobile = 1,
+        .cursor_needs_physical = 1,
 };
 const static struct intel_device_info intel_i865g_info = {
@@ -151,7 +152,7 @@ const static struct pci_device_id pciidlist[] = {
        INTEL_VGA_DEVICE(0x3577, &intel_i830_info),
        INTEL_VGA_DEVICE(0x2562, &intel_845g_info),
        INTEL_VGA_DEVICE(0x3582, &intel_i85x_info),
-        INTEL_VGA_DEVICE(0x35e8, &intel_i85x_info),
+        INTEL_VGA_DEVICE(0x358e, &intel_i85x_info),
        INTEL_VGA_DEVICE(0x2572, &intel_i865g_info),
        INTEL_VGA_DEVICE(0x2582, &intel_i915g_info),
        INTEL_VGA_DEVICE(0x258a, &intel_i915g_info),
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index c06d203b709b..bf11ad9998db 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -195,6 +195,7 @@ struct intel_overlay;
 struct intel_device_info {
        u8 is_mobile : 1;
        u8 is_i8xx : 1;
+        u8 is_i85x : 1;
        u8 is_i915g : 1;
        u8 is_i9xx : 1;
        u8 is_i945gm : 1;
@@ -242,11 +243,14 @@ typedef struct drm_i915_private {
        drm_dma_handle_t *status_page_dmah;
        void *hw_status_page;
+        void *seqno_page;
        dma_addr_t dma_status_page;
        uint32_t counter;
        unsigned int status_gfx_addr;
+        unsigned int seqno_gfx_addr;
        drm_local_map_t hws_map;
        struct drm_gem_object *hws_obj;
+        struct drm_gem_object *seqno_obj;
        struct drm_gem_object *pwrctx;
        struct resource mch_res;
@@ -641,6 +645,9 @@ typedef struct drm_i915_private {
        enum no_fbc_reason no_fbc_reason;
+        struct drm_mm_node *compressed_fb;
+        struct drm_mm_node *compressed_llb;
        /* list of fbdev register on this device */
        struct intel_fbdev *fbdev;
 } drm_i915_private_t;
@@ -1091,7 +1098,7 @@ extern int i915_wait_ring(struct drm_device * dev, int n, const char *caller);
 #define IS_I830(dev)            ((dev)->pci_device == 0x3577)
 #define IS_845G(dev)            ((dev)->pci_device == 0x2562)
-#define IS_I85X(dev)            ((dev)->pci_device == 0x3582)
+#define IS_I85X(dev)            (INTEL_INFO(dev)->is_i85x)
 #define IS_I865G(dev)           ((dev)->pci_device == 0x2572)
 #define IS_GEN2(dev)            (INTEL_INFO(dev)->is_i8xx)
 #define IS_I915G(dev)           (INTEL_INFO(dev)->is_i915g)
@@ -1157,6 +1164,7 @@ extern int i915_wait_ring(struct drm_device * dev, int n, const char *caller);
 #define HAS_PCH_SPLIT(dev) (IS_IRONLAKE(dev) || \
                            IS_GEN6(dev))
+#define HAS_PIPE_CONTROL(dev) (IS_IRONLAKE(dev) || IS_GEN6(dev))
 #define INTEL_PCH_TYPE(dev) (((struct drm_i915_private *)(dev)->dev_private)->pch_type)
 #define HAS_PCH_CPT(dev) (INTEL_PCH_TYPE(dev) == PCH_CPT)
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 3471dece13e7..666d75570502 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1588,6 +1588,13 @@ i915_gem_process_flushing_list(struct drm_device *dev,
        }
 }
+#define PIPE_CONTROL_FLUSH(addr)                                        \
+        OUT_RING(GFX_OP_PIPE_CONTROL | PIPE_CONTROL_QW_WRITE |          \
+                 PIPE_CONTROL_DEPTH_STALL);                             \
+        OUT_RING(addr | PIPE_CONTROL_GLOBAL_GTT);                       \
+        OUT_RING(0);                                                    \
+        OUT_RING(0);                                                    \
 /**
 * Creates a new sequence number, emitting a write of it to the status page
 * plus an interrupt, which will trigger i915_user_interrupt_handler.
@@ -1622,13 +1629,47 @@ i915_add_request(struct drm_device *dev, struct drm_file *file_priv,
        if (dev_priv->mm.next_gem_seqno == 0)
                dev_priv->mm.next_gem_seqno++;
-        BEGIN_LP_RING(4);
+        if (HAS_PIPE_CONTROL(dev)) {
-        OUT_RING(MI_STORE_DWORD_INDEX);
+                u32 scratch_addr = dev_priv->seqno_gfx_addr + 128;
-        OUT_RING(I915_GEM_HWS_INDEX << MI_STORE_DWORD_INDEX_SHIFT);
-        OUT_RING(seqno);
-        OUT_RING(MI_USER_INTERRUPT);
+                /*
-        ADVANCE_LP_RING();
+                 * Workaround qword write incoherence by flushing the
+                 * PIPE_NOTIFY buffers out to memory before requesting
+                 * an interrupt.
+                 */
+                BEGIN_LP_RING(32);
+                OUT_RING(GFX_OP_PIPE_CONTROL | PIPE_CONTROL_QW_WRITE |
+                         PIPE_CONTROL_WC_FLUSH | PIPE_CONTROL_TC_FLUSH);
+                OUT_RING(dev_priv->seqno_gfx_addr | PIPE_CONTROL_GLOBAL_GTT);
+                OUT_RING(seqno);
+                OUT_RING(0);
+                PIPE_CONTROL_FLUSH(scratch_addr);
+                scratch_addr += 128; /* write to separate cachelines */
+                PIPE_CONTROL_FLUSH(scratch_addr);
+                scratch_addr += 128;
+                PIPE_CONTROL_FLUSH(scratch_addr);
+                scratch_addr += 128;
+                PIPE_CONTROL_FLUSH(scratch_addr);
+                scratch_addr += 128;
+                PIPE_CONTROL_FLUSH(scratch_addr);
+                scratch_addr += 128;
+                PIPE_CONTROL_FLUSH(scratch_addr);
+                OUT_RING(GFX_OP_PIPE_CONTROL | PIPE_CONTROL_QW_WRITE |
+                         PIPE_CONTROL_WC_FLUSH | PIPE_CONTROL_TC_FLUSH |
+                         PIPE_CONTROL_NOTIFY);
+                OUT_RING(dev_priv->seqno_gfx_addr | PIPE_CONTROL_GLOBAL_GTT);
+                OUT_RING(seqno);
+                OUT_RING(0);
+                ADVANCE_LP_RING();
+        } else {
+                BEGIN_LP_RING(4);
+                OUT_RING(MI_STORE_DWORD_INDEX);
+                OUT_RING(I915_GEM_HWS_INDEX << MI_STORE_DWORD_INDEX_SHIFT);
+                OUT_RING(seqno);
+                OUT_RING(MI_USER_INTERRUPT);
+                ADVANCE_LP_RING();
+        }
        DRM_DEBUG_DRIVER("%d\n", seqno);
@@ -1752,7 +1793,10 @@ i915_get_gem_seqno(struct drm_device *dev)
 {
        drm_i915_private_t *dev_priv = dev->dev_private;
-        return READ_HWSP(dev_priv, I915_GEM_HWS_INDEX);
+        if (HAS_PIPE_CONTROL(dev))
+                return ((volatile u32 *)(dev_priv->seqno_page))[0];
+        else
+                return READ_HWSP(dev_priv, I915_GEM_HWS_INDEX);
 }
 /**
@@ -2362,6 +2406,12 @@ static void i915_write_fence_reg(struct drm_i915_fence_reg *reg)
        pitch_val = obj_priv->stride / tile_width;
        pitch_val = ffs(pitch_val) - 1;
+        if (obj_priv->tiling_mode == I915_TILING_Y &&
+            HAS_128_BYTE_Y_TILING(dev))
+                WARN_ON(pitch_val > I830_FENCE_MAX_PITCH_VAL);
+        else
+                WARN_ON(pitch_val > I915_FENCE_MAX_PITCH_VAL);
        val = obj_priv->gtt_offset;
        if (obj_priv->tiling_mode == I915_TILING_Y)
                val |= 1 << I830_FENCE_TILING_Y_SHIFT;
@@ -4554,6 +4604,49 @@ i915_gem_idle(struct drm_device *dev)
        return 0;
 }
+/*
+ * 965+ support PIPE_CONTROL commands, which provide finer grained control
+ * over cache flushing.
+ */
+static int
+i915_gem_init_pipe_control(struct drm_device *dev)
+{
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_gem_object *obj;
+        struct drm_i915_gem_object *obj_priv;
+        int ret;
+        obj = i915_gem_alloc_object(dev, 4096);
+        if (obj == NULL) {
+                DRM_ERROR("Failed to allocate seqno page\n");
+                ret = -ENOMEM;
+                goto err;
+        }
+        obj_priv = to_intel_bo(obj);
+        obj_priv->agp_type = AGP_USER_CACHED_MEMORY;
+        ret = i915_gem_object_pin(obj, 4096);
+        if (ret)
+                goto err_unref;
+        dev_priv->seqno_gfx_addr = obj_priv->gtt_offset;
+        dev_priv->seqno_page =  kmap(obj_priv->pages[0]);
+        if (dev_priv->seqno_page == NULL)
+                goto err_unpin;
+        dev_priv->seqno_obj = obj;
+        memset(dev_priv->seqno_page, 0, PAGE_SIZE);
+        return 0;
+err_unpin:
+        i915_gem_object_unpin(obj);
+err_unref:
+        drm_gem_object_unreference(obj);
+err:
+        return ret;
+}
 static int
 i915_gem_init_hws(struct drm_device *dev)
 {
@@ -4571,7 +4664,8 @@ i915_gem_init_hws(struct drm_device *dev)
        obj = i915_gem_alloc_object(dev, 4096);
        if (obj == NULL) {
                DRM_ERROR("Failed to allocate status page\n");
-                return -ENOMEM;
+                ret = -ENOMEM;
+                goto err;
        }
        obj_priv = to_intel_bo(obj);
        obj_priv->agp_type = AGP_USER_CACHED_MEMORY;
@@ -4579,7 +4673,7 @@ i915_gem_init_hws(struct drm_device *dev)
        ret = i915_gem_object_pin(obj, 4096);
        if (ret != 0) {
                drm_gem_object_unreference(obj);
-                return ret;
+                goto err_unref;
        }
        dev_priv->status_gfx_addr = obj_priv->gtt_offset;
@@ -4588,10 +4682,16 @@ i915_gem_init_hws(struct drm_device *dev)
        if (dev_priv->hw_status_page == NULL) {
                DRM_ERROR("Failed to map status page.\n");
                memset(&dev_priv->hws_map, 0, sizeof(dev_priv->hws_map));
-                i915_gem_object_unpin(obj);
+                ret = -EINVAL;
-                drm_gem_object_unreference(obj);
+                goto err_unpin;
-                return -EINVAL;
        }
+        if (HAS_PIPE_CONTROL(dev)) {
+                ret = i915_gem_init_pipe_control(dev);
+                if (ret)
+                        goto err_unpin;
+        }
        dev_priv->hws_obj = obj;
        memset(dev_priv->hw_status_page, 0, PAGE_SIZE);
        if (IS_GEN6(dev)) {
@@ -4604,6 +4704,30 @@ i915_gem_init_hws(struct drm_device *dev)
        DRM_DEBUG_DRIVER("hws offset: 0x%08x\n", dev_priv->status_gfx_addr);
        return 0;
+err_unpin:
+        i915_gem_object_unpin(obj);
+err_unref:
+        drm_gem_object_unreference(obj);
+err:
+        return 0;
+}
+static void
+i915_gem_cleanup_pipe_control(struct drm_device *dev)
+{
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_gem_object *obj;
+        struct drm_i915_gem_object *obj_priv;
+        obj = dev_priv->seqno_obj;
+        obj_priv = to_intel_bo(obj);
+        kunmap(obj_priv->pages[0]);
+        i915_gem_object_unpin(obj);
+        drm_gem_object_unreference(obj);
+        dev_priv->seqno_obj = NULL;
+        dev_priv->seqno_page = NULL;
 }
 static void
@@ -4627,6 +4751,9 @@ i915_gem_cleanup_hws(struct drm_device *dev)
        memset(&dev_priv->hws_map, 0, sizeof(dev_priv->hws_map));
        dev_priv->hw_status_page = NULL;
+        if (HAS_PIPE_CONTROL(dev))
+                i915_gem_cleanup_pipe_control(dev);
        /* Write high address into HWS_PGA when disabling. */
        I915_WRITE(HWS_PGA, 0x1ffff000);
 }
diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
index 449157f71610..4bdccefcf2cf 100644
--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
@@ -202,21 +202,17 @@ i915_tiling_ok(struct drm_device *dev, int stride, int size, int tiling_mode)
                 * reg, so dont bother to check the size */
                if (stride / 128 > I965_FENCE_MAX_PITCH_VAL)
                        return false;
-        } else if (IS_I9XX(dev)) {
+        } else if (IS_GEN3(dev) || IS_GEN2(dev)) {
-                uint32_t pitch_val = ffs(stride / tile_width) - 1;
+                if (stride > 8192)
-                /* XXX: For Y tiling, FENCE_MAX_PITCH_VAL is actually 6 (8KB)
-                 * instead of 4 (2KB) on 945s.
-                 */
-                if (pitch_val > I915_FENCE_MAX_PITCH_VAL ||
-                    size > (I830_FENCE_MAX_SIZE_VAL << 20))
                        return false;
-        } else {
-                uint32_t pitch_val = ffs(stride / tile_width) - 1;
-                if (pitch_val > I830_FENCE_MAX_PITCH_VAL ||
+                if (IS_GEN3(dev)) {
-                    size > (I830_FENCE_MAX_SIZE_VAL << 19))
+                        if (size > I830_FENCE_MAX_SIZE_VAL << 20)
-                        return false;
+                                return false;
+                } else {
+                        if (size > I830_FENCE_MAX_SIZE_VAL << 19)
+                                return false;
+                }
        }
        /* 965+ just needs multiples of tile width */
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index ed26b7b7376a..a7e4b1f27497 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -354,7 +354,7 @@ irqreturn_t ironlake_irq_handler(struct drm_device *dev)
                                READ_BREADCRUMB(dev_priv);
        }
-        if (gt_iir & GT_USER_INTERRUPT) {
+        if (gt_iir & GT_PIPE_NOTIFY) {
                u32 seqno = i915_get_gem_seqno(dev);
                dev_priv->mm.irq_gem_seqno = seqno;
                trace_i915_gem_request_complete(dev, seqno);
@@ -1011,7 +1011,7 @@ void i915_user_irq_get(struct drm_device *dev)
        spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
        if (dev->irq_enabled && (++dev_priv->user_irq_refcount == 1)) {
                if (HAS_PCH_SPLIT(dev))
-                        ironlake_enable_graphics_irq(dev_priv, GT_USER_INTERRUPT);
+                        ironlake_enable_graphics_irq(dev_priv, GT_PIPE_NOTIFY);
                else
                        i915_enable_irq(dev_priv, I915_USER_INTERRUPT);
        }
@@ -1027,7 +1027,7 @@ void i915_user_irq_put(struct drm_device *dev)
        BUG_ON(dev->irq_enabled && dev_priv->user_irq_refcount <= 0);
        if (dev->irq_enabled && (--dev_priv->user_irq_refcount == 0)) {
                if (HAS_PCH_SPLIT(dev))
-                        ironlake_disable_graphics_irq(dev_priv, GT_USER_INTERRUPT);
+                        ironlake_disable_graphics_irq(dev_priv, GT_PIPE_NOTIFY);
                else
                        i915_disable_irq(dev_priv, I915_USER_INTERRUPT);
        }
@@ -1311,7 +1311,7 @@ static int ironlake_irq_postinstall(struct drm_device *dev)
        /* enable kind of interrupts always enabled */
        u32 display_mask = DE_MASTER_IRQ_CONTROL | DE_GSE | DE_PCH_EVENT |
                           DE_PLANEA_FLIP_DONE | DE_PLANEB_FLIP_DONE;
-        u32 render_mask = GT_USER_INTERRUPT;
+        u32 render_mask = GT_PIPE_NOTIFY;
        u32 hotplug_mask = SDE_CRT_HOTPLUG | SDE_PORTB_HOTPLUG |
                           SDE_PORTC_HOTPLUG | SDE_PORTD_HOTPLUG;
diff --git a/drivers/gpu/drm/i915/i915_opregion.c b/drivers/gpu/drm/i915/i915_opregion.c
index 7cc8410239cb..8fcc75c1aa28 100644
--- a/drivers/gpu/drm/i915/i915_opregion.c
+++ b/drivers/gpu/drm/i915/i915_opregion.c
@@ -382,8 +382,57 @@ static void intel_didl_outputs(struct drm_device *dev)
        struct drm_i915_private *dev_priv = dev->dev_private;
        struct intel_opregion *opregion = &dev_priv->opregion;
        struct drm_connector *connector;
+        acpi_handle handle;
+        struct acpi_device *acpi_dev, *acpi_cdev, *acpi_video_bus = NULL;
+        unsigned long long device_id;
+        acpi_status status;
        int i = 0;
+        handle = DEVICE_ACPI_HANDLE(&dev->pdev->dev);
+        if (!handle || ACPI_FAILURE(acpi_bus_get_device(handle, &acpi_dev)))
+                return;
+        if (acpi_is_video_device(acpi_dev))
+                acpi_video_bus = acpi_dev;
+        else {
+                list_for_each_entry(acpi_cdev, &acpi_dev->children, node) {
+                        if (acpi_is_video_device(acpi_cdev)) {
+                                acpi_video_bus = acpi_cdev;
+                                break;
+                        }
+                }
+        }
+        if (!acpi_video_bus) {
+                printk(KERN_WARNING "No ACPI video bus found\n");
+                return;
+        }
+        list_for_each_entry(acpi_cdev, &acpi_video_bus->children, node) {
+                if (i >= 8) {
+                        dev_printk (KERN_ERR, &dev->pdev->dev,
+                                    "More than 8 outputs detected\n");
+                        return;
+                }
+                status =
+                        acpi_evaluate_integer(acpi_cdev->handle, "_ADR",
+                                                NULL, &device_id);
+                if (ACPI_SUCCESS(status)) {
+                        if (!device_id)
+                                goto blind_set;
+                        opregion->acpi->didl[i] = (u32)(device_id & 0x0f0f);
+                        i++;
+                }
+        }
+end:
+        /* If fewer than 8 outputs, the list must be null terminated */
+        if (i < 8)
+                opregion->acpi->didl[i] = 0;
+        return;
+blind_set:
+        i = 0;
        list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
                int output_type = ACPI_OTHER_OUTPUT;
                if (i >= 8) {
@@ -416,10 +465,7 @@ static void intel_didl_outputs(struct drm_device *dev)
                opregion->acpi->didl[i] |= (1<<31) | output_type | i;
                i++;
        }
+        goto end;
-        /* If fewer than 8 outputs, the list must be null terminated */
-        if (i < 8)
-                opregion->acpi->didl[i] = 0;
 }
 int intel_opregion_init(struct drm_device *dev, int resume)
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 0bbbb7753950..f3e39cc46f0d 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -230,6 +230,16 @@
 #define   ASYNC_FLIP                (1<<22)
 #define   DISPLAY_PLANE_A           (0<<20)
 #define   DISPLAY_PLANE_B           (1<<20)
+#define GFX_OP_PIPE_CONTROL     ((0x3<<29)|(0x3<<27)|(0x2<<24)|2)
+#define   PIPE_CONTROL_QW_WRITE (1<<14)
+#define   PIPE_CONTROL_DEPTH_STALL (1<<13)
+#define   PIPE_CONTROL_WC_FLUSH (1<<12)
+#define   PIPE_CONTROL_IS_FLUSH (1<<11) /* MBZ on Ironlake */
+#define   PIPE_CONTROL_TC_FLUSH (1<<10) /* GM45+ only */
+#define   PIPE_CONTROL_ISP_DIS  (1<<9)
+#define   PIPE_CONTROL_NOTIFY   (1<<8)
+#define   PIPE_CONTROL_GLOBAL_GTT (1<<2) /* in addr dword */
+#define   PIPE_CONTROL_STALL_EN (1<<1) /* in addr word, Ironlake+ only */
 /*
 * Fence registers
@@ -241,7 +251,7 @@
 #define   I830_FENCE_SIZE_BITS(size)    ((ffs((size) >> 19) - 1) << 8)
 #define   I830_FENCE_PITCH_SHIFT        4
 #define   I830_FENCE_REG_VALID          (1<<0)
-#define   I915_FENCE_MAX_PITCH_VAL      0x10
+#define   I915_FENCE_MAX_PITCH_VAL      4
 #define   I830_FENCE_MAX_PITCH_VAL      6
 #define   I830_FENCE_MAX_SIZE_VAL       (1<<8)
@@ -2342,6 +2352,7 @@
 #define DEIER   0x4400c
 /* GT interrupt */
+#define GT_PIPE_NOTIFY          (1 << 4)
 #define GT_SYNC_STATUS          (1 << 2)
 #define GT_USER_INTERRUPT       (1 << 0)
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 84c1aca8637e..e775ce67be33 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -5291,17 +5291,18 @@ static void intel_init_display(struct drm_device *dev)
                dev_priv->display.update_wm = g4x_update_wm;
        else if (IS_I965G(dev))
                dev_priv->display.update_wm = i965_update_wm;
-        else if (IS_I9XX(dev) || IS_MOBILE(dev)) {
+        else if (IS_I9XX(dev)) {
                dev_priv->display.update_wm = i9xx_update_wm;
                dev_priv->display.get_fifo_size = i9xx_get_fifo_size;
+        } else if (IS_I85X(dev)) {
+                dev_priv->display.update_wm = i9xx_update_wm;
+                dev_priv->display.get_fifo_size = i85x_get_fifo_size;
        } else {
-                if (IS_I85X(dev))
+                dev_priv->display.update_wm = i830_update_wm;
-                        dev_priv->display.get_fifo_size = i85x_get_fifo_size;
+                if (IS_845G(dev))
-                else if (IS_845G(dev))
                        dev_priv->display.get_fifo_size = i845_get_fifo_size;
                else
                        dev_priv->display.get_fifo_size = i830_get_fifo_size;
-                dev_priv->display.update_wm = i830_update_wm;
        }
 }
diff --git a/drivers/gpu/drm/radeon/atombios.h b/drivers/gpu/drm/radeon/atombios.h
index 26986c8e1f45..2ebcb979dd7e 100644
--- a/drivers/gpu/drm/radeon/atombios.h
+++ b/drivers/gpu/drm/radeon/atombios.h
@@ -2912,7 +2912,7 @@ typedef struct _ATOM_ANALOG_TV_INFO_V1_2
  UCHAR                    ucTV_BootUpDefaultStandard; 
  UCHAR                    ucExt_TV_ASIC_ID;
  UCHAR                    ucExt_TV_ASIC_SlaveAddr;
-  ATOM_DTD_FORMAT          aModeTimings[MAX_SUPPORTED_TV_TIMING];
+  ATOM_DTD_FORMAT          aModeTimings[MAX_SUPPORTED_TV_TIMING_V1_2];
 }ATOM_ANALOG_TV_INFO_V1_2;
 typedef struct _ATOM_DPCD_INFO
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 9bdccb964999..4de41b0ad5ce 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -3004,7 +3004,7 @@ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track)
        for (i = 0; i < track->num_cb; i++) {
                if (track->cb[i].robj == NULL) {
-                        if (!(track->fastfill || track->color_channel_mask ||
+                        if (!(track->zb_cb_clear || track->color_channel_mask ||
                              track->blend_read_enable)) {
                                continue;
                        }
diff --git a/drivers/gpu/drm/radeon/r100_track.h b/drivers/gpu/drm/radeon/r100_track.h
index fadfe68de9cc..f47cdca1c004 100644
--- a/drivers/gpu/drm/radeon/r100_track.h
+++ b/drivers/gpu/drm/radeon/r100_track.h
@@ -75,7 +75,7 @@ struct r100_cs_track {
        struct r100_cs_track_texture    textures[R300_TRACK_MAX_TEXTURE];
        bool                            z_enabled;
        bool                            separate_cube;
-        bool                            fastfill;
+        bool                            zb_cb_clear;
        bool                            blend_read_enable;
 };
diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
index 5d622cb39b33..6d9569e002f7 100644
--- a/drivers/gpu/drm/radeon/r300.c
+++ b/drivers/gpu/drm/radeon/r300.c
@@ -328,13 +328,12 @@ void r300_gpu_init(struct radeon_device *rdev)
 {
        uint32_t gb_tile_config, tmp;
-        /* FIXME: rv380 one pipes ? */
        if ((rdev->family == CHIP_R300 && rdev->pdev->device != 0x4144) ||
-            (rdev->family == CHIP_R350)) {
+            (rdev->family == CHIP_R350 && rdev->pdev->device != 0x4148)) {
                /* r300,r350 */
                rdev->num_gb_pipes = 2;
        } else {
-                /* rv350,rv370,rv380,r300 AD */
+                /* rv350,rv370,rv380,r300 AD, r350 AH */
                rdev->num_gb_pipes = 1;
        }
        rdev->num_z_pipes = 1;
@@ -1045,7 +1044,7 @@ static int r300_packet0_check(struct radeon_cs_parser *p,
                break;
        case 0x4d1c:
                /* ZB_BW_CNTL */
-                track->fastfill = !!(idx_value & (1 << 2));
+                track->zb_cb_clear = !!(idx_value & (1 << 5));
                break;
        case 0x4e04:
                /* RB3D_BLENDCNTL */
diff --git a/drivers/gpu/drm/radeon/r300_cmdbuf.c b/drivers/gpu/drm/radeon/r300_cmdbuf.c
index ea46d558e8f3..c5c2742e4140 100644
--- a/drivers/gpu/drm/radeon/r300_cmdbuf.c
+++ b/drivers/gpu/drm/radeon/r300_cmdbuf.c
@@ -921,7 +921,7 @@ static int r300_scratch(drm_radeon_private_t *dev_priv,
        ptr_addr = drm_buffer_read_object(cmdbuf->buffer,
                        sizeof(stack_ptr_addr), &stack_ptr_addr);
-        ref_age_base = (u32 *)(unsigned long)*ptr_addr;
+        ref_age_base = (u32 *)(unsigned long)get_unaligned(ptr_addr);
        for (i=0; i < header.scratch.n_bufs; i++) {
                buf_idx = drm_buffer_pointer_to_dword(cmdbuf->buffer, 0);
diff --git a/drivers/gpu/drm/radeon/r420.c b/drivers/gpu/drm/radeon/r420.c
index 3759d8384294..be092d243f84 100644
--- a/drivers/gpu/drm/radeon/r420.c
+++ b/drivers/gpu/drm/radeon/r420.c
@@ -59,6 +59,12 @@ void r420_pipes_init(struct radeon_device *rdev)
        /* get max number of pipes */
        gb_pipe_select = RREG32(0x402C);
        num_pipes = ((gb_pipe_select >> 12) & 3) + 1;
+        /* SE chips have 1 pipe */
+        if ((rdev->pdev->device == 0x5e4c) ||
+            (rdev->pdev->device == 0x5e4f))
+                num_pipes = 1;
        rdev->num_gb_pipes = num_pipes;
        tmp = 0;
        switch (num_pipes) {
diff --git a/drivers/gpu/drm/radeon/radeon_agp.c b/drivers/gpu/drm/radeon/radeon_agp.c
index c4457791dff1..28e473f1f56f 100644
--- a/drivers/gpu/drm/radeon/radeon_agp.c
+++ b/drivers/gpu/drm/radeon/radeon_agp.c
@@ -134,12 +134,10 @@ int radeon_agp_init(struct radeon_device *rdev)
        int ret;
        /* Acquire AGP. */
-        if (!rdev->ddev->agp->acquired) {
+        ret = drm_agp_acquire(rdev->ddev);
-                ret = drm_agp_acquire(rdev->ddev);
+        if (ret) {
-                if (ret) {
+                DRM_ERROR("Unable to acquire AGP: %d\n", ret);
-                        DRM_ERROR("Unable to acquire AGP: %d\n", ret);
+                return ret;
-                        return ret;
-                }
        }
        ret = drm_agp_info(rdev->ddev, &info);
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 273019925e0b..1d05debdd604 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -1264,7 +1264,7 @@ bool radeon_atom_get_tv_timings(struct radeon_device *rdev, int index,
        switch (crev) {
        case 1:
                tv_info = (ATOM_ANALOG_TV_INFO *)(mode_info->atom_context->bios + data_offset);
-                if (index > MAX_SUPPORTED_TV_TIMING)
+                if (index >= MAX_SUPPORTED_TV_TIMING)
                        return false;
                mode->crtc_htotal = le16_to_cpu(tv_info->aModeTimings[index].usCRTC_H_Total);
@@ -1302,7 +1302,7 @@ bool radeon_atom_get_tv_timings(struct radeon_device *rdev, int index,
                break;
        case 2:
                tv_info_v1_2 = (ATOM_ANALOG_TV_INFO_V1_2 *)(mode_info->atom_context->bios + data_offset);
-                if (index > MAX_SUPPORTED_TV_TIMING_V1_2)
+                if (index >= MAX_SUPPORTED_TV_TIMING_V1_2)
                        return false;
                dtd_timings = &tv_info_v1_2->aModeTimings[index];
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index c48934677adf..40a24c941f20 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -1294,6 +1294,8 @@ radeon_add_legacy_connector(struct drm_device *dev,
                        radeon_connector->ddc_bus = radeon_i2c_create(dev, i2c_bus, "DVI");
                        if (!radeon_connector->ddc_bus)
                                goto failed;
+                }
+                if (connector_type == DRM_MODE_CONNECTOR_DVII) {
                        radeon_connector->dac_load_detect = true;
                        drm_connector_attach_property(&radeon_connector->base,
                                                      rdev->mode_info.load_detect_property,
diff --git a/drivers/gpu/drm/radeon/radeon_cp.c b/drivers/gpu/drm/radeon/radeon_cp.c
index 419630dd2075..2f042a3c0e62 100644
--- a/drivers/gpu/drm/radeon/radeon_cp.c
+++ b/drivers/gpu/drm/radeon/radeon_cp.c
@@ -435,14 +435,19 @@ static void radeon_init_pipes(struct drm_device *dev)
        if ((dev_priv->flags & RADEON_FAMILY_MASK) >= CHIP_R420) {
                gb_pipe_sel = RADEON_READ(R400_GB_PIPE_SELECT);
                dev_priv->num_gb_pipes = ((gb_pipe_sel >> 12) & 0x3) + 1;
+                /* SE cards have 1 pipe */
+                if ((dev->pdev->device == 0x5e4c) ||
+                    (dev->pdev->device == 0x5e4f))
+                        dev_priv->num_gb_pipes = 1;
        } else {
                /* R3xx */
                if (((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_R300 &&
                     dev->pdev->device != 0x4144) ||
-                    ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_R350)) {
+                    ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_R350 &&
+                     dev->pdev->device != 0x4148)) {
                        dev_priv->num_gb_pipes = 2;
                } else {
-                        /* RV3xx/R300 AD */
+                        /* RV3xx/R300 AD/R350 AH */
                        dev_priv->num_gb_pipes = 1;
                }
        }
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index 243c1c4bc836..ce5163ed1fa6 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -86,12 +86,12 @@ static void evergreen_crtc_load_lut(struct drm_crtc *crtc)
        WREG32(EVERGREEN_DC_LUT_WHITE_OFFSET_GREEN + radeon_crtc->crtc_offset, 0xffff);
        WREG32(EVERGREEN_DC_LUT_WHITE_OFFSET_RED + radeon_crtc->crtc_offset, 0xffff);
-        WREG32(EVERGREEN_DC_LUT_RW_MODE, radeon_crtc->crtc_id);
+        WREG32(EVERGREEN_DC_LUT_RW_MODE + radeon_crtc->crtc_offset, 0);
-        WREG32(EVERGREEN_DC_LUT_WRITE_EN_MASK, 0x00000007);
+        WREG32(EVERGREEN_DC_LUT_WRITE_EN_MASK + radeon_crtc->crtc_offset, 0x00000007);
-        WREG32(EVERGREEN_DC_LUT_RW_INDEX, 0);
+        WREG32(EVERGREEN_DC_LUT_RW_INDEX + radeon_crtc->crtc_offset, 0);
        for (i = 0; i < 256; i++) {
-                WREG32(EVERGREEN_DC_LUT_30_COLOR,
+                WREG32(EVERGREEN_DC_LUT_30_COLOR + radeon_crtc->crtc_offset,
                       (radeon_crtc->lut_r[i] << 20) |
                       (radeon_crtc->lut_g[i] << 10) |
                       (radeon_crtc->lut_b[i] << 0));
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index 30293bec0801..c5ddaf58563a 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -254,6 +254,53 @@ radeon_get_atom_connector_priv_from_encoder(struct drm_encoder *encoder)
        return dig_connector;
 }
+void radeon_panel_mode_fixup(struct drm_encoder *encoder,
+                             struct drm_display_mode *adjusted_mode)
+{
+        struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+        struct drm_device *dev = encoder->dev;
+        struct radeon_device *rdev = dev->dev_private;
+        struct drm_display_mode *native_mode = &radeon_encoder->native_mode;
+        unsigned hblank = native_mode->htotal - native_mode->hdisplay;
+        unsigned vblank = native_mode->vtotal - native_mode->vdisplay;
+        unsigned hover = native_mode->hsync_start - native_mode->hdisplay;
+        unsigned vover = native_mode->vsync_start - native_mode->vdisplay;
+        unsigned hsync_width = native_mode->hsync_end - native_mode->hsync_start;
+        unsigned vsync_width = native_mode->vsync_end - native_mode->vsync_start;
+        adjusted_mode->clock = native_mode->clock;
+        adjusted_mode->flags = native_mode->flags;
+        if (ASIC_IS_AVIVO(rdev)) {
+                adjusted_mode->hdisplay = native_mode->hdisplay;
+                adjusted_mode->vdisplay = native_mode->vdisplay;
+        }
+        adjusted_mode->htotal = native_mode->hdisplay + hblank;
+        adjusted_mode->hsync_start = native_mode->hdisplay + hover;
+        adjusted_mode->hsync_end = adjusted_mode->hsync_start + hsync_width;
+        adjusted_mode->vtotal = native_mode->vdisplay + vblank;
+        adjusted_mode->vsync_start = native_mode->vdisplay + vover;
+        adjusted_mode->vsync_end = adjusted_mode->vsync_start + vsync_width;
+        drm_mode_set_crtcinfo(adjusted_mode, CRTC_INTERLACE_HALVE_V);
+        if (ASIC_IS_AVIVO(rdev)) {
+                adjusted_mode->crtc_hdisplay = native_mode->hdisplay;
+                adjusted_mode->crtc_vdisplay = native_mode->vdisplay;
+        }
+        adjusted_mode->crtc_htotal = adjusted_mode->crtc_hdisplay + hblank;
+        adjusted_mode->crtc_hsync_start = adjusted_mode->crtc_hdisplay + hover;
+        adjusted_mode->crtc_hsync_end = adjusted_mode->crtc_hsync_start + hsync_width;
+        adjusted_mode->crtc_vtotal = adjusted_mode->crtc_vdisplay + vblank;
+        adjusted_mode->crtc_vsync_start = adjusted_mode->crtc_vdisplay + vover;
+        adjusted_mode->crtc_vsync_end = adjusted_mode->crtc_vsync_start + vsync_width;
+}
 static bool radeon_atom_mode_fixup(struct drm_encoder *encoder,
                                   struct drm_display_mode *mode,
                                   struct drm_display_mode *adjusted_mode)
@@ -275,18 +322,8 @@ static bool radeon_atom_mode_fixup(struct drm_encoder *encoder,
                adjusted_mode->crtc_vsync_start = adjusted_mode->crtc_vdisplay + 2;
        /* get the native mode for LVDS */
-        if (radeon_encoder->active_device & (ATOM_DEVICE_LCD_SUPPORT)) {
+        if (radeon_encoder->active_device & (ATOM_DEVICE_LCD_SUPPORT))
-                struct drm_display_mode *native_mode = &radeon_encoder->native_mode;
+                radeon_panel_mode_fixup(encoder, adjusted_mode);
-                int mode_id = adjusted_mode->base.id;
-                *adjusted_mode = *native_mode;
-                if (!ASIC_IS_AVIVO(rdev)) {
-                        adjusted_mode->hdisplay = mode->hdisplay;
-                        adjusted_mode->vdisplay = mode->vdisplay;
-                        adjusted_mode->crtc_hdisplay = mode->hdisplay;
-                        adjusted_mode->crtc_vdisplay = mode->vdisplay;
-                }
-                adjusted_mode->base.id = mode_id;
-        }
        /* get the native mode for TV */
        if (radeon_encoder->active_device & (ATOM_DEVICE_TV_SUPPORT)) {
@@ -1326,7 +1363,7 @@ radeon_atom_encoder_mode_set(struct drm_encoder *encoder,
        radeon_encoder->pixel_clock = adjusted_mode->clock;
-        if (ASIC_IS_AVIVO(rdev)) {
+        if (ASIC_IS_AVIVO(rdev) && !ASIC_IS_DCE4(rdev)) {
                if (radeon_encoder->active_device & (ATOM_DEVICE_CV_SUPPORT | ATOM_DEVICE_TV_SUPPORT))
                        atombios_yuv_setup(encoder, true);
                else
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index d3657dcfdd26..c633319f98ed 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -165,7 +165,7 @@ u32 radeon_get_vblank_counter_kms(struct drm_device *dev, int crtc)
 {
        struct radeon_device *rdev = dev->dev_private;
-        if (crtc < 0 || crtc > 1) {
+        if (crtc < 0 || crtc >= rdev->num_crtc) {
                DRM_ERROR("Invalid crtc %d\n", crtc);
                return -EINVAL;
        }
@@ -177,7 +177,7 @@ int radeon_enable_vblank_kms(struct drm_device *dev, int crtc)
 {
        struct radeon_device *rdev = dev->dev_private;
-        if (crtc < 0 || crtc > 1) {
+        if (crtc < 0 || crtc >= rdev->num_crtc) {
                DRM_ERROR("Invalid crtc %d\n", crtc);
                return -EINVAL;
        }
@@ -191,7 +191,7 @@ void radeon_disable_vblank_kms(struct drm_device *dev, int crtc)
 {
        struct radeon_device *rdev = dev->dev_private;
-        if (crtc < 0 || crtc > 1) {
+        if (crtc < 0 || crtc >= rdev->num_crtc) {
                DRM_ERROR("Invalid crtc %d\n", crtc);
                return;
        }
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
index 2441cca7d775..0274abe17ad9 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
@@ -228,16 +228,8 @@ static bool radeon_legacy_mode_fixup(struct drm_encoder *encoder,
        drm_mode_set_crtcinfo(adjusted_mode, 0);
        /* get the native mode for LVDS */
-        if (radeon_encoder->active_device & (ATOM_DEVICE_LCD_SUPPORT)) {
+        if (radeon_encoder->active_device & (ATOM_DEVICE_LCD_SUPPORT))
-                struct drm_display_mode *native_mode = &radeon_encoder->native_mode;
+                radeon_panel_mode_fixup(encoder, adjusted_mode);
-                int mode_id = adjusted_mode->base.id;
-                *adjusted_mode = *native_mode;
-                adjusted_mode->hdisplay = mode->hdisplay;
-                adjusted_mode->vdisplay = mode->vdisplay;
-                adjusted_mode->crtc_hdisplay = mode->hdisplay;
-                adjusted_mode->crtc_vdisplay = mode->vdisplay;
-                adjusted_mode->base.id = mode_id;
-        }
        return true;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
index dd451c55c533..a2bc31465e4f 100644
--- a/drivers/gpu/drm/radeon/radeon_mode.h
+++ b/drivers/gpu/drm/radeon/radeon_mode.h
@@ -564,6 +564,8 @@ extern int radeon_static_clocks_init(struct drm_device *dev);
 bool radeon_crtc_scaling_mode_fixup(struct drm_crtc *crtc,
                                        struct drm_display_mode *mode,
                                        struct drm_display_mode *adjusted_mode);
+void radeon_panel_mode_fixup(struct drm_encoder *encoder,
+                             struct drm_display_mode *adjusted_mode);
 void atom_rv515_force_tv_scaler(struct radeon_device *rdev, struct radeon_crtc *radeon_crtc);
 /* legacy tv */
diff --git a/drivers/gpu/drm/via/via_video.c b/drivers/gpu/drm/via/via_video.c
index 6ec04ac12459..6efac8117c93 100644
--- a/drivers/gpu/drm/via/via_video.c
+++ b/drivers/gpu/drm/via/via_video.c
@@ -75,7 +75,7 @@ int via_decoder_futex(struct drm_device *dev, void *data, struct drm_file *file_
        DRM_DEBUG("\n");
-        if (fx->lock > VIA_NR_XVMC_LOCKS)
+        if (fx->lock >= VIA_NR_XVMC_LOCKS)
                return -EFAULT;
        lock = (volatile int *)XVMCLOCKPTR(sAPriv, fx->lock);
diff --git a/drivers/gpu/vga/vga_switcheroo.c b/drivers/gpu/vga/vga_switcheroo.c
index d6d1149d525d..c8768f38511e 100644
--- a/drivers/gpu/vga/vga_switcheroo.c
+++ b/drivers/gpu/vga/vga_switcheroo.c
@@ -276,8 +276,10 @@ vga_switcheroo_debugfs_write(struct file *filp, const char __user *ubuf,
        mutex_lock(&vgasr_mutex);
-        if (!vgasr_priv.active)
+        if (!vgasr_priv.active) {
-                return -EINVAL;
+                cnt = -EINVAL;
+                goto out;
+        }
        /* pwr off the device not in use */
        if (strncmp(usercmd, "OFF", 3) == 0) {
diff --git a/drivers/hwmon/asus_atk0110.c b/drivers/hwmon/asus_atk0110.c
index 75f3fa55663d..16c420240724 100644
--- a/drivers/hwmon/asus_atk0110.c
+++ b/drivers/hwmon/asus_atk0110.c
@@ -1169,15 +1169,19 @@ static int atk_create_files(struct atk_data *data)
        int err;
        list_for_each_entry(s, &data->sensor_list, list) {
+                sysfs_attr_init(&s->input_attr.attr);
                err = device_create_file(data->hwmon_dev, &s->input_attr);
                if (err)
                        return err;
+                sysfs_attr_init(&s->label_attr.attr);
                err = device_create_file(data->hwmon_dev, &s->label_attr);
                if (err)
                        return err;
+                sysfs_attr_init(&s->limit1_attr.attr);
                err = device_create_file(data->hwmon_dev, &s->limit1_attr);
                if (err)
                        return err;
+                sysfs_attr_init(&s->limit2_attr.attr);
                err = device_create_file(data->hwmon_dev, &s->limit2_attr);
                if (err)
                        return err;
diff --git a/drivers/hwmon/hp_accel.c b/drivers/hwmon/hp_accel.c
index be475e844c2a..c8ab50516672 100644
--- a/drivers/hwmon/hp_accel.c
+++ b/drivers/hwmon/hp_accel.c
@@ -217,6 +217,10 @@ static struct dmi_system_id lis3lv02d_dmi_ids[] = {
        AXIS_DMI_MATCH("DV7", "HP Pavilion dv7", x_inverted),
        AXIS_DMI_MATCH("HP8710", "HP Compaq 8710", y_inverted),
        AXIS_DMI_MATCH("HDX18", "HP HDX 18", x_inverted),
+        AXIS_DMI_MATCH("HPB432x", "HP ProBook 432", xy_rotated_left),
+        AXIS_DMI_MATCH("HPB442x", "HP ProBook 442", xy_rotated_left),
+        AXIS_DMI_MATCH("HPB452x", "HP ProBook 452", y_inverted),
+        AXIS_DMI_MATCH("HPB522x", "HP ProBook 522", xy_swap),
        { NULL, }
 /* Laptop models without axis info (yet):
 * "NC6910" "HP Compaq 6910"
diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index f7e27b702375..d1ff9408dc1f 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -146,10 +146,10 @@ static int i2c_imx_bus_busy(struct imx_i2c_struct *i2c_imx, int for_busy)
                                "<%s> I2C Interrupted\n", __func__);
                        return -EINTR;
                }
-                if (time_after(jiffies, orig_jiffies + HZ / 1000)) {
+                if (time_after(jiffies, orig_jiffies + msecs_to_jiffies(500))) {
                        dev_dbg(&i2c_imx->adapter.dev,
                                "<%s> I2C bus is busy\n", __func__);
-                        return -EIO;
+                        return -ETIMEDOUT;
                }
                schedule();
        }
@@ -444,6 +444,8 @@ static int i2c_imx_xfer(struct i2c_adapter *adapter,
                        result = i2c_imx_read(i2c_imx, &msgs[i]);
                else
                        result = i2c_imx_write(i2c_imx, &msgs[i]);
+                if (result)
+                        goto fail0;
        }
 fail0:
diff --git a/drivers/i2c/busses/i2c-octeon.c b/drivers/i2c/busses/i2c-octeon.c
index a2481f40ea1c..0e9f85d0a835 100644
--- a/drivers/i2c/busses/i2c-octeon.c
+++ b/drivers/i2c/busses/i2c-octeon.c
@@ -447,7 +447,7 @@ static struct i2c_adapter octeon_i2c_ops = {
 /**
 * octeon_i2c_setclock - Calculate and set clock divisors.
 */
-static int __init octeon_i2c_setclock(struct octeon_i2c *i2c)
+static int __devinit octeon_i2c_setclock(struct octeon_i2c *i2c)
 {
        int tclk, thp_base, inc, thp_idx, mdiv_idx, ndiv_idx, foscl, diff;
        int thp = 0x18, mdiv = 2, ndiv = 0, delta_hz = 1000000;
@@ -490,7 +490,7 @@ static int __init octeon_i2c_setclock(struct octeon_i2c *i2c)
        return 0;
 }
-static int __init octeon_i2c_initlowlevel(struct octeon_i2c *i2c)
+static int __devinit octeon_i2c_initlowlevel(struct octeon_i2c *i2c)
 {
        u8 status;
        int tries;
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index 6bd0f19cd451..389ac6032a7b 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -903,6 +903,11 @@ omap_i2c_probe(struct platform_device *pdev)
        platform_set_drvdata(pdev, dev);
+        if (cpu_is_omap7xx())
+                dev->reg_shift = 1;
+        else
+                dev->reg_shift = 2;
        if ((r = omap_i2c_get_clocks(dev)) != 0)
                goto err_iounmap;
@@ -926,11 +931,6 @@ omap_i2c_probe(struct platform_device *pdev)
                dev->b_hw = 1; /* Enable hardware fixes */
        }
-        if (cpu_is_omap7xx())
-                dev->reg_shift = 1;
-        else
-                dev->reg_shift = 2;
        /* reset ASAP, clearing any IRQs */
        omap_i2c_init(dev);
diff --git a/drivers/i2c/busses/i2c-pnx.c b/drivers/i2c/busses/i2c-pnx.c
index 247103372a06..a97e3fec8148 100644
--- a/drivers/i2c/busses/i2c-pnx.c
+++ b/drivers/i2c/busses/i2c-pnx.c
@@ -173,6 +173,9 @@ static int i2c_pnx_master_xmit(struct i2c_pnx_algo_data *alg_data)
                /* We still have something to talk about... */
                val = *alg_data->mif.buf++;
+                if (alg_data->mif.len == 1)
+                        val |= stop_bit;
                alg_data->mif.len--;
                iowrite32(val, I2C_REG_TX(alg_data));
@@ -246,6 +249,9 @@ static int i2c_pnx_master_rcv(struct i2c_pnx_algo_data *alg_data)
                        __func__);
                if (alg_data->mif.len == 1) {
+                        /* Last byte, do not acknowledge next rcv. */
+                        val |= stop_bit;
                        /*
                         * Enable interrupt RFDAIE (data in Rx fifo),
                         * and disable DRMIE (need data for Tx)
@@ -633,6 +639,8 @@ static int __devinit i2c_pnx_probe(struct platform_device *pdev)
         */
        tmp = ((freq / 1000) / I2C_PNX_SPEED_KHZ) / 2 - 2;
+        if (tmp > 0x3FF)
+                tmp = 0x3FF;
        iowrite32(tmp, I2C_REG_CKH(alg_data));
        iowrite32(tmp, I2C_REG_CKL(alg_data));
diff --git a/drivers/i2c/busses/i2c-stu300.c b/drivers/i2c/busses/i2c-stu300.c
index 1f5b38be73bc..495be451d326 100644
--- a/drivers/i2c/busses/i2c-stu300.c
+++ b/drivers/i2c/busses/i2c-stu300.c
@@ -498,7 +498,7 @@ static int stu300_set_clk(struct stu300_dev *dev, unsigned long clkrate)
        int i = 0;
        /* Locate the apropriate clock setting */
-        while (i < ARRAY_SIZE(stu300_clktable) &&
+        while (i < ARRAY_SIZE(stu300_clktable) - 1 &&
               stu300_clktable[i].rate < clkrate)
                i++;
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 3202a86f420e..c2258a51fe0c 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -40,12 +40,11 @@
 #include "i2c-core.h"
-/* core_lock protects i2c_adapter_idr, userspace_devices, and guarantees
+/* core_lock protects i2c_adapter_idr, and guarantees
   that device detection, deletion of detected devices, and attach_adapter
   and detach_adapter calls are serialized */
 static DEFINE_MUTEX(core_lock);
 static DEFINE_IDR(i2c_adapter_idr);
-static LIST_HEAD(userspace_devices);
 static struct device_type i2c_client_type;
 static int i2c_check_addr(struct i2c_adapter *adapter, int addr);
@@ -117,8 +116,10 @@ static int i2c_device_probe(struct device *dev)
        dev_dbg(dev, "probe\n");
        status = driver->probe(client, i2c_match_id(driver->id_table, client));
-        if (status)
+        if (status) {
                client->driver = NULL;
+                i2c_set_clientdata(client, NULL);
+        }
        return status;
 }
@@ -139,8 +140,10 @@ static int i2c_device_remove(struct device *dev)
                dev->driver = NULL;
                status = 0;
        }
-        if (status == 0)
+        if (status == 0) {
                client->driver = NULL;
+                i2c_set_clientdata(client, NULL);
+        }
        return status;
 }
@@ -538,9 +541,9 @@ i2c_sysfs_new_device(struct device *dev, struct device_attribute *attr,
                return -EEXIST;
        /* Keep track of the added device */
-        mutex_lock(&core_lock);
+        i2c_lock_adapter(adap);
-        list_add_tail(&client->detected, &userspace_devices);
+        list_add_tail(&client->detected, &adap->userspace_clients);
-        mutex_unlock(&core_lock);
+        i2c_unlock_adapter(adap);
        dev_info(dev, "%s: Instantiated device %s at 0x%02hx\n", "new_device",
                 info.type, info.addr);
@@ -579,9 +582,10 @@ i2c_sysfs_delete_device(struct device *dev, struct device_attribute *attr,
        /* Make sure the device was added through sysfs */
        res = -ENOENT;
-        mutex_lock(&core_lock);
+        i2c_lock_adapter(adap);
-        list_for_each_entry_safe(client, next, &userspace_devices, detected) {
+        list_for_each_entry_safe(client, next, &adap->userspace_clients,
-                if (client->addr == addr && client->adapter == adap) {
+                                 detected) {
+                if (client->addr == addr) {
                        dev_info(dev, "%s: Deleting device %s at 0x%02hx\n",
                                 "delete_device", client->name, client->addr);
@@ -591,7 +595,7 @@ i2c_sysfs_delete_device(struct device *dev, struct device_attribute *attr,
                        break;
                }
        }
-        mutex_unlock(&core_lock);
+        i2c_unlock_adapter(adap);
        if (res < 0)
                dev_err(dev, "%s: Can't find device in list\n",
@@ -673,6 +677,7 @@ static int i2c_register_adapter(struct i2c_adapter *adap)
        }
        rt_mutex_init(&adap->bus_lock);
+        INIT_LIST_HEAD(&adap->userspace_clients);
        /* Set default timeout to 1 second if not already set */
        if (adap->timeout == 0)
@@ -875,14 +880,15 @@ int i2c_del_adapter(struct i2c_adapter *adap)
                return res;
        /* Remove devices instantiated from sysfs */
-        list_for_each_entry_safe(client, next, &userspace_devices, detected) {
+        i2c_lock_adapter(adap);
-                if (client->adapter == adap) {
+        list_for_each_entry_safe(client, next, &adap->userspace_clients,
-                        dev_dbg(&adap->dev, "Removing %s at 0x%x\n",
+                                 detected) {
-                                client->name, client->addr);
+                dev_dbg(&adap->dev, "Removing %s at 0x%x\n", client->name,
-                        list_del(&client->detected);
+                        client->addr);
-                        i2c_unregister_device(client);
+                list_del(&client->detected);
-                }
+                i2c_unregister_device(client);
        }
+        i2c_unlock_adapter(adap);
        /* Detach any active clients. This can't fail, thus we do not
           checking the returned value. */
@@ -1260,12 +1266,23 @@ static int i2c_detect_address(struct i2c_client *temp_client,
                return 0;
        /* Make sure there is something at this address */
-        if (i2c_smbus_xfer(adapter, addr, 0, 0, 0, I2C_SMBUS_QUICK, NULL) < 0)
+        if (addr == 0x73 && (adapter->class & I2C_CLASS_HWMON)) {
-                return 0;
+                /* Special probe for FSC hwmon chips */
+                union i2c_smbus_data dummy;
-        /* Prevent 24RF08 corruption */
+                if (i2c_smbus_xfer(adapter, addr, 0, I2C_SMBUS_READ, 0,
-        if ((addr & ~0x0f) == 0x50)
+                                   I2C_SMBUS_BYTE_DATA, &dummy) < 0)
-                i2c_smbus_xfer(adapter, addr, 0, 0, 0, I2C_SMBUS_QUICK, NULL);
+                        return 0;
+        } else {
+                if (i2c_smbus_xfer(adapter, addr, 0, I2C_SMBUS_WRITE, 0,
+                                   I2C_SMBUS_QUICK, NULL) < 0)
+                        return 0;
+                /* Prevent 24RF08 corruption */
+                if ((addr & ~0x0f) == 0x50)
+                        i2c_smbus_xfer(adapter, addr, 0, I2C_SMBUS_WRITE, 0,
+                                       I2C_SMBUS_QUICK, NULL);
+        }
        /* Finally call the custom detection function */
        memset(&info, 0, sizeof(struct i2c_board_info));
diff --git a/drivers/ide/ide-cs.c b/drivers/ide/ide-cs.c
index ab87e4f7cec9..b85450865ff0 100644
--- a/drivers/ide/ide-cs.c
+++ b/drivers/ide/ide-cs.c
@@ -409,6 +409,8 @@ static struct pcmcia_device_id ide_ids[] = {
        PCMCIA_DEVICE_PROD_ID12("Hyperstone", "Model1", 0x3d5b9ef5, 0xca6ab420),
        PCMCIA_DEVICE_PROD_ID12("IBM", "microdrive", 0xb569a6e5, 0xa6d76178),
        PCMCIA_DEVICE_PROD_ID12("IBM", "IBM17JSSFP20", 0xb569a6e5, 0xf2508753),
+        PCMCIA_DEVICE_PROD_ID12("KINGSTON", "CF CARD 1GB", 0x2e6d1829, 0x55d5bffb),
+        PCMCIA_DEVICE_PROD_ID12("KINGSTON", "CF CARD 4GB", 0x2e6d1829, 0x531e7d10),
        PCMCIA_DEVICE_PROD_ID12("KINGSTON", "CF8GB", 0x2e6d1829, 0xacbe682e),
        PCMCIA_DEVICE_PROD_ID12("IO DATA", "CBIDE2      ", 0x547e66dc, 0x8671043b),
        PCMCIA_DEVICE_PROD_ID12("IO DATA", "PCIDE", 0x547e66dc, 0x5c5ab149),
@@ -429,6 +431,8 @@ static struct pcmcia_device_id ide_ids[] = {
        PCMCIA_DEVICE_PROD_ID12("TRANSCEND", "TS1GCF80", 0x709b1bf1, 0x2a54d4b1),
        PCMCIA_DEVICE_PROD_ID12("TRANSCEND", "TS2GCF120", 0x709b1bf1, 0x969aa4f2),
        PCMCIA_DEVICE_PROD_ID12("TRANSCEND", "TS4GCF120", 0x709b1bf1, 0xf54a91c8),
+        PCMCIA_DEVICE_PROD_ID12("TRANSCEND", "TS4GCF133", 0x709b1bf1, 0x7558f133),
+        PCMCIA_DEVICE_PROD_ID12("TRANSCEND", "TS8GCF133", 0x709b1bf1, 0xb2f89b47),
        PCMCIA_DEVICE_PROD_ID12("WIT", "IDE16", 0x244e5994, 0x3e232852),
        PCMCIA_DEVICE_PROD_ID12("WEIDA", "TWTTI", 0xcc7cf69c, 0x212bb918),
        PCMCIA_DEVICE_PROD_ID1("STI Flash", 0xe4a13209),
diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
index c52bec4d0530..423e0e6031ab 100644
--- a/drivers/input/joydev.c
+++ b/drivers/input/joydev.c
@@ -929,6 +929,24 @@ static const struct input_device_id joydev_ids[] = {
                .evbit = { BIT_MASK(EV_ABS) },
                .absbit = { BIT_MASK(ABS_THROTTLE) },
        },
+        {
+                .flags = INPUT_DEVICE_ID_MATCH_EVBIT |
+                                INPUT_DEVICE_ID_MATCH_KEYBIT,
+                .evbit = { BIT_MASK(EV_KEY) },
+                .keybit = {[BIT_WORD(BTN_JOYSTICK)] = BIT_MASK(BTN_JOYSTICK) },
+        },
+        {
+                .flags = INPUT_DEVICE_ID_MATCH_EVBIT |
+                                INPUT_DEVICE_ID_MATCH_KEYBIT,
+                .evbit = { BIT_MASK(EV_KEY) },
+                .keybit = { [BIT_WORD(BTN_GAMEPAD)] = BIT_MASK(BTN_GAMEPAD) },
+        },
+        {
+                .flags = INPUT_DEVICE_ID_MATCH_EVBIT |
+                                INPUT_DEVICE_ID_MATCH_KEYBIT,
+                .evbit = { BIT_MASK(EV_KEY) },
+                .keybit = { [BIT_WORD(BTN_TRIGGER_HAPPY)] = BIT_MASK(BTN_TRIGGER_HAPPY) },
+        },
        { }     /* Terminating entry */
 };
diff --git a/drivers/input/misc/ati_remote.c b/drivers/input/misc/ati_remote.c
index 614b65d78fe9..e8bbc619f6df 100644
--- a/drivers/input/misc/ati_remote.c
+++ b/drivers/input/misc/ati_remote.c
@@ -98,10 +98,12 @@
 * Module and Version Information, Module Parameters
 */
-#define ATI_REMOTE_VENDOR_ID    0x0bc7
+#define ATI_REMOTE_VENDOR_ID            0x0bc7
-#define ATI_REMOTE_PRODUCT_ID   0x004
+#define LOLA_REMOTE_PRODUCT_ID          0x0002
-#define LOLA_REMOTE_PRODUCT_ID  0x002
+#define LOLA2_REMOTE_PRODUCT_ID         0x0003
-#define MEDION_REMOTE_PRODUCT_ID 0x006
+#define ATI_REMOTE_PRODUCT_ID           0x0004
+#define NVIDIA_REMOTE_PRODUCT_ID        0x0005
+#define MEDION_REMOTE_PRODUCT_ID        0x0006
 #define DRIVER_VERSION          "2.2.1"
 #define DRIVER_AUTHOR           "Torrey Hoffman <thoffman@arnor.net>"
@@ -142,8 +144,10 @@ MODULE_PARM_DESC(repeat_delay, "Delay before sending repeats, default = 500 msec
 #define err(format, arg...) printk(KERN_ERR format , ## arg)
 static struct usb_device_id ati_remote_table[] = {
-        { USB_DEVICE(ATI_REMOTE_VENDOR_ID, ATI_REMOTE_PRODUCT_ID) },
        { USB_DEVICE(ATI_REMOTE_VENDOR_ID, LOLA_REMOTE_PRODUCT_ID) },
+        { USB_DEVICE(ATI_REMOTE_VENDOR_ID, LOLA2_REMOTE_PRODUCT_ID) },
+        { USB_DEVICE(ATI_REMOTE_VENDOR_ID, ATI_REMOTE_PRODUCT_ID) },
+        { USB_DEVICE(ATI_REMOTE_VENDOR_ID, NVIDIA_REMOTE_PRODUCT_ID) },
        { USB_DEVICE(ATI_REMOTE_VENDOR_ID, MEDION_REMOTE_PRODUCT_ID) },
        {}      /* Terminating entry */
 };
diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
index 0d22cb9ce42e..99d58764ef03 100644
--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
@@ -64,7 +64,6 @@ static const struct alps_model_info alps_model_data[] = {
        { { 0x62, 0x02, 0x14 }, 0xcf, 0xcf,
                ALPS_PASS | ALPS_DUALPOINT | ALPS_PS2_INTERLEAVED },
        { { 0x73, 0x02, 0x50 }, 0xcf, 0xcf, ALPS_FOUR_BUTTONS },          /* Dell Vostro 1400 */
-        { { 0x73, 0x02, 0x64 }, 0xf8, 0xf8, 0 },                          /* HP Pavilion dm3 */
        { { 0x52, 0x01, 0x14 }, 0xff, 0xff,
                ALPS_PASS | ALPS_DUALPOINT | ALPS_PS2_INTERLEAVED },      /* Toshiba Tecra A11-11L */
 };
diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
index a138b5da79f9..0520c2e19927 100644
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -25,6 +25,10 @@
                        printk(KERN_DEBUG format, ##arg);       \
        } while (0)
+static bool force_elantech;
+module_param_named(force_elantech, force_elantech, bool, 0644);
+MODULE_PARM_DESC(force_elantech, "Force the Elantech PS/2 protocol extension to be used, 1 = enabled, 0 = disabled (default).");
 /*
 * Send a Synaptics style sliced query command
 */
@@ -182,13 +186,17 @@ static void elantech_report_absolute_v1(struct psmouse *psmouse)
        static int old_fingers;
        if (etd->fw_version_maj == 0x01) {
-                /* byte 0:  D   U  p1  p2   1  p3   R   L
+                /*
-                   byte 1:  f   0  th  tw  x9  x8  y9  y8 */
+                 * byte 0:  D   U  p1  p2   1  p3   R   L
+                 * byte 1:  f   0  th  tw  x9  x8  y9  y8
+                 */
                fingers = ((packet[1] & 0x80) >> 7) +
                                ((packet[1] & 0x30) >> 4);
        } else {
-                /* byte 0: n1  n0  p2  p1   1  p3   R   L
+                /*
-                   byte 1:  0   0   0   0  x9  x8  y9  y8 */
+                 * byte 0: n1  n0  p2  p1   1  p3   R   L
+                 * byte 1:  0   0   0   0  x9  x8  y9  y8
+                 */
                fingers = (packet[0] & 0xc0) >> 6;
        }
@@ -202,13 +210,15 @@ static void elantech_report_absolute_v1(struct psmouse *psmouse)
        input_report_key(dev, BTN_TOUCH, fingers != 0);
-        /* byte 2: x7  x6  x5  x4  x3  x2  x1  x0
+        /*
-           byte 3: y7  y6  y5  y4  y3  y2  y1  y0 */
+         * byte 2: x7  x6  x5  x4  x3  x2  x1  x0
+         * byte 3: y7  y6  y5  y4  y3  y2  y1  y0
+         */
        if (fingers) {
                input_report_abs(dev, ABS_X,
                        ((packet[1] & 0x0c) << 6) | packet[2]);
-                input_report_abs(dev, ABS_Y, ETP_YMAX_V1 -
+                input_report_abs(dev, ABS_Y,
-                        (((packet[1] & 0x03) << 8) | packet[3]));
+                        ETP_YMAX_V1 - (((packet[1] & 0x03) << 8) | packet[3]));
        }
        input_report_key(dev, BTN_TOOL_FINGER, fingers == 1);
@@ -247,34 +257,47 @@ static void elantech_report_absolute_v2(struct psmouse *psmouse)
        switch (fingers) {
        case 1:
-                /* byte 1: x15 x14 x13 x12 x11 x10 x9  x8
+                /*
-                   byte 2: x7  x6  x5  x4  x4  x2  x1  x0 */
+                 * byte 1:  .   .   .   .   .  x10 x9  x8
-                input_report_abs(dev, ABS_X, (packet[1] << 8) | packet[2]);
+                 * byte 2: x7  x6  x5  x4  x4  x2  x1  x0
-                /* byte 4: y15 y14 y13 y12 y11 y10 y8  y8
+                 */
-                   byte 5: y7  y6  y5  y4  y3  y2  y1  y0 */
+                input_report_abs(dev, ABS_X,
-                input_report_abs(dev, ABS_Y, ETP_YMAX_V2 -
+                        ((packet[1] & 0x07) << 8) | packet[2]);
-                        ((packet[4] << 8) | packet[5]));
+                /*
+                 * byte 4:  .   .   .   .   .   .  y9  y8
+                 * byte 5: y7  y6  y5  y4  y3  y2  y1  y0
+                 */
+                input_report_abs(dev, ABS_Y,
+                        ETP_YMAX_V2 - (((packet[4] & 0x03) << 8) | packet[5]));
                break;
        case 2:
-                /* The coordinate of each finger is reported separately with
+                /*
-                   a lower resolution for two finger touches */
+                 * The coordinate of each finger is reported separately
-                /* byte 0:  .   .  ay8 ax8  .   .   .   .
+                 * with a lower resolution for two finger touches:
-                   byte 1: ax7 ax6 ax5 ax4 ax3 ax2 ax1 ax0 */
+                 * byte 0:  .   .  ay8 ax8  .   .   .   .
+                 * byte 1: ax7 ax6 ax5 ax4 ax3 ax2 ax1 ax0
+                 */
                x1 = ((packet[0] & 0x10) << 4) | packet[1];
                /* byte 2: ay7 ay6 ay5 ay4 ay3 ay2 ay1 ay0 */
                y1 = ETP_2FT_YMAX - (((packet[0] & 0x20) << 3) | packet[2]);
-                /* byte 3:  .   .  by8 bx8  .   .   .   .
+                /*
-                   byte 4: bx7 bx6 bx5 bx4 bx3 bx2 bx1 bx0 */
+                 * byte 3:  .   .  by8 bx8  .   .   .   .
+                 * byte 4: bx7 bx6 bx5 bx4 bx3 bx2 bx1 bx0
+                 */
                x2 = ((packet[3] & 0x10) << 4) | packet[4];
                /* byte 5: by7 by8 by5 by4 by3 by2 by1 by0 */
                y2 = ETP_2FT_YMAX - (((packet[3] & 0x20) << 3) | packet[5]);
-                /* For compatibility with the X Synaptics driver scale up one
+                /*
-                   coordinate and report as ordinary mouse movent */
+                 * For compatibility with the X Synaptics driver scale up
+                 * one coordinate and report as ordinary mouse movent
+                 */
                input_report_abs(dev, ABS_X, x1 << 2);
                input_report_abs(dev, ABS_Y, y1 << 2);
-                /* For compatibility with the proprietary X Elantech driver
+                /*
-                   report both coordinates as hat coordinates */
+                 * For compatibility with the proprietary X Elantech driver
+                 * report both coordinates as hat coordinates
+                 */
                input_report_abs(dev, ABS_HAT0X, x1);
                input_report_abs(dev, ABS_HAT0Y, y1);
                input_report_abs(dev, ABS_HAT1X, x2);
@@ -596,8 +619,12 @@ int elantech_detect(struct psmouse *psmouse, bool set_properties)
                 param[0], param[1], param[2]);
        if (param[0] == 0 || param[1] != 0) {
-                pr_debug("elantech.c: Probably not a real Elantech touchpad. Aborting.\n");
+                if (!force_elantech) {
-                return -1;
+                        pr_debug("elantech.c: Probably not a real Elantech touchpad. Aborting.\n");
+                        return -1;
+                }
+                pr_debug("elantech.c: Probably not a real Elantech touchpad. Enabling anyway due to force_elantech.\n");
        }
        if (set_properties) {
@@ -666,7 +693,8 @@ int elantech_init(struct psmouse *psmouse)
         * Assume every version greater than this is new EeePC style
         * hardware with 6 byte packets
         */
-        if (etd->fw_version_maj >= 0x02 && etd->fw_version_min >= 0x30) {
+        if ((etd->fw_version_maj == 0x02 && etd->fw_version_min >= 0x30) ||
+            etd->fw_version_maj > 0x02) {
                etd->hw_version = 2;
                /* For now show extra debug information */
                etd->debug = 1;
diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
index d8c0c8d6992c..cbc807264940 100644
--- a/drivers/input/mouse/psmouse-base.c
+++ b/drivers/input/mouse/psmouse-base.c
@@ -110,6 +110,7 @@ static struct workqueue_struct *kpsmoused_wq;
 struct psmouse_protocol {
        enum psmouse_type type;
        bool maxproto;
+        bool ignore_parity; /* Protocol should ignore parity errors from KBC */
        const char *name;
        const char *alias;
        int (*detect)(struct psmouse *, bool);
@@ -288,7 +289,9 @@ static irqreturn_t psmouse_interrupt(struct serio *serio,
        if (psmouse->state == PSMOUSE_IGNORE)
                goto out;
-        if (flags & (SERIO_PARITY|SERIO_TIMEOUT)) {
+        if (unlikely((flags & SERIO_TIMEOUT) ||
+                     ((flags & SERIO_PARITY) && !psmouse->ignore_parity))) {
                if (psmouse->state == PSMOUSE_ACTIVATED)
                        printk(KERN_WARNING "psmouse.c: bad data from KBC -%s%s\n",
                                flags & SERIO_TIMEOUT ? " timeout" : "",
@@ -759,6 +762,7 @@ static const struct psmouse_protocol psmouse_protocols[] = {
                .name           = "PS/2",
                .alias          = "bare",
                .maxproto       = true,
+                .ignore_parity  = true,
                .detect         = ps2bare_detect,
        },
 #ifdef CONFIG_MOUSE_PS2_LOGIPS2PP
@@ -786,6 +790,7 @@ static const struct psmouse_protocol psmouse_protocols[] = {
                .name           = "ImPS/2",
                .alias          = "imps",
                .maxproto       = true,
+                .ignore_parity  = true,
                .detect         = intellimouse_detect,
        },
        {
@@ -793,6 +798,7 @@ static const struct psmouse_protocol psmouse_protocols[] = {
                .name           = "ImExPS/2",
                .alias          = "exps",
                .maxproto       = true,
+                .ignore_parity  = true,
                .detect         = im_explorer_detect,
        },
 #ifdef CONFIG_MOUSE_PS2_SYNAPTICS
@@ -1222,6 +1228,7 @@ static void psmouse_disconnect(struct serio *serio)
 static int psmouse_switch_protocol(struct psmouse *psmouse,
                                   const struct psmouse_protocol *proto)
 {
+        const struct psmouse_protocol *selected_proto;
        struct input_dev *input_dev = psmouse->dev;
        input_dev->dev.parent = &psmouse->ps2dev.serio->dev;
@@ -1245,9 +1252,14 @@ static int psmouse_switch_protocol(struct psmouse *psmouse,
                        return -1;
                psmouse->type = proto->type;
-        } else
+                selected_proto = proto;
+        } else {
                psmouse->type = psmouse_extensions(psmouse,
                                                   psmouse_max_proto, true);
+                selected_proto = psmouse_protocol_by_type(psmouse->type);
+        }
+        psmouse->ignore_parity = selected_proto->ignore_parity;
        /*
         * If mouse's packet size is 3 there is no point in polling the
@@ -1267,7 +1279,7 @@ static int psmouse_switch_protocol(struct psmouse *psmouse,
                psmouse->resync_time = 0;
        snprintf(psmouse->devname, sizeof(psmouse->devname), "%s %s %s",
-                 psmouse_protocol_by_type(psmouse->type)->name, psmouse->vendor, psmouse->name);
+                 selected_proto->name, psmouse->vendor, psmouse->name);
        input_dev->name = psmouse->devname;
        input_dev->phys = psmouse->phys;
diff --git a/drivers/input/mouse/psmouse.h b/drivers/input/mouse/psmouse.h
index e053bdd137ff..593e910bfc7a 100644
--- a/drivers/input/mouse/psmouse.h
+++ b/drivers/input/mouse/psmouse.h
@@ -47,6 +47,7 @@ struct psmouse {
        unsigned char pktcnt;
        unsigned char pktsize;
        unsigned char type;
+        bool ignore_parity;
        bool acks_disable_command;
        unsigned int model;
        unsigned long last;
diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
index 026df6010161..ebd7a99efeae 100644
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -137,7 +137,8 @@ static int synaptics_capability(struct psmouse *psmouse)
        if (synaptics_send_cmd(psmouse, SYN_QUE_CAPABILITIES, cap))
                return -1;
        priv->capabilities = (cap[0] << 16) | (cap[1] << 8) | cap[2];
-        priv->ext_cap = 0;
+        priv->ext_cap = priv->ext_cap_0c = 0;
        if (!SYN_CAP_VALID(priv->capabilities))
                return -1;
@@ -150,7 +151,7 @@ static int synaptics_capability(struct psmouse *psmouse)
        if (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 1) {
                if (synaptics_send_cmd(psmouse, SYN_QUE_EXT_CAPAB, cap)) {
                        printk(KERN_ERR "Synaptics claims to have extended capabilities,"
-                               " but I'm not able to read them.");
+                               " but I'm not able to read them.\n");
                } else {
                        priv->ext_cap = (cap[0] << 16) | (cap[1] << 8) | cap[2];
@@ -162,6 +163,16 @@ static int synaptics_capability(struct psmouse *psmouse)
                                priv->ext_cap &= 0xff0fff;
                }
        }
+        if (SYN_EXT_CAP_REQUESTS(priv->capabilities) >= 4) {
+                if (synaptics_send_cmd(psmouse, SYN_QUE_EXT_CAPAB_0C, cap)) {
+                        printk(KERN_ERR "Synaptics claims to have extended capability 0x0c,"
+                               " but I'm not able to read it.\n");
+                } else {
+                        priv->ext_cap_0c = (cap[0] << 16) | (cap[1] << 8) | cap[2];
+                }
+        }
        return 0;
 }
@@ -348,7 +359,15 @@ static void synaptics_parse_hw_state(unsigned char buf[], struct synaptics_data
                hw->left  = (buf[0] & 0x01) ? 1 : 0;
                hw->right = (buf[0] & 0x02) ? 1 : 0;
-                if (SYN_CAP_MIDDLE_BUTTON(priv->capabilities)) {
+                if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) {
+                        /*
+                         * Clickpad's button is transmitted as middle button,
+                         * however, since it is primary button, we will report
+                         * it as BTN_LEFT.
+                         */
+                        hw->left = ((buf[0] ^ buf[3]) & 0x01) ? 1 : 0;
+                } else if (SYN_CAP_MIDDLE_BUTTON(priv->capabilities)) {
                        hw->middle = ((buf[0] ^ buf[3]) & 0x01) ? 1 : 0;
                        if (hw->w == 2)
                                hw->scroll = (signed char)(buf[1]);
@@ -593,6 +612,12 @@ static void set_input_params(struct input_dev *dev, struct synaptics_data *priv)
        dev->absres[ABS_X] = priv->x_res;
        dev->absres[ABS_Y] = priv->y_res;
+        if (SYN_CAP_CLICKPAD(priv->ext_cap_0c)) {
+                /* Clickpads report only left button */
+                __clear_bit(BTN_RIGHT, dev->keybit);
+                __clear_bit(BTN_MIDDLE, dev->keybit);
+        }
 }
 static void synaptics_disconnect(struct psmouse *psmouse)
@@ -697,10 +722,10 @@ int synaptics_init(struct psmouse *psmouse)
        priv->pkt_type = SYN_MODEL_NEWABS(priv->model_id) ? SYN_NEWABS : SYN_OLDABS;
-        printk(KERN_INFO "Synaptics Touchpad, model: %ld, fw: %ld.%ld, id: %#lx, caps: %#lx/%#lx\n",
+        printk(KERN_INFO "Synaptics Touchpad, model: %ld, fw: %ld.%ld, id: %#lx, caps: %#lx/%#lx/%#lx\n",
                SYN_ID_MODEL(priv->identity),
                SYN_ID_MAJOR(priv->identity), SYN_ID_MINOR(priv->identity),
-                priv->model_id, priv->capabilities, priv->ext_cap);
+                priv->model_id, priv->capabilities, priv->ext_cap, priv->ext_cap_0c);
        set_input_params(psmouse->dev, priv);
diff --git a/drivers/input/mouse/synaptics.h b/drivers/input/mouse/synaptics.h
index f0f40a331dc8..ae37c5d162a4 100644
--- a/drivers/input/mouse/synaptics.h
+++ b/drivers/input/mouse/synaptics.h
@@ -18,6 +18,7 @@
 #define SYN_QUE_SERIAL_NUMBER_SUFFIX    0x07
 #define SYN_QUE_RESOLUTION              0x08
 #define SYN_QUE_EXT_CAPAB               0x09
+#define SYN_QUE_EXT_CAPAB_0C            0x0c
 /* synatics modes */
 #define SYN_BIT_ABSOLUTE_MODE           (1 << 7)
@@ -48,6 +49,8 @@
 #define SYN_CAP_VALID(c)                ((((c) & 0x00ff00) >> 8) == 0x47)
 #define SYN_EXT_CAP_REQUESTS(c)         (((c) & 0x700000) >> 20)
 #define SYN_CAP_MULTI_BUTTON_NO(ec)     (((ec) & 0x00f000) >> 12)
+#define SYN_CAP_PRODUCT_ID(ec)          (((ec) & 0xff0000) >> 16)
+#define SYN_CAP_CLICKPAD(ex0c)          ((ex0c) & 0x100100)
 /* synaptics modes query bits */
 #define SYN_MODE_ABSOLUTE(m)            ((m) & (1 << 7))
@@ -96,6 +99,7 @@ struct synaptics_data {
        unsigned long int model_id;             /* Model-ID */
        unsigned long int capabilities;         /* Capabilities */
        unsigned long int ext_cap;              /* Extended Capabilities */
+        unsigned long int ext_cap_0c;           /* Ext Caps from 0x0c query */
        unsigned long int identity;             /* Identification */
        int x_res;                              /* X resolution in units/mm */
        int y_res;                              /* Y resolution in units/mm */
diff --git a/drivers/input/touchscreen/eeti_ts.c b/drivers/input/touchscreen/eeti_ts.c
index 204b8a1a601c..75f8b73010fa 100644
--- a/drivers/input/touchscreen/eeti_ts.c
+++ b/drivers/input/touchscreen/eeti_ts.c
@@ -124,14 +124,25 @@ static irqreturn_t eeti_ts_isr(int irq, void *dev_id)
        return IRQ_HANDLED;
 }
-static int eeti_ts_open(struct input_dev *dev)
+static void eeti_ts_start(struct eeti_ts_priv *priv)
 {
-        struct eeti_ts_priv *priv = input_get_drvdata(dev);
        enable_irq(priv->irq);
        /* Read the events once to arm the IRQ */
        eeti_ts_read(&priv->work);
+}
+static void eeti_ts_stop(struct eeti_ts_priv *priv)
+{
+        disable_irq(priv->irq);
+        cancel_work_sync(&priv->work);
+}
+static int eeti_ts_open(struct input_dev *dev)
+{
+        struct eeti_ts_priv *priv = input_get_drvdata(dev);
+        eeti_ts_start(priv);
        return 0;
 }
@@ -140,8 +151,7 @@ static void eeti_ts_close(struct input_dev *dev)
 {
        struct eeti_ts_priv *priv = input_get_drvdata(dev);
-        disable_irq(priv->irq);
+        eeti_ts_stop(priv);
-        cancel_work_sync(&priv->work);
 }
 static int __devinit eeti_ts_probe(struct i2c_client *client,
@@ -153,10 +163,12 @@ static int __devinit eeti_ts_probe(struct i2c_client *client,
        unsigned int irq_flags;
        int err = -ENOMEM;
-        /* In contrast to what's described in the datasheet, there seems
+        /*
+         * In contrast to what's described in the datasheet, there seems
         * to be no way of probing the presence of that device using I2C
         * commands. So we need to blindly believe it is there, and wait
-         * for interrupts to occur. */
+         * for interrupts to occur.
+         */
        priv = kzalloc(sizeof(*priv), GFP_KERNEL);
        if (!priv) {
@@ -212,9 +224,11 @@ static int __devinit eeti_ts_probe(struct i2c_client *client,
                goto err2;
        }
-        /* Disable the irq for now. It will be enabled once the input device
+        /*
-         * is opened. */
+         * Disable the device for now. It will be enabled once the
-        disable_irq(priv->irq);
+         * input device is opened.
+         */
+        eeti_ts_stop(priv);
        device_init_wakeup(&client->dev, 0);
        return 0;
@@ -235,6 +249,12 @@ static int __devexit eeti_ts_remove(struct i2c_client *client)
        struct eeti_ts_priv *priv = i2c_get_clientdata(client);
        free_irq(priv->irq, priv);
+        /*
+         * eeti_ts_stop() leaves IRQ disabled. We need to re-enable it
+         * so that device still works if we reload the driver.
+         */
+        enable_irq(priv->irq);
        input_unregister_device(priv->input);
        i2c_set_clientdata(client, NULL);
        kfree(priv);
@@ -246,6 +266,14 @@ static int __devexit eeti_ts_remove(struct i2c_client *client)
 static int eeti_ts_suspend(struct i2c_client *client, pm_message_t mesg)
 {
        struct eeti_ts_priv *priv = i2c_get_clientdata(client);
+        struct input_dev *input_dev = priv->input;
+        mutex_lock(&input_dev->mutex);
+        if (input_dev->users)
+                eeti_ts_stop(priv);
+        mutex_unlock(&input_dev->mutex);
        if (device_may_wakeup(&client->dev))
                enable_irq_wake(priv->irq);
@@ -256,10 +284,18 @@ static int eeti_ts_suspend(struct i2c_client *client, pm_message_t mesg)
 static int eeti_ts_resume(struct i2c_client *client)
 {
        struct eeti_ts_priv *priv = i2c_get_clientdata(client);
+        struct input_dev *input_dev = priv->input;
        if (device_may_wakeup(&client->dev))
                disable_irq_wake(priv->irq);
+        mutex_lock(&input_dev->mutex);
+        if (input_dev->users)
+                eeti_ts_start(priv);
+        mutex_unlock(&input_dev->mutex);
        return 0;
 }
 #else
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index e3e9a36ea3b7..58ea0ecae7c3 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -1650,8 +1650,8 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
                                     int previous, int *dd_idx,
                                     struct stripe_head *sh)
 {
-        long stripe;
+        sector_t stripe, stripe2;
-        unsigned long chunk_number;
+        sector_t chunk_number;
        unsigned int chunk_offset;
        int pd_idx, qd_idx;
        int ddf_layout = 0;
@@ -1671,18 +1671,13 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
         */
        chunk_offset = sector_div(r_sector, sectors_per_chunk);
        chunk_number = r_sector;
-        BUG_ON(r_sector != chunk_number);
        /*
         * Compute the stripe number
         */
-        stripe = chunk_number / data_disks;
+        stripe = chunk_number;
+        *dd_idx = sector_div(stripe, data_disks);
-        /*
+        stripe2 = stripe;
-         * Compute the data disk and parity disk indexes inside the stripe
-         */
-        *dd_idx = chunk_number % data_disks;
        /*
         * Select the parity disk based on the user selected algorithm.
         */
@@ -1694,21 +1689,21 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
        case 5:
                switch (algorithm) {
                case ALGORITHM_LEFT_ASYMMETRIC:
-                        pd_idx = data_disks - stripe % raid_disks;
+                        pd_idx = data_disks - sector_div(stripe2, raid_disks);
                        if (*dd_idx >= pd_idx)
                                (*dd_idx)++;
                        break;
                case ALGORITHM_RIGHT_ASYMMETRIC:
-                        pd_idx = stripe % raid_disks;
+                        pd_idx = sector_div(stripe2, raid_disks);
                        if (*dd_idx >= pd_idx)
                                (*dd_idx)++;
                        break;
                case ALGORITHM_LEFT_SYMMETRIC:
-                        pd_idx = data_disks - stripe % raid_disks;
+                        pd_idx = data_disks - sector_div(stripe2, raid_disks);
                        *dd_idx = (pd_idx + 1 + *dd_idx) % raid_disks;
                        break;
                case ALGORITHM_RIGHT_SYMMETRIC:
-                        pd_idx = stripe % raid_disks;
+                        pd_idx = sector_div(stripe2, raid_disks);
                        *dd_idx = (pd_idx + 1 + *dd_idx) % raid_disks;
                        break;
                case ALGORITHM_PARITY_0:
@@ -1728,7 +1723,7 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
                switch (algorithm) {
                case ALGORITHM_LEFT_ASYMMETRIC:
-                        pd_idx = raid_disks - 1 - (stripe % raid_disks);
+                        pd_idx = raid_disks - 1 - sector_div(stripe2, raid_disks);
                        qd_idx = pd_idx + 1;
                        if (pd_idx == raid_disks-1) {
                                (*dd_idx)++;    /* Q D D D P */
@@ -1737,7 +1732,7 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
                                (*dd_idx) += 2; /* D D P Q D */
                        break;
                case ALGORITHM_RIGHT_ASYMMETRIC:
-                        pd_idx = stripe % raid_disks;
+                        pd_idx = sector_div(stripe2, raid_disks);
                        qd_idx = pd_idx + 1;
                        if (pd_idx == raid_disks-1) {
                                (*dd_idx)++;    /* Q D D D P */
@@ -1746,12 +1741,12 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
                                (*dd_idx) += 2; /* D D P Q D */
                        break;
                case ALGORITHM_LEFT_SYMMETRIC:
-                        pd_idx = raid_disks - 1 - (stripe % raid_disks);
+                        pd_idx = raid_disks - 1 - sector_div(stripe2, raid_disks);
                        qd_idx = (pd_idx + 1) % raid_disks;
                        *dd_idx = (pd_idx + 2 + *dd_idx) % raid_disks;
                        break;
                case ALGORITHM_RIGHT_SYMMETRIC:
-                        pd_idx = stripe % raid_disks;
+                        pd_idx = sector_div(stripe2, raid_disks);
                        qd_idx = (pd_idx + 1) % raid_disks;
                        *dd_idx = (pd_idx + 2 + *dd_idx) % raid_disks;
                        break;
@@ -1770,7 +1765,7 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
                        /* Exactly the same as RIGHT_ASYMMETRIC, but or
                         * of blocks for computing Q is different.
                         */
-                        pd_idx = stripe % raid_disks;
+                        pd_idx = sector_div(stripe2, raid_disks);
                        qd_idx = pd_idx + 1;
                        if (pd_idx == raid_disks-1) {
                                (*dd_idx)++;    /* Q D D D P */
@@ -1785,7 +1780,8 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
                         * D D D P Q  rather than
                         * Q D D D P
                         */
-                        pd_idx = raid_disks - 1 - ((stripe + 1) % raid_disks);
+                        stripe2 += 1;
+                        pd_idx = raid_disks - 1 - sector_div(stripe2, raid_disks);
                        qd_idx = pd_idx + 1;
                        if (pd_idx == raid_disks-1) {
                                (*dd_idx)++;    /* Q D D D P */
@@ -1797,7 +1793,7 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
                case ALGORITHM_ROTATING_N_CONTINUE:
                        /* Same as left_symmetric but Q is before P */
-                        pd_idx = raid_disks - 1 - (stripe % raid_disks);
+                        pd_idx = raid_disks - 1 - sector_div(stripe2, raid_disks);
                        qd_idx = (pd_idx + raid_disks - 1) % raid_disks;
                        *dd_idx = (pd_idx + 1 + *dd_idx) % raid_disks;
                        ddf_layout = 1;
@@ -1805,27 +1801,27 @@ static sector_t raid5_compute_sector(raid5_conf_t *conf, sector_t r_sector,
                case ALGORITHM_LEFT_ASYMMETRIC_6:
                        /* RAID5 left_asymmetric, with Q on last device */
-                        pd_idx = data_disks - stripe % (raid_disks-1);
+                        pd_idx = data_disks - sector_div(stripe2, raid_disks-1);
                        if (*dd_idx >= pd_idx)
                                (*dd_idx)++;
                        qd_idx = raid_disks - 1;
                        break;
                case ALGORITHM_RIGHT_ASYMMETRIC_6:
-                        pd_idx = stripe % (raid_disks-1);
+                        pd_idx = sector_div(stripe2, raid_disks-1);
                        if (*dd_idx >= pd_idx)
                                (*dd_idx)++;
                        qd_idx = raid_disks - 1;
                        break;
                case ALGORITHM_LEFT_SYMMETRIC_6:
-                        pd_idx = data_disks - stripe % (raid_disks-1);
+                        pd_idx = data_disks - sector_div(stripe2, raid_disks-1);
                        *dd_idx = (pd_idx + 1 + *dd_idx) % (raid_disks-1);
                        qd_idx = raid_disks - 1;
                        break;
                case ALGORITHM_RIGHT_SYMMETRIC_6:
-                        pd_idx = stripe % (raid_disks-1);
+                        pd_idx = sector_div(stripe2, raid_disks-1);
                        *dd_idx = (pd_idx + 1 + *dd_idx) % (raid_disks-1);
                        qd_idx = raid_disks - 1;
                        break;
@@ -1870,14 +1866,14 @@ static sector_t compute_blocknr(struct stripe_head *sh, int i, int previous)
                                 : conf->algorithm;
        sector_t stripe;
        int chunk_offset;
-        int chunk_number, dummy1, dd_idx = i;
+        sector_t chunk_number;
+        int dummy1, dd_idx = i;
        sector_t r_sector;
        struct stripe_head sh2;
        chunk_offset = sector_div(new_sector, sectors_per_chunk);
        stripe = new_sector;
-        BUG_ON(new_sector != stripe);
        if (i == sh->pd_idx)
                return 0;
@@ -1970,7 +1966,7 @@ static sector_t compute_blocknr(struct stripe_head *sh, int i, int previous)
        }
        chunk_number = stripe * data_disks + i;
-        r_sector = (sector_t)chunk_number * sectors_per_chunk + chunk_offset;
+        r_sector = chunk_number * sectors_per_chunk + chunk_offset;
        check = raid5_compute_sector(conf, r_sector,
                                     previous, &dummy1, &sh2);
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 2191c8d896a0..0d0d625fece2 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -311,6 +311,22 @@ config TI_DAC7512
          This driver can also be built as a module. If so, the module
          will be calles ti_dac7512.
+config VMWARE_BALLOON
+        tristate "VMware Balloon Driver"
+        depends on X86
+        help
+          This is VMware physical memory management driver which acts
+          like a "balloon" that can be inflated to reclaim physical pages
+          by reserving them in the guest and invalidating them in the
+          monitor, freeing up the underlying machine pages so they can
+          be allocated to other guests. The balloon can also be deflated
+          to allow the guest to use more physical memory.
+          If unsure, say N.
+          To compile this driver as a module, choose M here: the
+          module will be called vmware_balloon.
 source "drivers/misc/c2port/Kconfig"
 source "drivers/misc/eeprom/Kconfig"
 source "drivers/misc/cb710/Kconfig"
diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index 27c484355414..7b6f7eefdf8d 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -29,3 +29,4 @@ obj-$(CONFIG_C2PORT)		+= c2port/
 obj-$(CONFIG_IWMC3200TOP)      += iwmc3200top/
 obj-y                           += eeprom/
 obj-y                           += cb710/
+obj-$(CONFIG_VMWARE_BALLOON)    += vmware_balloon.o
diff --git a/drivers/misc/vmware_balloon.c b/drivers/misc/vmware_balloon.c
new file mode 100644
index 000000000000..e7161c4e3798
--- /dev/null
+++ b/drivers/misc/vmware_balloon.c
@@ -0,0 +1,832 @@
+/*
+ * VMware Balloon driver.
+ *
+ * Copyright (C) 2000-2010, VMware, Inc. All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License and no later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ * NON INFRINGEMENT.  See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * Maintained by: Dmitry Torokhov <dtor@vmware.com>
+ */
+/*
+ * This is VMware physical memory management driver for Linux. The driver
+ * acts like a "balloon" that can be inflated to reclaim physical pages by
+ * reserving them in the guest and invalidating them in the monitor,
+ * freeing up the underlying machine pages so they can be allocated to
+ * other guests.  The balloon can also be deflated to allow the guest to
+ * use more physical memory. Higher level policies can control the sizes
+ * of balloons in VMs in order to manage physical memory resources.
+ */
+//#define DEBUG
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/mm.h>
+#include <linux/sched.h>
+#include <linux/module.h>
+#include <linux/workqueue.h>
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
+#include <asm/vmware.h>
+MODULE_AUTHOR("VMware, Inc.");
+MODULE_DESCRIPTION("VMware Memory Control (Balloon) Driver");
+MODULE_VERSION("1.2.1.0-K");
+MODULE_ALIAS("dmi:*:svnVMware*:*");
+MODULE_ALIAS("vmware_vmmemctl");
+MODULE_LICENSE("GPL");
+/*
+ * Various constants controlling rate of inflaint/deflating balloon,
+ * measured in pages.
+ */
+/*
+ * Rate of allocating memory when there is no memory pressure
+ * (driver performs non-sleeping allocations).
+ */
+#define VMW_BALLOON_NOSLEEP_ALLOC_MAX   16384U
+/*
+ * Rates of memory allocaton when guest experiences memory pressure
+ * (driver performs sleeping allocations).
+ */
+#define VMW_BALLOON_RATE_ALLOC_MIN      512U
+#define VMW_BALLOON_RATE_ALLOC_MAX      2048U
+#define VMW_BALLOON_RATE_ALLOC_INC      16U
+/*
+ * Rates for releasing pages while deflating balloon.
+ */
+#define VMW_BALLOON_RATE_FREE_MIN       512U
+#define VMW_BALLOON_RATE_FREE_MAX       16384U
+#define VMW_BALLOON_RATE_FREE_INC       16U
+/*
+ * When guest is under memory pressure, use a reduced page allocation
+ * rate for next several cycles.
+ */
+#define VMW_BALLOON_SLOW_CYCLES         4
+/*
+ * Use __GFP_HIGHMEM to allow pages from HIGHMEM zone. We don't
+ * allow wait (__GFP_WAIT) for NOSLEEP page allocations. Use
+ * __GFP_NOWARN, to suppress page allocation failure warnings.
+ */
+#define VMW_PAGE_ALLOC_NOSLEEP          (__GFP_HIGHMEM|__GFP_NOWARN)
+/*
+ * Use GFP_HIGHUSER when executing in a separate kernel thread
+ * context and allocation can sleep.  This is less stressful to
+ * the guest memory system, since it allows the thread to block
+ * while memory is reclaimed, and won't take pages from emergency
+ * low-memory pools.
+ */
+#define VMW_PAGE_ALLOC_CANSLEEP         (GFP_HIGHUSER)
+/* Maximum number of page allocations without yielding processor */
+#define VMW_BALLOON_YIELD_THRESHOLD     1024
+/*
+ * Hypervisor communication port definitions.
+ */
+#define VMW_BALLOON_HV_PORT             0x5670
+#define VMW_BALLOON_HV_MAGIC            0x456c6d6f
+#define VMW_BALLOON_PROTOCOL_VERSION    2
+#define VMW_BALLOON_GUEST_ID            1       /* Linux */
+#define VMW_BALLOON_CMD_START           0
+#define VMW_BALLOON_CMD_GET_TARGET      1
+#define VMW_BALLOON_CMD_LOCK            2
+#define VMW_BALLOON_CMD_UNLOCK          3
+#define VMW_BALLOON_CMD_GUEST_ID        4
+/* error codes */
+#define VMW_BALLOON_SUCCESS             0
+#define VMW_BALLOON_FAILURE             -1
+#define VMW_BALLOON_ERROR_CMD_INVALID   1
+#define VMW_BALLOON_ERROR_PPN_INVALID   2
+#define VMW_BALLOON_ERROR_PPN_LOCKED    3
+#define VMW_BALLOON_ERROR_PPN_UNLOCKED  4
+#define VMW_BALLOON_ERROR_PPN_PINNED    5
+#define VMW_BALLOON_ERROR_PPN_NOTNEEDED 6
+#define VMW_BALLOON_ERROR_RESET         7
+#define VMW_BALLOON_ERROR_BUSY          8
+#define VMWARE_BALLOON_CMD(cmd, data, result)           \
+({                                                      \
+        unsigned long __stat, __dummy1, __dummy2;       \
+        __asm__ __volatile__ ("inl (%%dx)" :            \
+                "=a"(__stat),                           \
+                "=c"(__dummy1),                         \
+                "=d"(__dummy2),                         \
+                "=b"(result) :                          \
+                "0"(VMW_BALLOON_HV_MAGIC),              \
+                "1"(VMW_BALLOON_CMD_##cmd),             \
+                "2"(VMW_BALLOON_HV_PORT),               \
+                "3"(data) :                             \
+                "memory");                              \
+        result &= -1UL;                                 \
+        __stat & -1UL;                                  \
+})
+#ifdef CONFIG_DEBUG_FS
+struct vmballoon_stats {
+        unsigned int timer;
+        /* allocation statustics */
+        unsigned int alloc;
+        unsigned int alloc_fail;
+        unsigned int sleep_alloc;
+        unsigned int sleep_alloc_fail;
+        unsigned int refused_alloc;
+        unsigned int refused_free;
+        unsigned int free;
+        /* monitor operations */
+        unsigned int lock;
+        unsigned int lock_fail;
+        unsigned int unlock;
+        unsigned int unlock_fail;
+        unsigned int target;
+        unsigned int target_fail;
+        unsigned int start;
+        unsigned int start_fail;
+        unsigned int guest_type;
+        unsigned int guest_type_fail;
+};
+#define STATS_INC(stat) (stat)++
+#else
+#define STATS_INC(stat)
+#endif
+struct vmballoon {
+        /* list of reserved physical pages */
+        struct list_head pages;
+        /* transient list of non-balloonable pages */
+        struct list_head refused_pages;
+        /* balloon size in pages */
+        unsigned int size;
+        unsigned int target;
+        /* reset flag */
+        bool reset_required;
+        /* adjustment rates (pages per second) */
+        unsigned int rate_alloc;
+        unsigned int rate_free;
+        /* slowdown page allocations for next few cycles */
+        unsigned int slow_allocation_cycles;
+#ifdef CONFIG_DEBUG_FS
+        /* statistics */
+        struct vmballoon_stats stats;
+        /* debugfs file exporting statistics */
+        struct dentry *dbg_entry;
+#endif
+        struct sysinfo sysinfo;
+        struct delayed_work dwork;
+};
+static struct vmballoon balloon;
+static struct workqueue_struct *vmballoon_wq;
+/*
+ * Send "start" command to the host, communicating supported version
+ * of the protocol.
+ */
+static bool vmballoon_send_start(struct vmballoon *b)
+{
+        unsigned long status, dummy;
+        STATS_INC(b->stats.start);
+        status = VMWARE_BALLOON_CMD(START, VMW_BALLOON_PROTOCOL_VERSION, dummy);
+        if (status == VMW_BALLOON_SUCCESS)
+                return true;
+        pr_debug("%s - failed, hv returns %ld\n", __func__, status);
+        STATS_INC(b->stats.start_fail);
+        return false;
+}
+static bool vmballoon_check_status(struct vmballoon *b, unsigned long status)
+{
+        switch (status) {
+        case VMW_BALLOON_SUCCESS:
+                return true;
+        case VMW_BALLOON_ERROR_RESET:
+                b->reset_required = true;
+                /* fall through */
+        default:
+                return false;
+        }
+}
+/*
+ * Communicate guest type to the host so that it can adjust ballooning
+ * algorithm to the one most appropriate for the guest. This command
+ * is normally issued after sending "start" command and is part of
+ * standard reset sequence.
+ */
+static bool vmballoon_send_guest_id(struct vmballoon *b)
+{
+        unsigned long status, dummy;
+        status = VMWARE_BALLOON_CMD(GUEST_ID, VMW_BALLOON_GUEST_ID, dummy);
+        STATS_INC(b->stats.guest_type);
+        if (vmballoon_check_status(b, status))
+                return true;
+        pr_debug("%s - failed, hv returns %ld\n", __func__, status);
+        STATS_INC(b->stats.guest_type_fail);
+        return false;
+}
+/*
+ * Retrieve desired balloon size from the host.
+ */
+static bool vmballoon_send_get_target(struct vmballoon *b, u32 *new_target)
+{
+        unsigned long status;
+        unsigned long target;
+        unsigned long limit;
+        u32 limit32;
+        /*
+         * si_meminfo() is cheap. Moreover, we want to provide dynamic
+         * max balloon size later. So let us call si_meminfo() every
+         * iteration.
+         */
+        si_meminfo(&b->sysinfo);
+        limit = b->sysinfo.totalram;
+        /* Ensure limit fits in 32-bits */
+        limit32 = (u32)limit;
+        if (limit != limit32)
+                return false;
+        /* update stats */
+        STATS_INC(b->stats.target);
+        status = VMWARE_BALLOON_CMD(GET_TARGET, limit, target);
+        if (vmballoon_check_status(b, status)) {
+                *new_target = target;
+                return true;
+        }
+        pr_debug("%s - failed, hv returns %ld\n", __func__, status);
+        STATS_INC(b->stats.target_fail);
+        return false;
+}
+/*
+ * Notify the host about allocated page so that host can use it without
+ * fear that guest will need it. Host may reject some pages, we need to
+ * check the return value and maybe submit a different page.
+ */
+static bool vmballoon_send_lock_page(struct vmballoon *b, unsigned long pfn)
+{
+        unsigned long status, dummy;
+        u32 pfn32;
+        pfn32 = (u32)pfn;
+        if (pfn32 != pfn)
+                return false;
+        STATS_INC(b->stats.lock);
+        status = VMWARE_BALLOON_CMD(LOCK, pfn, dummy);
+        if (vmballoon_check_status(b, status))
+                return true;
+        pr_debug("%s - ppn %lx, hv returns %ld\n", __func__, pfn, status);
+        STATS_INC(b->stats.lock_fail);
+        return false;
+}
+/*
+ * Notify the host that guest intends to release given page back into
+ * the pool of available (to the guest) pages.
+ */
+static bool vmballoon_send_unlock_page(struct vmballoon *b, unsigned long pfn)
+{
+        unsigned long status, dummy;
+        u32 pfn32;
+        pfn32 = (u32)pfn;
+        if (pfn32 != pfn)
+                return false;
+        STATS_INC(b->stats.unlock);
+        status = VMWARE_BALLOON_CMD(UNLOCK, pfn, dummy);
+        if (vmballoon_check_status(b, status))
+                return true;
+        pr_debug("%s - ppn %lx, hv returns %ld\n", __func__, pfn, status);
+        STATS_INC(b->stats.unlock_fail);
+        return false;
+}
+/*
+ * Quickly release all pages allocated for the balloon. This function is
+ * called when host decides to "reset" balloon for one reason or another.
+ * Unlike normal "deflate" we do not (shall not) notify host of the pages
+ * being released.
+ */
+static void vmballoon_pop(struct vmballoon *b)
+{
+        struct page *page, *next;
+        unsigned int count = 0;
+        list_for_each_entry_safe(page, next, &b->pages, lru) {
+                list_del(&page->lru);
+                __free_page(page);
+                STATS_INC(b->stats.free);
+                b->size--;
+                if (++count >= b->rate_free) {
+                        count = 0;
+                        cond_resched();
+                }
+        }
+}
+/*
+ * Perform standard reset sequence by popping the balloon (in case it
+ * is not  empty) and then restarting protocol. This operation normally
+ * happens when host responds with VMW_BALLOON_ERROR_RESET to a command.
+ */
+static void vmballoon_reset(struct vmballoon *b)
+{
+        /* free all pages, skipping monitor unlock */
+        vmballoon_pop(b);
+        if (vmballoon_send_start(b)) {
+                b->reset_required = false;
+                if (!vmballoon_send_guest_id(b))
+                        pr_err("failed to send guest ID to the host\n");
+        }
+}
+/*
+ * Allocate (or reserve) a page for the balloon and notify the host.  If host
+ * refuses the page put it on "refuse" list and allocate another one until host
+ * is satisfied. "Refused" pages are released at the end of inflation cycle
+ * (when we allocate b->rate_alloc pages).
+ */
+static int vmballoon_reserve_page(struct vmballoon *b, bool can_sleep)
+{
+        struct page *page;
+        gfp_t flags;
+        bool locked = false;
+        do {
+                if (!can_sleep)
+                        STATS_INC(b->stats.alloc);
+                else
+                        STATS_INC(b->stats.sleep_alloc);
+                flags = can_sleep ? VMW_PAGE_ALLOC_CANSLEEP : VMW_PAGE_ALLOC_NOSLEEP;
+                page = alloc_page(flags);
+                if (!page) {
+                        if (!can_sleep)
+                                STATS_INC(b->stats.alloc_fail);
+                        else
+                                STATS_INC(b->stats.sleep_alloc_fail);
+                        return -ENOMEM;
+                }
+                /* inform monitor */
+                locked = vmballoon_send_lock_page(b, page_to_pfn(page));
+                if (!locked) {
+                        if (b->reset_required) {
+                                __free_page(page);
+                                return -EIO;
+                        }
+                        /* place on list of non-balloonable pages, retry allocation */
+                        list_add(&page->lru, &b->refused_pages);
+                        STATS_INC(b->stats.refused_alloc);
+                }
+        } while (!locked);
+        /* track allocated page */
+        list_add(&page->lru, &b->pages);
+        /* update balloon size */
+        b->size++;
+        return 0;
+}
+/*
+ * Release the page allocated for the balloon. Note that we first notify
+ * the host so it can make sure the page will be available for the guest
+ * to use, if needed.
+ */
+static int vmballoon_release_page(struct vmballoon *b, struct page *page)
+{
+        if (!vmballoon_send_unlock_page(b, page_to_pfn(page)))
+                return -EIO;
+        list_del(&page->lru);
+        /* deallocate page */
+        __free_page(page);
+        STATS_INC(b->stats.free);
+        /* update balloon size */
+        b->size--;
+        return 0;
+}
+/*
+ * Release pages that were allocated while attempting to inflate the
+ * balloon but were refused by the host for one reason or another.
+ */
+static void vmballoon_release_refused_pages(struct vmballoon *b)
+{
+        struct page *page, *next;
+        list_for_each_entry_safe(page, next, &b->refused_pages, lru) {
+                list_del(&page->lru);
+                __free_page(page);
+                STATS_INC(b->stats.refused_free);
+        }
+}
+/*
+ * Inflate the balloon towards its target size. Note that we try to limit
+ * the rate of allocation to make sure we are not choking the rest of the
+ * system.
+ */
+static void vmballoon_inflate(struct vmballoon *b)
+{
+        unsigned int goal;
+        unsigned int rate;
+        unsigned int i;
+        unsigned int allocations = 0;
+        int error = 0;
+        bool alloc_can_sleep = false;
+        pr_debug("%s - size: %d, target %d\n", __func__, b->size, b->target);
+        /*
+         * First try NOSLEEP page allocations to inflate balloon.
+         *
+         * If we do not throttle nosleep allocations, we can drain all
+         * free pages in the guest quickly (if the balloon target is high).
+         * As a side-effect, draining free pages helps to inform (force)
+         * the guest to start swapping if balloon target is not met yet,
+         * which is a desired behavior. However, balloon driver can consume
+         * all available CPU cycles if too many pages are allocated in a
+         * second. Therefore, we throttle nosleep allocations even when
+         * the guest is not under memory pressure. OTOH, if we have already
+         * predicted that the guest is under memory pressure, then we
+         * slowdown page allocations considerably.
+         */
+        goal = b->target - b->size;
+        /*
+         * Start with no sleep allocation rate which may be higher
+         * than sleeping allocation rate.
+         */
+        rate = b->slow_allocation_cycles ?
+                        b->rate_alloc : VMW_BALLOON_NOSLEEP_ALLOC_MAX;
+        pr_debug("%s - goal: %d, no-sleep rate: %d, sleep rate: %d\n",
+                 __func__, goal, rate, b->rate_alloc);
+        for (i = 0; i < goal; i++) {
+                error = vmballoon_reserve_page(b, alloc_can_sleep);
+                if (error) {
+                        if (error != -ENOMEM) {
+                                /*
+                                 * Not a page allocation failure, stop this
+                                 * cycle. Maybe we'll get new target from
+                                 * the host soon.
+                                 */
+                                break;
+                        }
+                        if (alloc_can_sleep) {
+                                /*
+                                 * CANSLEEP page allocation failed, so guest
+                                 * is under severe memory pressure. Quickly
+                                 * decrease allocation rate.
+                                 */
+                                b->rate_alloc = max(b->rate_alloc / 2,
+                                                    VMW_BALLOON_RATE_ALLOC_MIN);
+                                break;
+                        }
+                        /*
+                         * NOSLEEP page allocation failed, so the guest is
+                         * under memory pressure. Let us slow down page
+                         * allocations for next few cycles so that the guest
+                         * gets out of memory pressure. Also, if we already
+                         * allocated b->rate_alloc pages, let's pause,
+                         * otherwise switch to sleeping allocations.
+                         */
+                        b->slow_allocation_cycles = VMW_BALLOON_SLOW_CYCLES;
+                        if (i >= b->rate_alloc)
+                                break;
+                        alloc_can_sleep = true;
+                        /* Lower rate for sleeping allocations. */
+                        rate = b->rate_alloc;
+                }
+                if (++allocations > VMW_BALLOON_YIELD_THRESHOLD) {
+                        cond_resched();
+                        allocations = 0;
+                }
+                if (i >= rate) {
+                        /* We allocated enough pages, let's take a break. */
+                        break;
+                }
+        }
+        /*
+         * We reached our goal without failures so try increasing
+         * allocation rate.
+         */
+        if (error == 0 && i >= b->rate_alloc) {
+                unsigned int mult = i / b->rate_alloc;
+                b->rate_alloc =
+                        min(b->rate_alloc + mult * VMW_BALLOON_RATE_ALLOC_INC,
+                            VMW_BALLOON_RATE_ALLOC_MAX);
+        }
+        vmballoon_release_refused_pages(b);
+}
+/*
+ * Decrease the size of the balloon allowing guest to use more memory.
+ */
+static void vmballoon_deflate(struct vmballoon *b)
+{
+        struct page *page, *next;
+        unsigned int i = 0;
+        unsigned int goal;
+        int error;
+        pr_debug("%s - size: %d, target %d\n", __func__, b->size, b->target);
+        /* limit deallocation rate */
+        goal = min(b->size - b->target, b->rate_free);
+        pr_debug("%s - goal: %d, rate: %d\n", __func__, goal, b->rate_free);
+        /* free pages to reach target */
+        list_for_each_entry_safe(page, next, &b->pages, lru) {
+                error = vmballoon_release_page(b, page);
+                if (error) {
+                        /* quickly decrease rate in case of error */
+                        b->rate_free = max(b->rate_free / 2,
+                                           VMW_BALLOON_RATE_FREE_MIN);
+                        return;
+                }
+                if (++i >= goal)
+                        break;
+        }
+        /* slowly increase rate if there were no errors */
+        b->rate_free = min(b->rate_free + VMW_BALLOON_RATE_FREE_INC,
+                           VMW_BALLOON_RATE_FREE_MAX);
+}
+/*
+ * Balloon work function: reset protocol, if needed, get the new size and
+ * adjust balloon as needed. Repeat in 1 sec.
+ */
+static void vmballoon_work(struct work_struct *work)
+{
+        struct delayed_work *dwork = to_delayed_work(work);
+        struct vmballoon *b = container_of(dwork, struct vmballoon, dwork);
+        unsigned int target;
+        STATS_INC(b->stats.timer);
+        if (b->reset_required)
+                vmballoon_reset(b);
+        if (b->slow_allocation_cycles > 0)
+                b->slow_allocation_cycles--;
+        if (vmballoon_send_get_target(b, &target)) {
+                /* update target, adjust size */
+                b->target = target;
+                if (b->size < target)
+                        vmballoon_inflate(b);
+                else if (b->size > target)
+                        vmballoon_deflate(b);
+        }
+        queue_delayed_work(vmballoon_wq, dwork, round_jiffies_relative(HZ));
+}
+/*
+ * DEBUGFS Interface
+ */
+#ifdef CONFIG_DEBUG_FS
+static int vmballoon_debug_show(struct seq_file *f, void *offset)
+{
+        struct vmballoon *b = f->private;
+        struct vmballoon_stats *stats = &b->stats;
+        /* format size info */
+        seq_printf(f,
+                   "target:             %8d pages\n"
+                   "current:            %8d pages\n",
+                   b->target, b->size);
+        /* format rate info */
+        seq_printf(f,
+                   "rateNoSleepAlloc:   %8d pages/sec\n"
+                   "rateSleepAlloc:     %8d pages/sec\n"
+                   "rateFree:           %8d pages/sec\n",
+                   VMW_BALLOON_NOSLEEP_ALLOC_MAX,
+                   b->rate_alloc, b->rate_free);
+        seq_printf(f,
+                   "\n"
+                   "timer:              %8u\n"
+                   "start:              %8u (%4u failed)\n"
+                   "guestType:          %8u (%4u failed)\n"
+                   "lock:               %8u (%4u failed)\n"
+                   "unlock:             %8u (%4u failed)\n"
+                   "target:             %8u (%4u failed)\n"
+                   "primNoSleepAlloc:   %8u (%4u failed)\n"
+                   "primCanSleepAlloc:  %8u (%4u failed)\n"
+                   "primFree:           %8u\n"
+                   "errAlloc:           %8u\n"
+                   "errFree:            %8u\n",
+                   stats->timer,
+                   stats->start, stats->start_fail,
+                   stats->guest_type, stats->guest_type_fail,
+                   stats->lock,  stats->lock_fail,
+                   stats->unlock, stats->unlock_fail,
+                   stats->target, stats->target_fail,
+                   stats->alloc, stats->alloc_fail,
+                   stats->sleep_alloc, stats->sleep_alloc_fail,
+                   stats->free,
+                   stats->refused_alloc, stats->refused_free);
+        return 0;
+}
+static int vmballoon_debug_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, vmballoon_debug_show, inode->i_private);
+}
+static const struct file_operations vmballoon_debug_fops = {
+        .owner          = THIS_MODULE,
+        .open           = vmballoon_debug_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
+static int __init vmballoon_debugfs_init(struct vmballoon *b)
+{
+        int error;
+        b->dbg_entry = debugfs_create_file("vmmemctl", S_IRUGO, NULL, b,
+                                           &vmballoon_debug_fops);
+        if (IS_ERR(b->dbg_entry)) {
+                error = PTR_ERR(b->dbg_entry);
+                pr_err("failed to create debugfs entry, error: %d\n", error);
+                return error;
+        }
+        return 0;
+}
+static void __exit vmballoon_debugfs_exit(struct vmballoon *b)
+{
+        debugfs_remove(b->dbg_entry);
+}
+#else
+static inline int vmballoon_debugfs_init(struct vmballoon *b)
+{
+        return 0;
+}
+static inline void vmballoon_debugfs_exit(struct vmballoon *b)
+{
+}
+#endif  /* CONFIG_DEBUG_FS */
+static int __init vmballoon_init(void)
+{
+        int error;
+        /*
+         * Check if we are running on VMware's hypervisor and bail out
+         * if we are not.
+         */
+        if (!vmware_platform())
+                return -ENODEV;
+        vmballoon_wq = create_freezeable_workqueue("vmmemctl");
+        if (!vmballoon_wq) {
+                pr_err("failed to create workqueue\n");
+                return -ENOMEM;
+        }
+        INIT_LIST_HEAD(&balloon.pages);
+        INIT_LIST_HEAD(&balloon.refused_pages);
+        /* initialize rates */
+        balloon.rate_alloc = VMW_BALLOON_RATE_ALLOC_MAX;
+        balloon.rate_free = VMW_BALLOON_RATE_FREE_MAX;
+        INIT_DELAYED_WORK(&balloon.dwork, vmballoon_work);
+        /*
+         * Start balloon.
+         */
+        if (!vmballoon_send_start(&balloon)) {
+                pr_err("failed to send start command to the host\n");
+                error = -EIO;
+                goto fail;
+        }
+        if (!vmballoon_send_guest_id(&balloon)) {
+                pr_err("failed to send guest ID to the host\n");
+                error = -EIO;
+                goto fail;
+        }
+        error = vmballoon_debugfs_init(&balloon);
+        if (error)
+                goto fail;
+        queue_delayed_work(vmballoon_wq, &balloon.dwork, 0);
+        return 0;
+fail:
+        destroy_workqueue(vmballoon_wq);
+        return error;
+}
+module_init(vmballoon_init);
+static void __exit vmballoon_exit(void)
+{
+        cancel_delayed_work_sync(&balloon.dwork);
+        destroy_workqueue(vmballoon_wq);
+        vmballoon_debugfs_exit(&balloon);
+        /*
+         * Deallocate all reserved memory, and reset connection with monitor.
+         * Reset connection before deallocating memory to avoid potential for
+         * additional spurious resets from guest touching deallocated pages.
+         */
+        vmballoon_send_start(&balloon);
+        vmballoon_pop(&balloon);
+}
+module_exit(vmballoon_exit);
diff --git a/drivers/mtd/Makefile b/drivers/mtd/Makefile
index 82d1e4de475b..4521b1ecce45 100644
--- a/drivers/mtd/Makefile
+++ b/drivers/mtd/Makefile
@@ -4,7 +4,7 @@
 # Core functionality.
 obj-$(CONFIG_MTD)               += mtd.o
-mtd-y                           := mtdcore.o mtdsuper.o mtdbdi.o
+mtd-y                           := mtdcore.o mtdsuper.o
 mtd-$(CONFIG_MTD_PARTITIONS)    += mtdpart.o
 obj-$(CONFIG_MTD_CONCAT)        += mtdconcat.o
diff --git a/drivers/mtd/internal.h b/drivers/mtd/internal.h
deleted file mode 100644
index c658fe7216b5..000000000000
--- a/drivers/mtd/internal.h
+++ /dev/null
@@ -1,17 +0,0 @@
-/* Internal MTD definitions
- *
- * Copyright © 2006 Red Hat, Inc. All Rights Reserved.
- * Written by David Howells (dhowells@redhat.com)
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version
- * 2 of the License, or (at your option) any later version.
- */
-/*
- * mtdbdi.c
- */
-extern struct backing_dev_info mtd_bdi_unmappable;
-extern struct backing_dev_info mtd_bdi_ro_mappable;
-extern struct backing_dev_info mtd_bdi_rw_mappable;
diff --git a/drivers/mtd/mtdbdi.c b/drivers/mtd/mtdbdi.c
deleted file mode 100644
index 5ca5aed0b225..000000000000
--- a/drivers/mtd/mtdbdi.c
+++ /dev/null
@@ -1,43 +0,0 @@
-/* MTD backing device capabilities
- *
- * Copyright © 2006 Red Hat, Inc. All Rights Reserved.
- * Written by David Howells (dhowells@redhat.com)
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of the GNU General Public License
- * as published by the Free Software Foundation; either version
- * 2 of the License, or (at your option) any later version.
- */
-#include <linux/backing-dev.h>
-#include <linux/mtd/mtd.h>
-#include "internal.h"
-/*
- * backing device capabilities for non-mappable devices (such as NAND flash)
- * - permits private mappings, copies are taken of the data
- */
-struct backing_dev_info mtd_bdi_unmappable = {
-        .capabilities   = BDI_CAP_MAP_COPY,
-};
-/*
- * backing device capabilities for R/O mappable devices (such as ROM)
- * - permits private mappings, copies are taken of the data
- * - permits non-writable shared mappings
- */
-struct backing_dev_info mtd_bdi_ro_mappable = {
-        .capabilities   = (BDI_CAP_MAP_COPY | BDI_CAP_MAP_DIRECT |
-                           BDI_CAP_EXEC_MAP | BDI_CAP_READ_MAP),
-};
-/*
- * backing device capabilities for writable mappable devices (such as RAM)
- * - permits private mappings, copies are taken of the data
- * - permits non-writable shared mappings
- */
-struct backing_dev_info mtd_bdi_rw_mappable = {
-        .capabilities   = (BDI_CAP_MAP_COPY | BDI_CAP_MAP_DIRECT |
-                           BDI_CAP_EXEC_MAP | BDI_CAP_READ_MAP |
-                           BDI_CAP_WRITE_MAP),
-};
diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index 5b38b17d2229..b177e750efc3 100644
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -2,6 +2,9 @@
 * Core registration and callback routines for MTD
 * drivers and users.
 *
+ * bdi bits are:
+ * Copyright © 2006 Red Hat, Inc. All Rights Reserved.
+ * Written by David Howells (dhowells@redhat.com)
 */
 #include <linux/module.h>
@@ -16,11 +19,39 @@
 #include <linux/init.h>
 #include <linux/mtd/compatmac.h>
 #include <linux/proc_fs.h>
+#include <linux/backing-dev.h>
 #include <linux/mtd/mtd.h>
-#include "internal.h"
 #include "mtdcore.h"
+/*
+ * backing device capabilities for non-mappable devices (such as NAND flash)
+ * - permits private mappings, copies are taken of the data
+ */
+struct backing_dev_info mtd_bdi_unmappable = {
+        .capabilities   = BDI_CAP_MAP_COPY,
+};
+/*
+ * backing device capabilities for R/O mappable devices (such as ROM)
+ * - permits private mappings, copies are taken of the data
+ * - permits non-writable shared mappings
+ */
+struct backing_dev_info mtd_bdi_ro_mappable = {
+        .capabilities   = (BDI_CAP_MAP_COPY | BDI_CAP_MAP_DIRECT |
+                           BDI_CAP_EXEC_MAP | BDI_CAP_READ_MAP),
+};
+/*
+ * backing device capabilities for writable mappable devices (such as RAM)
+ * - permits private mappings, copies are taken of the data
+ * - permits non-writable shared mappings
+ */
+struct backing_dev_info mtd_bdi_rw_mappable = {
+        .capabilities   = (BDI_CAP_MAP_COPY | BDI_CAP_MAP_DIRECT |
+                           BDI_CAP_EXEC_MAP | BDI_CAP_READ_MAP |
+                           BDI_CAP_WRITE_MAP),
+};
 static int mtd_cls_suspend(struct device *dev, pm_message_t state);
 static int mtd_cls_resume(struct device *dev);
@@ -628,20 +659,55 @@ done:
 /*====================================================================*/
 /* Init code */
+static int __init mtd_bdi_init(struct backing_dev_info *bdi, const char *name)
+{
+        int ret;
+        ret = bdi_init(bdi);
+        if (!ret)
+                ret = bdi_register(bdi, NULL, name);
+        if (ret)
+                bdi_destroy(bdi);
+        return ret;
+}
 static int __init init_mtd(void)
 {
        int ret;
        ret = class_register(&mtd_class);
+        if (ret)
+                goto err_reg;
+        ret = mtd_bdi_init(&mtd_bdi_unmappable, "mtd-unmap");
+        if (ret)
+                goto err_bdi1;
+        ret = mtd_bdi_init(&mtd_bdi_ro_mappable, "mtd-romap");
+        if (ret)
+                goto err_bdi2;
+        ret = mtd_bdi_init(&mtd_bdi_rw_mappable, "mtd-rwmap");
+        if (ret)
+                goto err_bdi3;
-        if (ret) {
-                pr_err("Error registering mtd class: %d\n", ret);
-                return ret;
-        }
 #ifdef CONFIG_PROC_FS
        if ((proc_mtd = create_proc_entry( "mtd", 0, NULL )))
                proc_mtd->read_proc = mtd_read_proc;
 #endif /* CONFIG_PROC_FS */
        return 0;
+err_bdi3:
+        bdi_destroy(&mtd_bdi_ro_mappable);
+err_bdi2:
+        bdi_destroy(&mtd_bdi_unmappable);
+err_bdi1:
+        class_unregister(&mtd_class);
+err_reg:
+        pr_err("Error registering mtd class or bdi: %d\n", ret);
+        return ret;
 }
 static void __exit cleanup_mtd(void)
@@ -651,6 +717,9 @@ static void __exit cleanup_mtd(void)
                remove_proc_entry( "mtd", NULL);
 #endif /* CONFIG_PROC_FS */
        class_unregister(&mtd_class);
+        bdi_destroy(&mtd_bdi_unmappable);
+        bdi_destroy(&mtd_bdi_ro_mappable);
+        bdi_destroy(&mtd_bdi_rw_mappable);
 }
 module_init(init_mtd);
diff --git a/drivers/mtd/mtdsuper.c b/drivers/mtd/mtdsuper.c
index af8b42e0a55b..7c003191fca4 100644
--- a/drivers/mtd/mtdsuper.c
+++ b/drivers/mtd/mtdsuper.c
@@ -13,6 +13,7 @@
 #include <linux/mtd/super.h>
 #include <linux/namei.h>
 #include <linux/ctype.h>
+#include <linux/slab.h>
 /*
 * compare superblocks to see if they're equivalent
@@ -44,6 +45,7 @@ static int get_sb_mtd_set(struct super_block *sb, void *_mtd)
        sb->s_mtd = mtd;
        sb->s_dev = MKDEV(MTD_BLOCK_MAJOR, mtd->index);
+        sb->s_bdi = mtd->backing_dev_info;
        return 0;
 }
diff --git a/drivers/mtd/nand/orion_nand.c b/drivers/mtd/nand/orion_nand.c
index f59c07427af3..d60fc5719fef 100644
--- a/drivers/mtd/nand/orion_nand.c
+++ b/drivers/mtd/nand/orion_nand.c
@@ -60,7 +60,13 @@ static void orion_nand_read_buf(struct mtd_info *mtd, uint8_t *buf, int len)
        }
        buf64 = (uint64_t *)buf;
        while (i < len/8) {
-                uint64_t x;
+                /*
+                 * Since GCC has no proper constraint (PR 43518)
+                 * force x variable to r2/r3 registers as ldrd instruction
+                 * requires first register to be even.
+                 */
+                register uint64_t x asm ("r2");
                asm volatile ("ldrd\t%0, [%1]" : "=&r" (x) : "r" (io_base));
                buf64[i++] = x;
        }
diff --git a/drivers/net/8139too.c b/drivers/net/8139too.c
index a03d291de854..f0d23de32967 100644
--- a/drivers/net/8139too.c
+++ b/drivers/net/8139too.c
@@ -1944,7 +1944,7 @@ static int rtl8139_rx(struct net_device *dev, struct rtl8139_private *tp,
                netif_dbg(tp, rx_status, dev, "%s() status %04x, size %04x, cur %04x\n",
                          __func__, rx_status, rx_size, cur_rx);
 #if RTL8139_DEBUG > 2
-                print_dump_hex(KERN_DEBUG, "Frame contents: ",
+                print_hex_dump(KERN_DEBUG, "Frame contents: ",
                               DUMP_PREFIX_OFFSET, 16, 1,
                               &rx_ring[ring_offset], 70, true);
 #endif
diff --git a/drivers/net/Makefile b/drivers/net/Makefile
index a583b50d9de8..12b280afdd51 100644
--- a/drivers/net/Makefile
+++ b/drivers/net/Makefile
@@ -273,6 +273,7 @@ obj-$(CONFIG_USB_RTL8150)       += usb/
 obj-$(CONFIG_USB_HSO)           += usb/
 obj-$(CONFIG_USB_USBNET)        += usb/
 obj-$(CONFIG_USB_ZD1201)        += usb/
+obj-$(CONFIG_USB_IPHETH)        += usb/
 obj-y += wireless/
 obj-$(CONFIG_NET_TULIP) += tulip/
diff --git a/drivers/net/arm/ep93xx_eth.c b/drivers/net/arm/ep93xx_eth.c
index 6995169d285a..cd17d09f385c 100644
--- a/drivers/net/arm/ep93xx_eth.c
+++ b/drivers/net/arm/ep93xx_eth.c
@@ -311,11 +311,6 @@ err:
                processed++;
        }
-        if (processed) {
-                wrw(ep, REG_RXDENQ, processed);
-                wrw(ep, REG_RXSTSENQ, processed);
-        }
        return processed;
 }
@@ -350,6 +345,11 @@ poll_some_more:
                        goto poll_some_more;
        }
+        if (rx) {
+                wrw(ep, REG_RXDENQ, rx);
+                wrw(ep, REG_RXSTSENQ, rx);
+        }
        return rx;
 }
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index a257babd1bb4..ac90a3828f69 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -58,8 +58,8 @@
 #include "bnx2_fw.h"
 #define DRV_MODULE_NAME         "bnx2"
-#define DRV_MODULE_VERSION      "2.0.8"
+#define DRV_MODULE_VERSION      "2.0.9"
-#define DRV_MODULE_RELDATE      "Feb 15, 2010"
+#define DRV_MODULE_RELDATE      "April 27, 2010"
 #define FW_MIPS_FILE_06         "bnx2/bnx2-mips-06-5.0.0.j6.fw"
 #define FW_RV2P_FILE_06         "bnx2/bnx2-rv2p-06-5.0.0.j3.fw"
 #define FW_MIPS_FILE_09         "bnx2/bnx2-mips-09-5.0.0.j9.fw"
@@ -651,9 +651,10 @@ bnx2_napi_enable(struct bnx2 *bp)
 }
 static void
-bnx2_netif_stop(struct bnx2 *bp)
+bnx2_netif_stop(struct bnx2 *bp, bool stop_cnic)
 {
-        bnx2_cnic_stop(bp);
+        if (stop_cnic)
+                bnx2_cnic_stop(bp);
        if (netif_running(bp->dev)) {
                int i;
@@ -671,14 +672,15 @@ bnx2_netif_stop(struct bnx2 *bp)
 }
 static void
-bnx2_netif_start(struct bnx2 *bp)
+bnx2_netif_start(struct bnx2 *bp, bool start_cnic)
 {
        if (atomic_dec_and_test(&bp->intr_sem)) {
                if (netif_running(bp->dev)) {
                        netif_tx_wake_all_queues(bp->dev);
                        bnx2_napi_enable(bp);
                        bnx2_enable_int(bp);
-                        bnx2_cnic_start(bp);
+                        if (start_cnic)
+                                bnx2_cnic_start(bp);
                }
        }
 }
@@ -4759,8 +4761,12 @@ bnx2_reset_chip(struct bnx2 *bp, u32 reset_code)
                rc = bnx2_alloc_bad_rbuf(bp);
        }
-        if (bp->flags & BNX2_FLAG_USING_MSIX)
+        if (bp->flags & BNX2_FLAG_USING_MSIX) {
                bnx2_setup_msix_tbl(bp);
+                /* Prevent MSIX table reads and write from timing out */
+                REG_WR(bp, BNX2_MISC_ECO_HW_CTL,
+                        BNX2_MISC_ECO_HW_CTL_LARGE_GRC_TMOUT_EN);
+        }
        return rc;
 }
@@ -6273,12 +6279,12 @@ bnx2_reset_task(struct work_struct *work)
                return;
        }
-        bnx2_netif_stop(bp);
+        bnx2_netif_stop(bp, true);
        bnx2_init_nic(bp, 1);
        atomic_set(&bp->intr_sem, 1);
-        bnx2_netif_start(bp);
+        bnx2_netif_start(bp, true);
        rtnl_unlock();
 }
@@ -6320,7 +6326,7 @@ bnx2_vlan_rx_register(struct net_device *dev, struct vlan_group *vlgrp)
        struct bnx2 *bp = netdev_priv(dev);
        if (netif_running(dev))
-                bnx2_netif_stop(bp);
+                bnx2_netif_stop(bp, false);
        bp->vlgrp = vlgrp;
@@ -6331,7 +6337,7 @@ bnx2_vlan_rx_register(struct net_device *dev, struct vlan_group *vlgrp)
        if (bp->flags & BNX2_FLAG_CAN_KEEP_VLAN)
                bnx2_fw_sync(bp, BNX2_DRV_MSG_CODE_KEEP_VLAN_UPDATE, 0, 1);
-        bnx2_netif_start(bp);
+        bnx2_netif_start(bp, false);
 }
 #endif
@@ -7051,9 +7057,9 @@ bnx2_set_coalesce(struct net_device *dev, struct ethtool_coalesce *coal)
        bp->stats_ticks &= BNX2_HC_STATS_TICKS_HC_STAT_TICKS;
        if (netif_running(bp->dev)) {
-                bnx2_netif_stop(bp);
+                bnx2_netif_stop(bp, true);
                bnx2_init_nic(bp, 0);
-                bnx2_netif_start(bp);
+                bnx2_netif_start(bp, true);
        }
        return 0;
@@ -7083,7 +7089,7 @@ bnx2_change_ring_size(struct bnx2 *bp, u32 rx, u32 tx)
                /* Reset will erase chipset stats; save them */
                bnx2_save_stats(bp);
-                bnx2_netif_stop(bp);
+                bnx2_netif_stop(bp, true);
                bnx2_reset_chip(bp, BNX2_DRV_MSG_CODE_RESET);
                bnx2_free_skbs(bp);
                bnx2_free_mem(bp);
@@ -7111,7 +7117,7 @@ bnx2_change_ring_size(struct bnx2 *bp, u32 rx, u32 tx)
                        bnx2_setup_cnic_irq_info(bp);
                mutex_unlock(&bp->cnic_lock);
 #endif
-                bnx2_netif_start(bp);
+                bnx2_netif_start(bp, true);
        }
        return 0;
 }
@@ -7364,7 +7370,7 @@ bnx2_self_test(struct net_device *dev, struct ethtool_test *etest, u64 *buf)
        if (etest->flags & ETH_TEST_FL_OFFLINE) {
                int i;
-                bnx2_netif_stop(bp);
+                bnx2_netif_stop(bp, true);
                bnx2_reset_chip(bp, BNX2_DRV_MSG_CODE_DIAG);
                bnx2_free_skbs(bp);
@@ -7383,7 +7389,7 @@ bnx2_self_test(struct net_device *dev, struct ethtool_test *etest, u64 *buf)
                        bnx2_shutdown_chip(bp);
                else {
                        bnx2_init_nic(bp, 1);
-                        bnx2_netif_start(bp);
+                        bnx2_netif_start(bp, true);
                }
                /* wait for link up */
@@ -8377,7 +8383,7 @@ bnx2_suspend(struct pci_dev *pdev, pm_message_t state)
                return 0;
        flush_scheduled_work();
-        bnx2_netif_stop(bp);
+        bnx2_netif_stop(bp, true);
        netif_device_detach(dev);
        del_timer_sync(&bp->timer);
        bnx2_shutdown_chip(bp);
@@ -8399,7 +8405,7 @@ bnx2_resume(struct pci_dev *pdev)
        bnx2_set_power_state(bp, PCI_D0);
        netif_device_attach(dev);
        bnx2_init_nic(bp, 1);
-        bnx2_netif_start(bp);
+        bnx2_netif_start(bp, true);
        return 0;
 }
@@ -8426,7 +8432,7 @@ static pci_ers_result_t bnx2_io_error_detected(struct pci_dev *pdev,
        }
        if (netif_running(dev)) {
-                bnx2_netif_stop(bp);
+                bnx2_netif_stop(bp, true);
                del_timer_sync(&bp->timer);
                bnx2_reset_nic(bp, BNX2_DRV_MSG_CODE_RESET);
        }
@@ -8483,7 +8489,7 @@ static void bnx2_io_resume(struct pci_dev *pdev)
        rtnl_lock();
        if (netif_running(dev))
-                bnx2_netif_start(bp);
+                bnx2_netif_start(bp, true);
        netif_device_attach(dev);
        rtnl_unlock();
diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c
index 33451092b8e8..d800b598ae3d 100644
--- a/drivers/net/can/usb/ems_usb.c
+++ b/drivers/net/can/usb/ems_usb.c
@@ -1006,7 +1006,7 @@ static int ems_usb_probe(struct usb_interface *intf,
        netdev = alloc_candev(sizeof(struct ems_usb), MAX_TX_URBS);
        if (!netdev) {
-                dev_err(netdev->dev.parent, "Couldn't alloc candev\n");
+                dev_err(&intf->dev, "ems_usb: Couldn't alloc candev\n");
                return -ENOMEM;
        }
@@ -1036,20 +1036,20 @@ static int ems_usb_probe(struct usb_interface *intf,
        dev->intr_urb = usb_alloc_urb(0, GFP_KERNEL);
        if (!dev->intr_urb) {
-                dev_err(netdev->dev.parent, "Couldn't alloc intr URB\n");
+                dev_err(&intf->dev, "Couldn't alloc intr URB\n");
                goto cleanup_candev;
        }
        dev->intr_in_buffer = kzalloc(INTR_IN_BUFFER_SIZE, GFP_KERNEL);
        if (!dev->intr_in_buffer) {
-                dev_err(netdev->dev.parent, "Couldn't alloc Intr buffer\n");
+                dev_err(&intf->dev, "Couldn't alloc Intr buffer\n");
                goto cleanup_intr_urb;
        }
        dev->tx_msg_buffer = kzalloc(CPC_HEADER_SIZE +
                                     sizeof(struct ems_cpc_msg), GFP_KERNEL);
        if (!dev->tx_msg_buffer) {
-                dev_err(netdev->dev.parent, "Couldn't alloc Tx buffer\n");
+                dev_err(&intf->dev, "Couldn't alloc Tx buffer\n");
                goto cleanup_intr_in_buffer;
        }
diff --git a/drivers/net/cxgb3/ael1002.c b/drivers/net/cxgb3/ael1002.c
index 5248f9e0b2f4..35cd36729155 100644
--- a/drivers/net/cxgb3/ael1002.c
+++ b/drivers/net/cxgb3/ael1002.c
@@ -934,7 +934,7 @@ static struct cphy_ops xaui_direct_ops = {
 int t3_xaui_direct_phy_prep(struct cphy *phy, struct adapter *adapter,
                            int phy_addr, const struct mdio_ops *mdio_ops)
 {
-        cphy_init(phy, adapter, MDIO_PRTAD_NONE, &xaui_direct_ops, mdio_ops,
+        cphy_init(phy, adapter, phy_addr, &xaui_direct_ops, mdio_ops,
                  SUPPORTED_10000baseT_Full | SUPPORTED_AUI | SUPPORTED_TP,
                  "10GBASE-CX4");
        return 0;
diff --git a/drivers/net/cxgb3/cxgb3_main.c b/drivers/net/cxgb3/cxgb3_main.c
index aced6c5e635c..e3f1b8566495 100644
--- a/drivers/net/cxgb3/cxgb3_main.c
+++ b/drivers/net/cxgb3/cxgb3_main.c
@@ -439,7 +439,7 @@ static void free_irq_resources(struct adapter *adapter)
 static int await_mgmt_replies(struct adapter *adap, unsigned long init_cnt,
                              unsigned long n)
 {
-        int attempts = 5;
+        int attempts = 10;
        while (adap->sge.qs[0].rspq.offload_pkts < init_cnt + n) {
                if (!--attempts)
diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index b997e578e58f..791080303db1 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -166,6 +166,7 @@
 #include <linux/ethtool.h>
 #include <linux/string.h>
 #include <linux/firmware.h>
+#include <linux/rtnetlink.h>
 #include <asm/unaligned.h>
@@ -2265,8 +2266,13 @@ static void e100_tx_timeout_task(struct work_struct *work)
        DPRINTK(TX_ERR, DEBUG, "scb.status=0x%02X\n",
                ioread8(&nic->csr->scb.status));
-        e100_down(netdev_priv(netdev));
-        e100_up(netdev_priv(netdev));
+        rtnl_lock();
+        if (netif_running(netdev)) {
+                e100_down(netdev_priv(netdev));
+                e100_up(netdev_priv(netdev));
+        }
+        rtnl_unlock();
 }
 static int e100_loopback_test(struct nic *nic, enum loopback loopback_mode)
diff --git a/drivers/net/e1000e/82571.c b/drivers/net/e1000e/82571.c
index 712ccc66ba25..90155552ea09 100644
--- a/drivers/net/e1000e/82571.c
+++ b/drivers/net/e1000e/82571.c
@@ -336,7 +336,6 @@ static s32 e1000_get_variants_82571(struct e1000_adapter *adapter)
        struct e1000_hw *hw = &adapter->hw;
        static int global_quad_port_a; /* global port a indication */
        struct pci_dev *pdev = adapter->pdev;
-        u16 eeprom_data = 0;
        int is_port_b = er32(STATUS) & E1000_STATUS_FUNC_1;
        s32 rc;
@@ -387,16 +386,15 @@ static s32 e1000_get_variants_82571(struct e1000_adapter *adapter)
                if (pdev->device == E1000_DEV_ID_82571EB_SERDES_QUAD)
                        adapter->flags &= ~FLAG_HAS_WOL;
                break;
        case e1000_82573:
+        case e1000_82574:
+        case e1000_82583:
+                /* Disable ASPM L0s due to hardware errata */
+                e1000e_disable_aspm(adapter->pdev, PCIE_LINK_STATE_L0S);
                if (pdev->device == E1000_DEV_ID_82573L) {
-                        if (e1000_read_nvm(&adapter->hw, NVM_INIT_3GIO_3, 1,
+                        adapter->flags |= FLAG_HAS_JUMBO_FRAMES;
-                                       &eeprom_data) < 0)
+                        adapter->max_hw_frame_size = DEFAULT_JUMBO;
-                                break;
-                        if (!(eeprom_data & NVM_WORD1A_ASPM_MASK)) {
-                                adapter->flags |= FLAG_HAS_JUMBO_FRAMES;
-                                adapter->max_hw_frame_size = DEFAULT_JUMBO;
-                        }
                }
                break;
        default:
@@ -1792,6 +1790,7 @@ struct e1000_info e1000_82571_info = {
                                  | FLAG_RESET_OVERWRITES_LAA /* errata */
                                  | FLAG_TARC_SPEED_MODE_BIT /* errata */
                                  | FLAG_APME_CHECK_PORT_B,
+        .flags2                 = FLAG2_DISABLE_ASPM_L1, /* errata 13 */
        .pba                    = 38,
        .max_hw_frame_size      = DEFAULT_JUMBO,
        .get_variants           = e1000_get_variants_82571,
@@ -1809,6 +1808,7 @@ struct e1000_info e1000_82572_info = {
                                  | FLAG_RX_CSUM_ENABLED
                                  | FLAG_HAS_CTRLEXT_ON_LOAD
                                  | FLAG_TARC_SPEED_MODE_BIT, /* errata */
+        .flags2                 = FLAG2_DISABLE_ASPM_L1, /* errata 13 */
        .pba                    = 38,
        .max_hw_frame_size      = DEFAULT_JUMBO,
        .get_variants           = e1000_get_variants_82571,
@@ -1820,13 +1820,11 @@ struct e1000_info e1000_82572_info = {
 struct e1000_info e1000_82573_info = {
        .mac                    = e1000_82573,
        .flags                  = FLAG_HAS_HW_VLAN_FILTER
-                                  | FLAG_HAS_JUMBO_FRAMES
                                  | FLAG_HAS_WOL
                                  | FLAG_APME_IN_CTRL3
                                  | FLAG_RX_CSUM_ENABLED
                                  | FLAG_HAS_SMART_POWER_DOWN
                                  | FLAG_HAS_AMT
-                                  | FLAG_HAS_ERT
                                  | FLAG_HAS_SWSM_ON_LOAD,
        .pba                    = 20,
        .max_hw_frame_size      = ETH_FRAME_LEN + ETH_FCS_LEN,
diff --git a/drivers/net/e1000e/e1000.h b/drivers/net/e1000e/e1000.h
index 118bdf483593..ee32b9b27a9f 100644
--- a/drivers/net/e1000e/e1000.h
+++ b/drivers/net/e1000e/e1000.h
@@ -37,6 +37,7 @@
 #include <linux/io.h>
 #include <linux/netdevice.h>
 #include <linux/pci.h>
+#include <linux/pci-aspm.h>
 #include "hw.h"
@@ -374,7 +375,7 @@ struct e1000_adapter {
 struct e1000_info {
        enum e1000_mac_type     mac;
        unsigned int            flags;
-        unsigned int            flags2;
+        unsigned int            flags2;
        u32                     pba;
        u32                     max_hw_frame_size;
        s32                     (*get_variants)(struct e1000_adapter *);
@@ -421,6 +422,7 @@ struct e1000_info {
 #define FLAG2_CRC_STRIPPING               (1 << 0)
 #define FLAG2_HAS_PHY_WAKEUP              (1 << 1)
 #define FLAG2_IS_DISCARDING               (1 << 2)
+#define FLAG2_DISABLE_ASPM_L1             (1 << 3)
 #define E1000_RX_DESC_PS(R, i)      \
        (&(((union e1000_rx_desc_packet_split *)((R).desc))[i]))
@@ -461,6 +463,7 @@ extern void e1000e_update_stats(struct e1000_adapter *adapter);
 extern bool e1000e_has_link(struct e1000_adapter *adapter);
 extern void e1000e_set_interrupt_capability(struct e1000_adapter *adapter);
 extern void e1000e_reset_interrupt_capability(struct e1000_adapter *adapter);
+extern void e1000e_disable_aspm(struct pci_dev *pdev, u16 state);
 extern unsigned int copybreak;
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 73d43c53015a..dbf81788bb40 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -4283,6 +4283,14 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
                return -EINVAL;
        }
+        /* 82573 Errata 17 */
+        if (((adapter->hw.mac.type == e1000_82573) ||
+             (adapter->hw.mac.type == e1000_82574)) &&
+            (max_frame > ETH_FRAME_LEN + ETH_FCS_LEN)) {
+                adapter->flags2 |= FLAG2_DISABLE_ASPM_L1;
+                e1000e_disable_aspm(adapter->pdev, PCIE_LINK_STATE_L1);
+        }
        while (test_and_set_bit(__E1000_RESETTING, &adapter->state))
                msleep(1);
        /* e1000e_down -> e1000e_reset dependent on max_frame_size & mtu */
@@ -4605,29 +4613,42 @@ static void e1000_complete_shutdown(struct pci_dev *pdev, bool sleep,
        }
 }
-static void e1000e_disable_l1aspm(struct pci_dev *pdev)
+#ifdef CONFIG_PCIEASPM
+static void __e1000e_disable_aspm(struct pci_dev *pdev, u16 state)
+{
+        pci_disable_link_state(pdev, state);
+}
+#else
+static void __e1000e_disable_aspm(struct pci_dev *pdev, u16 state)
 {
        int pos;
-        u16 val;
+        u16 reg16;
        /*
-         * 82573 workaround - disable L1 ASPM on mobile chipsets
+         * Both device and parent should have the same ASPM setting.
-         *
+         * Disable ASPM in downstream component first and then upstream.
-         * L1 ASPM on various mobile (ich7) chipsets do not behave properly
-         * resulting in lost data or garbage information on the pci-e link
-         * level. This could result in (false) bad EEPROM checksum errors,
-         * long ping times (up to 2s) or even a system freeze/hang.
-         *
-         * Unfortunately this feature saves about 1W power consumption when
-         * active.
         */
-        pos = pci_find_capability(pdev, PCI_CAP_ID_EXP);
+        pos = pci_pcie_cap(pdev);
-        pci_read_config_word(pdev, pos + PCI_EXP_LNKCTL, &val);
+        pci_read_config_word(pdev, pos + PCI_EXP_LNKCTL, &reg16);
-        if (val & 0x2) {
+        reg16 &= ~state;
-                dev_warn(&pdev->dev, "Disabling L1 ASPM\n");
+        pci_write_config_word(pdev, pos + PCI_EXP_LNKCTL, reg16);
-                val &= ~0x2;
-                pci_write_config_word(pdev, pos + PCI_EXP_LNKCTL, val);
+        if (!pdev->bus->self)
-        }
+                return;
+        pos = pci_pcie_cap(pdev->bus->self);
+        pci_read_config_word(pdev->bus->self, pos + PCI_EXP_LNKCTL, &reg16);
+        reg16 &= ~state;
+        pci_write_config_word(pdev->bus->self, pos + PCI_EXP_LNKCTL, reg16);
+}
+#endif
+void e1000e_disable_aspm(struct pci_dev *pdev, u16 state)
+{
+        dev_info(&pdev->dev, "Disabling ASPM %s %s\n",
+                 (state & PCIE_LINK_STATE_L0S) ? "L0s" : "",
+                 (state & PCIE_LINK_STATE_L1) ? "L1" : "");
+        __e1000e_disable_aspm(pdev, state);
 }
 #ifdef CONFIG_PM
@@ -4653,7 +4674,8 @@ static int e1000_resume(struct pci_dev *pdev)
        pci_set_power_state(pdev, PCI_D0);
        pci_restore_state(pdev);
        pci_save_state(pdev);
-        e1000e_disable_l1aspm(pdev);
+        if (adapter->flags2 & FLAG2_DISABLE_ASPM_L1)
+                e1000e_disable_aspm(pdev, PCIE_LINK_STATE_L1);
        err = pci_enable_device_mem(pdev);
        if (err) {
@@ -4795,7 +4817,8 @@ static pci_ers_result_t e1000_io_slot_reset(struct pci_dev *pdev)
        int err;
        pci_ers_result_t result;
-        e1000e_disable_l1aspm(pdev);
+        if (adapter->flags2 & FLAG2_DISABLE_ASPM_L1)
+                e1000e_disable_aspm(pdev, PCIE_LINK_STATE_L1);
        err = pci_enable_device_mem(pdev);
        if (err) {
                dev_err(&pdev->dev,
@@ -4889,13 +4912,6 @@ static void e1000_eeprom_checks(struct e1000_adapter *adapter)
                dev_warn(&adapter->pdev->dev,
                         "Warning: detected DSPD enabled in EEPROM\n");
        }
-        ret_val = e1000_read_nvm(hw, NVM_INIT_3GIO_3, 1, &buf);
-        if (!ret_val && (le16_to_cpu(buf) & (3 << 2))) {
-                /* ASPM enable */
-                dev_warn(&adapter->pdev->dev,
-                         "Warning: detected ASPM enabled in EEPROM\n");
-        }
 }
 static const struct net_device_ops e1000e_netdev_ops = {
@@ -4944,7 +4960,8 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
        u16 eeprom_data = 0;
        u16 eeprom_apme_mask = E1000_EEPROM_APME;
-        e1000e_disable_l1aspm(pdev);
+        if (ei->flags2 & FLAG2_DISABLE_ASPM_L1)
+                e1000e_disable_aspm(pdev, PCIE_LINK_STATE_L1);
        err = pci_enable_device_mem(pdev);
        if (err)
diff --git a/drivers/net/fec.c b/drivers/net/fec.c
index 9f98c1c4a344..9b4e8f797a7a 100644
--- a/drivers/net/fec.c
+++ b/drivers/net/fec.c
@@ -1653,7 +1653,7 @@ fec_set_mac_address(struct net_device *dev, void *p)
                (dev->dev_addr[1] << 16) | (dev->dev_addr[0] << 24),
                fep->hwp + FEC_ADDR_LOW);
        writel((dev->dev_addr[5] << 16) | (dev->dev_addr[4] << 24),
-                fep + FEC_ADDR_HIGH);
+                fep->hwp + FEC_ADDR_HIGH);
        return 0;
 }
diff --git a/drivers/net/fsl_pq_mdio.c b/drivers/net/fsl_pq_mdio.c
index d5160edf2fcf..3acac5f930c8 100644
--- a/drivers/net/fsl_pq_mdio.c
+++ b/drivers/net/fsl_pq_mdio.c
@@ -205,8 +205,6 @@ static int fsl_pq_mdio_find_free(struct mii_bus *new_bus)
 static u32 __iomem *get_gfar_tbipa(struct fsl_pq_mdio __iomem *regs, struct device_node *np)
 {
        struct gfar __iomem *enet_regs;
-        u32 __iomem *ioremap_tbipa;
-        u64 addr, size;
        /*
         * This is mildly evil, but so is our hardware for doing this.
@@ -220,9 +218,7 @@ static u32 __iomem *get_gfar_tbipa(struct fsl_pq_mdio __iomem *regs, struct devi
                return &enet_regs->tbipa;
        } else if (of_device_is_compatible(np, "fsl,etsec2-mdio") ||
                        of_device_is_compatible(np, "fsl,etsec2-tbi")) {
-                addr = of_translate_address(np, of_get_address(np, 1, &size, NULL));
+                return of_iomap(np, 1);
-                ioremap_tbipa = ioremap(addr, size);
-                return ioremap_tbipa;
        } else
                return NULL;
 }
@@ -279,6 +275,7 @@ static int fsl_pq_mdio_probe(struct of_device *ofdev,
        u32 __iomem *tbipa;
        struct mii_bus *new_bus;
        int tbiaddr = -1;
+        const u32 *addrp;
        u64 addr = 0, size = 0;
        int err = 0;
@@ -297,8 +294,19 @@ static int fsl_pq_mdio_probe(struct of_device *ofdev,
        new_bus->priv = priv;
        fsl_pq_mdio_bus_name(new_bus->id, np);
+        addrp = of_get_address(np, 0, &size, NULL);
+        if (!addrp) {
+                err = -EINVAL;
+                goto err_free_bus;
+        }
        /* Set the PHY base address */
-        addr = of_translate_address(np, of_get_address(np, 0, &size, NULL));
+        addr = of_translate_address(np, addrp);
+        if (addr == OF_BAD_ADDR) {
+                err = -EINVAL;
+                goto err_free_bus;
+        }
        map = ioremap(addr, size);
        if (!map) {
                err = -ENOMEM;
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 080d1cea5b26..4e97ca182997 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -549,12 +549,8 @@ static int gfar_parse_group(struct device_node *np,
                struct gfar_private *priv, const char *model)
 {
        u32 *queue_mask;
-        u64 addr, size;
-        addr = of_translate_address(np,
-                        of_get_address(np, 0, &size, NULL));
-        priv->gfargrp[priv->num_grps].regs = ioremap(addr, size);
+        priv->gfargrp[priv->num_grps].regs = of_iomap(np, 0);
        if (!priv->gfargrp[priv->num_grps].regs)
                return -ENOMEM;
@@ -1515,9 +1511,9 @@ static void gfar_halt_nodisable(struct net_device *dev)
                tempval |= (DMACTRL_GRS | DMACTRL_GTS);
                gfar_write(&regs->dmactrl, tempval);
-                while (!(gfar_read(&regs->ievent) &
+                spin_event_timeout(((gfar_read(&regs->ievent) &
-                         (IEVENT_GRSC | IEVENT_GTSC)))
+                         (IEVENT_GRSC | IEVENT_GTSC)) ==
-                        cpu_relax();
+                         (IEVENT_GRSC | IEVENT_GTSC)), -1, 0);
        }
 }
diff --git a/drivers/net/ixgbe/ixgbe_82599.c b/drivers/net/ixgbe/ixgbe_82599.c
index b405a00817c6..12fc0e7ba2ca 100644
--- a/drivers/net/ixgbe/ixgbe_82599.c
+++ b/drivers/net/ixgbe/ixgbe_82599.c
@@ -39,6 +39,8 @@
 #define IXGBE_82599_MC_TBL_SIZE   128
 #define IXGBE_82599_VFT_TBL_SIZE  128
+void ixgbe_disable_tx_laser_multispeed_fiber(struct ixgbe_hw *hw);
+void ixgbe_enable_tx_laser_multispeed_fiber(struct ixgbe_hw *hw);
 void ixgbe_flap_tx_laser_multispeed_fiber(struct ixgbe_hw *hw);
 s32 ixgbe_setup_mac_link_multispeed_fiber(struct ixgbe_hw *hw,
                                          ixgbe_link_speed speed,
@@ -69,8 +71,14 @@ static void ixgbe_init_mac_link_ops_82599(struct ixgbe_hw *hw)
        if (hw->phy.multispeed_fiber) {
                /* Set up dual speed SFP+ support */
                mac->ops.setup_link = &ixgbe_setup_mac_link_multispeed_fiber;
+                mac->ops.disable_tx_laser =
+                                       &ixgbe_disable_tx_laser_multispeed_fiber;
+                mac->ops.enable_tx_laser =
+                                        &ixgbe_enable_tx_laser_multispeed_fiber;
                mac->ops.flap_tx_laser = &ixgbe_flap_tx_laser_multispeed_fiber;
        } else {
+                mac->ops.disable_tx_laser = NULL;
+                mac->ops.enable_tx_laser = NULL;
                mac->ops.flap_tx_laser = NULL;
                if ((mac->ops.get_media_type(hw) ==
                     ixgbe_media_type_backplane) &&
@@ -415,6 +423,44 @@ s32 ixgbe_start_mac_link_82599(struct ixgbe_hw *hw,
        return status;
 }
+ /**
+  *  ixgbe_disable_tx_laser_multispeed_fiber - Disable Tx laser
+  *  @hw: pointer to hardware structure
+  *
+  *  The base drivers may require better control over SFP+ module
+  *  PHY states.  This includes selectively shutting down the Tx
+  *  laser on the PHY, effectively halting physical link.
+  **/
+void ixgbe_disable_tx_laser_multispeed_fiber(struct ixgbe_hw *hw)
+{
+        u32 esdp_reg = IXGBE_READ_REG(hw, IXGBE_ESDP);
+        /* Disable tx laser; allow 100us to go dark per spec */
+        esdp_reg |= IXGBE_ESDP_SDP3;
+        IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
+        IXGBE_WRITE_FLUSH(hw);
+        udelay(100);
+}
+/**
+ *  ixgbe_enable_tx_laser_multispeed_fiber - Enable Tx laser
+ *  @hw: pointer to hardware structure
+ *
+ *  The base drivers may require better control over SFP+ module
+ *  PHY states.  This includes selectively turning on the Tx
+ *  laser on the PHY, effectively starting physical link.
+ **/
+void ixgbe_enable_tx_laser_multispeed_fiber(struct ixgbe_hw *hw)
+{
+        u32 esdp_reg = IXGBE_READ_REG(hw, IXGBE_ESDP);
+        /* Enable tx laser; allow 100ms to light up */
+        esdp_reg &= ~IXGBE_ESDP_SDP3;
+        IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
+        IXGBE_WRITE_FLUSH(hw);
+        msleep(100);
+}
 /**
 *  ixgbe_flap_tx_laser_multispeed_fiber - Flap Tx laser
 *  @hw: pointer to hardware structure
@@ -429,23 +475,11 @@ s32 ixgbe_start_mac_link_82599(struct ixgbe_hw *hw,
 **/
 void ixgbe_flap_tx_laser_multispeed_fiber(struct ixgbe_hw *hw)
 {
-        u32 esdp_reg = IXGBE_READ_REG(hw, IXGBE_ESDP);
        hw_dbg(hw, "ixgbe_flap_tx_laser_multispeed_fiber\n");
        if (hw->mac.autotry_restart) {
-                /* Disable tx laser; allow 100us to go dark per spec */
+                ixgbe_disable_tx_laser_multispeed_fiber(hw);
-                esdp_reg |= IXGBE_ESDP_SDP3;
+                ixgbe_enable_tx_laser_multispeed_fiber(hw);
-                IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
-                IXGBE_WRITE_FLUSH(hw);
-                udelay(100);
-                /* Enable tx laser; allow 100ms to light up */
-                esdp_reg &= ~IXGBE_ESDP_SDP3;
-                IXGBE_WRITE_REG(hw, IXGBE_ESDP, esdp_reg);
-                IXGBE_WRITE_FLUSH(hw);
-                msleep(100);
                hw->mac.autotry_restart = false;
        }
 }
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index 8f677cb86290..6c00ee493a3b 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -2982,6 +2982,10 @@ static int ixgbe_up_complete(struct ixgbe_adapter *adapter)
        else
                ixgbe_configure_msi_and_legacy(adapter);
+        /* enable the optics */
+        if (hw->phy.multispeed_fiber)
+                hw->mac.ops.enable_tx_laser(hw);
        clear_bit(__IXGBE_DOWN, &adapter->state);
        ixgbe_napi_enable_all(adapter);
@@ -3243,6 +3247,10 @@ void ixgbe_down(struct ixgbe_adapter *adapter)
        /* signal that we are down to the interrupt handler */
        set_bit(__IXGBE_DOWN, &adapter->state);
+        /* power down the optics */
+        if (hw->phy.multispeed_fiber)
+                hw->mac.ops.disable_tx_laser(hw);
        /* disable receive for all VFs and wait one second */
        if (adapter->num_vfs) {
                /* ping all the active vfs to let them know we are going down */
@@ -6253,6 +6261,10 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
                goto err_eeprom;
        }
+        /* power down the optics */
+        if (hw->phy.multispeed_fiber)
+                hw->mac.ops.disable_tx_laser(hw);
        init_timer(&adapter->watchdog_timer);
        adapter->watchdog_timer.function = &ixgbe_watchdog;
        adapter->watchdog_timer.data = (unsigned long)adapter;
@@ -6400,16 +6412,6 @@ static void __devexit ixgbe_remove(struct pci_dev *pdev)
        del_timer_sync(&adapter->sfp_timer);
        cancel_work_sync(&adapter->watchdog_task);
        cancel_work_sync(&adapter->sfp_task);
-        if (adapter->hw.phy.multispeed_fiber) {
-                struct ixgbe_hw *hw = &adapter->hw;
-                /*
-                 * Restart clause 37 autoneg, disable and re-enable
-                 * the tx laser, to clear & alert the link partner
-                 * that it needs to restart autotry
-                 */
-                hw->mac.autotry_restart = true;
-                hw->mac.ops.flap_tx_laser(hw);
-        }
        cancel_work_sync(&adapter->multispeed_fiber_task);
        cancel_work_sync(&adapter->sfp_config_module_task);
        if (adapter->flags & IXGBE_FLAG_FDIR_HASH_CAPABLE ||
diff --git a/drivers/net/ixgbe/ixgbe_type.h b/drivers/net/ixgbe/ixgbe_type.h
index 4ec6dc1a5b75..534affcc38ca 100644
--- a/drivers/net/ixgbe/ixgbe_type.h
+++ b/drivers/net/ixgbe/ixgbe_type.h
@@ -2398,6 +2398,8 @@ struct ixgbe_mac_operations {
        s32 (*enable_rx_dma)(struct ixgbe_hw *, u32);
        /* Link */
+        void (*disable_tx_laser)(struct ixgbe_hw *);
+        void (*enable_tx_laser)(struct ixgbe_hw *);
        void (*flap_tx_laser)(struct ixgbe_hw *);
        s32 (*setup_link)(struct ixgbe_hw *, ixgbe_link_speed, bool, bool);
        s32 (*check_link)(struct ixgbe_hw *, ixgbe_link_speed *, bool *, bool);
diff --git a/drivers/net/ks8851.c b/drivers/net/ks8851.c
index 13cc1ca261d9..9e9f9b349766 100644
--- a/drivers/net/ks8851.c
+++ b/drivers/net/ks8851.c
@@ -722,12 +722,14 @@ static void ks8851_tx_work(struct work_struct *work)
                txb = skb_dequeue(&ks->txq);
                last = skb_queue_empty(&ks->txq);
-                ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_SDA);
+                if (txb != NULL) {
-                ks8851_wrpkt(ks, txb, last);
+                        ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr | RXQCR_SDA);
-                ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr);
+                        ks8851_wrpkt(ks, txb, last);
-                ks8851_wrreg16(ks, KS_TXQCR, TXQCR_METFE);
+                        ks8851_wrreg16(ks, KS_RXQCR, ks->rc_rxqcr);
+                        ks8851_wrreg16(ks, KS_TXQCR, TXQCR_METFE);
-                ks8851_done_tx(ks, txb);
+                        ks8851_done_tx(ks, txb);
+                }
        }
        mutex_unlock(&ks->lock);
diff --git a/drivers/net/pcmcia/3c574_cs.c b/drivers/net/pcmcia/3c574_cs.c
index 3d1d3a7b7ed3..757f87bb1db3 100644
--- a/drivers/net/pcmcia/3c574_cs.c
+++ b/drivers/net/pcmcia/3c574_cs.c
@@ -781,8 +781,13 @@ static netdev_tx_t el3_start_xmit(struct sk_buff *skb,
                  inw(ioaddr + EL3_STATUS));
        spin_lock_irqsave(&lp->window_lock, flags);
+        dev->stats.tx_bytes += skb->len;
+        /* Put out the doubleword header... */
        outw(skb->len, ioaddr + TX_FIFO);
        outw(0, ioaddr + TX_FIFO);
+        /* ... and the packet rounded to a doubleword. */
        outsl(ioaddr + TX_FIFO, skb->data, (skb->len+3)>>2);
        dev->trans_start = jiffies;
@@ -1021,8 +1026,6 @@ static void update_stats(struct net_device *dev)
        /* BadSSD */                               inb(ioaddr + 12);
        up                                       = inb(ioaddr + 13);
-        dev->stats.tx_bytes                     += tx + ((up & 0xf0) << 12);
        EL3WINDOW(1);
 }
diff --git a/drivers/net/pcmcia/smc91c92_cs.c b/drivers/net/pcmcia/smc91c92_cs.c
index fd9d6e34fda4..ccc553782a0d 100644
--- a/drivers/net/pcmcia/smc91c92_cs.c
+++ b/drivers/net/pcmcia/smc91c92_cs.c
@@ -1804,23 +1804,30 @@ static void media_check(u_long arg)
    SMC_SELECT_BANK(1);
    media |= (inw(ioaddr + CONFIG) & CFG_AUI_SELECT) ? 2 : 1;
+    SMC_SELECT_BANK(saved_bank);
+    spin_unlock_irqrestore(&smc->lock, flags);
    /* Check for pending interrupt with watchdog flag set: with
       this, we can limp along even if the interrupt is blocked */
    if (smc->watchdog++ && ((i>>8) & i)) {
        if (!smc->fast_poll)
            printk(KERN_INFO "%s: interrupt(s) dropped!\n", dev->name);
+        local_irq_save(flags);
        smc_interrupt(dev->irq, dev);
+        local_irq_restore(flags);
        smc->fast_poll = HZ;
    }
    if (smc->fast_poll) {
        smc->fast_poll--;
        smc->media.expires = jiffies + HZ/100;
        add_timer(&smc->media);
-        SMC_SELECT_BANK(saved_bank);
-        spin_unlock_irqrestore(&smc->lock, flags);
        return;
    }
+    spin_lock_irqsave(&smc->lock, flags);
+    saved_bank = inw(ioaddr + BANK_SELECT);
    if (smc->cfg & CFG_MII_SELECT) {
        if (smc->mii_if.phy_id < 0)
            goto reschedule;
@@ -1978,15 +1985,16 @@ static int smc_get_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
        unsigned int ioaddr = dev->base_addr;
        u16 saved_bank = inw(ioaddr + BANK_SELECT);
        int ret;
+        unsigned long flags;
-        spin_lock_irq(&smc->lock);
+        spin_lock_irqsave(&smc->lock, flags);
        SMC_SELECT_BANK(3);
        if (smc->cfg & CFG_MII_SELECT)
                ret = mii_ethtool_gset(&smc->mii_if, ecmd);
        else
                ret = smc_netdev_get_ecmd(dev, ecmd);
        SMC_SELECT_BANK(saved_bank);
-        spin_unlock_irq(&smc->lock);
+        spin_unlock_irqrestore(&smc->lock, flags);
        return ret;
 }
@@ -1996,15 +2004,16 @@ static int smc_set_settings(struct net_device *dev, struct ethtool_cmd *ecmd)
        unsigned int ioaddr = dev->base_addr;
        u16 saved_bank = inw(ioaddr + BANK_SELECT);
        int ret;
+        unsigned long flags;
-        spin_lock_irq(&smc->lock);
+        spin_lock_irqsave(&smc->lock, flags);
        SMC_SELECT_BANK(3);
        if (smc->cfg & CFG_MII_SELECT)
                ret = mii_ethtool_sset(&smc->mii_if, ecmd);
        else
                ret = smc_netdev_set_ecmd(dev, ecmd);
        SMC_SELECT_BANK(saved_bank);
-        spin_unlock_irq(&smc->lock);
+        spin_unlock_irqrestore(&smc->lock, flags);
        return ret;
 }
@@ -2014,12 +2023,13 @@ static u32 smc_get_link(struct net_device *dev)
        unsigned int ioaddr = dev->base_addr;
        u16 saved_bank = inw(ioaddr + BANK_SELECT);
        u32 ret;
+        unsigned long flags;
-        spin_lock_irq(&smc->lock);
+        spin_lock_irqsave(&smc->lock, flags);
        SMC_SELECT_BANK(3);
        ret = smc_link_ok(dev);
        SMC_SELECT_BANK(saved_bank);
-        spin_unlock_irq(&smc->lock);
+        spin_unlock_irqrestore(&smc->lock, flags);
        return ret;
 }
@@ -2056,16 +2066,17 @@ static int smc_ioctl (struct net_device *dev, struct ifreq *rq, int cmd)
        int rc = 0;
        u16 saved_bank;
        unsigned int ioaddr = dev->base_addr;
+        unsigned long flags;
        if (!netif_running(dev))
                return -EINVAL;
-        spin_lock_irq(&smc->lock);
+        spin_lock_irqsave(&smc->lock, flags);
        saved_bank = inw(ioaddr + BANK_SELECT);
        SMC_SELECT_BANK(3);
        rc = generic_mii_ioctl(&smc->mii_if, mii, cmd, NULL);
        SMC_SELECT_BANK(saved_bank);
-        spin_unlock_irq(&smc->lock);
+        spin_unlock_irqrestore(&smc->lock, flags);
        return rc;
 }
diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
index fc5938ba3d78..a527e37728cd 100644
--- a/drivers/net/phy/Kconfig
+++ b/drivers/net/phy/Kconfig
@@ -88,6 +88,11 @@ config LSI_ET1011C_PHY
        ---help---
          Supports the LSI ET1011C PHY.
+config MICREL_PHY
+        tristate "Driver for Micrel PHYs"
+        ---help---
+          Supports the KSZ9021, VSC8201, KS8001 PHYs.
 config FIXED_PHY
        bool "Driver for MDIO Bus/PHY emulation with fixed speed/link PHYs"
        depends on PHYLIB=y
diff --git a/drivers/net/phy/Makefile b/drivers/net/phy/Makefile
index 1342585af381..13bebab65d02 100644
--- a/drivers/net/phy/Makefile
+++ b/drivers/net/phy/Makefile
@@ -20,4 +20,5 @@ obj-$(CONFIG_MDIO_BITBANG)	+= mdio-bitbang.o
 obj-$(CONFIG_MDIO_GPIO)         += mdio-gpio.o
 obj-$(CONFIG_NATIONAL_PHY)      += national.o
 obj-$(CONFIG_STE10XP)           += ste10Xp.o
+obj-$(CONFIG_MICREL_PHY)        += micrel.o
 obj-$(CONFIG_MDIO_OCTEON)       += mdio-octeon.o
diff --git a/drivers/net/phy/mdio-octeon.c b/drivers/net/phy/mdio-octeon.c
index a872aea4ed74..f443d43edd80 100644
--- a/drivers/net/phy/mdio-octeon.c
+++ b/drivers/net/phy/mdio-octeon.c
@@ -88,6 +88,7 @@ static int octeon_mdiobus_write(struct mii_bus *bus, int phy_id,
 static int __init octeon_mdiobus_probe(struct platform_device *pdev)
 {
        struct octeon_mdiobus *bus;
+        union cvmx_smix_en smi_en;
        int i;
        int err = -ENOENT;
@@ -103,6 +104,10 @@ static int __init octeon_mdiobus_probe(struct platform_device *pdev)
        if (!bus->mii_bus)
                goto err;
+        smi_en.u64 = 0;
+        smi_en.s.en = 1;
+        cvmx_write_csr(CVMX_SMIX_EN(bus->unit), smi_en.u64);
        /*
         * Standard Octeon evaluation boards don't support phy
         * interrupts, we need to poll.
@@ -133,17 +138,22 @@ err_register:
 err:
        devm_kfree(&pdev->dev, bus);
+        smi_en.u64 = 0;
+        cvmx_write_csr(CVMX_SMIX_EN(bus->unit), smi_en.u64);
        return err;
 }
 static int __exit octeon_mdiobus_remove(struct platform_device *pdev)
 {
        struct octeon_mdiobus *bus;
+        union cvmx_smix_en smi_en;
        bus = dev_get_drvdata(&pdev->dev);
        mdiobus_unregister(bus->mii_bus);
        mdiobus_free(bus->mii_bus);
+        smi_en.u64 = 0;
+        cvmx_write_csr(CVMX_SMIX_EN(bus->unit), smi_en.u64);
        return 0;
 }
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
new file mode 100644
index 000000000000..0cd80e4d71d9
--- /dev/null
+++ b/drivers/net/phy/micrel.c
@@ -0,0 +1,104 @@
+/*
+ * drivers/net/phy/micrel.c
+ *
+ * Driver for Micrel PHYs
+ *
+ * Author: David J. Choi
+ *
+ * Copyright (c) 2010 Micrel, Inc.
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ *
+ * Support : ksz9021 , vsc8201, ks8001
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/phy.h>
+#define PHY_ID_KSZ9021                  0x00221611
+#define PHY_ID_VSC8201                  0x000FC413
+#define PHY_ID_KS8001                   0x0022161A
+static int kszphy_config_init(struct phy_device *phydev)
+{
+        return 0;
+}
+static struct phy_driver ks8001_driver = {
+        .phy_id         = PHY_ID_KS8001,
+        .phy_id_mask    = 0x00fffff0,
+        .features       = PHY_BASIC_FEATURES,
+        .flags          = PHY_POLL,
+        .config_init    = kszphy_config_init,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
+        .driver         = { .owner = THIS_MODULE,},
+};
+static struct phy_driver vsc8201_driver = {
+        .phy_id         = PHY_ID_VSC8201,
+        .name           = "Micrel VSC8201",
+        .phy_id_mask    = 0x00fffff0,
+        .features       = PHY_BASIC_FEATURES,
+        .flags          = PHY_POLL,
+        .config_init    = kszphy_config_init,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
+        .driver         = { .owner = THIS_MODULE,},
+};
+static struct phy_driver ksz9021_driver = {
+        .phy_id         = PHY_ID_KSZ9021,
+        .phy_id_mask    = 0x000fff10,
+        .name           = "Micrel KSZ9021 Gigabit PHY",
+        .features       = PHY_GBIT_FEATURES | SUPPORTED_Pause,
+        .flags          = PHY_POLL,
+        .config_init    = kszphy_config_init,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
+        .driver         = { .owner = THIS_MODULE, },
+};
+static int __init ksphy_init(void)
+{
+        int ret;
+        ret = phy_driver_register(&ks8001_driver);
+        if (ret)
+                goto err1;
+        ret = phy_driver_register(&vsc8201_driver);
+        if (ret)
+                goto err2;
+        ret = phy_driver_register(&ksz9021_driver);
+        if (ret)
+                goto err3;
+        return 0;
+err3:
+        phy_driver_unregister(&vsc8201_driver);
+err2:
+        phy_driver_unregister(&ks8001_driver);
+err1:
+        return ret;
+}
+static void __exit ksphy_exit(void)
+{
+        phy_driver_unregister(&ks8001_driver);
+        phy_driver_unregister(&vsc8201_driver);
+        phy_driver_unregister(&ksz9021_driver);
+}
+module_init(ksphy_init);
+module_exit(ksphy_exit);
+MODULE_DESCRIPTION("Micrel PHY driver");
+MODULE_AUTHOR("David J. Choi");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 6e281bc825e5..8518a2e58e53 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -405,6 +405,7 @@ static ssize_t ppp_read(struct file *file, char __user *buf,
        DECLARE_WAITQUEUE(wait, current);
        ssize_t ret;
        struct sk_buff *skb = NULL;
+        struct iovec iov;
        ret = count;
@@ -448,7 +449,9 @@ static ssize_t ppp_read(struct file *file, char __user *buf,
        if (skb->len > count)
                goto outf;
        ret = -EFAULT;
-        if (copy_to_user(buf, skb->data, skb->len))
+        iov.iov_base = buf;
+        iov.iov_len = count;
+        if (skb_copy_datagram_iovec(skb, 0, &iov, skb->len))
                goto outf;
        ret = skb->len;
@@ -1567,13 +1570,22 @@ ppp_input(struct ppp_channel *chan, struct sk_buff *skb)
        struct channel *pch = chan->ppp;
        int proto;
-        if (!pch || skb->len == 0) {
+        if (!pch) {
                kfree_skb(skb);
                return;
        }
-        proto = PPP_PROTO(skb);
        read_lock_bh(&pch->upl);
+        if (!pskb_may_pull(skb, 2)) {
+                kfree_skb(skb);
+                if (pch->ppp) {
+                        ++pch->ppp->dev->stats.rx_length_errors;
+                        ppp_receive_error(pch->ppp);
+                }
+                goto done;
+        }
+        proto = PPP_PROTO(skb);
        if (!pch->ppp || proto >= 0xc000 || proto == PPP_CCPFRAG) {
                /* put it on the channel queue */
                skb_queue_tail(&pch->file.rq, skb);
@@ -1585,6 +1597,8 @@ ppp_input(struct ppp_channel *chan, struct sk_buff *skb)
        } else {
                ppp_do_recv(pch->ppp, skb, pch);
        }
+done:
        read_unlock_bh(&pch->upl);
 }
@@ -1617,7 +1631,8 @@ ppp_input_error(struct ppp_channel *chan, int code)
 static void
 ppp_receive_frame(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)
 {
-        if (pskb_may_pull(skb, 2)) {
+        /* note: a 0-length skb is used as an error indication */
+        if (skb->len > 0) {
 #ifdef CONFIG_PPP_MULTILINK
                /* XXX do channel-level decompression here */
                if (PPP_PROTO(skb) == PPP_MP)
@@ -1625,15 +1640,10 @@ ppp_receive_frame(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)
                else
 #endif /* CONFIG_PPP_MULTILINK */
                        ppp_receive_nonmp_frame(ppp, skb);
-                return;
+        } else {
+                kfree_skb(skb);
+                ppp_receive_error(ppp);
        }
-        if (skb->len > 0)
-                /* note: a 0-length skb is used as an error indication */
-                ++ppp->dev->stats.rx_length_errors;
-        kfree_skb(skb);
-        ppp_receive_error(ppp);
 }
 static void
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index dbb1f5a1824c..dd8106ff35aa 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -1042,14 +1042,14 @@ static void rtl8169_vlan_rx_register(struct net_device *dev,
 }
 static int rtl8169_rx_vlan_skb(struct rtl8169_private *tp, struct RxDesc *desc,
-                               struct sk_buff *skb)
+                               struct sk_buff *skb, int polling)
 {
        u32 opts2 = le32_to_cpu(desc->opts2);
        struct vlan_group *vlgrp = tp->vlgrp;
        int ret;
        if (vlgrp && (opts2 & RxVlanTag)) {
-                vlan_hwaccel_receive_skb(skb, vlgrp, swab16(opts2 & 0xffff));
+                __vlan_hwaccel_rx(skb, vlgrp, swab16(opts2 & 0xffff), polling);
                ret = 0;
        } else
                ret = -1;
@@ -1066,7 +1066,7 @@ static inline u32 rtl8169_tx_vlan_tag(struct rtl8169_private *tp,
 }
 static int rtl8169_rx_vlan_skb(struct rtl8169_private *tp, struct RxDesc *desc,
-                               struct sk_buff *skb)
+                               struct sk_buff *skb, int polling)
 {
        return -1;
 }
@@ -2759,6 +2759,7 @@ static void rtl8169_release_board(struct pci_dev *pdev, struct net_device *dev,
 {
        iounmap(ioaddr);
        pci_release_regions(pdev);
+        pci_clear_mwi(pdev);
        pci_disable_device(pdev);
        free_netdev(dev);
 }
@@ -2825,8 +2826,13 @@ static void rtl_rar_set(struct rtl8169_private *tp, u8 *addr)
        spin_lock_irq(&tp->lock);
        RTL_W8(Cfg9346, Cfg9346_Unlock);
        RTL_W32(MAC4, high);
+        RTL_R32(MAC4);
        RTL_W32(MAC0, low);
+        RTL_R32(MAC0);
        RTL_W8(Cfg9346, Cfg9346_Lock);
        spin_unlock_irq(&tp->lock);
@@ -3014,9 +3020,8 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                goto err_out_free_dev_1;
        }
-        rc = pci_set_mwi(pdev);
+        if (pci_set_mwi(pdev) < 0)
-        if (rc < 0)
+                netif_info(tp, probe, dev, "Mem-Wr-Inval unavailable\n");
-                goto err_out_disable_2;
        /* make sure PCI base addr 1 is MMIO */
        if (!(pci_resource_flags(pdev, region) & IORESOURCE_MEM)) {
@@ -3024,7 +3029,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                          "region #%d not an MMIO resource, aborting\n",
                          region);
                rc = -ENODEV;
-                goto err_out_mwi_3;
+                goto err_out_mwi_2;
        }
        /* check for weird/broken PCI region reporting */
@@ -3032,13 +3037,13 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                netif_err(tp, probe, dev,
                          "Invalid PCI region size(s), aborting\n");
                rc = -ENODEV;
-                goto err_out_mwi_3;
+                goto err_out_mwi_2;
        }
        rc = pci_request_regions(pdev, MODULENAME);
        if (rc < 0) {
                netif_err(tp, probe, dev, "could not request regions\n");
-                goto err_out_mwi_3;
+                goto err_out_mwi_2;
        }
        tp->cp_cmd = PCIMulRW | RxChkSum;
@@ -3051,7 +3056,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                rc = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
                if (rc < 0) {
                        netif_err(tp, probe, dev, "DMA configuration failed\n");
-                        goto err_out_free_res_4;
+                        goto err_out_free_res_3;
                }
        }
@@ -3060,7 +3065,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        if (!ioaddr) {
                netif_err(tp, probe, dev, "cannot remap MMIO, aborting\n");
                rc = -EIO;
-                goto err_out_free_res_4;
+                goto err_out_free_res_3;
        }
        tp->pcie_cap = pci_find_capability(pdev, PCI_CAP_ID_EXP);
@@ -3102,7 +3107,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        if (i == ARRAY_SIZE(rtl_chip_info)) {
                dev_err(&pdev->dev,
                        "driver bug, MAC version not found in rtl_chip_info\n");
-                goto err_out_msi_5;
+                goto err_out_msi_4;
        }
        tp->chipset = i;
@@ -3167,7 +3172,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        rc = register_netdev(dev);
        if (rc < 0)
-                goto err_out_msi_5;
+                goto err_out_msi_4;
        pci_set_drvdata(pdev, dev);
@@ -3190,14 +3195,13 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 out:
        return rc;
-err_out_msi_5:
+err_out_msi_4:
        rtl_disable_msi(pdev, tp);
        iounmap(ioaddr);
-err_out_free_res_4:
+err_out_free_res_3:
        pci_release_regions(pdev);
-err_out_mwi_3:
+err_out_mwi_2:
        pci_clear_mwi(pdev);
-err_out_disable_2:
        pci_disable_device(pdev);
 err_out_free_dev_1:
        free_netdev(dev);
@@ -4441,12 +4445,20 @@ out:
        return done;
 }
+/*
+ * Warning : rtl8169_rx_interrupt() might be called :
+ * 1) from NAPI (softirq) context
+ *      (polling = 1 : we should call netif_receive_skb())
+ * 2) from process context (rtl8169_reset_task())
+ *      (polling = 0 : we must call netif_rx() instead)
+ */
 static int rtl8169_rx_interrupt(struct net_device *dev,
                                struct rtl8169_private *tp,
                                void __iomem *ioaddr, u32 budget)
 {
        unsigned int cur_rx, rx_left;
        unsigned int delta, count;
+        int polling = (budget != ~(u32)0) ? 1 : 0;
        cur_rx = tp->cur_rx;
        rx_left = NUM_RX_DESC + tp->dirty_rx - cur_rx;
@@ -4508,8 +4520,12 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
                        skb_put(skb, pkt_size);
                        skb->protocol = eth_type_trans(skb, dev);
-                        if (rtl8169_rx_vlan_skb(tp, desc, skb) < 0)
+                        if (rtl8169_rx_vlan_skb(tp, desc, skb, polling) < 0) {
-                                netif_receive_skb(skb);
+                                if (likely(polling))
+                                        netif_receive_skb(skb);
+                                else
+                                        netif_rx(skb);
+                        }
                        dev->stats.rx_bytes += pkt_size;
                        dev->stats.rx_packets++;
diff --git a/drivers/net/sb1250-mac.c b/drivers/net/sb1250-mac.c
index 9944e5d662c0..04efc0c1bda9 100644
--- a/drivers/net/sb1250-mac.c
+++ b/drivers/net/sb1250-mac.c
@@ -2353,17 +2353,36 @@ static int sbmac_init(struct platform_device *pldev, long long base)
        sc->mii_bus = mdiobus_alloc();
        if (sc->mii_bus == NULL) {
-                sbmac_uninitctx(sc);
+                err = -ENOMEM;
-                return -ENOMEM;
+                goto uninit_ctx;
        }
+        sc->mii_bus->name = sbmac_mdio_string;
+        snprintf(sc->mii_bus->id, MII_BUS_ID_SIZE, "%x", idx);
+        sc->mii_bus->priv = sc;
+        sc->mii_bus->read = sbmac_mii_read;
+        sc->mii_bus->write = sbmac_mii_write;
+        sc->mii_bus->irq = sc->phy_irq;
+        for (i = 0; i < PHY_MAX_ADDR; ++i)
+                sc->mii_bus->irq[i] = SBMAC_PHY_INT;
+        sc->mii_bus->parent = &pldev->dev;
+        /*
+         * Probe PHY address
+         */
+        err = mdiobus_register(sc->mii_bus);
+        if (err) {
+                printk(KERN_ERR "%s: unable to register MDIO bus\n",
+                       dev->name);
+                goto free_mdio;
+        }
+        dev_set_drvdata(&pldev->dev, sc->mii_bus);
        err = register_netdev(dev);
        if (err) {
                printk(KERN_ERR "%s.%d: unable to register netdev\n",
                       sbmac_string, idx);
-                mdiobus_free(sc->mii_bus);
+                goto unreg_mdio;
-                sbmac_uninitctx(sc);
-                return err;
        }
        pr_info("%s.%d: registered as %s\n", sbmac_string, idx, dev->name);
@@ -2379,19 +2398,15 @@ static int sbmac_init(struct platform_device *pldev, long long base)
        pr_info("%s: SiByte Ethernet at 0x%08Lx, address: %pM\n",
               dev->name, base, eaddr);
-        sc->mii_bus->name = sbmac_mdio_string;
-        snprintf(sc->mii_bus->id, MII_BUS_ID_SIZE, "%x", idx);
-        sc->mii_bus->priv = sc;
-        sc->mii_bus->read = sbmac_mii_read;
-        sc->mii_bus->write = sbmac_mii_write;
-        sc->mii_bus->irq = sc->phy_irq;
-        for (i = 0; i < PHY_MAX_ADDR; ++i)
-                sc->mii_bus->irq[i] = SBMAC_PHY_INT;
-        sc->mii_bus->parent = &pldev->dev;
-        dev_set_drvdata(&pldev->dev, sc->mii_bus);
        return 0;
+unreg_mdio:
+        mdiobus_unregister(sc->mii_bus);
+        dev_set_drvdata(&pldev->dev, NULL);
+free_mdio:
+        mdiobus_free(sc->mii_bus);
+uninit_ctx:
+        sbmac_uninitctx(sc);
+        return err;
 }
@@ -2417,16 +2432,6 @@ static int sbmac_open(struct net_device *dev)
                goto out_err;
        }
-        /*
-         * Probe PHY address
-         */
-        err = mdiobus_register(sc->mii_bus);
-        if (err) {
-                printk(KERN_ERR "%s: unable to register MDIO bus\n",
-                       dev->name);
-                goto out_unirq;
-        }
        sc->sbm_speed = sbmac_speed_none;
        sc->sbm_duplex = sbmac_duplex_none;
        sc->sbm_fc = sbmac_fc_none;
@@ -2457,11 +2462,7 @@ static int sbmac_open(struct net_device *dev)
        return 0;
 out_unregister:
-        mdiobus_unregister(sc->mii_bus);
-out_unirq:
        free_irq(dev->irq, dev);
 out_err:
        return err;
 }
@@ -2650,9 +2651,6 @@ static int sbmac_close(struct net_device *dev)
        phy_disconnect(sc->phy_dev);
        sc->phy_dev = NULL;
-        mdiobus_unregister(sc->mii_bus);
        free_irq(dev->irq, dev);
        sbdma_emptyring(&(sc->sbm_txdma));
@@ -2760,6 +2758,7 @@ static int __exit sbmac_remove(struct platform_device *pldev)
        unregister_netdev(dev);
        sbmac_uninitctx(sc);
+        mdiobus_unregister(sc->mii_bus);
        mdiobus_free(sc->mii_bus);
        iounmap(sc->sbm_base);
        free_netdev(dev);
diff --git a/drivers/net/sfc/efx.c b/drivers/net/sfc/efx.c
index 6486657c47b8..649a264d6a81 100644
--- a/drivers/net/sfc/efx.c
+++ b/drivers/net/sfc/efx.c
@@ -1861,6 +1861,7 @@ out:
        }
        if (disabled) {
+                dev_close(efx->net_dev);
                EFX_ERR(efx, "has been disabled\n");
                efx->state = STATE_DISABLED;
        } else {
@@ -1884,8 +1885,7 @@ static void efx_reset_work(struct work_struct *data)
        }
        rtnl_lock();
-        if (efx_reset(efx, efx->reset_pending))
+        (void)efx_reset(efx, efx->reset_pending);
-                dev_close(efx->net_dev);
        rtnl_unlock();
 }
diff --git a/drivers/net/sfc/falcon.c b/drivers/net/sfc/falcon.c
index d294d66fd600..08278e7302b3 100644
--- a/drivers/net/sfc/falcon.c
+++ b/drivers/net/sfc/falcon.c
@@ -1320,7 +1320,9 @@ static int falcon_probe_nvconfig(struct efx_nic *efx)
        EFX_LOG(efx, "PHY is %d phy_id %d\n", efx->phy_type, efx->mdio.prtad);
-        falcon_probe_board(efx, board_rev);
+        rc = falcon_probe_board(efx, board_rev);
+        if (rc)
+                goto fail2;
        kfree(nvconfig);
        return 0;
diff --git a/drivers/net/sfc/falcon_boards.c b/drivers/net/sfc/falcon_boards.c
index 5712fddd72f2..c7a933a3292e 100644
--- a/drivers/net/sfc/falcon_boards.c
+++ b/drivers/net/sfc/falcon_boards.c
@@ -728,15 +728,7 @@ static const struct falcon_board_type board_types[] = {
        },
 };
-static const struct falcon_board_type falcon_dummy_board = {
+int falcon_probe_board(struct efx_nic *efx, u16 revision_info)
-        .init           = efx_port_dummy_op_int,
-        .init_phy       = efx_port_dummy_op_void,
-        .fini           = efx_port_dummy_op_void,
-        .set_id_led     = efx_port_dummy_op_set_id_led,
-        .monitor        = efx_port_dummy_op_int,
-};
-void falcon_probe_board(struct efx_nic *efx, u16 revision_info)
 {
        struct falcon_board *board = falcon_board(efx);
        u8 type_id = FALCON_BOARD_TYPE(revision_info);
@@ -754,8 +746,9 @@ void falcon_probe_board(struct efx_nic *efx, u16 revision_info)
                         (efx->pci_dev->subsystem_vendor == EFX_VENDID_SFC)
                         ? board->type->ref_model : board->type->gen_type,
                         'A' + board->major, board->minor);
+                return 0;
        } else {
                EFX_ERR(efx, "unknown board type %d\n", type_id);
-                board->type = &falcon_dummy_board;
+                return -ENODEV;
        }
 }
diff --git a/drivers/net/sfc/nic.h b/drivers/net/sfc/nic.h
index 9351c0331a47..3166bafdfbef 100644
--- a/drivers/net/sfc/nic.h
+++ b/drivers/net/sfc/nic.h
@@ -156,7 +156,7 @@ extern struct efx_nic_type siena_a0_nic_type;
 **************************************************************************
 */
-extern void falcon_probe_board(struct efx_nic *efx, u16 revision_info);
+extern int falcon_probe_board(struct efx_nic *efx, u16 revision_info);
 /* TX data path */
 extern int efx_nic_probe_tx(struct efx_tx_queue *tx_queue);
diff --git a/drivers/net/sfc/siena.c b/drivers/net/sfc/siena.c
index 38dcc42c4f79..e0c46f59d1f8 100644
--- a/drivers/net/sfc/siena.c
+++ b/drivers/net/sfc/siena.c
@@ -456,8 +456,17 @@ static int siena_try_update_nic_stats(struct efx_nic *efx)
 static void siena_update_nic_stats(struct efx_nic *efx)
 {
-        while (siena_try_update_nic_stats(efx) == -EAGAIN)
+        int retry;
-                cpu_relax();
+        /* If we're unlucky enough to read statistics wduring the DMA, wait
+         * up to 10ms for it to finish (typically takes <500us) */
+        for (retry = 0; retry < 100; ++retry) {
+                if (siena_try_update_nic_stats(efx) == 0)
+                        return;
+                udelay(100);
+        }
+        /* Use the old values instead */
 }
 static void siena_start_nic_stats(struct efx_nic *efx)
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 22cf1c446de3..ecc41cffb470 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -8633,6 +8633,7 @@ static int tg3_test_msi(struct tg3 *tp)
        pci_disable_msi(tp->pdev);
        tp->tg3_flags2 &= ~TG3_FLG2_USING_MSI;
+        tp->napi[0].irq_vec = tp->pdev->irq;
        err = tg3_request_irq(tp, 0);
        if (err)
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index ba56ce4382d9..d7b7018a1de1 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -385,4 +385,25 @@ config USB_CDC_PHONET
          cellular modem, as found on most Nokia handsets with the
          "PC suite" USB profile.
+config USB_IPHETH
+        tristate "Apple iPhone USB Ethernet driver"
+        default n
+        ---help---
+          Module used to share Internet connection (tethering) from your
+          iPhone (Original, 3G and 3GS) to your system.
+          Note that you need userspace libraries and programs that are needed
+          to pair your device with your system and that understand the iPhone
+          protocol.
+          For more information: http://giagio.com/wiki/moin.cgi/iPhoneEthernetDriver
+config USB_SIERRA_NET
+        tristate "USB-to-WWAN Driver for Sierra Wireless modems"
+        depends on USB_USBNET
+        help
+          Choose this option if you have a Sierra Wireless USB-to-WWAN device.
+          To compile this driver as a module, choose M here: the
+          module will be called sierra_net.
 endmenu
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index 82ea62955b56..b13a279663ba 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -23,4 +23,6 @@ obj-$(CONFIG_USB_NET_MCS7830)	+= mcs7830.o
 obj-$(CONFIG_USB_USBNET)        += usbnet.o
 obj-$(CONFIG_USB_NET_INT51X1)   += int51x1.o
 obj-$(CONFIG_USB_CDC_PHONET)    += cdc-phonet.o
+obj-$(CONFIG_USB_IPHETH)        += ipheth.o
+obj-$(CONFIG_USB_SIERRA_NET)    += sierra_net.o
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index c8cdb7f30adc..3547cf13d219 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -431,6 +431,7 @@ static const struct driver_info mbm_info = {
        .bind =         cdc_bind,
        .unbind =       usbnet_cdc_unbind,
        .status =       cdc_status,
+        .manage_power = cdc_manage_power,
 };
 /*-------------------------------------------------------------------------*/
diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c
index 04b281002a76..5dfed9297b22 100644
--- a/drivers/net/usb/dm9601.c
+++ b/drivers/net/usb/dm9601.c
@@ -240,7 +240,7 @@ static int dm_write_shared_word(struct usbnet *dev, int phy, u8 reg, __le16 valu
                goto out;
        dm_write_reg(dev, DM_SHARED_ADDR, phy ? (reg | 0x40) : reg);
-        dm_write_reg(dev, DM_SHARED_CTRL, phy ? 0x1c : 0x14);
+        dm_write_reg(dev, DM_SHARED_CTRL, phy ? 0x1a : 0x12);
        for (i = 0; i < DM_TIMEOUT; i++) {
                u8 tmp;
diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c
new file mode 100644
index 000000000000..418825d26f90
--- /dev/null
+++ b/drivers/net/usb/ipheth.c
@@ -0,0 +1,569 @@
+/*
+ * ipheth.c - Apple iPhone USB Ethernet driver
+ *
+ * Copyright (c) 2009 Diego Giagio <diego@giagio.com>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of GIAGIO.COM nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * Alternatively, provided that this notice is retained in full, this
+ * software may be distributed under the terms of the GNU General
+ * Public License ("GPL") version 2, in which case the provisions of the
+ * GPL apply INSTEAD OF those given above.
+ *
+ * The provided data structures and external interfaces from this code
+ * are not restricted to be used by modules with a GPL compatible license.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH
+ * DAMAGE.
+ *
+ *
+ * Attention: iPhone device must be paired, otherwise it won't respond to our
+ * driver. For more info: http://giagio.com/wiki/moin.cgi/iPhoneEthernetDriver
+ *
+ */
+#include <linux/kernel.h>
+#include <linux/errno.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/ethtool.h>
+#include <linux/usb.h>
+#include <linux/workqueue.h>
+#define USB_VENDOR_APPLE        0x05ac
+#define USB_PRODUCT_IPHONE      0x1290
+#define USB_PRODUCT_IPHONE_3G   0x1292
+#define USB_PRODUCT_IPHONE_3GS  0x1294
+#define IPHETH_USBINTF_CLASS    255
+#define IPHETH_USBINTF_SUBCLASS 253
+#define IPHETH_USBINTF_PROTO    1
+#define IPHETH_BUF_SIZE         1516
+#define IPHETH_TX_TIMEOUT       (5 * HZ)
+#define IPHETH_INTFNUM          2
+#define IPHETH_ALT_INTFNUM      1
+#define IPHETH_CTRL_ENDP        0x00
+#define IPHETH_CTRL_BUF_SIZE    0x40
+#define IPHETH_CTRL_TIMEOUT     (5 * HZ)
+#define IPHETH_CMD_GET_MACADDR   0x00
+#define IPHETH_CMD_CARRIER_CHECK 0x45
+#define IPHETH_CARRIER_CHECK_TIMEOUT round_jiffies_relative(1 * HZ)
+#define IPHETH_CARRIER_ON       0x04
+static struct usb_device_id ipheth_table[] = {
+        { USB_DEVICE_AND_INTERFACE_INFO(
+                USB_VENDOR_APPLE, USB_PRODUCT_IPHONE,
+                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+                IPHETH_USBINTF_PROTO) },
+        { USB_DEVICE_AND_INTERFACE_INFO(
+                USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_3G,
+                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+                IPHETH_USBINTF_PROTO) },
+        { USB_DEVICE_AND_INTERFACE_INFO(
+                USB_VENDOR_APPLE, USB_PRODUCT_IPHONE_3GS,
+                IPHETH_USBINTF_CLASS, IPHETH_USBINTF_SUBCLASS,
+                IPHETH_USBINTF_PROTO) },
+        { }
+};
+MODULE_DEVICE_TABLE(usb, ipheth_table);
+struct ipheth_device {
+        struct usb_device *udev;
+        struct usb_interface *intf;
+        struct net_device *net;
+        struct sk_buff *tx_skb;
+        struct urb *tx_urb;
+        struct urb *rx_urb;
+        unsigned char *tx_buf;
+        unsigned char *rx_buf;
+        unsigned char *ctrl_buf;
+        u8 bulk_in;
+        u8 bulk_out;
+        struct delayed_work carrier_work;
+};
+static int ipheth_rx_submit(struct ipheth_device *dev, gfp_t mem_flags);
+static int ipheth_alloc_urbs(struct ipheth_device *iphone)
+{
+        struct urb *tx_urb = NULL;
+        struct urb *rx_urb = NULL;
+        u8 *tx_buf = NULL;
+        u8 *rx_buf = NULL;
+        tx_urb = usb_alloc_urb(0, GFP_KERNEL);
+        if (tx_urb == NULL)
+                goto error_nomem;
+        rx_urb = usb_alloc_urb(0, GFP_KERNEL);
+        if (rx_urb == NULL)
+                goto free_tx_urb;
+        tx_buf = usb_buffer_alloc(iphone->udev,
+                                  IPHETH_BUF_SIZE,
+                                  GFP_KERNEL,
+                                  &tx_urb->transfer_dma);
+        if (tx_buf == NULL)
+                goto free_rx_urb;
+        rx_buf = usb_buffer_alloc(iphone->udev,
+                                  IPHETH_BUF_SIZE,
+                                  GFP_KERNEL,
+                                  &rx_urb->transfer_dma);
+        if (rx_buf == NULL)
+                goto free_tx_buf;
+        iphone->tx_urb = tx_urb;
+        iphone->rx_urb = rx_urb;
+        iphone->tx_buf = tx_buf;
+        iphone->rx_buf = rx_buf;
+        return 0;
+free_tx_buf:
+        usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, tx_buf,
+                        tx_urb->transfer_dma);
+free_rx_urb:
+        usb_free_urb(rx_urb);
+free_tx_urb:
+        usb_free_urb(tx_urb);
+error_nomem:
+        return -ENOMEM;
+}
+static void ipheth_free_urbs(struct ipheth_device *iphone)
+{
+        usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, iphone->rx_buf,
+                        iphone->rx_urb->transfer_dma);
+        usb_buffer_free(iphone->udev, IPHETH_BUF_SIZE, iphone->tx_buf,
+                        iphone->tx_urb->transfer_dma);
+        usb_free_urb(iphone->rx_urb);
+        usb_free_urb(iphone->tx_urb);
+}
+static void ipheth_kill_urbs(struct ipheth_device *dev)
+{
+        usb_kill_urb(dev->tx_urb);
+        usb_kill_urb(dev->rx_urb);
+}
+static void ipheth_rcvbulk_callback(struct urb *urb)
+{
+        struct ipheth_device *dev;
+        struct sk_buff *skb;
+        int status;
+        char *buf;
+        int len;
+        dev = urb->context;
+        if (dev == NULL)
+                return;
+        status = urb->status;
+        switch (status) {
+        case -ENOENT:
+        case -ECONNRESET:
+        case -ESHUTDOWN:
+                return;
+        case 0:
+                break;
+        default:
+                err("%s: urb status: %d", __func__, urb->status);
+                return;
+        }
+        len = urb->actual_length;
+        buf = urb->transfer_buffer;
+        skb = dev_alloc_skb(NET_IP_ALIGN + len);
+        if (!skb) {
+                err("%s: dev_alloc_skb: -ENOMEM", __func__);
+                dev->net->stats.rx_dropped++;
+                return;
+        }
+        skb_reserve(skb, NET_IP_ALIGN);
+        memcpy(skb_put(skb, len), buf + NET_IP_ALIGN, len - NET_IP_ALIGN);
+        skb->dev = dev->net;
+        skb->protocol = eth_type_trans(skb, dev->net);
+        dev->net->stats.rx_packets++;
+        dev->net->stats.rx_bytes += len;
+        netif_rx(skb);
+        ipheth_rx_submit(dev, GFP_ATOMIC);
+}
+static void ipheth_sndbulk_callback(struct urb *urb)
+{
+        struct ipheth_device *dev;
+        dev = urb->context;
+        if (dev == NULL)
+                return;
+        if (urb->status != 0 &&
+            urb->status != -ENOENT &&
+            urb->status != -ECONNRESET &&
+            urb->status != -ESHUTDOWN)
+                err("%s: urb status: %d", __func__, urb->status);
+        dev_kfree_skb_irq(dev->tx_skb);
+        netif_wake_queue(dev->net);
+}
+static int ipheth_carrier_set(struct ipheth_device *dev)
+{
+        struct usb_device *udev = dev->udev;
+        int retval;
+        retval = usb_control_msg(udev,
+                        usb_rcvctrlpipe(udev, IPHETH_CTRL_ENDP),
+                        IPHETH_CMD_CARRIER_CHECK, /* request */
+                        0xc0, /* request type */
+                        0x00, /* value */
+                        0x02, /* index */
+                        dev->ctrl_buf, IPHETH_CTRL_BUF_SIZE,
+                        IPHETH_CTRL_TIMEOUT);
+        if (retval < 0) {
+                err("%s: usb_control_msg: %d", __func__, retval);
+                return retval;
+        }
+        if (dev->ctrl_buf[0] == IPHETH_CARRIER_ON)
+                netif_carrier_on(dev->net);
+        else
+                netif_carrier_off(dev->net);
+        return 0;
+}
+static void ipheth_carrier_check_work(struct work_struct *work)
+{
+        struct ipheth_device *dev = container_of(work, struct ipheth_device,
+                                                 carrier_work.work);
+        ipheth_carrier_set(dev);
+        schedule_delayed_work(&dev->carrier_work, IPHETH_CARRIER_CHECK_TIMEOUT);
+}
+static int ipheth_get_macaddr(struct ipheth_device *dev)
+{
+        struct usb_device *udev = dev->udev;
+        struct net_device *net = dev->net;
+        int retval;
+        retval = usb_control_msg(udev,
+                                 usb_rcvctrlpipe(udev, IPHETH_CTRL_ENDP),
+                                 IPHETH_CMD_GET_MACADDR, /* request */
+                                 0xc0, /* request type */
+                                 0x00, /* value */
+                                 0x02, /* index */
+                                 dev->ctrl_buf,
+                                 IPHETH_CTRL_BUF_SIZE,
+                                 IPHETH_CTRL_TIMEOUT);
+        if (retval < 0) {
+                err("%s: usb_control_msg: %d", __func__, retval);
+        } else if (retval < ETH_ALEN) {
+                err("%s: usb_control_msg: short packet: %d bytes",
+                        __func__, retval);
+                retval = -EINVAL;
+        } else {
+                memcpy(net->dev_addr, dev->ctrl_buf, ETH_ALEN);
+                retval = 0;
+        }
+        return retval;
+}
+static int ipheth_rx_submit(struct ipheth_device *dev, gfp_t mem_flags)
+{
+        struct usb_device *udev = dev->udev;
+        int retval;
+        usb_fill_bulk_urb(dev->rx_urb, udev,
+                          usb_rcvbulkpipe(udev, dev->bulk_in),
+                          dev->rx_buf, IPHETH_BUF_SIZE,
+                          ipheth_rcvbulk_callback,
+                          dev);
+        dev->rx_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+        retval = usb_submit_urb(dev->rx_urb, mem_flags);
+        if (retval)
+                err("%s: usb_submit_urb: %d", __func__, retval);
+        return retval;
+}
+static int ipheth_open(struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+        struct usb_device *udev = dev->udev;
+        int retval = 0;
+        usb_set_interface(udev, IPHETH_INTFNUM, IPHETH_ALT_INTFNUM);
+        retval = ipheth_carrier_set(dev);
+        if (retval)
+                return retval;
+        retval = ipheth_rx_submit(dev, GFP_KERNEL);
+        if (retval)
+                return retval;
+        schedule_delayed_work(&dev->carrier_work, IPHETH_CARRIER_CHECK_TIMEOUT);
+        netif_start_queue(net);
+        return retval;
+}
+static int ipheth_close(struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+        cancel_delayed_work_sync(&dev->carrier_work);
+        netif_stop_queue(net);
+        return 0;
+}
+static int ipheth_tx(struct sk_buff *skb, struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+        struct usb_device *udev = dev->udev;
+        int retval;
+        /* Paranoid */
+        if (skb->len > IPHETH_BUF_SIZE) {
+                WARN(1, "%s: skb too large: %d bytes", __func__, skb->len);
+                dev->net->stats.tx_dropped++;
+                dev_kfree_skb_irq(skb);
+                return NETDEV_TX_OK;
+        }
+        memcpy(dev->tx_buf, skb->data, skb->len);
+        if (skb->len < IPHETH_BUF_SIZE)
+                memset(dev->tx_buf + skb->len, 0, IPHETH_BUF_SIZE - skb->len);
+        usb_fill_bulk_urb(dev->tx_urb, udev,
+                          usb_sndbulkpipe(udev, dev->bulk_out),
+                          dev->tx_buf, IPHETH_BUF_SIZE,
+                          ipheth_sndbulk_callback,
+                          dev);
+        dev->tx_urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
+        retval = usb_submit_urb(dev->tx_urb, GFP_ATOMIC);
+        if (retval) {
+                err("%s: usb_submit_urb: %d", __func__, retval);
+                dev->net->stats.tx_errors++;
+                dev_kfree_skb_irq(skb);
+        } else {
+                dev->tx_skb = skb;
+                dev->net->stats.tx_packets++;
+                dev->net->stats.tx_bytes += skb->len;
+                netif_stop_queue(net);
+        }
+        return NETDEV_TX_OK;
+}
+static void ipheth_tx_timeout(struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+        err("%s: TX timeout", __func__);
+        dev->net->stats.tx_errors++;
+        usb_unlink_urb(dev->tx_urb);
+}
+static struct net_device_stats *ipheth_stats(struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+        return &dev->net->stats;
+}
+static u32 ipheth_ethtool_op_get_link(struct net_device *net)
+{
+        struct ipheth_device *dev = netdev_priv(net);
+        return netif_carrier_ok(dev->net);
+}
+static struct ethtool_ops ops = {
+        .get_link = ipheth_ethtool_op_get_link
+};
+static const struct net_device_ops ipheth_netdev_ops = {
+        .ndo_open = &ipheth_open,
+        .ndo_stop = &ipheth_close,
+        .ndo_start_xmit = &ipheth_tx,
+        .ndo_tx_timeout = &ipheth_tx_timeout,
+        .ndo_get_stats = &ipheth_stats,
+};
+static struct device_type ipheth_type = {
+        .name   = "wwan",
+};
+static int ipheth_probe(struct usb_interface *intf,
+                        const struct usb_device_id *id)
+{
+        struct usb_device *udev = interface_to_usbdev(intf);
+        struct usb_host_interface *hintf;
+        struct usb_endpoint_descriptor *endp;
+        struct ipheth_device *dev;
+        struct net_device *netdev;
+        int i;
+        int retval;
+        netdev = alloc_etherdev(sizeof(struct ipheth_device));
+        if (!netdev)
+                return -ENOMEM;
+        netdev->netdev_ops = &ipheth_netdev_ops;
+        netdev->watchdog_timeo = IPHETH_TX_TIMEOUT;
+        strcpy(netdev->name, "wwan%d");
+        dev = netdev_priv(netdev);
+        dev->udev = udev;
+        dev->net = netdev;
+        dev->intf = intf;
+        /* Set up endpoints */
+        hintf = usb_altnum_to_altsetting(intf, IPHETH_ALT_INTFNUM);
+        if (hintf == NULL) {
+                retval = -ENODEV;
+                err("Unable to find alternate settings interface");
+                goto err_endpoints;
+        }
+        for (i = 0; i < hintf->desc.bNumEndpoints; i++) {
+                endp = &hintf->endpoint[i].desc;
+                if (usb_endpoint_is_bulk_in(endp))
+                        dev->bulk_in = endp->bEndpointAddress;
+                else if (usb_endpoint_is_bulk_out(endp))
+                        dev->bulk_out = endp->bEndpointAddress;
+        }
+        if (!(dev->bulk_in && dev->bulk_out)) {
+                retval = -ENODEV;
+                err("Unable to find endpoints");
+                goto err_endpoints;
+        }
+        dev->ctrl_buf = kmalloc(IPHETH_CTRL_BUF_SIZE, GFP_KERNEL);
+        if (dev->ctrl_buf == NULL) {
+                retval = -ENOMEM;
+                goto err_alloc_ctrl_buf;
+        }
+        retval = ipheth_get_macaddr(dev);
+        if (retval)
+                goto err_get_macaddr;
+        INIT_DELAYED_WORK(&dev->carrier_work, ipheth_carrier_check_work);
+        retval = ipheth_alloc_urbs(dev);
+        if (retval) {
+                err("error allocating urbs: %d", retval);
+                goto err_alloc_urbs;
+        }
+        usb_set_intfdata(intf, dev);
+        SET_NETDEV_DEV(netdev, &intf->dev);
+        SET_ETHTOOL_OPS(netdev, &ops);
+        SET_NETDEV_DEVTYPE(netdev, &ipheth_type);
+        retval = register_netdev(netdev);
+        if (retval) {
+                err("error registering netdev: %d", retval);
+                retval = -EIO;
+                goto err_register_netdev;
+        }
+        dev_info(&intf->dev, "Apple iPhone USB Ethernet device attached\n");
+        return 0;
+err_register_netdev:
+        ipheth_free_urbs(dev);
+err_alloc_urbs:
+err_get_macaddr:
+err_alloc_ctrl_buf:
+        kfree(dev->ctrl_buf);
+err_endpoints:
+        free_netdev(netdev);
+        return retval;
+}
+static void ipheth_disconnect(struct usb_interface *intf)
+{
+        struct ipheth_device *dev;
+        dev = usb_get_intfdata(intf);
+        if (dev != NULL) {
+                unregister_netdev(dev->net);
+                ipheth_kill_urbs(dev);
+                ipheth_free_urbs(dev);
+                kfree(dev->ctrl_buf);
+                free_netdev(dev->net);
+        }
+        usb_set_intfdata(intf, NULL);
+        dev_info(&intf->dev, "Apple iPhone USB Ethernet now disconnected\n");
+}
+static struct usb_driver ipheth_driver = {
+        .name =         "ipheth",
+        .probe =        ipheth_probe,
+        .disconnect =   ipheth_disconnect,
+        .id_table =     ipheth_table,
+};
+static int __init ipheth_init(void)
+{
+        int retval;
+        retval = usb_register(&ipheth_driver);
+        if (retval) {
+                err("usb_register failed: %d", retval);
+                return retval;
+        }
+        return 0;
+}
+static void __exit ipheth_exit(void)
+{
+        usb_deregister(&ipheth_driver);
+}
+module_init(ipheth_init);
+module_exit(ipheth_exit);
+MODULE_AUTHOR("Diego Giagio <diego@giagio.com>");
+MODULE_DESCRIPTION("Apple iPhone USB Ethernet driver");
+MODULE_LICENSE("Dual BSD/GPL");
diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
index 52671ea043a7..c4c334d9770f 100644
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -145,6 +145,7 @@ static struct usb_device_id usb_klsi_table[] = {
        { USB_DEVICE(0x0707, 0x0100) }, /* SMC 2202USB */
        { USB_DEVICE(0x07aa, 0x0001) }, /* Correga K.K. */
        { USB_DEVICE(0x07b8, 0x4000) }, /* D-Link DU-E10 */
+        { USB_DEVICE(0x07c9, 0xb010) }, /* Allied Telesyn AT-USB10 USB Ethernet Adapter */
        { USB_DEVICE(0x0846, 0x1001) }, /* NetGear EA-101 */
        { USB_DEVICE(0x0846, 0x1002) }, /* NetGear EA-101 */
        { USB_DEVICE(0x085a, 0x0008) }, /* PortGear Ethernet Adapter */
diff --git a/drivers/net/usb/sierra_net.c b/drivers/net/usb/sierra_net.c
new file mode 100644
index 000000000000..f1942d69a0d5
--- /dev/null
+++ b/drivers/net/usb/sierra_net.c
@@ -0,0 +1,1004 @@
+/*
+ * USB-to-WWAN Driver for Sierra Wireless modems
+ *
+ * Copyright (C) 2008, 2009, 2010 Paxton Smith, Matthew Safar, Rory Filer
+ *                          <linux@sierrawireless.com>
+ *
+ * Portions of this based on the cdc_ether driver by David Brownell (2003-2005)
+ * and Ole Andre Vadla Ravnas (ActiveSync) (2006).
+ *
+ * IMPORTANT DISCLAIMER: This driver is not commercially supported by
+ * Sierra Wireless. Use at your own risk.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+#define DRIVER_VERSION "v.2.0"
+#define DRIVER_AUTHOR "Paxton Smith, Matthew Safar, Rory Filer"
+#define DRIVER_DESC "USB-to-WWAN Driver for Sierra Wireless modems"
+static const char driver_name[] = "sierra_net";
+/* if defined debug messages enabled */
+/*#define       DEBUG*/
+#include <linux/module.h>
+#include <linux/etherdevice.h>
+#include <linux/ethtool.h>
+#include <linux/mii.h>
+#include <linux/sched.h>
+#include <linux/timer.h>
+#include <linux/usb.h>
+#include <linux/usb/cdc.h>
+#include <net/ip.h>
+#include <net/udp.h>
+#include <asm/unaligned.h>
+#include <linux/usb/usbnet.h>
+#define SWI_USB_REQUEST_GET_FW_ATTR     0x06
+#define SWI_GET_FW_ATTR_MASK            0x08
+/* atomic counter partially included in MAC address to make sure 2 devices
+ * do not end up with the same MAC - concept breaks in case of > 255 ifaces
+ */
+static  atomic_t iface_counter = ATOMIC_INIT(0);
+/*
+ * SYNC Timer Delay definition used to set the expiry time
+ */
+#define SIERRA_NET_SYNCDELAY (2*HZ)
+/* Max. MTU supported. The modem buffers are limited to 1500 */
+#define SIERRA_NET_MAX_SUPPORTED_MTU    1500
+/* The SIERRA_NET_USBCTL_BUF_LEN defines a buffer size allocated for control
+ * message reception ... and thus the max. received packet.
+ * (May be the cause for parse_hip returning -EINVAL)
+ */
+#define SIERRA_NET_USBCTL_BUF_LEN       1024
+/* list of interface numbers - used for constructing interface lists */
+struct sierra_net_iface_info {
+        const u32 infolen;      /* number of interface numbers on list */
+        const u8  *ifaceinfo;   /* pointer to the array holding the numbers */
+};
+struct sierra_net_info_data {
+        u16 rx_urb_size;
+        struct sierra_net_iface_info whitelist;
+};
+/* Private data structure */
+struct sierra_net_data {
+        u8 ethr_hdr_tmpl[ETH_HLEN]; /* ethernet header template for rx'd pkts */
+        u16 link_up;            /* air link up or down */
+        u8 tx_hdr_template[4];  /* part of HIP hdr for tx'd packets */
+        u8 sync_msg[4];         /* SYNC message */
+        u8 shdwn_msg[4];        /* Shutdown message */
+        /* Backpointer to the container */
+        struct usbnet *usbnet;
+        u8 ifnum;       /* interface number */
+/* Bit masks, must be a power of 2 */
+#define SIERRA_NET_EVENT_RESP_AVAIL    0x01
+#define SIERRA_NET_TIMER_EXPIRY        0x02
+        unsigned long kevent_flags;
+        struct work_struct sierra_net_kevent;
+        struct timer_list sync_timer; /* For retrying SYNC sequence */
+};
+struct param {
+        int is_present;
+        union {
+                void  *ptr;
+                u32    dword;
+                u16    word;
+                u8     byte;
+        };
+};
+/* HIP message type */
+#define SIERRA_NET_HIP_EXTENDEDID       0x7F
+#define SIERRA_NET_HIP_HSYNC_ID         0x60    /* Modem -> host */
+#define SIERRA_NET_HIP_RESTART_ID       0x62    /* Modem -> host */
+#define SIERRA_NET_HIP_MSYNC_ID         0x20    /* Host -> modem */
+#define SIERRA_NET_HIP_SHUTD_ID         0x26    /* Host -> modem */
+#define SIERRA_NET_HIP_EXT_IP_IN_ID   0x0202
+#define SIERRA_NET_HIP_EXT_IP_OUT_ID  0x0002
+/* 3G UMTS Link Sense Indication definitions */
+#define SIERRA_NET_HIP_LSI_UMTSID       0x78
+/* Reverse Channel Grant Indication HIP message */
+#define SIERRA_NET_HIP_RCGI             0x64
+/* LSI Protocol types */
+#define SIERRA_NET_PROTOCOL_UMTS      0x01
+/* LSI Coverage */
+#define SIERRA_NET_COVERAGE_NONE      0x00
+#define SIERRA_NET_COVERAGE_NOPACKET  0x01
+/* LSI Session */
+#define SIERRA_NET_SESSION_IDLE       0x00
+/* LSI Link types */
+#define SIERRA_NET_AS_LINK_TYPE_IPv4  0x00
+struct lsi_umts {
+        u8 protocol;
+        u8 unused1;
+        __be16 length;
+        /* eventually use a union for the rest - assume umts for now */
+        u8 coverage;
+        u8 unused2[41];
+        u8 session_state;
+        u8 unused3[33];
+        u8 link_type;
+        u8 pdp_addr_len; /* NW-supplied PDP address len */
+        u8 pdp_addr[16]; /* NW-supplied PDP address (bigendian)) */
+        u8 unused4[23];
+        u8 dns1_addr_len; /* NW-supplied 1st DNS address len (bigendian) */
+        u8 dns1_addr[16]; /* NW-supplied 1st DNS address */
+        u8 dns2_addr_len; /* NW-supplied 2nd DNS address len */
+        u8 dns2_addr[16]; /* NW-supplied 2nd DNS address (bigendian)*/
+        u8 wins1_addr_len; /* NW-supplied 1st Wins address len */
+        u8 wins1_addr[16]; /* NW-supplied 1st Wins address (bigendian)*/
+        u8 wins2_addr_len; /* NW-supplied 2nd Wins address len */
+        u8 wins2_addr[16]; /* NW-supplied 2nd Wins address (bigendian) */
+        u8 unused5[4];
+        u8 gw_addr_len; /* NW-supplied GW address len */
+        u8 gw_addr[16]; /* NW-supplied GW address (bigendian) */
+        u8 reserved[8];
+} __attribute__ ((packed));
+#define SIERRA_NET_LSI_COMMON_LEN      4
+#define SIERRA_NET_LSI_UMTS_LEN        (sizeof(struct lsi_umts))
+#define SIERRA_NET_LSI_UMTS_STATUS_LEN \
+        (SIERRA_NET_LSI_UMTS_LEN - SIERRA_NET_LSI_COMMON_LEN)
+/* Forward definitions */
+static void sierra_sync_timer(unsigned long syncdata);
+static int sierra_net_change_mtu(struct net_device *net, int new_mtu);
+/* Our own net device operations structure */
+static const struct net_device_ops sierra_net_device_ops = {
+        .ndo_open               = usbnet_open,
+        .ndo_stop               = usbnet_stop,
+        .ndo_start_xmit         = usbnet_start_xmit,
+        .ndo_tx_timeout         = usbnet_tx_timeout,
+        .ndo_change_mtu         = sierra_net_change_mtu,
+        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_validate_addr      = eth_validate_addr,
+};
+/* get private data associated with passed in usbnet device */
+static inline struct sierra_net_data *sierra_net_get_private(struct usbnet *dev)
+{
+        return (struct sierra_net_data *)dev->data[0];
+}
+/* set private data associated with passed in usbnet device */
+static inline void sierra_net_set_private(struct usbnet *dev,
+                        struct sierra_net_data *priv)
+{
+        dev->data[0] = (unsigned long)priv;
+}
+/* is packet IPv4 */
+static inline int is_ip(struct sk_buff *skb)
+{
+        return (skb->protocol == cpu_to_be16(ETH_P_IP));
+}
+/*
+ * check passed in packet and make sure that:
+ *  - it is linear (no scatter/gather)
+ *  - it is ethernet (mac_header properly set)
+ */
+static int check_ethip_packet(struct sk_buff *skb, struct usbnet *dev)
+{
+        skb_reset_mac_header(skb); /* ethernet header */
+        if (skb_is_nonlinear(skb)) {
+                netdev_err(dev->net, "Non linear buffer-dropping\n");
+                return 0;
+        }
+        if (!pskb_may_pull(skb, ETH_HLEN))
+                return 0;
+        skb->protocol = eth_hdr(skb)->h_proto;
+        return 1;
+}
+static const u8 *save16bit(struct param *p, const u8 *datap)
+{
+        p->is_present = 1;
+        p->word = get_unaligned_be16(datap);
+        return datap + sizeof(p->word);
+}
+static const u8 *save8bit(struct param *p, const u8 *datap)
+{
+        p->is_present = 1;
+        p->byte = *datap;
+        return datap + sizeof(p->byte);
+}
+/*----------------------------------------------------------------------------*
+ *                              BEGIN HIP                                     *
+ *----------------------------------------------------------------------------*/
+/* HIP header */
+#define SIERRA_NET_HIP_HDR_LEN 4
+/* Extended HIP header */
+#define SIERRA_NET_HIP_EXT_HDR_LEN 6
+struct hip_hdr {
+        int    hdrlen;
+        struct param payload_len;
+        struct param msgid;
+        struct param msgspecific;
+        struct param extmsgid;
+};
+static int parse_hip(const u8 *buf, const u32 buflen, struct hip_hdr *hh)
+{
+        const u8 *curp = buf;
+        int    padded;
+        if (buflen < SIERRA_NET_HIP_HDR_LEN)
+                return -EPROTO;
+        curp = save16bit(&hh->payload_len, curp);
+        curp = save8bit(&hh->msgid, curp);
+        curp = save8bit(&hh->msgspecific, curp);
+        padded = hh->msgid.byte & 0x80;
+        hh->msgid.byte &= 0x7F;                 /* 7 bits */
+        hh->extmsgid.is_present = (hh->msgid.byte == SIERRA_NET_HIP_EXTENDEDID);
+        if (hh->extmsgid.is_present) {
+                if (buflen < SIERRA_NET_HIP_EXT_HDR_LEN)
+                        return -EPROTO;
+                hh->payload_len.word &= 0x3FFF; /* 14 bits */
+                curp = save16bit(&hh->extmsgid, curp);
+                hh->extmsgid.word &= 0x03FF;    /* 10 bits */
+                hh->hdrlen = SIERRA_NET_HIP_EXT_HDR_LEN;
+        } else {
+                hh->payload_len.word &= 0x07FF; /* 11 bits */
+                hh->hdrlen = SIERRA_NET_HIP_HDR_LEN;
+        }
+        if (padded) {
+                hh->hdrlen++;
+                hh->payload_len.word--;
+        }
+        /* if real packet shorter than the claimed length */
+        if (buflen < (hh->hdrlen + hh->payload_len.word))
+                return -EINVAL;
+        return 0;
+}
+static void build_hip(u8 *buf, const u16 payloadlen,
+                struct sierra_net_data *priv)
+{
+        /* the following doesn't have the full functionality. We
+         * currently build only one kind of header, so it is faster this way
+         */
+        put_unaligned_be16(payloadlen, buf);
+        memcpy(buf+2, priv->tx_hdr_template, sizeof(priv->tx_hdr_template));
+}
+/*----------------------------------------------------------------------------*
+ *                              END HIP                                       *
+ *----------------------------------------------------------------------------*/
+static int sierra_net_send_cmd(struct usbnet *dev,
+                u8 *cmd, int cmdlen, const char * cmd_name)
+{
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+        int  status;
+        status = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0),
+                        USB_CDC_SEND_ENCAPSULATED_COMMAND,
+                        USB_DIR_OUT|USB_TYPE_CLASS|USB_RECIP_INTERFACE, 0,
+                        priv->ifnum, cmd, cmdlen, USB_CTRL_SET_TIMEOUT);
+        if (status != cmdlen && status != -ENODEV)
+                netdev_err(dev->net, "Submit %s failed %d\n", cmd_name, status);
+        return status;
+}
+static int sierra_net_send_sync(struct usbnet *dev)
+{
+        int  status;
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+        status = sierra_net_send_cmd(dev, priv->sync_msg,
+                        sizeof(priv->sync_msg), "SYNC");
+        return status;
+}
+static void sierra_net_set_ctx_index(struct sierra_net_data *priv, u8 ctx_ix)
+{
+        dev_dbg(&(priv->usbnet->udev->dev), "%s %d", __func__, ctx_ix);
+        priv->tx_hdr_template[0] = 0x3F;
+        priv->tx_hdr_template[1] = ctx_ix;
+        *((u16 *)&priv->tx_hdr_template[2]) =
+                cpu_to_be16(SIERRA_NET_HIP_EXT_IP_OUT_ID);
+}
+static inline int sierra_net_is_valid_addrlen(u8 len)
+{
+        return (len == sizeof(struct in_addr));
+}
+static int sierra_net_parse_lsi(struct usbnet *dev, char *data, int datalen)
+{
+        struct lsi_umts *lsi = (struct lsi_umts *)data;
+        if (datalen < sizeof(struct lsi_umts)) {
+                netdev_err(dev->net, "%s: Data length %d, exp %Zu\n",
+                                __func__, datalen,
+                                sizeof(struct lsi_umts));
+                return -1;
+        }
+        if (lsi->length != cpu_to_be16(SIERRA_NET_LSI_UMTS_STATUS_LEN)) {
+                netdev_err(dev->net, "%s: LSI_UMTS_STATUS_LEN %d, exp %u\n",
+                                __func__, be16_to_cpu(lsi->length),
+                                (u32)SIERRA_NET_LSI_UMTS_STATUS_LEN);
+                return -1;
+        }
+        /* Validate the protocol  - only support UMTS for now */
+        if (lsi->protocol != SIERRA_NET_PROTOCOL_UMTS) {
+                netdev_err(dev->net, "Protocol unsupported, 0x%02x\n",
+                        lsi->protocol);
+                return -1;
+        }
+        /* Validate the link type */
+        if (lsi->link_type != SIERRA_NET_AS_LINK_TYPE_IPv4) {
+                netdev_err(dev->net, "Link type unsupported: 0x%02x\n",
+                        lsi->link_type);
+                return -1;
+        }
+        /* Validate the coverage */
+        if (lsi->coverage == SIERRA_NET_COVERAGE_NONE
+           || lsi->coverage == SIERRA_NET_COVERAGE_NOPACKET) {
+                netdev_err(dev->net, "No coverage, 0x%02x\n", lsi->coverage);
+                return 0;
+        }
+        /* Validate the session state */
+        if (lsi->session_state == SIERRA_NET_SESSION_IDLE) {
+                netdev_err(dev->net, "Session idle, 0x%02x\n",
+                        lsi->session_state);
+                return 0;
+        }
+        /* Set link_sense true */
+        return 1;
+}
+static void sierra_net_handle_lsi(struct usbnet *dev, char *data,
+                struct hip_hdr  *hh)
+{
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+        int link_up;
+        link_up = sierra_net_parse_lsi(dev, data + hh->hdrlen,
+                                        hh->payload_len.word);
+        if (link_up < 0) {
+                netdev_err(dev->net, "Invalid LSI\n");
+                return;
+        }
+        if (link_up) {
+                sierra_net_set_ctx_index(priv, hh->msgspecific.byte);
+                priv->link_up = 1;
+                netif_carrier_on(dev->net);
+        } else {
+                priv->link_up = 0;
+                netif_carrier_off(dev->net);
+        }
+}
+static void sierra_net_dosync(struct usbnet *dev)
+{
+        int status;
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+        /* tell modem we are ready */
+        status = sierra_net_send_sync(dev);
+        if (status < 0)
+                netdev_err(dev->net,
+                        "Send SYNC failed, status %d\n", status);
+        status = sierra_net_send_sync(dev);
+        if (status < 0)
+                netdev_err(dev->net,
+                        "Send SYNC failed, status %d\n", status);
+        /* Now, start a timer and make sure we get the Restart Indication */
+        priv->sync_timer.function = sierra_sync_timer;
+        priv->sync_timer.data = (unsigned long) dev;
+        priv->sync_timer.expires = jiffies + SIERRA_NET_SYNCDELAY;
+        add_timer(&priv->sync_timer);
+}
+static void sierra_net_kevent(struct work_struct *work)
+{
+        struct sierra_net_data *priv =
+                container_of(work, struct sierra_net_data, sierra_net_kevent);
+        struct usbnet *dev = priv->usbnet;
+        int  len;
+        int  err;
+        u8  *buf;
+        u8   ifnum;
+        if (test_bit(SIERRA_NET_EVENT_RESP_AVAIL, &priv->kevent_flags)) {
+                clear_bit(SIERRA_NET_EVENT_RESP_AVAIL, &priv->kevent_flags);
+                /* Query the modem for the LSI message */
+                buf = kzalloc(SIERRA_NET_USBCTL_BUF_LEN, GFP_KERNEL);
+                if (!buf) {
+                        netdev_err(dev->net,
+                                "failed to allocate buf for LS msg\n");
+                        return;
+                }
+                ifnum = priv->ifnum;
+                len = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0),
+                                USB_CDC_GET_ENCAPSULATED_RESPONSE,
+                                USB_DIR_IN|USB_TYPE_CLASS|USB_RECIP_INTERFACE,
+                                0, ifnum, buf, SIERRA_NET_USBCTL_BUF_LEN,
+                                USB_CTRL_SET_TIMEOUT);
+                if (len < 0) {
+                        netdev_err(dev->net,
+                                "usb_control_msg failed, status %d\n", len);
+                } else {
+                        struct hip_hdr  hh;
+                        dev_dbg(&dev->udev->dev, "%s: Received status message,"
+                                " %04x bytes", __func__, len);
+                        err = parse_hip(buf, len, &hh);
+                        if (err) {
+                                netdev_err(dev->net, "%s: Bad packet,"
+                                        " parse result %d\n", __func__, err);
+                                kfree(buf);
+                                return;
+                        }
+                        /* Validate packet length */
+                        if (len != hh.hdrlen + hh.payload_len.word) {
+                                netdev_err(dev->net, "%s: Bad packet, received"
+                                        " %d, expected %d\n",   __func__, len,
+                                        hh.hdrlen + hh.payload_len.word);
+                                kfree(buf);
+                                return;
+                        }
+                        /* Switch on received message types */
+                        switch (hh.msgid.byte) {
+                        case SIERRA_NET_HIP_LSI_UMTSID:
+                                dev_dbg(&dev->udev->dev, "LSI for ctx:%d",
+                                        hh.msgspecific.byte);
+                                sierra_net_handle_lsi(dev, buf, &hh);
+                                break;
+                        case SIERRA_NET_HIP_RESTART_ID:
+                                dev_dbg(&dev->udev->dev, "Restart reported: %d,"
+                                                " stopping sync timer",
+                                                hh.msgspecific.byte);
+                                /* Got sync resp - stop timer & clear mask */
+                                del_timer_sync(&priv->sync_timer);
+                                clear_bit(SIERRA_NET_TIMER_EXPIRY,
+                                          &priv->kevent_flags);
+                                break;
+                        case SIERRA_NET_HIP_HSYNC_ID:
+                                dev_dbg(&dev->udev->dev, "SYNC received");
+                                err = sierra_net_send_sync(dev);
+                                if (err < 0)
+                                        netdev_err(dev->net,
+                                                "Send SYNC failed %d\n", err);
+                                break;
+                        case SIERRA_NET_HIP_EXTENDEDID:
+                                netdev_err(dev->net, "Unrecognized HIP msg, "
+                                        "extmsgid 0x%04x\n", hh.extmsgid.word);
+                                break;
+                        case SIERRA_NET_HIP_RCGI:
+                                /* Ignored */
+                                break;
+                        default:
+                                netdev_err(dev->net, "Unrecognized HIP msg, "
+                                        "msgid 0x%02x\n", hh.msgid.byte);
+                                break;
+                        }
+                }
+                kfree(buf);
+        }
+        /* The sync timer bit might be set */
+        if (test_bit(SIERRA_NET_TIMER_EXPIRY, &priv->kevent_flags)) {
+                clear_bit(SIERRA_NET_TIMER_EXPIRY, &priv->kevent_flags);
+                dev_dbg(&dev->udev->dev, "Deferred sync timer expiry");
+                sierra_net_dosync(priv->usbnet);
+        }
+        if (priv->kevent_flags)
+                dev_dbg(&dev->udev->dev, "sierra_net_kevent done, "
+                        "kevent_flags = 0x%lx", priv->kevent_flags);
+}
+static void sierra_net_defer_kevent(struct usbnet *dev, int work)
+{
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+        set_bit(work, &priv->kevent_flags);
+        schedule_work(&priv->sierra_net_kevent);
+}
+/*
+ * Sync Retransmit Timer Handler. On expiry, kick the work queue
+ */
+void sierra_sync_timer(unsigned long syncdata)
+{
+        struct usbnet *dev = (struct usbnet *)syncdata;
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+        /* Kick the tasklet */
+        sierra_net_defer_kevent(dev, SIERRA_NET_TIMER_EXPIRY);
+}
+static void sierra_net_status(struct usbnet *dev, struct urb *urb)
+{
+        struct usb_cdc_notification *event;
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+        if (urb->actual_length < sizeof *event)
+                return;
+        /* Add cases to handle other standard notifications. */
+        event = urb->transfer_buffer;
+        switch (event->bNotificationType) {
+        case USB_CDC_NOTIFY_NETWORK_CONNECTION:
+        case USB_CDC_NOTIFY_SPEED_CHANGE:
+                /* USB 305 sends those */
+                break;
+        case USB_CDC_NOTIFY_RESPONSE_AVAILABLE:
+                sierra_net_defer_kevent(dev, SIERRA_NET_EVENT_RESP_AVAIL);
+                break;
+        default:
+                netdev_err(dev->net, ": unexpected notification %02x!\n",
+                                event->bNotificationType);
+                break;
+        }
+}
+static void sierra_net_get_drvinfo(struct net_device *net,
+                struct ethtool_drvinfo *info)
+{
+        /* Inherit standard device info */
+        usbnet_get_drvinfo(net, info);
+        strncpy(info->driver, driver_name, sizeof info->driver);
+        strncpy(info->version, DRIVER_VERSION, sizeof info->version);
+}
+static u32 sierra_net_get_link(struct net_device *net)
+{
+        struct usbnet *dev = netdev_priv(net);
+        /* Report link is down whenever the interface is down */
+        return sierra_net_get_private(dev)->link_up && netif_running(net);
+}
+static struct ethtool_ops sierra_net_ethtool_ops = {
+        .get_drvinfo = sierra_net_get_drvinfo,
+        .get_link = sierra_net_get_link,
+        .get_msglevel = usbnet_get_msglevel,
+        .set_msglevel = usbnet_set_msglevel,
+        .get_settings = usbnet_get_settings,
+        .set_settings = usbnet_set_settings,
+        .nway_reset = usbnet_nway_reset,
+};
+/* MTU can not be more than 1500 bytes, enforce it. */
+static int sierra_net_change_mtu(struct net_device *net, int new_mtu)
+{
+        if (new_mtu > SIERRA_NET_MAX_SUPPORTED_MTU)
+                return -EINVAL;
+        return usbnet_change_mtu(net, new_mtu);
+}
+static int is_whitelisted(const u8 ifnum,
+                        const struct sierra_net_iface_info *whitelist)
+{
+        if (whitelist) {
+                const u8 *list = whitelist->ifaceinfo;
+                int i;
+                for (i = 0; i < whitelist->infolen; i++) {
+                        if (list[i] == ifnum)
+                                return 1;
+                }
+        }
+        return 0;
+}
+static int sierra_net_get_fw_attr(struct usbnet *dev, u16 *datap)
+{
+        int result = 0;
+        u16 *attrdata;
+        attrdata = kmalloc(sizeof(*attrdata), GFP_KERNEL);
+        if (!attrdata)
+                return -ENOMEM;
+        result = usb_control_msg(
+                        dev->udev,
+                        usb_rcvctrlpipe(dev->udev, 0),
+                        /* _u8 vendor specific request */
+                        SWI_USB_REQUEST_GET_FW_ATTR,
+                        USB_DIR_IN | USB_TYPE_VENDOR,   /* __u8 request type */
+                        0x0000,         /* __u16 value not used */
+                        0x0000,         /* __u16 index  not used */
+                        attrdata,       /* char *data */
+                        sizeof(*attrdata),              /* __u16 size */
+                        USB_CTRL_SET_TIMEOUT);  /* int timeout */
+        if (result < 0) {
+                kfree(attrdata);
+                return -EIO;
+        }
+        *datap = *attrdata;
+        kfree(attrdata);
+        return result;
+}
+/*
+ * collects the bulk endpoints, the status endpoint.
+ */
+static int sierra_net_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        u8      ifacenum;
+        u8      numendpoints;
+        u16     fwattr = 0;
+        int     status;
+        struct ethhdr *eth;
+        struct sierra_net_data *priv;
+        static const u8 sync_tmplate[sizeof(priv->sync_msg)] = {
+                0x00, 0x00, SIERRA_NET_HIP_MSYNC_ID, 0x00};
+        static const u8 shdwn_tmplate[sizeof(priv->shdwn_msg)] = {
+                0x00, 0x00, SIERRA_NET_HIP_SHUTD_ID, 0x00};
+        struct sierra_net_info_data *data =
+                        (struct sierra_net_info_data *)dev->driver_info->data;
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+        ifacenum = intf->cur_altsetting->desc.bInterfaceNumber;
+        /* We only accept certain interfaces */
+        if (!is_whitelisted(ifacenum, &data->whitelist)) {
+                dev_dbg(&dev->udev->dev, "Ignoring interface: %d", ifacenum);
+                return -ENODEV;
+        }
+        numendpoints = intf->cur_altsetting->desc.bNumEndpoints;
+        /* We have three endpoints, bulk in and out, and a status */
+        if (numendpoints != 3) {
+                dev_err(&dev->udev->dev, "Expected 3 endpoints, found: %d",
+                        numendpoints);
+                return -ENODEV;
+        }
+        /* Status endpoint set in usbnet_get_endpoints() */
+        dev->status = NULL;
+        status = usbnet_get_endpoints(dev, intf);
+        if (status < 0) {
+                dev_err(&dev->udev->dev, "Error in usbnet_get_endpoints (%d)",
+                        status);
+                return -ENODEV;
+        }
+        /* Initialize sierra private data */
+        priv = kzalloc(sizeof *priv, GFP_KERNEL);
+        if (!priv) {
+                dev_err(&dev->udev->dev, "No memory");
+                return -ENOMEM;
+        }
+        priv->usbnet = dev;
+        priv->ifnum = ifacenum;
+        dev->net->netdev_ops = &sierra_net_device_ops;
+        /* change MAC addr to include, ifacenum, and to be unique */
+        dev->net->dev_addr[ETH_ALEN-2] = atomic_inc_return(&iface_counter);
+        dev->net->dev_addr[ETH_ALEN-1] = ifacenum;
+        /* we will have to manufacture ethernet headers, prepare template */
+        eth = (struct ethhdr *)priv->ethr_hdr_tmpl;
+        memcpy(&eth->h_dest, dev->net->dev_addr, ETH_ALEN);
+        eth->h_proto = cpu_to_be16(ETH_P_IP);
+        /* prepare shutdown message template */
+        memcpy(priv->shdwn_msg, shdwn_tmplate, sizeof(priv->shdwn_msg));
+        /* set context index initially to 0 - prepares tx hdr template */
+        sierra_net_set_ctx_index(priv, 0);
+        /* decrease the rx_urb_size and max_tx_size to 4k on USB 1.1 */
+        dev->rx_urb_size  = data->rx_urb_size;
+        if (dev->udev->speed != USB_SPEED_HIGH)
+                dev->rx_urb_size  = min_t(size_t, 4096, data->rx_urb_size);
+        dev->net->hard_header_len += SIERRA_NET_HIP_EXT_HDR_LEN;
+        dev->hard_mtu = dev->net->mtu + dev->net->hard_header_len;
+        /* Set up the netdev */
+        dev->net->flags |= IFF_NOARP;
+        dev->net->ethtool_ops = &sierra_net_ethtool_ops;
+        netif_carrier_off(dev->net);
+        sierra_net_set_private(dev, priv);
+        priv->kevent_flags = 0;
+        /* Use the shared workqueue */
+        INIT_WORK(&priv->sierra_net_kevent, sierra_net_kevent);
+        /* Only need to do this once */
+        init_timer(&priv->sync_timer);
+        /* verify fw attributes */
+        status = sierra_net_get_fw_attr(dev, &fwattr);
+        dev_dbg(&dev->udev->dev, "Fw attr: %x\n", fwattr);
+        /* test whether firmware supports DHCP */
+        if (!(status == sizeof(fwattr) && (fwattr & SWI_GET_FW_ATTR_MASK))) {
+                /* found incompatible firmware version */
+                dev_err(&dev->udev->dev, "Incompatible driver and firmware"
+                        " versions\n");
+                kfree(priv);
+                return -ENODEV;
+        }
+        /* prepare sync message from template */
+        memcpy(priv->sync_msg, sync_tmplate, sizeof(priv->sync_msg));
+        /* initiate the sync sequence */
+        sierra_net_dosync(dev);
+        return 0;
+}
+static void sierra_net_unbind(struct usbnet *dev, struct usb_interface *intf)
+{
+        int status;
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+        /* Kill the timer then flush the work queue */
+        del_timer_sync(&priv->sync_timer);
+        flush_scheduled_work();
+        /* tell modem we are going away */
+        status = sierra_net_send_cmd(dev, priv->shdwn_msg,
+                        sizeof(priv->shdwn_msg), "Shutdown");
+        if (status < 0)
+                netdev_err(dev->net,
+                        "usb_control_msg failed, status %d\n", status);
+        sierra_net_set_private(dev, NULL);
+        kfree(priv);
+}
+static struct sk_buff *sierra_net_skb_clone(struct usbnet *dev,
+                struct sk_buff *skb, int len)
+{
+        struct sk_buff *new_skb;
+        /* clone skb */
+        new_skb = skb_clone(skb, GFP_ATOMIC);
+        /* remove len bytes from original */
+        skb_pull(skb, len);
+        /* trim next packet to it's length */
+        if (new_skb) {
+                skb_trim(new_skb, len);
+        } else {
+                if (netif_msg_rx_err(dev))
+                        netdev_err(dev->net, "failed to get skb\n");
+                dev->net->stats.rx_dropped++;
+        }
+        return new_skb;
+}
+/* ---------------------------- Receive data path ----------------------*/
+static int sierra_net_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+{
+        int err;
+        struct hip_hdr  hh;
+        struct sk_buff *new_skb;
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+        /* could contain multiple packets */
+        while (likely(skb->len)) {
+                err = parse_hip(skb->data, skb->len, &hh);
+                if (err) {
+                        if (netif_msg_rx_err(dev))
+                                netdev_err(dev->net, "Invalid HIP header %d\n",
+                                        err);
+                        /* dev->net->stats.rx_errors incremented by caller */
+                        dev->net->stats.rx_length_errors++;
+                        return 0;
+                }
+                /* Validate Extended HIP header */
+                if (!hh.extmsgid.is_present
+                    || hh.extmsgid.word != SIERRA_NET_HIP_EXT_IP_IN_ID) {
+                        if (netif_msg_rx_err(dev))
+                                netdev_err(dev->net, "HIP/ETH: Invalid pkt\n");
+                        dev->net->stats.rx_frame_errors++;
+                        /* dev->net->stats.rx_errors incremented by caller */;
+                        return 0;
+                }
+                skb_pull(skb, hh.hdrlen);
+                /* We are going to accept this packet, prepare it */
+                memcpy(skb->data, sierra_net_get_private(dev)->ethr_hdr_tmpl,
+                        ETH_HLEN);
+                /* Last packet in batch handled by usbnet */
+                if (hh.payload_len.word == skb->len)
+                        return 1;
+                new_skb = sierra_net_skb_clone(dev, skb, hh.payload_len.word);
+                if (new_skb)
+                        usbnet_skb_return(dev, new_skb);
+        } /* while */
+        return 0;
+}
+/* ---------------------------- Transmit data path ----------------------*/
+struct sk_buff *sierra_net_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
+                gfp_t flags)
+{
+        struct sierra_net_data *priv = sierra_net_get_private(dev);
+        u16 len;
+        bool need_tail;
+        dev_dbg(&dev->udev->dev, "%s", __func__);
+        if (priv->link_up && check_ethip_packet(skb, dev) && is_ip(skb)) {
+                /* enough head room as is? */
+                if (SIERRA_NET_HIP_EXT_HDR_LEN <= skb_headroom(skb)) {
+                        /* Save the Eth/IP length and set up HIP hdr */
+                        len = skb->len;
+                        skb_push(skb, SIERRA_NET_HIP_EXT_HDR_LEN);
+                        /* Handle ZLP issue */
+                        need_tail = ((len + SIERRA_NET_HIP_EXT_HDR_LEN)
+                                % dev->maxpacket == 0);
+                        if (need_tail) {
+                                if (unlikely(skb_tailroom(skb) == 0)) {
+                                        netdev_err(dev->net, "tx_fixup:"
+                                                "no room for packet\n");
+                                        dev_kfree_skb_any(skb);
+                                        return NULL;
+                                } else {
+                                        skb->data[skb->len] = 0;
+                                        __skb_put(skb, 1);
+                                        len = len + 1;
+                                }
+                        }
+                        build_hip(skb->data, len, priv);
+                        return skb;
+                } else {
+                        /*
+                         * compensate in the future if necessary
+                         */
+                        netdev_err(dev->net, "tx_fixup: no room for HIP\n");
+                } /* headroom */
+        }
+        if (!priv->link_up)
+                dev->net->stats.tx_carrier_errors++;
+        /* tx_dropped incremented by usbnet */
+        /* filter the packet out, release it  */
+        dev_kfree_skb_any(skb);
+        return NULL;
+}
+static const u8 sierra_net_ifnum_list[] = { 7, 10, 11 };
+static const struct sierra_net_info_data sierra_net_info_data_68A3 = {
+        .rx_urb_size = 8 * 1024,
+        .whitelist = {
+                .infolen = ARRAY_SIZE(sierra_net_ifnum_list),
+                .ifaceinfo = sierra_net_ifnum_list
+        }
+};
+static const struct driver_info sierra_net_info_68A3 = {
+        .description = "Sierra Wireless USB-to-WWAN Modem",
+        .flags = FLAG_WWAN | FLAG_SEND_ZLP,
+        .bind = sierra_net_bind,
+        .unbind = sierra_net_unbind,
+        .status = sierra_net_status,
+        .rx_fixup = sierra_net_rx_fixup,
+        .tx_fixup = sierra_net_tx_fixup,
+        .data = (unsigned long)&sierra_net_info_data_68A3,
+};
+static const struct usb_device_id products[] = {
+        {USB_DEVICE(0x1199, 0x68A3), /* Sierra Wireless USB-to-WWAN modem */
+        .driver_info = (unsigned long) &sierra_net_info_68A3},
+        {}, /* last item */
+};
+MODULE_DEVICE_TABLE(usb, products);
+/* We are based on usbnet, so let it handle the USB driver specifics */
+static struct usb_driver sierra_net_driver = {
+        .name = "sierra_net",
+        .id_table = products,
+        .probe = usbnet_probe,
+        .disconnect = usbnet_disconnect,
+        .suspend = usbnet_suspend,
+        .resume = usbnet_resume,
+        .no_dynamic_id = 1,
+};
+static int __init sierra_net_init(void)
+{
+        BUILD_BUG_ON(FIELD_SIZEOF(struct usbnet, data)
+                                < sizeof(struct cdc_state));
+        return usb_register(&sierra_net_driver);
+}
+static void __exit sierra_net_exit(void)
+{
+        usb_deregister(&sierra_net_driver);
+}
+module_exit(sierra_net_exit);
+module_init(sierra_net_init);
+MODULE_AUTHOR(DRIVER_AUTHOR);
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_VERSION(DRIVER_VERSION);
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index c4844adff92a..92b3e64fc14d 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -259,7 +259,7 @@ static struct iwl_lib_ops iwl6000_lib = {
                        EEPROM_5000_REG_BAND_3_CHANNELS,
                        EEPROM_5000_REG_BAND_4_CHANNELS,
                        EEPROM_5000_REG_BAND_5_CHANNELS,
-                        EEPROM_5000_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
                        EEPROM_5000_REG_BAND_52_HT40_CHANNELS
                },
                .verify_signature  = iwlcore_eeprom_verify_signature,
@@ -323,7 +323,7 @@ static struct iwl_lib_ops iwl6050_lib = {
                        EEPROM_5000_REG_BAND_3_CHANNELS,
                        EEPROM_5000_REG_BAND_4_CHANNELS,
                        EEPROM_5000_REG_BAND_5_CHANNELS,
-                        EEPROM_5000_REG_BAND_24_HT40_CHANNELS,
+                        EEPROM_6000_REG_BAND_24_HT40_CHANNELS,
                        EEPROM_5000_REG_BAND_52_HT40_CHANNELS
                },
                .verify_signature  = iwlcore_eeprom_verify_signature,
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 8b8e3e1cbb44..bdff56583e11 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -3331,6 +3331,7 @@ static void iwl_cancel_deferred_work(struct iwl_priv *priv)
        cancel_delayed_work_sync(&priv->init_alive_start);
        cancel_delayed_work(&priv->scan_check);
+        cancel_work_sync(&priv->start_internal_scan);
        cancel_delayed_work(&priv->alive_start);
        cancel_work_sync(&priv->beacon_update);
        del_timer_sync(&priv->statistics_periodic);
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 3352f7086632..049b652bcb5e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -3358,7 +3358,6 @@ static void iwl_force_rf_reset(struct iwl_priv *priv)
         */
        IWL_DEBUG_INFO(priv, "perform radio reset.\n");
        iwl_internal_short_hw_scan(priv);
-        return;
 }
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index 732590f5fe30..36940a9ec6b9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -506,7 +506,7 @@ void iwl_init_scan_params(struct iwl_priv *priv);
 int iwl_scan_cancel(struct iwl_priv *priv);
 int iwl_scan_cancel_timeout(struct iwl_priv *priv, unsigned long ms);
 int iwl_mac_hw_scan(struct ieee80211_hw *hw, struct cfg80211_scan_request *req);
-int iwl_internal_short_hw_scan(struct iwl_priv *priv);
+void iwl_internal_short_hw_scan(struct iwl_priv *priv);
 int iwl_force_reset(struct iwl_priv *priv, int mode);
 u16 iwl_fill_probe_req(struct iwl_priv *priv, struct ieee80211_mgmt *frame,
                       const u8 *ie, int ie_len, int left);
diff --git a/drivers/net/wireless/iwlwifi/iwl-dev.h b/drivers/net/wireless/iwlwifi/iwl-dev.h
index 6054c5fba0c1..ef1720a852e9 100644
--- a/drivers/net/wireless/iwlwifi/iwl-dev.h
+++ b/drivers/net/wireless/iwlwifi/iwl-dev.h
@@ -1296,6 +1296,7 @@ struct iwl_priv {
        struct work_struct tt_work;
        struct work_struct ct_enter;
        struct work_struct ct_exit;
+        struct work_struct start_internal_scan;
        struct tasklet_struct irq_tasklet;
diff --git a/drivers/net/wireless/iwlwifi/iwl-eeprom.h b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
index 4e1ba824dc50..8171c701e4e1 100644
--- a/drivers/net/wireless/iwlwifi/iwl-eeprom.h
+++ b/drivers/net/wireless/iwlwifi/iwl-eeprom.h
@@ -203,6 +203,10 @@ struct iwl_eeprom_enhanced_txpwr {
 #define EEPROM_5000_REG_BAND_52_HT40_CHANNELS  ((0x92)\
                | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 22  bytes */
+/* 6000 regulatory - indirect access */
+#define EEPROM_6000_REG_BAND_24_HT40_CHANNELS  ((0x80)\
+                | INDIRECT_ADDRESS | INDIRECT_REGULATORY)   /* 14  bytes */
 /* 6000 and up regulatory tx power - indirect access */
 /* max. elements per section */
 #define EEPROM_MAX_TXPOWER_SECTION_ELEMENTS     (8)
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index 9ab0e412bf10..12e455a4b90e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -470,6 +470,8 @@ EXPORT_SYMBOL(iwl_init_scan_params);
 static int iwl_scan_initiate(struct iwl_priv *priv)
 {
+        WARN_ON(!mutex_is_locked(&priv->mutex));
        IWL_DEBUG_INFO(priv, "Starting scan...\n");
        set_bit(STATUS_SCANNING, &priv->status);
        priv->is_internal_short_scan = false;
@@ -547,24 +549,31 @@ EXPORT_SYMBOL(iwl_mac_hw_scan);
 * internal short scan, this function should only been called while associated.
 * It will reset and tune the radio to prevent possible RF related problem
 */
-int iwl_internal_short_hw_scan(struct iwl_priv *priv)
+void iwl_internal_short_hw_scan(struct iwl_priv *priv)
 {
-        int ret = 0;
+        queue_work(priv->workqueue, &priv->start_internal_scan);
+}
+static void iwl_bg_start_internal_scan(struct work_struct *work)
+{
+        struct iwl_priv *priv =
+                container_of(work, struct iwl_priv, start_internal_scan);
+        mutex_lock(&priv->mutex);
        if (!iwl_is_ready_rf(priv)) {
-                ret = -EIO;
                IWL_DEBUG_SCAN(priv, "not ready or exit pending\n");
-                goto out;
+                goto unlock;
        }
        if (test_bit(STATUS_SCANNING, &priv->status)) {
                IWL_DEBUG_SCAN(priv, "Scan already in progress.\n");
-                ret = -EAGAIN;
+                goto unlock;
-                goto out;
        }
        if (test_bit(STATUS_SCAN_ABORTING, &priv->status)) {
                IWL_DEBUG_SCAN(priv, "Scan request while abort pending\n");
-                ret = -EAGAIN;
+                goto unlock;
-                goto out;
        }
        priv->scan_bands = 0;
@@ -577,9 +586,8 @@ int iwl_internal_short_hw_scan(struct iwl_priv *priv)
        set_bit(STATUS_SCANNING, &priv->status);
        priv->is_internal_short_scan = true;
        queue_work(priv->workqueue, &priv->request_scan);
+ unlock:
-out:
+        mutex_unlock(&priv->mutex);
-        return ret;
 }
 EXPORT_SYMBOL(iwl_internal_short_hw_scan);
@@ -965,6 +973,7 @@ void iwl_setup_scan_deferred_work(struct iwl_priv *priv)
        INIT_WORK(&priv->scan_completed, iwl_bg_scan_completed);
        INIT_WORK(&priv->request_scan, iwl_bg_request_scan);
        INIT_WORK(&priv->abort_scan, iwl_bg_abort_scan);
+        INIT_WORK(&priv->start_internal_scan, iwl_bg_start_internal_scan);
        INIT_DELAYED_WORK(&priv->scan_check, iwl_bg_scan_check);
 }
 EXPORT_SYMBOL(iwl_setup_scan_deferred_work);
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index 269fda362836..c24067f1a0cb 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -246,7 +246,7 @@ static void p54p_check_tx_ring(struct ieee80211_hw *dev, u32 *index,
        u32 idx, i;
        i = (*index) % ring_limit;
-        (*index) = idx = le32_to_cpu(ring_control->device_idx[1]);
+        (*index) = idx = le32_to_cpu(ring_control->device_idx[ring_index]);
        idx %= ring_limit;
        while (i != idx) {
diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c
index 18ecae4a4375..b4748337223b 100644
--- a/drivers/of/of_mdio.c
+++ b/drivers/of/of_mdio.c
@@ -69,7 +69,7 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np)
                }
                phy = get_phy_device(mdio, be32_to_cpup(addr));
-                if (!phy) {
+                if (!phy || IS_ERR(phy)) {
                        dev_err(&mdio->dev, "error probing PHY at address %i\n",
                                *addr);
                        continue;
diff --git a/drivers/pci/hotplug/rpadlpar_core.c b/drivers/pci/hotplug/rpadlpar_core.c
index 4e3e0382c16e..083034710fa6 100644
--- a/drivers/pci/hotplug/rpadlpar_core.c
+++ b/drivers/pci/hotplug/rpadlpar_core.c
@@ -20,6 +20,7 @@
 #include <linux/init.h>
 #include <linux/pci.h>
 #include <linux/string.h>
+#include <linux/vmalloc.h>
 #include <asm/pci-bridge.h>
 #include <linux/mutex.h>
@@ -430,6 +431,8 @@ int dlpar_remove_slot(char *drc_name)
                        rc = dlpar_remove_pci_slot(drc_name, dn);
                        break;
        }
+        vm_unmap_aliases();
        printk(KERN_INFO "%s: slot %s removed\n", DLPAR_MODULE_NAME, drc_name);
 exit:
        mutex_unlock(&rpadlpar_mutex);
diff --git a/drivers/pci/hotplug/rpaphp_core.c b/drivers/pci/hotplug/rpaphp_core.c
index 719702240780..ef7411c660b9 100644
--- a/drivers/pci/hotplug/rpaphp_core.c
+++ b/drivers/pci/hotplug/rpaphp_core.c
@@ -29,6 +29,7 @@
 #include <linux/pci_hotplug.h>
 #include <linux/smp.h>
 #include <linux/init.h>
+#include <linux/vmalloc.h>
 #include <asm/eeh.h>       /* for eeh_add_device() */
 #include <asm/rtas.h>           /* rtas_call */
 #include <asm/pci-bridge.h>     /* for pci_controller */
@@ -418,6 +419,8 @@ static int disable_slot(struct hotplug_slot *hotplug_slot)
                return -EINVAL;
        pcibios_remove_pci_devices(slot->bus);
+        vm_unmap_aliases();
        slot->state = NOT_CONFIGURED;
        return 0;
 }
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 5ea587e59e48..37499127c801 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -679,7 +679,7 @@ static void __pci_start_power_transition(struct pci_dev *dev, pci_power_t state)
 */
 int __pci_complete_power_transition(struct pci_dev *dev, pci_power_t state)
 {
-        return state > PCI_D0 ?
+        return state >= PCI_D0 ?
                        pci_platform_power_transition(dev, state) : -EINVAL;
 }
 EXPORT_SYMBOL_GPL(__pci_complete_power_transition);
@@ -716,10 +716,6 @@ int pci_set_power_state(struct pci_dev *dev, pci_power_t state)
                 */
                return 0;
-        /* Check if we're already there */
-        if (dev->current_state == state)
-                return 0;
        __pci_start_power_transition(dev, state);
        /* This device is quirked not to be put into D3, so
diff --git a/drivers/pci/pcie/aer/aerdrv.c b/drivers/pci/pcie/aer/aerdrv.c
index aa495ad9bbd4..7a711ee314b7 100644
--- a/drivers/pci/pcie/aer/aerdrv.c
+++ b/drivers/pci/pcie/aer/aerdrv.c
@@ -244,11 +244,17 @@ static pci_ers_result_t aer_root_reset(struct pci_dev *dev)
        /* Assert Secondary Bus Reset */
        pci_read_config_word(dev, PCI_BRIDGE_CONTROL, &p2p_ctrl);
-        p2p_ctrl |= PCI_CB_BRIDGE_CTL_CB_RESET;
+        p2p_ctrl |= PCI_BRIDGE_CTL_BUS_RESET;
        pci_write_config_word(dev, PCI_BRIDGE_CONTROL, p2p_ctrl);
+        /*
+         * we should send hot reset message for 2ms to allow it time to
+         * propogate to all downstream ports
+         */
+        msleep(2);
        /* De-assert Secondary Bus Reset */
-        p2p_ctrl &= ~PCI_CB_BRIDGE_CTL_CB_RESET;
+        p2p_ctrl &= ~PCI_BRIDGE_CTL_BUS_RESET;
        pci_write_config_word(dev, PCI_BRIDGE_CONTROL, p2p_ctrl);
        /*
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index 882bd8d29fe3..c82548afcd5c 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -174,19 +174,14 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
        pci_read_config_dword(dev, pos, &sz);
        pci_write_config_dword(dev, pos, l);
-        if (!sz)
-                goto fail;      /* BAR not implemented */
        /*
         * All bits set in sz means the device isn't working properly.
-         * If it's a memory BAR or a ROM, bit 0 must be clear; if it's
+         * If the BAR isn't implemented, all bits must be 0.  If it's a
-         * an io BAR, bit 1 must be clear.
+         * memory BAR or a ROM, bit 0 must be clear; if it's an io BAR, bit
+         * 1 must be clear.
         */
-        if (sz == 0xffffffff) {
+        if (!sz || sz == 0xffffffff)
-                dev_err(&dev->dev, "reg %x: invalid size %#x; broken device?\n",
-                        pos, sz);
                goto fail;
-        }
        /*
         * I don't know how l can have all bits set.  Copied from old code.
@@ -249,17 +244,13 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
                                   pos, res);
                }
        } else {
-                u32 size = pci_size(l, sz, mask);
+                sz = pci_size(l, sz, mask);
-                if (!size) {
+                if (!sz)
-                        dev_err(&dev->dev, "reg %x: invalid size "
-                                "(l %#x sz %#x mask %#x); broken device?",
-                                pos, l, sz, mask);
                        goto fail;
-                }
                res->start = l;
-                res->end = l + size;
+                res->end = l + sz;
                dev_printk(KERN_DEBUG, &dev->dev, "reg %x: %pR\n", pos, res);
        }
diff --git a/drivers/pcmcia/cistpl.c b/drivers/pcmcia/cistpl.c
index f230f6543bff..854959cada3a 100644
--- a/drivers/pcmcia/cistpl.c
+++ b/drivers/pcmcia/cistpl.c
@@ -1484,6 +1484,11 @@ int pccard_validate_cis(struct pcmcia_socket *s, unsigned int *info)
        if (!s)
                return -EINVAL;
+        if (s->functions) {
+                WARN_ON(1);
+                return -EINVAL;
+        }
        /* We do not want to validate the CIS cache... */
        mutex_lock(&s->ops_mutex);
        destroy_cis_cache(s);
@@ -1639,7 +1644,7 @@ static ssize_t pccard_show_cis(struct kobject *kobj,
                count = 0;
        else {
                struct pcmcia_socket *s;
-                unsigned int chains;
+                unsigned int chains = 1;
                if (off + count > size)
                        count = size - off;
@@ -1648,7 +1653,7 @@ static ssize_t pccard_show_cis(struct kobject *kobj,
                if (!(s->state & SOCKET_PRESENT))
                        return -ENODEV;
-                if (pccard_validate_cis(s, &chains))
+                if (!s->functions && pccard_validate_cis(s, &chains))
                        return -EIO;
                if (!chains)
                        return -ENODATA;
diff --git a/drivers/pcmcia/db1xxx_ss.c b/drivers/pcmcia/db1xxx_ss.c
index 6206408e196c..0f4cc3f00028 100644
--- a/drivers/pcmcia/db1xxx_ss.c
+++ b/drivers/pcmcia/db1xxx_ss.c
@@ -146,7 +146,6 @@ static irqreturn_t db1200_pcmcia_cdirq(int irq, void *data)
 static int db1x_pcmcia_setup_irqs(struct db1x_pcmcia_sock *sock)
 {
        int ret;
-        unsigned long flags;
        if (sock->stschg_irq != -1) {
                ret = request_irq(sock->stschg_irq, db1000_pcmcia_stschgirq,
@@ -162,8 +161,6 @@ static int db1x_pcmcia_setup_irqs(struct db1x_pcmcia_sock *sock)
         * active one disabled.
         */
        if (sock->board_type == BOARD_TYPE_DB1200) {
-                local_irq_save(flags);
                ret = request_irq(sock->insert_irq, db1200_pcmcia_cdirq,
                                  IRQF_DISABLED, "pcmcia_insert", sock);
                if (ret)
@@ -173,17 +170,14 @@ static int db1x_pcmcia_setup_irqs(struct db1x_pcmcia_sock *sock)
                                  IRQF_DISABLED, "pcmcia_eject", sock);
                if (ret) {
                        free_irq(sock->insert_irq, sock);
-                        local_irq_restore(flags);
                        goto out1;
                }
-                /* disable the currently active one */
+                /* enable the currently silent one */
                if (db1200_card_inserted(sock))
-                        disable_irq_nosync(sock->insert_irq);
+                        enable_irq(sock->eject_irq);
                else
-                        disable_irq_nosync(sock->eject_irq);
+                        enable_irq(sock->insert_irq);
-                local_irq_restore(flags);
        } else {
                /* all other (older) Db1x00 boards use a GPIO to show
                 * card detection status:  use both-edge triggers.
diff --git a/drivers/pcmcia/ds.c b/drivers/pcmcia/ds.c
index cb6036d89e59..508f94a2a78d 100644
--- a/drivers/pcmcia/ds.c
+++ b/drivers/pcmcia/ds.c
@@ -335,7 +335,6 @@ static void pcmcia_card_remove(struct pcmcia_socket *s, struct pcmcia_device *le
                mutex_lock(&s->ops_mutex);
                list_del(&p_dev->socket_device_list);
-                p_dev->_removed = 1;
                mutex_unlock(&s->ops_mutex);
                dev_dbg(&p_dev->dev, "unregistering device\n");
@@ -654,14 +653,7 @@ static int pcmcia_requery_callback(struct device *dev, void * _data)
 static void pcmcia_requery(struct pcmcia_socket *s)
 {
-        int present, has_pfc;
+        int has_pfc;
-        mutex_lock(&s->ops_mutex);
-        present = s->pcmcia_state.present;
-        mutex_unlock(&s->ops_mutex);
-        if (!present)
-                return;
        if (s->functions == 0) {
                pcmcia_card_add(s);
@@ -687,12 +679,10 @@ static void pcmcia_requery(struct pcmcia_socket *s)
                        new_funcs = mfc.nfn;
                else
                        new_funcs = 1;
-                if (old_funcs > new_funcs) {
+                if (old_funcs != new_funcs) {
+                        /* we need to re-start */
                        pcmcia_card_remove(s, NULL);
                        pcmcia_card_add(s);
-                } else if (new_funcs > old_funcs) {
-                        s->functions = new_funcs;
-                        pcmcia_device_add(s, 1);
                }
        }
@@ -728,6 +718,8 @@ static int pcmcia_load_firmware(struct pcmcia_device *dev, char * filename)
        struct pcmcia_socket *s = dev->socket;
        const struct firmware *fw;
        int ret = -ENOMEM;
+        cistpl_longlink_mfc_t mfc;
+        int old_funcs, new_funcs = 1;
        if (!filename)
                return -EINVAL;
@@ -750,6 +742,14 @@ static int pcmcia_load_firmware(struct pcmcia_device *dev, char * filename)
                        goto release;
                }
+                /* we need to re-start if the number of functions changed */
+                old_funcs = s->functions;
+                if (!pccard_read_tuple(s, BIND_FN_ALL, CISTPL_LONGLINK_MFC,
+                                        &mfc))
+                        new_funcs = mfc.nfn;
+                if (old_funcs != new_funcs)
+                        ret = -EBUSY;
                /* update information */
                pcmcia_device_query(dev);
@@ -820,11 +820,12 @@ static inline int pcmcia_devmatch(struct pcmcia_device *dev,
        }
        if (did->match_flags & PCMCIA_DEV_ID_MATCH_DEVICE_NO) {
-                if (dev->device_no != did->device_no)
+                dev_dbg(&dev->dev, "this is a pseudo-multi-function device\n");
-                        return 0;
                mutex_lock(&dev->socket->ops_mutex);
                dev->socket->pcmcia_state.has_pfc = 1;
                mutex_unlock(&dev->socket->ops_mutex);
+                if (dev->device_no != did->device_no)
+                        return 0;
        }
        if (did->match_flags & PCMCIA_DEV_ID_MATCH_FUNC_ID) {
@@ -835,7 +836,7 @@ static inline int pcmcia_devmatch(struct pcmcia_device *dev,
                /* if this is a pseudo-multi-function device,
                 * we need explicit matches */
-                if (did->match_flags & PCMCIA_DEV_ID_MATCH_DEVICE_NO)
+                if (dev->socket->pcmcia_state.has_pfc)
                        return 0;
                if (dev->device_no)
                        return 0;
@@ -858,10 +859,8 @@ static inline int pcmcia_devmatch(struct pcmcia_device *dev,
        if (did->match_flags & PCMCIA_DEV_ID_MATCH_FAKE_CIS) {
                dev_dbg(&dev->dev, "device needs a fake CIS\n");
                if (!dev->socket->fake_cis)
-                        pcmcia_load_firmware(dev, did->cisfile);
+                        if (pcmcia_load_firmware(dev, did->cisfile))
+                                return 0;
-                if (!dev->socket->fake_cis)
-                        return 0;
        }
        if (did->match_flags & PCMCIA_DEV_ID_MATCH_ANONYMOUS) {
@@ -1254,9 +1253,7 @@ static int ds_event(struct pcmcia_socket *skt, event_t event, int priority)
        switch (event) {
        case CS_EVENT_CARD_REMOVAL:
-                mutex_lock(&s->ops_mutex);
+                atomic_set(&skt->present, 0);
-                s->pcmcia_state.present = 0;
-                mutex_unlock(&s->ops_mutex);
                pcmcia_card_remove(skt, NULL);
                handle_event(skt, event);
                mutex_lock(&s->ops_mutex);
@@ -1265,9 +1262,9 @@ static int ds_event(struct pcmcia_socket *skt, event_t event, int priority)
                break;
        case CS_EVENT_CARD_INSERTION:
+                atomic_set(&skt->present, 1);
                mutex_lock(&s->ops_mutex);
                s->pcmcia_state.has_pfc = 0;
-                s->pcmcia_state.present = 1;
                destroy_cis_cache(s); /* to be on the safe side... */
                mutex_unlock(&s->ops_mutex);
                pcmcia_card_add(skt);
@@ -1307,7 +1304,13 @@ static int ds_event(struct pcmcia_socket *skt, event_t event, int priority)
    return 0;
 } /* ds_event */
+/*
+ * NOTE: This is racy. There's no guarantee the card will still be
+ * physically present, even if the call to this function returns
+ * non-NULL. Furthermore, the device driver most likely is unbound
+ * almost immediately, so the timeframe where pcmcia_dev_present
+ * returns NULL is probably really really small.
+ */
 struct pcmcia_device *pcmcia_dev_present(struct pcmcia_device *_p_dev)
 {
        struct pcmcia_device *p_dev;
@@ -1317,22 +1320,9 @@ struct pcmcia_device *pcmcia_dev_present(struct pcmcia_device *_p_dev)
        if (!p_dev)
                return NULL;
-        mutex_lock(&p_dev->socket->ops_mutex);
+        if (atomic_read(&p_dev->socket->present) != 0)
-        if (!p_dev->socket->pcmcia_state.present)
+                ret = p_dev;
-                goto out;
-        if (p_dev->socket->pcmcia_state.dead)
-                goto out;
-        if (p_dev->_removed)
-                goto out;
-        if (p_dev->suspended)
-                goto out;
-        ret = p_dev;
- out:
-        mutex_unlock(&p_dev->socket->ops_mutex);
        pcmcia_put_dev(p_dev);
        return ret;
 }
@@ -1382,6 +1372,8 @@ static int __devinit pcmcia_bus_add_socket(struct device *dev,
                return ret;
        }
+        atomic_set(&socket->present, 0);
        return 0;
 }
@@ -1393,10 +1385,6 @@ static void pcmcia_bus_remove_socket(struct device *dev,
        if (!socket)
                return;
-        mutex_lock(&socket->ops_mutex);
-        socket->pcmcia_state.dead = 1;
-        mutex_unlock(&socket->ops_mutex);
        pccard_register_pcmcia(socket, NULL);
        /* unregister any unbound devices */
diff --git a/drivers/pcmcia/pcmcia_resource.c b/drivers/pcmcia/pcmcia_resource.c
index caec1dee2a4b..7c3d03bb4f30 100644
--- a/drivers/pcmcia/pcmcia_resource.c
+++ b/drivers/pcmcia/pcmcia_resource.c
@@ -755,12 +755,12 @@ int pcmcia_request_irq(struct pcmcia_device *p_dev, irq_req_t *req)
        else
                printk(KERN_WARNING "pcmcia: Driver needs updating to support IRQ sharing.\n");
-#ifdef CONFIG_PCMCIA_PROBE
+        /* If the interrupt is already assigned, it must be the same */
+        if (s->irq.AssignedIRQ != 0)
-        if (s->irq.AssignedIRQ != 0) {
-                /* If the interrupt is already assigned, it must be the same */
                irq = s->irq.AssignedIRQ;
-        } else {
+#ifdef CONFIG_PCMCIA_PROBE
+        if (!irq) {
                int try;
                u32 mask = s->irq_mask;
                void *data = p_dev; /* something unique to this device */
diff --git a/drivers/pcmcia/rsrc_nonstatic.c b/drivers/pcmcia/rsrc_nonstatic.c
index 559069a80a3b..a6eb7b59ba9f 100644
--- a/drivers/pcmcia/rsrc_nonstatic.c
+++ b/drivers/pcmcia/rsrc_nonstatic.c
@@ -214,7 +214,7 @@ static void do_io_probe(struct pcmcia_socket *s, unsigned int base,
                return;
        }
        for (i = base, most = 0; i < base+num; i += 8) {
-                res = claim_region(NULL, i, 8, IORESOURCE_IO, "PCMCIA ioprobe");
+                res = claim_region(s, i, 8, IORESOURCE_IO, "PCMCIA ioprobe");
                if (!res)
                        continue;
                hole = inb(i);
@@ -231,9 +231,14 @@ static void do_io_probe(struct pcmcia_socket *s, unsigned int base,
        bad = any = 0;
        for (i = base; i < base+num; i += 8) {
-                res = claim_region(NULL, i, 8, IORESOURCE_IO, "PCMCIA ioprobe");
+                res = claim_region(s, i, 8, IORESOURCE_IO, "PCMCIA ioprobe");
-                if (!res)
+                if (!res) {
+                        if (!any)
+                                printk(" excluding");
+                        if (!bad)
+                                bad = any = i;
                        continue;
+                }
                for (j = 0; j < 8; j++)
                        if (inb(i+j) != most)
                                break;
@@ -253,6 +258,7 @@ static void do_io_probe(struct pcmcia_socket *s, unsigned int base,
        }
        if (bad) {
                if ((num > 16) && (bad == base) && (i == base+num)) {
+                        sub_interval(&s_data->io_db, bad, i-bad);
                        printk(" nothing: probe failed.\n");
                        return;
                } else {
@@ -804,7 +810,7 @@ static int adjust_memory(struct pcmcia_socket *s, unsigned int action, unsigned
 static int adjust_io(struct pcmcia_socket *s, unsigned int action, unsigned long start, unsigned long end)
 {
        struct socket_data *data = s->resource_data;
-        unsigned long size = end - start + 1;
+        unsigned long size;
        int ret = 0;
 #if defined(CONFIG_X86)
@@ -814,6 +820,8 @@ static int adjust_io(struct pcmcia_socket *s, unsigned int action, unsigned long
                start = 0x100;
 #endif
+        size = end - start + 1;
        if (end < start)
                return -EINVAL;
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 7bec4588c268..6c3320d75055 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -390,6 +390,7 @@ config EEEPC_WMI
        depends on ACPI_WMI
        depends on INPUT
        depends on EXPERIMENTAL
+        select INPUT_SPARSEKMAP
        ---help---
          Say Y here if you want to support WMI-based hotkeys on Eee PC laptops.
diff --git a/drivers/platform/x86/asus-laptop.c b/drivers/platform/x86/asus-laptop.c
index 52262b012abb..efe8f6388906 100644
--- a/drivers/platform/x86/asus-laptop.c
+++ b/drivers/platform/x86/asus-laptop.c
@@ -79,15 +79,15 @@ static uint wapf = 1;
 module_param(wapf, uint, 0644);
 MODULE_PARM_DESC(wapf, "WAPF value");
-static uint wlan_status = 1;
+static int wlan_status = 1;
-static uint bluetooth_status = 1;
+static int bluetooth_status = 1;
-module_param(wlan_status, uint, 0644);
+module_param(wlan_status, int, 0644);
 MODULE_PARM_DESC(wlan_status, "Set the wireless status on boot "
                 "(0 = disabled, 1 = enabled, -1 = don't do anything). "
                 "default is 1");
-module_param(bluetooth_status, uint, 0644);
+module_param(bluetooth_status, int, 0644);
 MODULE_PARM_DESC(bluetooth_status, "Set the wireless status on boot "
                 "(0 = disabled, 1 = enabled, -1 = don't do anything). "
                 "default is 1");
diff --git a/drivers/platform/x86/dell-wmi.c b/drivers/platform/x86/dell-wmi.c
index 6ba6c30e5bb6..66f53c3c35e8 100644
--- a/drivers/platform/x86/dell-wmi.c
+++ b/drivers/platform/x86/dell-wmi.c
@@ -217,6 +217,7 @@ static void dell_wmi_notify(u32 value, void *context)
                if (dell_new_hk_type && (buffer_entry[1] != 0x10)) {
                        printk(KERN_INFO "dell-wmi: Received unknown WMI event"
                                         " (0x%x)\n", buffer_entry[1]);
+                        kfree(obj);
                        return;
                }
@@ -234,7 +235,7 @@ static void dell_wmi_notify(u32 value, void *context)
                            key->keycode == KEY_BRIGHTNESSDOWN) && acpi_video) {
                        /* Don't report brightness notifications that will also
                         * come via ACPI */
-                        return;
+                        ;
                } else {
                        input_report_key(dell_wmi_input_dev, key->keycode, 1);
                        input_sync(dell_wmi_input_dev);
diff --git a/drivers/platform/x86/eeepc-laptop.c b/drivers/platform/x86/eeepc-laptop.c
index 54a015785ca8..0306174ba875 100644
--- a/drivers/platform/x86/eeepc-laptop.c
+++ b/drivers/platform/x86/eeepc-laptop.c
@@ -169,7 +169,6 @@ struct eeepc_laptop {
        struct backlight_device *backlight_device;
        struct input_dev *inputdev;
-        struct key_entry *keymap;
        struct rfkill *wlan_rfkill;
        struct rfkill *bluetooth_rfkill;
@@ -1204,8 +1203,8 @@ static int eeepc_input_init(struct eeepc_laptop *eeepc)
 static void eeepc_input_exit(struct eeepc_laptop *eeepc)
 {
        if (eeepc->inputdev) {
+                sparse_keymap_free(eeepc->inputdev);
                input_unregister_device(eeepc->inputdev);
-                kfree(eeepc->keymap);
        }
 }
diff --git a/drivers/platform/x86/eeepc-wmi.c b/drivers/platform/x86/eeepc-wmi.c
index 9f8822658fd7..b227eb469f49 100644
--- a/drivers/platform/x86/eeepc-wmi.c
+++ b/drivers/platform/x86/eeepc-wmi.c
@@ -23,6 +23,8 @@
 *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
 */
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/init.h>
@@ -30,22 +32,34 @@
 #include <linux/slab.h>
 #include <linux/input.h>
 #include <linux/input/sparse-keymap.h>
+#include <linux/fb.h>
+#include <linux/backlight.h>
+#include <linux/platform_device.h>
 #include <acpi/acpi_bus.h>
 #include <acpi/acpi_drivers.h>
+#define EEEPC_WMI_FILE  "eeepc-wmi"
 MODULE_AUTHOR("Yong Wang <yong.y.wang@intel.com>");
 MODULE_DESCRIPTION("Eee PC WMI Hotkey Driver");
 MODULE_LICENSE("GPL");
 #define EEEPC_WMI_EVENT_GUID    "ABBC0F72-8EA1-11D1-00A0-C90629100000"
+#define EEEPC_WMI_MGMT_GUID     "97845ED0-4E6D-11DE-8A39-0800200C9A66"
 MODULE_ALIAS("wmi:"EEEPC_WMI_EVENT_GUID);
+MODULE_ALIAS("wmi:"EEEPC_WMI_MGMT_GUID);
 #define NOTIFY_BRNUP_MIN        0x11
 #define NOTIFY_BRNUP_MAX        0x1f
 #define NOTIFY_BRNDOWN_MIN      0x20
 #define NOTIFY_BRNDOWN_MAX      0x2e
+#define EEEPC_WMI_METHODID_DEVS 0x53564544
+#define EEEPC_WMI_METHODID_DSTS 0x53544344
+#define EEEPC_WMI_DEVID_BACKLIGHT       0x00050012
 static const struct key_entry eeepc_wmi_keymap[] = {
        /* Sleep already handled via generic ACPI code */
        { KE_KEY, 0x5d, { KEY_WLAN } },
@@ -58,18 +72,198 @@ static const struct key_entry eeepc_wmi_keymap[] = {
        { KE_END, 0},
 };
-static struct input_dev *eeepc_wmi_input_dev;
+struct bios_args {
+        u32     dev_id;
+        u32     ctrl_param;
+};
+struct eeepc_wmi {
+        struct input_dev *inputdev;
+        struct backlight_device *backlight_device;
+};
+static struct platform_device *platform_device;
+static int eeepc_wmi_input_init(struct eeepc_wmi *eeepc)
+{
+        int err;
+        eeepc->inputdev = input_allocate_device();
+        if (!eeepc->inputdev)
+                return -ENOMEM;
+        eeepc->inputdev->name = "Eee PC WMI hotkeys";
+        eeepc->inputdev->phys = EEEPC_WMI_FILE "/input0";
+        eeepc->inputdev->id.bustype = BUS_HOST;
+        eeepc->inputdev->dev.parent = &platform_device->dev;
+        err = sparse_keymap_setup(eeepc->inputdev, eeepc_wmi_keymap, NULL);
+        if (err)
+                goto err_free_dev;
+        err = input_register_device(eeepc->inputdev);
+        if (err)
+                goto err_free_keymap;
+        return 0;
+err_free_keymap:
+        sparse_keymap_free(eeepc->inputdev);
+err_free_dev:
+        input_free_device(eeepc->inputdev);
+        return err;
+}
+static void eeepc_wmi_input_exit(struct eeepc_wmi *eeepc)
+{
+        if (eeepc->inputdev) {
+                sparse_keymap_free(eeepc->inputdev);
+                input_unregister_device(eeepc->inputdev);
+        }
+        eeepc->inputdev = NULL;
+}
+static acpi_status eeepc_wmi_get_devstate(u32 dev_id, u32 *ctrl_param)
+{
+        struct acpi_buffer input = { (acpi_size)sizeof(u32), &dev_id };
+        struct acpi_buffer output = { ACPI_ALLOCATE_BUFFER, NULL };
+        union acpi_object *obj;
+        acpi_status status;
+        u32 tmp;
+        status = wmi_evaluate_method(EEEPC_WMI_MGMT_GUID,
+                        1, EEEPC_WMI_METHODID_DSTS, &input, &output);
+        if (ACPI_FAILURE(status))
+                return status;
+        obj = (union acpi_object *)output.pointer;
+        if (obj && obj->type == ACPI_TYPE_INTEGER)
+                tmp = (u32)obj->integer.value;
+        else
+                tmp = 0;
+        if (ctrl_param)
+                *ctrl_param = tmp;
+        kfree(obj);
+        return status;
+}
+static acpi_status eeepc_wmi_set_devstate(u32 dev_id, u32 ctrl_param)
+{
+        struct bios_args args = {
+                .dev_id = dev_id,
+                .ctrl_param = ctrl_param,
+        };
+        struct acpi_buffer input = { (acpi_size)sizeof(args), &args };
+        acpi_status status;
+        status = wmi_evaluate_method(EEEPC_WMI_MGMT_GUID,
+                        1, EEEPC_WMI_METHODID_DEVS, &input, NULL);
+        return status;
+}
+static int read_brightness(struct backlight_device *bd)
+{
+        static u32 ctrl_param;
+        acpi_status status;
+        status = eeepc_wmi_get_devstate(EEEPC_WMI_DEVID_BACKLIGHT, &ctrl_param);
+        if (ACPI_FAILURE(status))
+                return -1;
+        else
+                return ctrl_param & 0xFF;
+}
+static int update_bl_status(struct backlight_device *bd)
+{
+        static u32 ctrl_param;
+        acpi_status status;
+        ctrl_param = bd->props.brightness;
+        status = eeepc_wmi_set_devstate(EEEPC_WMI_DEVID_BACKLIGHT, ctrl_param);
+        if (ACPI_FAILURE(status))
+                return -1;
+        else
+                return 0;
+}
+static const struct backlight_ops eeepc_wmi_bl_ops = {
+        .get_brightness = read_brightness,
+        .update_status = update_bl_status,
+};
+static int eeepc_wmi_backlight_notify(struct eeepc_wmi *eeepc, int code)
+{
+        struct backlight_device *bd = eeepc->backlight_device;
+        int old = bd->props.brightness;
+        int new;
+        if (code >= NOTIFY_BRNUP_MIN && code <= NOTIFY_BRNUP_MAX)
+                new = code - NOTIFY_BRNUP_MIN + 1;
+        else if (code >= NOTIFY_BRNDOWN_MIN && code <= NOTIFY_BRNDOWN_MAX)
+                new = code - NOTIFY_BRNDOWN_MIN;
+        bd->props.brightness = new;
+        backlight_update_status(bd);
+        backlight_force_update(bd, BACKLIGHT_UPDATE_HOTKEY);
+        return old;
+}
+static int eeepc_wmi_backlight_init(struct eeepc_wmi *eeepc)
+{
+        struct backlight_device *bd;
+        struct backlight_properties props;
+        memset(&props, 0, sizeof(struct backlight_properties));
+        props.max_brightness = 15;
+        bd = backlight_device_register(EEEPC_WMI_FILE,
+                                       &platform_device->dev, eeepc,
+                                       &eeepc_wmi_bl_ops, &props);
+        if (IS_ERR(bd)) {
+                pr_err("Could not register backlight device\n");
+                return PTR_ERR(bd);
+        }
+        eeepc->backlight_device = bd;
+        bd->props.brightness = read_brightness(bd);
+        bd->props.power = FB_BLANK_UNBLANK;
+        backlight_update_status(bd);
+        return 0;
+}
+static void eeepc_wmi_backlight_exit(struct eeepc_wmi *eeepc)
+{
+        if (eeepc->backlight_device)
+                backlight_device_unregister(eeepc->backlight_device);
+        eeepc->backlight_device = NULL;
+}
 static void eeepc_wmi_notify(u32 value, void *context)
 {
+        struct eeepc_wmi *eeepc = context;
        struct acpi_buffer response = { ACPI_ALLOCATE_BUFFER, NULL };
        union acpi_object *obj;
        acpi_status status;
        int code;
+        int orig_code;
        status = wmi_get_event_data(value, &response);
        if (status != AE_OK) {
-                pr_err("EEEPC WMI: bad event status 0x%x\n", status);
+                pr_err("bad event status 0x%x\n", status);
                return;
        }
@@ -77,81 +271,142 @@ static void eeepc_wmi_notify(u32 value, void *context)
        if (obj && obj->type == ACPI_TYPE_INTEGER) {
                code = obj->integer.value;
+                orig_code = code;
                if (code >= NOTIFY_BRNUP_MIN && code <= NOTIFY_BRNUP_MAX)
                        code = NOTIFY_BRNUP_MIN;
-                else if (code >= NOTIFY_BRNDOWN_MIN && code <= NOTIFY_BRNDOWN_MAX)
+                else if (code >= NOTIFY_BRNDOWN_MIN &&
+                         code <= NOTIFY_BRNDOWN_MAX)
                        code = NOTIFY_BRNDOWN_MIN;
-                if (!sparse_keymap_report_event(eeepc_wmi_input_dev,
+                if (code == NOTIFY_BRNUP_MIN || code == NOTIFY_BRNDOWN_MIN) {
+                        if (!acpi_video_backlight_support())
+                                eeepc_wmi_backlight_notify(eeepc, orig_code);
+                }
+                if (!sparse_keymap_report_event(eeepc->inputdev,
                                                code, 1, true))
-                        pr_info("EEEPC WMI: Unknown key %x pressed\n", code);
+                        pr_info("Unknown key %x pressed\n", code);
        }
        kfree(obj);
 }
-static int eeepc_wmi_input_setup(void)
+static int __devinit eeepc_wmi_platform_probe(struct platform_device *device)
 {
+        struct eeepc_wmi *eeepc;
        int err;
+        acpi_status status;
-        eeepc_wmi_input_dev = input_allocate_device();
+        eeepc = platform_get_drvdata(device);
-        if (!eeepc_wmi_input_dev)
-                return -ENOMEM;
-        eeepc_wmi_input_dev->name = "Eee PC WMI hotkeys";
-        eeepc_wmi_input_dev->phys = "wmi/input0";
-        eeepc_wmi_input_dev->id.bustype = BUS_HOST;
-        err = sparse_keymap_setup(eeepc_wmi_input_dev, eeepc_wmi_keymap, NULL);
+        err = eeepc_wmi_input_init(eeepc);
        if (err)
-                goto err_free_dev;
+                goto error_input;
-        err = input_register_device(eeepc_wmi_input_dev);
+        if (!acpi_video_backlight_support()) {
-        if (err)
+                err = eeepc_wmi_backlight_init(eeepc);
-                goto err_free_keymap;
+                if (err)
+                        goto error_backlight;
+        } else
+                pr_info("Backlight controlled by ACPI video driver\n");
+        status = wmi_install_notify_handler(EEEPC_WMI_EVENT_GUID,
+                                        eeepc_wmi_notify, eeepc);
+        if (ACPI_FAILURE(status)) {
+                pr_err("Unable to register notify handler - %d\n",
+                        status);
+                err = -ENODEV;
+                goto error_wmi;
+        }
        return 0;
-err_free_keymap:
+error_wmi:
-        sparse_keymap_free(eeepc_wmi_input_dev);
+        eeepc_wmi_backlight_exit(eeepc);
-err_free_dev:
+error_backlight:
-        input_free_device(eeepc_wmi_input_dev);
+        eeepc_wmi_input_exit(eeepc);
+error_input:
        return err;
 }
+static int __devexit eeepc_wmi_platform_remove(struct platform_device *device)
+{
+        struct eeepc_wmi *eeepc;
+        eeepc = platform_get_drvdata(device);
+        wmi_remove_notify_handler(EEEPC_WMI_EVENT_GUID);
+        eeepc_wmi_backlight_exit(eeepc);
+        eeepc_wmi_input_exit(eeepc);
+        return 0;
+}
+static struct platform_driver platform_driver = {
+        .driver = {
+                .name = EEEPC_WMI_FILE,
+                .owner = THIS_MODULE,
+        },
+        .probe = eeepc_wmi_platform_probe,
+        .remove = __devexit_p(eeepc_wmi_platform_remove),
+};
 static int __init eeepc_wmi_init(void)
 {
+        struct eeepc_wmi *eeepc;
        int err;
-        acpi_status status;
-        if (!wmi_has_guid(EEEPC_WMI_EVENT_GUID)) {
+        if (!wmi_has_guid(EEEPC_WMI_EVENT_GUID) ||
-                pr_warning("EEEPC WMI: No known WMI GUID found\n");
+            !wmi_has_guid(EEEPC_WMI_MGMT_GUID)) {
+                pr_warning("No known WMI GUID found\n");
                return -ENODEV;
        }
-        err = eeepc_wmi_input_setup();
+        eeepc = kzalloc(sizeof(struct eeepc_wmi), GFP_KERNEL);
-        if (err)
+        if (!eeepc)
-                return err;
+                return -ENOMEM;
-        status = wmi_install_notify_handler(EEEPC_WMI_EVENT_GUID,
+        platform_device = platform_device_alloc(EEEPC_WMI_FILE, -1);
-                                        eeepc_wmi_notify, NULL);
+        if (!platform_device) {
-        if (ACPI_FAILURE(status)) {
+                pr_warning("Unable to allocate platform device\n");
-                sparse_keymap_free(eeepc_wmi_input_dev);
+                err = -ENOMEM;
-                input_unregister_device(eeepc_wmi_input_dev);
+                goto fail_platform;
-                pr_err("EEEPC WMI: Unable to register notify handler - %d\n",
+        }
-                        status);
-                return -ENODEV;
+        err = platform_device_add(platform_device);
+        if (err) {
+                pr_warning("Unable to add platform device\n");
+                goto put_dev;
+        }
+        platform_set_drvdata(platform_device, eeepc);
+        err = platform_driver_register(&platform_driver);
+        if (err) {
+                pr_warning("Unable to register platform driver\n");
+                goto del_dev;
        }
        return 0;
+del_dev:
+        platform_device_del(platform_device);
+put_dev:
+        platform_device_put(platform_device);
+fail_platform:
+        kfree(eeepc);
+        return err;
 }
 static void __exit eeepc_wmi_exit(void)
 {
-        wmi_remove_notify_handler(EEEPC_WMI_EVENT_GUID);
+        struct eeepc_wmi *eeepc;
-        sparse_keymap_free(eeepc_wmi_input_dev);
-        input_unregister_device(eeepc_wmi_input_dev);
+        eeepc = platform_get_drvdata(platform_device);
+        platform_driver_unregister(&platform_driver);
+        platform_device_unregister(platform_device);
+        kfree(eeepc);
 }
 module_init(eeepc_wmi_init);
diff --git a/drivers/regulator/max8925-regulator.c b/drivers/regulator/max8925-regulator.c
index b6218f11c957..552cad85ae5a 100644
--- a/drivers/regulator/max8925-regulator.c
+++ b/drivers/regulator/max8925-regulator.c
@@ -109,7 +109,7 @@ static int max8925_is_enabled(struct regulator_dev *rdev)
        struct max8925_regulator_info *info = rdev_get_drvdata(rdev);
        int ret;
-        ret = max8925_reg_read(info->i2c, info->vol_reg);
+        ret = max8925_reg_read(info->i2c, info->enable_reg);
        if (ret < 0)
                return ret;
diff --git a/drivers/regulator/mc13783-regulator.c b/drivers/regulator/mc13783-regulator.c
index a681f5e8f786..ad036dd8da13 100644
--- a/drivers/regulator/mc13783-regulator.c
+++ b/drivers/regulator/mc13783-regulator.c
@@ -618,9 +618,12 @@ static int __devexit mc13783_regulator_remove(struct platform_device *pdev)
                dev_get_platdata(&pdev->dev);
        int i;
+        platform_set_drvdata(pdev, NULL);
        for (i = 0; i < pdata->num_regulators; i++)
                regulator_unregister(priv->regulators[i]);
+        kfree(priv);
        return 0;
 }
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index bbea90baf98f..acf222f91f5a 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -1899,7 +1899,8 @@ restart:
                /*  Process requests that may be recovered */
                if (cqr->status == DASD_CQR_NEED_ERP) {
                        erp_fn = base->discipline->erp_action(cqr);
-                        erp_fn(cqr);
+                        if (IS_ERR(erp_fn(cqr)))
+                                continue;
                        goto restart;
                }
diff --git a/drivers/s390/block/dasd_3990_erp.c b/drivers/s390/block/dasd_3990_erp.c
index 6927e751ce3e..6632649dd6aa 100644
--- a/drivers/s390/block/dasd_3990_erp.c
+++ b/drivers/s390/block/dasd_3990_erp.c
@@ -2309,7 +2309,7 @@ static struct dasd_ccw_req *dasd_3990_erp_add_erp(struct dasd_ccw_req *cqr)
                                     cqr->retries);
                        dasd_block_set_timer(device->block, (HZ << 3));
                }
-                return cqr;
+                return erp;
        }
        ccw = cqr->cpaddr;
@@ -2372,6 +2372,9 @@ dasd_3990_erp_additional_erp(struct dasd_ccw_req * cqr)
        /* add erp and initialize with default TIC */
        erp = dasd_3990_erp_add_erp(cqr);
+        if (IS_ERR(erp))
+                return erp;
        /* inspect sense, determine specific ERP if possible */
        if (erp != cqr) {
@@ -2711,6 +2714,8 @@ dasd_3990_erp_action(struct dasd_ccw_req * cqr)
        if (erp == NULL) {
                /* no matching erp found - set up erp */
                erp = dasd_3990_erp_additional_erp(cqr);
+                if (IS_ERR(erp))
+                        return erp;
        } else {
                /* matching erp found - set all leading erp's to DONE */
                erp = dasd_3990_erp_handle_match_erp(cqr, erp);
diff --git a/drivers/s390/char/zcore.c b/drivers/s390/char/zcore.c
index 18daf16aa357..7217966f7d31 100644
--- a/drivers/s390/char/zcore.c
+++ b/drivers/s390/char/zcore.c
@@ -638,11 +638,7 @@ static int __init zcore_reipl_init(void)
                rc = memcpy_hsa_kernel(ipl_block, ipib_info.ipib, PAGE_SIZE);
        else
                rc = memcpy_real(ipl_block, (void *) ipib_info.ipib, PAGE_SIZE);
-        if (rc) {
+        if (rc || csum_partial(ipl_block, ipl_block->hdr.len, 0) !=
-                free_page((unsigned long) ipl_block);
-                return rc;
-        }
-        if (csum_partial(ipl_block, ipl_block->hdr.len, 0) !=
            ipib_info.checksum) {
                TRACE("Checksum does not match\n");
                free_page((unsigned long) ipl_block);
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index 4038f5b4f144..ce7cb87479fe 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -29,6 +29,7 @@
 #include "chsc.h"
 static void *sei_page;
+static DEFINE_SPINLOCK(sda_lock);
 /**
 * chsc_error_from_response() - convert a chsc response to an error
@@ -832,11 +833,10 @@ void __init chsc_free_sei_area(void)
        kfree(sei_page);
 }
-int __init
+int chsc_enable_facility(int operation_code)
-chsc_enable_facility(int operation_code)
 {
        int ret;
-        struct {
+        static struct {
                struct chsc_header request;
                u8 reserved1:4;
                u8 format:4;
@@ -849,33 +849,32 @@ chsc_enable_facility(int operation_code)
                u32 reserved5:4;
                u32 format2:4;
                u32 reserved6:24;
-        } __attribute__ ((packed)) *sda_area;
+        } __attribute__ ((packed, aligned(4096))) sda_area;
-        sda_area = (void *)get_zeroed_page(GFP_KERNEL|GFP_DMA);
+        spin_lock(&sda_lock);
-        if (!sda_area)
+        memset(&sda_area, 0, sizeof(sda_area));
-                return -ENOMEM;
+        sda_area.request.length = 0x0400;
-        sda_area->request.length = 0x0400;
+        sda_area.request.code = 0x0031;
-        sda_area->request.code = 0x0031;
+        sda_area.operation_code = operation_code;
-        sda_area->operation_code = operation_code;
-        ret = chsc(sda_area);
+        ret = chsc(&sda_area);
        if (ret > 0) {
                ret = (ret == 3) ? -ENODEV : -EBUSY;
                goto out;
        }
-        switch (sda_area->response.code) {
+        switch (sda_area.response.code) {
        case 0x0101:
                ret = -EOPNOTSUPP;
                break;
        default:
-                ret = chsc_error_from_response(sda_area->response.code);
+                ret = chsc_error_from_response(sda_area.response.code);
        }
        if (ret != 0)
                CIO_CRW_EVENT(2, "chsc: sda (oc=%x) failed (rc=%04x)\n",
-                              operation_code, sda_area->response.code);
+                              operation_code, sda_area.response.code);
 out:
-        free_page((unsigned long)sda_area);
+        spin_unlock(&sda_lock);
        return ret;
 }
diff --git a/drivers/s390/cio/chsc_sch.c b/drivers/s390/cio/chsc_sch.c
index 404f630c27ca..3b6f4adc5094 100644
--- a/drivers/s390/cio/chsc_sch.c
+++ b/drivers/s390/cio/chsc_sch.c
@@ -124,7 +124,7 @@ static int chsc_subchannel_prepare(struct subchannel *sch)
         * since we don't have a way to clear the subchannel and
         * cannot disable it with a request running.
         */
-        cc = stsch(sch->schid, &schib);
+        cc = stsch_err(sch->schid, &schib);
        if (!cc && scsw_stctl(&schib.scsw))
                return -EAGAIN;
        return 0;
diff --git a/drivers/s390/cio/cio.c b/drivers/s390/cio/cio.c
index f736cdcf08ad..5feea1a371e1 100644
--- a/drivers/s390/cio/cio.c
+++ b/drivers/s390/cio/cio.c
@@ -361,7 +361,7 @@ int cio_commit_config(struct subchannel *sch)
        struct schib schib;
        int ccode, retry, ret = 0;
-        if (stsch(sch->schid, &schib) || !css_sch_is_valid(&schib))
+        if (stsch_err(sch->schid, &schib) || !css_sch_is_valid(&schib))
                return -ENODEV;
        for (retry = 0; retry < 5; retry++) {
@@ -372,7 +372,7 @@ int cio_commit_config(struct subchannel *sch)
                        return ccode;
                switch (ccode) {
                case 0: /* successful */
-                        if (stsch(sch->schid, &schib) ||
+                        if (stsch_err(sch->schid, &schib) ||
                            !css_sch_is_valid(&schib))
                                return -ENODEV;
                        if (cio_check_config(sch, &schib)) {
@@ -404,7 +404,7 @@ int cio_update_schib(struct subchannel *sch)
 {
        struct schib schib;
-        if (stsch(sch->schid, &schib) || !css_sch_is_valid(&schib))
+        if (stsch_err(sch->schid, &schib) || !css_sch_is_valid(&schib))
                return -ENODEV;
        memcpy(&sch->schib, &schib, sizeof(schib));
@@ -771,7 +771,7 @@ cio_get_console_sch_no(void)
        if (console_irq != -1) {
                /* VM provided us with the irq number of the console. */
                schid.sch_no = console_irq;
-                if (stsch(schid, &console_subchannel.schib) != 0 ||
+                if (stsch_err(schid, &console_subchannel.schib) != 0 ||
                    (console_subchannel.schib.pmcw.st != SUBCHANNEL_TYPE_IO) ||
                    !console_subchannel.schib.pmcw.dnv)
                        return -1;
@@ -863,10 +863,10 @@ __disable_subchannel_easy(struct subchannel_id schid, struct schib *schib)
        cc = 0;
        for (retry=0;retry<3;retry++) {
                schib->pmcw.ena = 0;
-                cc = msch(schid, schib);
+                cc = msch_err(schid, schib);
                if (cc)
                        return (cc==3?-ENODEV:-EBUSY);
-                if (stsch(schid, schib) || !css_sch_is_valid(schib))
+                if (stsch_err(schid, schib) || !css_sch_is_valid(schib))
                        return -ENODEV;
                if (!schib->pmcw.ena)
                        return 0;
@@ -913,7 +913,7 @@ static int stsch_reset(struct subchannel_id schid, struct schib *addr)
        pgm_check_occured = 0;
        s390_base_pgm_handler_fn = cio_reset_pgm_check_handler;
-        rc = stsch(schid, addr);
+        rc = stsch_err(schid, addr);
        s390_base_pgm_handler_fn = NULL;
        /* The program check handler could have changed pgm_check_occured. */
@@ -950,7 +950,7 @@ static int __shutdown_subchannel_easy(struct subchannel_id schid, void *data)
                        /* No default clear strategy */
                        break;
                }
-                stsch(schid, &schib);
+                stsch_err(schid, &schib);
                __disable_subchannel_easy(schid, &schib);
        }
 out:
@@ -1086,7 +1086,7 @@ int __init cio_get_iplinfo(struct cio_iplinfo *iplinfo)
        schid = *(struct subchannel_id *)&S390_lowcore.subchannel_id;
        if (!schid.one)
                return -ENODEV;
-        if (stsch(schid, &schib))
+        if (stsch_err(schid, &schib))
                return -ENODEV;
        if (schib.pmcw.st != SUBCHANNEL_TYPE_IO)
                return -ENODEV;
diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
index 2769da54f2b9..511649115bd7 100644
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -870,15 +870,10 @@ static int __init css_bus_init(void)
        /* Try to enable MSS. */
        ret = chsc_enable_facility(CHSC_SDA_OC_MSS);
-        switch (ret) {
+        if (ret)
-        case 0: /* Success. */
-                max_ssid = __MAX_SSID;
-                break;
-        case -ENOMEM:
-                goto out;
-        default:
                max_ssid = 0;
-        }
+        else /* Success. */
+                max_ssid = __MAX_SSID;
        ret = slow_subchannel_init();
        if (ret)
@@ -1048,6 +1043,11 @@ static int __init channel_subsystem_init_sync(void)
 }
 subsys_initcall_sync(channel_subsystem_init_sync);
+void channel_subsystem_reinit(void)
+{
+        chsc_enable_facility(CHSC_SDA_OC_MSS);
+}
 #ifdef CONFIG_PROC_FS
 static ssize_t cio_settle_write(struct file *file, const char __user *buf,
                                size_t count, loff_t *ppos)
diff --git a/drivers/s390/cio/device_fsm.c b/drivers/s390/cio/device_fsm.c
index c56ab94612f9..c9b852647f01 100644
--- a/drivers/s390/cio/device_fsm.c
+++ b/drivers/s390/cio/device_fsm.c
@@ -45,7 +45,7 @@ static void ccw_timeout_log(struct ccw_device *cdev)
        sch = to_subchannel(cdev->dev.parent);
        private = to_io_private(sch);
        orb = &private->orb;
-        cc = stsch(sch->schid, &schib);
+        cc = stsch_err(sch->schid, &schib);
        printk(KERN_WARNING "cio: ccw device timeout occurred at %llx, "
               "device information:\n", get_clock());
diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
index 18564891ea61..b3b1d2f79398 100644
--- a/drivers/s390/scsi/zfcp_fsf.c
+++ b/drivers/s390/scsi/zfcp_fsf.c
@@ -2105,7 +2105,8 @@ static void zfcp_fsf_req_trace(struct zfcp_fsf_req *req, struct scsi_cmnd *scsi)
        blktrc.inb_usage = req->qdio_req.qdio_inb_usage;
        blktrc.outb_usage = req->qdio_req.qdio_outb_usage;
-        if (req->adapter->adapter_features & FSF_FEATURE_MEASUREMENT_DATA) {
+        if (req->adapter->adapter_features & FSF_FEATURE_MEASUREMENT_DATA &&
+            !(req->status & ZFCP_STATUS_FSFREQ_ERROR)) {
                blktrc.flags |= ZFCP_BLK_LAT_VALID;
                blktrc.channel_lat = lat_in->channel_lat * ticks;
                blktrc.fabric_lat = lat_in->fabric_lat * ticks;
@@ -2157,9 +2158,8 @@ static void zfcp_fsf_send_fcp_command_task_handler(struct zfcp_fsf_req *req)
        fcp_rsp = (struct fcp_resp_with_ext *) &req->qtcb->bottom.io.fcp_rsp;
        zfcp_fc_eval_fcp_rsp(fcp_rsp, scpnt);
-        zfcp_fsf_req_trace(req, scpnt);
 skip_fsfstatus:
+        zfcp_fsf_req_trace(req, scpnt);
        zfcp_dbf_scsi_result(req->adapter->dbf, scpnt, req);
        scpnt->host_scribble = NULL;
diff --git a/drivers/scsi/be2iscsi/be_mgmt.c b/drivers/scsi/be2iscsi/be_mgmt.c
index 72617b650a7e..e641922f20bc 100644
--- a/drivers/scsi/be2iscsi/be_mgmt.c
+++ b/drivers/scsi/be2iscsi/be_mgmt.c
@@ -169,6 +169,7 @@ unsigned char mgmt_invalidate_icds(struct beiscsi_hba *phba,
                SE_DEBUG(DBG_LVL_1,
                         "Failed to allocate memory for"
                         "mgmt_invalidate_icds \n");
+                spin_unlock(&ctrl->mbox_lock);
                return -1;
        }
        nonemb_cmd.size = sizeof(struct invalidate_commands_params_in);
diff --git a/drivers/scsi/bnx2i/bnx2i.h b/drivers/scsi/bnx2i/bnx2i.h
index 6cf9dc37d78b..6b624e767d3b 100644
--- a/drivers/scsi/bnx2i/bnx2i.h
+++ b/drivers/scsi/bnx2i/bnx2i.h
@@ -362,6 +362,7 @@ struct bnx2i_hba {
        u32 num_ccell;
        int ofld_conns_active;
+        wait_queue_head_t eh_wait;
        int max_active_conns;
        struct iscsi_cid_queue cid_que;
@@ -381,6 +382,7 @@ struct bnx2i_hba {
        spinlock_t lock;        /* protects hba structure access */
        struct mutex net_dev_lock;/* sync net device access */
+        int hba_shutdown_tmo;
        /*
         * PCI related info.
         */
diff --git a/drivers/scsi/bnx2i/bnx2i_init.c b/drivers/scsi/bnx2i/bnx2i_init.c
index 6d8172e781cf..5d9296c599f6 100644
--- a/drivers/scsi/bnx2i/bnx2i_init.c
+++ b/drivers/scsi/bnx2i/bnx2i_init.c
@@ -177,11 +177,22 @@ void bnx2i_stop(void *handle)
        struct bnx2i_hba *hba = handle;
        /* check if cleanup happened in GOING_DOWN context */
-        clear_bit(ADAPTER_STATE_UP, &hba->adapter_state);
        if (!test_and_clear_bit(ADAPTER_STATE_GOING_DOWN,
                                &hba->adapter_state))
                iscsi_host_for_each_session(hba->shost,
                                            bnx2i_drop_session);
+        /* Wait for all endpoints to be torn down, Chip will be reset once
+         *  control returns to network driver. So it is required to cleanup and
+         * release all connection resources before returning from this routine.
+         */
+        wait_event_interruptible_timeout(hba->eh_wait,
+                                         (hba->ofld_conns_active == 0),
+                                         hba->hba_shutdown_tmo);
+        /* This flag should be cleared last so that ep_disconnect() gracefully
+         * cleans up connection context
+         */
+        clear_bit(ADAPTER_STATE_UP, &hba->adapter_state);
 }
 /**
diff --git a/drivers/scsi/bnx2i/bnx2i_iscsi.c b/drivers/scsi/bnx2i/bnx2i_iscsi.c
index f2e9b18fe76c..fa68ab34b998 100644
--- a/drivers/scsi/bnx2i/bnx2i_iscsi.c
+++ b/drivers/scsi/bnx2i/bnx2i_iscsi.c
@@ -820,6 +820,11 @@ struct bnx2i_hba *bnx2i_alloc_hba(struct cnic_dev *cnic)
        spin_lock_init(&hba->lock);
        mutex_init(&hba->net_dev_lock);
+        init_waitqueue_head(&hba->eh_wait);
+        if (test_bit(BNX2I_NX2_DEV_57710, &hba->cnic_dev_type))
+                hba->hba_shutdown_tmo = 240 * HZ;
+        else    /* 5706/5708/5709 */
+                hba->hba_shutdown_tmo = 30 * HZ;
        if (iscsi_host_add(shost, &hba->pcidev->dev))
                goto free_dump_mem;
@@ -1658,8 +1663,8 @@ static struct iscsi_endpoint *bnx2i_ep_connect(struct Scsi_Host *shost,
                 */
                hba = bnx2i_check_route(dst_addr);
-        if (!hba) {
+        if (!hba || test_bit(ADAPTER_STATE_GOING_DOWN, &hba->adapter_state)) {
-                rc = -ENOMEM;
+                rc = -EINVAL;
                goto check_busy;
        }
@@ -1804,7 +1809,7 @@ static int bnx2i_ep_poll(struct iscsi_endpoint *ep, int timeout_ms)
                                               (bnx2i_ep->state ==
                                                EP_STATE_CONNECT_COMPL)),
                                              msecs_to_jiffies(timeout_ms));
-        if (!rc || (bnx2i_ep->state == EP_STATE_OFLD_FAILED))
+        if (bnx2i_ep->state == EP_STATE_OFLD_FAILED)
                rc = -1;
        if (rc > 0)
@@ -1957,6 +1962,8 @@ return_bnx2i_ep:
        if (!hba->ofld_conns_active)
                bnx2i_unreg_dev_all();
+        wake_up_interruptible(&hba->eh_wait);
 }
diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c
index 496764349c41..0435d044c9da 100644
--- a/drivers/scsi/dpt_i2o.c
+++ b/drivers/scsi/dpt_i2o.c
@@ -188,7 +188,8 @@ MODULE_DEVICE_TABLE(pci,dptids);
 static int adpt_detect(struct scsi_host_template* sht)
 {
        struct pci_dev *pDev = NULL;
-        adpt_hba* pHba;
+        adpt_hba *pHba;
+        adpt_hba *next;
        PINFO("Detecting Adaptec I2O RAID controllers...\n");
@@ -206,7 +207,8 @@ static int adpt_detect(struct scsi_host_template* sht)
        }
        /* In INIT state, Activate IOPs */
-        for (pHba = hba_chain; pHba; pHba = pHba->next) {
+        for (pHba = hba_chain; pHba; pHba = next) {
+                next = pHba->next;
                // Activate does get status , init outbound, and get hrt
                if (adpt_i2o_activate_hba(pHba) < 0) {
                        adpt_i2o_delete_hba(pHba);
@@ -243,7 +245,8 @@ rebuild_sys_tab:
        PDEBUG("HBA's in OPERATIONAL state\n");
        printk("dpti: If you have a lot of devices this could take a few minutes.\n");
-        for (pHba = hba_chain; pHba; pHba = pHba->next) {
+        for (pHba = hba_chain; pHba; pHba = next) {
+                next = pHba->next;
                printk(KERN_INFO"%s: Reading the hardware resource table.\n", pHba->name);
                if (adpt_i2o_lct_get(pHba) < 0){
                        adpt_i2o_delete_hba(pHba);
@@ -263,7 +266,8 @@ rebuild_sys_tab:
                adpt_sysfs_class = NULL;
        }
-        for (pHba = hba_chain; pHba; pHba = pHba->next) {
+        for (pHba = hba_chain; pHba; pHba = next) {
+                next = pHba->next;
                if (adpt_scsi_host_alloc(pHba, sht) < 0){
                        adpt_i2o_delete_hba(pHba);
                        continue;
@@ -1229,11 +1233,10 @@ static void adpt_i2o_delete_hba(adpt_hba* pHba)
                }
        }
        pci_dev_put(pHba->pDev);
-        kfree(pHba);
        if (adpt_sysfs_class)
                device_destroy(adpt_sysfs_class,
                                MKDEV(DPTI_I2O_MAJOR, pHba->unit));
+        kfree(pHba);
        if(hba_count <= 0){
                unregister_chrdev(DPTI_I2O_MAJOR, DPT_DRIVER);   
diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
index ff5ec5ac1fb5..88bad0e81bdd 100644
--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
+++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
@@ -323,16 +323,6 @@ static void set_srp_direction(struct scsi_cmnd *cmd,
                srp_cmd->buf_fmt = fmt;
 }
-static void unmap_sg_list(int num_entries,
-                struct device *dev,
-                struct srp_direct_buf *md)
-{
-        int i;
-        for (i = 0; i < num_entries; ++i)
-                dma_unmap_single(dev, md[i].va, md[i].len, DMA_BIDIRECTIONAL);
-}
 /**
 * unmap_cmd_data: - Unmap data pointed in srp_cmd based on the format
 * @cmd:        srp_cmd whose additional_data member will be unmapped
@@ -350,24 +340,9 @@ static void unmap_cmd_data(struct srp_cmd *cmd,
        if (out_fmt == SRP_NO_DATA_DESC && in_fmt == SRP_NO_DATA_DESC)
                return;
-        else if (out_fmt == SRP_DATA_DESC_DIRECT ||
-                 in_fmt == SRP_DATA_DESC_DIRECT) {
-                struct srp_direct_buf *data =
-                        (struct srp_direct_buf *) cmd->add_data;
-                dma_unmap_single(dev, data->va, data->len, DMA_BIDIRECTIONAL);
-        } else {
-                struct srp_indirect_buf *indirect =
-                        (struct srp_indirect_buf *) cmd->add_data;
-                int num_mapped = indirect->table_desc.len /
-                        sizeof(struct srp_direct_buf);
-                if (num_mapped <= MAX_INDIRECT_BUFS) {
+        if (evt_struct->cmnd)
-                        unmap_sg_list(num_mapped, dev, &indirect->desc_list[0]);
+                scsi_dma_unmap(evt_struct->cmnd);
-                        return;
-                }
-                unmap_sg_list(num_mapped, dev, evt_struct->ext_list);
-        }
 }
 static int map_sg_list(struct scsi_cmnd *cmd, int nseg,
diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c
index 0ee725ced511..02143af7c1af 100644
--- a/drivers/scsi/iscsi_tcp.c
+++ b/drivers/scsi/iscsi_tcp.c
@@ -599,7 +599,7 @@ static void iscsi_sw_tcp_conn_stop(struct iscsi_cls_conn *cls_conn, int flag)
        set_bit(ISCSI_SUSPEND_BIT, &conn->suspend_rx);
        write_unlock_bh(&tcp_sw_conn->sock->sk->sk_callback_lock);
-        if (sock->sk->sk_sleep && waitqueue_active(sock->sk->sk_sleep)) {
+        if (sock->sk->sk_sleep) {
                sock->sk->sk_err = EIO;
                wake_up_interruptible(sock->sk->sk_sleep);
        }
diff --git a/drivers/scsi/lpfc/lpfc_bsg.c b/drivers/scsi/lpfc/lpfc_bsg.c
index ec3723831e89..d62b3e467926 100644
--- a/drivers/scsi/lpfc/lpfc_bsg.c
+++ b/drivers/scsi/lpfc/lpfc_bsg.c
@@ -433,7 +433,7 @@ lpfc_bsg_rport_els_cmp(struct lpfc_hba *phba,
        dd_data = cmdiocbq->context1;
        /* normal completion and timeout crossed paths, already done */
        if (!dd_data) {
-                spin_unlock_irqrestore(&phba->hbalock, flags);
+                spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
                return;
        }
@@ -1196,7 +1196,7 @@ lpfc_issue_ct_rsp_cmp(struct lpfc_hba *phba,
        dd_data = cmdiocbq->context1;
        /* normal completion and timeout crossed paths, already done */
        if (!dd_data) {
-                spin_unlock_irqrestore(&phba->hbalock, flags);
+                spin_unlock_irqrestore(&phba->ct_ev_lock, flags);
                return;
        }
diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c
index 359e9a71a021..1c7ef55966fb 100644
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -2393,6 +2393,7 @@ qla24xx_bsg_timeout(struct fc_bsg_job *bsg_job)
        return 0;
 done:
+        spin_unlock_irqrestore(&ha->hardware_lock, flags);
        if (bsg_job->request->msgcode == FC_BSG_HST_CT)
                kfree(sp->fcport);
        kfree(sp->ctx);
diff --git a/drivers/scsi/qla4xxx/ql4_mbx.c b/drivers/scsi/qla4xxx/ql4_mbx.c
index 09d6d4b76f39..caeb7d10ae04 100644
--- a/drivers/scsi/qla4xxx/ql4_mbx.c
+++ b/drivers/scsi/qla4xxx/ql4_mbx.c
@@ -467,7 +467,7 @@ int qla4xxx_get_fwddb_entry(struct scsi_qla_host *ha,
        if (conn_err_detail)
                *conn_err_detail = mbox_sts[5];
        if (tcp_source_port_num)
-                *tcp_source_port_num = (uint16_t) mbox_sts[6] >> 16;
+                *tcp_source_port_num = (uint16_t) (mbox_sts[6] >> 16);
        if (connection_id)
                *connection_id = (uint16_t) mbox_sts[6] & 0x00FF;
        status = QLA_SUCCESS;
diff --git a/drivers/scsi/wd7000.c b/drivers/scsi/wd7000.c
index d0b7d2ff9ac5..333580bf37c5 100644
--- a/drivers/scsi/wd7000.c
+++ b/drivers/scsi/wd7000.c
@@ -1587,7 +1587,7 @@ static int wd7000_host_reset(struct scsi_cmnd *SCpnt)
 {
        Adapter *host = (Adapter *) SCpnt->device->host->hostdata;
-        spin_unlock_irq(SCpnt->device->host->host_lock);
+        spin_lock_irq(SCpnt->device->host->host_lock);
        if (wd7000_adapter_reset(host) < 0) {
                spin_unlock_irq(SCpnt->device->host->host_lock);
diff --git a/drivers/serial/8250_pnp.c b/drivers/serial/8250_pnp.c
index 24485cc62ff8..4822cb50cd0f 100644
--- a/drivers/serial/8250_pnp.c
+++ b/drivers/serial/8250_pnp.c
@@ -348,6 +348,8 @@ static const struct pnp_device_id pnp_dev_table[] = {
        {       "FUJ02E6",              0       },
        /* Fujitsu Wacom 2FGT Tablet PC device */
        {       "FUJ02E7",              0       },
+        /* Fujitsu Wacom 1FGT Tablet PC device */
+        {       "FUJ02E9",              0       },
        /*
         * LG C1 EXPRESS DUAL (C1-PB11A3) touch screen (actually a FUJ02E6 in
         * disguise)
diff --git a/drivers/serial/mcf.c b/drivers/serial/mcf.c
index 7bb5fee639e3..b5aaef965f24 100644
--- a/drivers/serial/mcf.c
+++ b/drivers/serial/mcf.c
@@ -263,6 +263,7 @@ static void mcf_set_termios(struct uart_port *port, struct ktermios *termios,
        }
        spin_lock_irqsave(&port->lock, flags);
+        uart_update_timeout(port, termios->c_cflag, baud);
        writeb(MCFUART_UCR_CMDRESETRX, port->membase + MCFUART_UCR);
        writeb(MCFUART_UCR_CMDRESETTX, port->membase + MCFUART_UCR);
        writeb(MCFUART_UCR_CMDRESETMRPTR, port->membase + MCFUART_UCR);
@@ -379,6 +380,7 @@ static irqreturn_t mcf_interrupt(int irq, void *data)
 static void mcf_config_port(struct uart_port *port, int flags)
 {
        port->type = PORT_MCF;
+        port->fifosize = MCFUART_TXFIFOSIZE;
        /* Clear mask, so no surprise interrupts. */
        writeb(0, port->membase + MCFUART_UIMR);
@@ -424,7 +426,7 @@ static int mcf_verify_port(struct uart_port *port, struct serial_struct *ser)
 /*
 *      Define the basic serial functions we support.
 */
-static struct uart_ops mcf_uart_ops = {
+static const struct uart_ops mcf_uart_ops = {
        .tx_empty       = mcf_tx_empty,
        .get_mctrl      = mcf_get_mctrl,
        .set_mctrl      = mcf_set_mctrl,
@@ -443,7 +445,7 @@ static struct uart_ops mcf_uart_ops = {
        .verify_port    = mcf_verify_port,
 };
-static struct mcf_uart mcf_ports[3];
+static struct mcf_uart mcf_ports[4];
 #define MCF_MAXPORTS    ARRAY_SIZE(mcf_ports)
diff --git a/drivers/serial/mpc52xx_uart.c b/drivers/serial/mpc52xx_uart.c
index 3119fddaedb5..a176ab4bd65b 100644
--- a/drivers/serial/mpc52xx_uart.c
+++ b/drivers/serial/mpc52xx_uart.c
@@ -29,39 +29,6 @@
 * kind, whether express or implied.
 */
-/* Platform device Usage :
- *
- * Since PSCs can have multiple function, the correct driver for each one
- * is selected by calling mpc52xx_match_psc_function(...). The function
- * handled by this driver is "uart".
- *
- * The driver init all necessary registers to place the PSC in uart mode without
- * DCD. However, the pin multiplexing aren't changed and should be set either
- * by the bootloader or in the platform init code.
- *
- * The idx field must be equal to the PSC index (e.g. 0 for PSC1, 1 for PSC2,
- * and so on). So the PSC1 is mapped to /dev/ttyPSC0, PSC2 to /dev/ttyPSC1 and
- * so on. But be warned, it's an ABSOLUTE REQUIREMENT ! This is needed mainly
- * fpr the console code : without this 1:1 mapping, at early boot time, when we
- * are parsing the kernel args console=ttyPSC?, we wouldn't know which PSC it
- * will be mapped to.
- */
-/* OF Platform device Usage :
- *
- * This driver is only used for PSCs configured in uart mode.  The device
- * tree will have a node for each PSC with "mpc52xx-psc-uart" in the compatible
- * list.
- *
- * By default, PSC devices are enumerated in the order they are found.  However
- * a particular PSC number can be forces by adding 'device_no = <port#>'
- * to the device node.
- *
- * The driver init all necessary registers to place the PSC in uart mode without
- * DCD. However, the pin multiplexing aren't changed and should be set either
- * by the bootloader or in the platform init code.
- */
 #undef DEBUG
 #include <linux/device.h>
diff --git a/drivers/serial/pmac_zilog.c b/drivers/serial/pmac_zilog.c
index 4eaa043ca2a8..700e10833bf9 100644
--- a/drivers/serial/pmac_zilog.c
+++ b/drivers/serial/pmac_zilog.c
@@ -752,8 +752,10 @@ static void pmz_break_ctl(struct uart_port *port, int break_state)
                uap->curregs[R5] = new_reg;
                /* NOTE: Not subject to 'transmitter active' rule. */
-                if (ZS_IS_ASLEEP(uap))
+                if (ZS_IS_ASLEEP(uap)) {
+                        spin_unlock_irqrestore(&port->lock, flags);
                        return;
+                }
                write_zsreg(uap, R5, uap->curregs[R5]);
        }
diff --git a/drivers/serial/serial_cs.c b/drivers/serial/serial_cs.c
index 175d202ab37e..8cfa5b12ea7a 100644
--- a/drivers/serial/serial_cs.c
+++ b/drivers/serial/serial_cs.c
@@ -105,6 +105,10 @@ struct serial_cfg_mem {
 * manfid 0x0160, 0x0104
 * This card appears to have a 14.7456MHz clock.
 */
+/* Generic Modem: MD55x (GPRS/EDGE) have
+ * Elan VPU16551 UART with 14.7456MHz oscillator
+ * manfid 0x015D, 0x4C45
+ */
 static void quirk_setup_brainboxes_0104(struct pcmcia_device *link, struct uart_port *port)
 {
        port->uartclk = 14745600;
@@ -196,6 +200,11 @@ static const struct serial_quirk quirks[] = {
                .multi  = -1,
                .setup  = quirk_setup_brainboxes_0104,
        }, {
+                .manfid = 0x015D,
+                .prodid = 0x4C45,
+                .multi  = -1,
+                .setup  = quirk_setup_brainboxes_0104,
+        }, {
                .manfid = MANFID_IBM,
                .prodid = ~0,
                .multi  = -1,
diff --git a/drivers/serial/serial_ks8695.c b/drivers/serial/serial_ks8695.c
index 2e71bbc04dac..b1962025b1aa 100644
--- a/drivers/serial/serial_ks8695.c
+++ b/drivers/serial/serial_ks8695.c
@@ -650,6 +650,7 @@ static struct console ks8695_console = {
 static int __init ks8695_console_init(void)
 {
+        add_preferred_console(SERIAL_KS8695_DEVNAME, 0, NULL);
        register_console(&ks8695_console);
        return 0;
 }
diff --git a/drivers/spi/omap2_mcspi.c b/drivers/spi/omap2_mcspi.c
index d8356af118a8..e0de0d0eedea 100644
--- a/drivers/spi/omap2_mcspi.c
+++ b/drivers/spi/omap2_mcspi.c
@@ -204,6 +204,7 @@ static inline void mcspi_write_chconf0(const struct spi_device *spi, u32 val)
        cs->chconf0 = val;
        mcspi_write_cs_reg(spi, OMAP2_MCSPI_CHCONF0, val);
+        mcspi_read_cs_reg(spi, OMAP2_MCSPI_CHCONF0);
 }
 static void omap2_mcspi_set_dma_req(const struct spi_device *spi,
@@ -532,7 +533,7 @@ omap2_mcspi_txrx_pio(struct spi_device *spi, struct spi_transfer *xfer)
                                        goto out;
                                }
 #ifdef VERBOSE
-                                dev_dbg(&spi->dev, "write-%d %04x\n",
+                                dev_dbg(&spi->dev, "write-%d %08x\n",
                                                word_len, *tx);
 #endif
                                __raw_writel(*tx++, tx_reg);
@@ -550,7 +551,7 @@ omap2_mcspi_txrx_pio(struct spi_device *spi, struct spi_transfer *xfer)
                                        mcspi_write_chconf0(spi, l);
                                *rx++ = __raw_readl(rx_reg);
 #ifdef VERBOSE
-                                dev_dbg(&spi->dev, "read-%d %04x\n",
+                                dev_dbg(&spi->dev, "read-%d %08x\n",
                                                word_len, *(rx - 1));
 #endif
                        }
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 9ffb0fdbd6fe..b3a1f9259b62 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -41,7 +41,7 @@ static void spidev_release(struct device *dev)
                spi->master->cleanup(spi);
        spi_master_put(spi->master);
-        kfree(dev);
+        kfree(spi);
 }
 static ssize_t
@@ -257,6 +257,7 @@ int spi_add_device(struct spi_device *spi)
 {
        static DEFINE_MUTEX(spi_add_lock);
        struct device *dev = spi->master->dev.parent;
+        struct device *d;
        int status;
        /* Chipselects are numbered 0..max; validate. */
@@ -278,10 +279,11 @@ int spi_add_device(struct spi_device *spi)
         */
        mutex_lock(&spi_add_lock);
-        if (bus_find_device_by_name(&spi_bus_type, NULL, dev_name(&spi->dev))
+        d = bus_find_device_by_name(&spi_bus_type, NULL, dev_name(&spi->dev));
-                        != NULL) {
+        if (d != NULL) {
                dev_err(dev, "chipselect %d already in use\n",
                                spi->chip_select);
+                put_device(d);
                status = -EBUSY;
                goto done;
        }
diff --git a/drivers/staging/dt3155/dt3155_drv.c b/drivers/staging/dt3155/dt3155_drv.c
index a67c622869d2..7ac2c6d8e9a3 100644
--- a/drivers/staging/dt3155/dt3155_drv.c
+++ b/drivers/staging/dt3155/dt3155_drv.c
@@ -57,19 +57,8 @@ MA 02111-1307 USA
 extern void printques(int);
-#ifdef MODULE
 #include <linux/module.h>
 #include <linux/interrupt.h>
-MODULE_LICENSE("GPL");
-#endif
-#ifndef CONFIG_PCI
-#error  "DT3155 :  Kernel PCI support not enabled (DT3155 drive requires PCI)"
-#endif
 #include <linux/pci.h>
 #include <linux/types.h>
 #include <linux/poll.h>
@@ -84,6 +73,9 @@ MODULE_LICENSE("GPL");
 #include "dt3155_io.h"
 #include "allocator.h"
+MODULE_LICENSE("GPL");
 /* Error variable.  Zero means no error. */
 int dt3155_errno = 0;
@@ -472,9 +464,9 @@ static void dt3155_init_isr(int minor)
  /* 50/60 Hz should be set before this point but let's make sure it is */
  /* right anyway */
-  ReadI2C(dt3155_lbase[ minor ], CONFIG, &i2c_csr2.reg);
+  ReadI2C(dt3155_lbase[ minor ], CSR2, &i2c_csr2.reg);
  i2c_csr2.fld.HZ50 = FORMAT50HZ;
-  WriteI2C(dt3155_lbase[ minor ], CONFIG, i2c_config.reg);
+  WriteI2C(dt3155_lbase[ minor ], CSR2, i2c_csr2.reg);
  /* enable busmaster chip, clear flags */
diff --git a/drivers/staging/hv/Hv.c b/drivers/staging/hv/Hv.c
index 5d53889fb4a4..3a1112d29aeb 100644
--- a/drivers/staging/hv/Hv.c
+++ b/drivers/staging/hv/Hv.c
@@ -306,9 +306,9 @@ void HvCleanup(void)
        DPRINT_ENTER(VMBUS);
        if (gHvContext.SignalEventBuffer) {
+                kfree(gHvContext.SignalEventBuffer);
                gHvContext.SignalEventBuffer = NULL;
                gHvContext.SignalEventParam = NULL;
-                kfree(gHvContext.SignalEventBuffer);
        }
        if (gHvContext.HypercallPage) {
diff --git a/drivers/staging/hv/RndisFilter.c b/drivers/staging/hv/RndisFilter.c
index cd2930de2176..6704f64c93f0 100644
--- a/drivers/staging/hv/RndisFilter.c
+++ b/drivers/staging/hv/RndisFilter.c
@@ -751,6 +751,7 @@ static int RndisFilterOpenDevice(struct rndis_device *Device)
        ret = RndisFilterSetPacketFilter(Device,
                                         NDIS_PACKET_TYPE_BROADCAST |
+                                         NDIS_PACKET_TYPE_ALL_MULTICAST |
                                         NDIS_PACKET_TYPE_DIRECTED);
        if (ret == 0)
                Device->State = RNDIS_DEV_DATAINITIALIZED;
diff --git a/drivers/staging/hv/netvsc_drv.c b/drivers/staging/hv/netvsc_drv.c
index 2ccb6b93fe47..ab27d9a4446d 100644
--- a/drivers/staging/hv/netvsc_drv.c
+++ b/drivers/staging/hv/netvsc_drv.c
@@ -403,8 +403,7 @@ static int netvsc_probe(struct device *device)
        if (!net_drv_obj->Base.OnDeviceAdd)
                return -1;
-        net = alloc_netdev(sizeof(struct net_device_context), "seth%d",
+        net = alloc_etherdev(sizeof(struct net_device_context));
-                           ether_setup);
        if (!net)
                return -1;
diff --git a/drivers/staging/iio/accel/lis3l02dq_core.c b/drivers/staging/iio/accel/lis3l02dq_core.c
index ea76902797bb..82e43588e8a5 100644
--- a/drivers/staging/iio/accel/lis3l02dq_core.c
+++ b/drivers/staging/iio/accel/lis3l02dq_core.c
@@ -618,7 +618,7 @@ static int lis3l02dq_thresh_handler_th(struct iio_dev *dev_info,
 static void lis3l02dq_thresh_handler_bh_no_check(struct work_struct *work_s)
 {
        struct iio_work_cont *wc
-                = container_of(work_s, struct iio_work_cont, ws_nocheck);
+                = container_of(work_s, struct iio_work_cont, ws);
        struct lis3l02dq_state *st = wc->st;
        u8 t;
diff --git a/drivers/staging/iio/accel/lis3l02dq_ring.c b/drivers/staging/iio/accel/lis3l02dq_ring.c
index 93712430e579..a4d97ea0df3d 100644
--- a/drivers/staging/iio/accel/lis3l02dq_ring.c
+++ b/drivers/staging/iio/accel/lis3l02dq_ring.c
@@ -493,6 +493,9 @@ int lis3l02dq_probe_trigger(struct iio_dev *indio_dev)
        struct lis3l02dq_state *state = indio_dev->dev_data;
        state->trig = iio_allocate_trigger();
+        if (!state->trig)
+                return -ENOMEM;
        state->trig->name = kmalloc(IIO_TRIGGER_NAME_LENGTH, GFP_KERNEL);
        if (!state->trig->name) {
                ret = -ENOMEM;
diff --git a/drivers/staging/iio/adc/max1363_core.c b/drivers/staging/iio/adc/max1363_core.c
index 790d1cc9cdc3..773f1d1d9c6e 100644
--- a/drivers/staging/iio/adc/max1363_core.c
+++ b/drivers/staging/iio/adc/max1363_core.c
@@ -557,6 +557,7 @@ error_put_reg:
        if (!IS_ERR(st->reg))
                regulator_put(st->reg);
 error_free_st:
+        i2c_set_clientdata(client, NULL);
        kfree(st);
 error_ret:
@@ -574,6 +575,7 @@ static int max1363_remove(struct i2c_client *client)
                regulator_disable(st->reg);
                regulator_put(st->reg);
        }
+        i2c_set_clientdata(client, NULL);
        kfree(st);
        return 0;
diff --git a/drivers/staging/iio/industrialio-core.c b/drivers/staging/iio/industrialio-core.c
index 37f58f66e491..1d77082c8531 100644
--- a/drivers/staging/iio/industrialio-core.c
+++ b/drivers/staging/iio/industrialio-core.c
@@ -537,6 +537,7 @@ static void iio_device_unregister_sysfs(struct iio_dev *dev_info)
        sysfs_remove_group(&dev_info->dev.kobj, dev_info->attrs);
 }
+/* Return a negative errno on failure */
 int iio_get_new_idr_val(struct idr *this_idr)
 {
        int ret;
@@ -660,7 +661,7 @@ static int iio_device_register_eventset(struct iio_dev *dev_info)
        for (i = 0; i < dev_info->num_interrupt_lines; i++) {
                dev_info->event_interfaces[i].owner = dev_info->driver_module;
                ret = iio_get_new_idr_val(&iio_event_idr);
-                if (ret)
+                if (ret < 0)
                        goto error_free_setup_ev_ints;
                else
                        dev_info->event_interfaces[i].id = ret;
diff --git a/drivers/staging/iio/light/tsl2563.c b/drivers/staging/iio/light/tsl2563.c
index 1ba4aa392f6e..8770a00e3652 100644
--- a/drivers/staging/iio/light/tsl2563.c
+++ b/drivers/staging/iio/light/tsl2563.c
@@ -682,6 +682,7 @@ static int __devinit tsl2563_probe(struct i2c_client *client,
 fail2:
        iio_device_unregister(chip->indio_dev);
 fail1:
+        i2c_set_clientdata(client, NULL);
        kfree(chip);
        return err;
 }
@@ -692,6 +693,7 @@ static int tsl2563_remove(struct i2c_client *client)
        iio_device_unregister(chip->indio_dev);
+        i2c_set_clientdata(client, NULL);
        kfree(chip);
        return 0;
 }
diff --git a/drivers/staging/iio/ring_sw.c b/drivers/staging/iio/ring_sw.c
index b104c3d9c35e..cf22c091668c 100644
--- a/drivers/staging/iio/ring_sw.c
+++ b/drivers/staging/iio/ring_sw.c
@@ -293,7 +293,7 @@ again:
                return -EAGAIN;
        memcpy(data, last_written_p_copy, ring->buf.bpd);
-        if (unlikely(ring->last_written_p >= last_written_p_copy))
+        if (unlikely(ring->last_written_p != last_written_p_copy))
                goto again;
        iio_unmark_sw_rb_in_use(&ring->buf);
diff --git a/drivers/staging/octeon/cvmx-helper-board.c b/drivers/staging/octeon/cvmx-helper-board.c
index 3085e38a6f99..00a555b83354 100644
--- a/drivers/staging/octeon/cvmx-helper-board.c
+++ b/drivers/staging/octeon/cvmx-helper-board.c
@@ -153,6 +153,14 @@ int cvmx_helper_board_get_mii_address(int ipd_port)
                 * through switch.
                 */
                return -1;
+        case CVMX_BOARD_TYPE_CUST_WSX16:
+                if (ipd_port >= 0 && ipd_port <= 3)
+                        return ipd_port;
+                else if (ipd_port >= 16 && ipd_port <= 19)
+                        return ipd_port - 16 + 4;
+                else
+                        return -1;
        }
        /* Some unknown board. Somebody forgot to update this function... */
diff --git a/drivers/staging/rt2860/usb_main_dev.c b/drivers/staging/rt2860/usb_main_dev.c
index 1873a79bb033..740db0c1ac01 100644
--- a/drivers/staging/rt2860/usb_main_dev.c
+++ b/drivers/staging/rt2860/usb_main_dev.c
@@ -63,6 +63,7 @@ struct usb_device_id rtusb_usb_id[] = {
        {USB_DEVICE(0x07D1, 0x3C11)},   /* D-Link */
        {USB_DEVICE(0x14B2, 0x3C07)},   /* AL */
        {USB_DEVICE(0x050D, 0x8053)},   /* Belkin */
+        {USB_DEVICE(0x050D, 0x825B)},   /* Belkin */
        {USB_DEVICE(0x14B2, 0x3C23)},   /* Airlink */
        {USB_DEVICE(0x14B2, 0x3C27)},   /* Airlink */
        {USB_DEVICE(0x07AA, 0x002F)},   /* Corega */
diff --git a/drivers/staging/rtl8192su/r8192U_core.c b/drivers/staging/rtl8192su/r8192U_core.c
index e16256fe595a..04d9b85f3d4c 100644
--- a/drivers/staging/rtl8192su/r8192U_core.c
+++ b/drivers/staging/rtl8192su/r8192U_core.c
@@ -113,14 +113,17 @@ u32 rt_global_debug_component = \
 static const struct usb_device_id rtl8192_usb_id_tbl[] = {
        /* Realtek */
+        {USB_DEVICE(0x0bda, 0x8171)},
        {USB_DEVICE(0x0bda, 0x8192)},
        {USB_DEVICE(0x0bda, 0x8709)},
        /* Corega */
        {USB_DEVICE(0x07aa, 0x0043)},
        /* Belkin */
        {USB_DEVICE(0x050d, 0x805E)},
+        {USB_DEVICE(0x050d, 0x815F)}, /* Belkin F5D8053 v6 */
        /* Sitecom */
        {USB_DEVICE(0x0df6, 0x0031)},
+        {USB_DEVICE(0x0df6, 0x004b)},   /* WL-349 */
        /* EnGenius */
        {USB_DEVICE(0x1740, 0x9201)},
        /* Dlink */
diff --git a/drivers/staging/usbip/usbip_event.c b/drivers/staging/usbip/usbip_event.c
index 6da1021e8a65..a2566f1075d5 100644
--- a/drivers/staging/usbip/usbip_event.c
+++ b/drivers/staging/usbip/usbip_event.c
@@ -117,6 +117,9 @@ void usbip_stop_eh(struct usbip_device *ud)
 {
        struct usbip_task *eh = &ud->eh;
+        if (eh->thread == current)
+                return; /* do not wait for myself */
        wait_for_completion(&eh->thread_done);
        usbip_dbg_eh("usbip_eh has finished\n");
 }
diff --git a/drivers/staging/vme/bridges/vme_tsi148.c b/drivers/staging/vme/bridges/vme_tsi148.c
index 68f24425977f..783051f59f19 100644
--- a/drivers/staging/vme/bridges/vme_tsi148.c
+++ b/drivers/staging/vme/bridges/vme_tsi148.c
@@ -2455,9 +2455,10 @@ static int tsi148_probe(struct pci_dev *pdev, const struct pci_device_id *id)
        dev_info(&pdev->dev, "VME Write and flush and error check is %s\n",
                err_chk ? "enabled" : "disabled");
-        if (tsi148_crcsr_init(tsi148_bridge, pdev))
+        if (tsi148_crcsr_init(tsi148_bridge, pdev)) {
                dev_err(&pdev->dev, "CR/CSR configuration failed.\n");
                goto err_crcsr;
+        }
        retval = vme_register_bridge(tsi148_bridge);
        if (retval != 0) {
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index be6331e2c276..5e1a253b08a0 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1542,6 +1542,9 @@ static const struct usb_device_id acm_ids[] = {
        { USB_DEVICE(0x1bbb, 0x0003), /* Alcatel OT-I650 */
        .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
        },
+        { USB_DEVICE(0x1576, 0x03b1), /* Maretron USB100 */
+        .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
+        },
        /* Nokia S60 phones expose two ACM channels. The first is
         * a modem and is picked up by the standard AT-command
diff --git a/drivers/usb/core/Kconfig b/drivers/usb/core/Kconfig
index 97a819c23ef3..7e594449600e 100644
--- a/drivers/usb/core/Kconfig
+++ b/drivers/usb/core/Kconfig
@@ -109,7 +109,7 @@ config USB_SUSPEND
 config USB_OTG
        bool
        depends on USB && EXPERIMENTAL
-        select USB_SUSPEND
+        depends on USB_SUSPEND
        default n
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index 6a3b5cae3a6e..2f3dc4cdf79b 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -301,7 +301,7 @@ static int usb_probe_interface(struct device *dev)
        intf->condition = USB_INTERFACE_BINDING;
-        /* Bound interfaces are initially active.  They are
+        /* Probed interfaces are initially active.  They are
         * runtime-PM-enabled only if the driver has autosuspend support.
         * They are sensitive to their children's power states.
         */
@@ -437,11 +437,11 @@ int usb_driver_claim_interface(struct usb_driver *driver,
        iface->condition = USB_INTERFACE_BOUND;
-        /* Bound interfaces are initially active.  They are
+        /* Claimed interfaces are initially inactive (suspended).  They are
         * runtime-PM-enabled only if the driver has autosuspend support.
         * They are sensitive to their children's power states.
         */
-        pm_runtime_set_active(dev);
+        pm_runtime_set_suspended(dev);
        pm_suspend_ignore_children(dev, false);
        if (driver->supports_autosuspend)
                pm_runtime_enable(dev);
@@ -1170,7 +1170,7 @@ done:
 static int usb_suspend_both(struct usb_device *udev, pm_message_t msg)
 {
        int                     status = 0;
-        int                     i = 0;
+        int                     i = 0, n = 0;
        struct usb_interface    *intf;
        if (udev->state == USB_STATE_NOTATTACHED ||
@@ -1179,7 +1179,8 @@ static int usb_suspend_both(struct usb_device *udev, pm_message_t msg)
        /* Suspend all the interfaces and then udev itself */
        if (udev->actconfig) {
-                for (; i < udev->actconfig->desc.bNumInterfaces; i++) {
+                n = udev->actconfig->desc.bNumInterfaces;
+                for (i = n - 1; i >= 0; --i) {
                        intf = udev->actconfig->interface[i];
                        status = usb_suspend_interface(udev, intf, msg);
                        if (status != 0)
@@ -1192,7 +1193,7 @@ static int usb_suspend_both(struct usb_device *udev, pm_message_t msg)
        /* If the suspend failed, resume interfaces that did get suspended */
        if (status != 0) {
                msg.event ^= (PM_EVENT_SUSPEND | PM_EVENT_RESUME);
-                while (--i >= 0) {
+                while (++i < n) {
                        intf = udev->actconfig->interface[i];
                        usb_resume_interface(udev, intf, msg, 0);
                }
@@ -1263,13 +1264,47 @@ static int usb_resume_both(struct usb_device *udev, pm_message_t msg)
        return status;
 }
+static void choose_wakeup(struct usb_device *udev, pm_message_t msg)
+{
+        int                     w, i;
+        struct usb_interface    *intf;
+        /* Remote wakeup is needed only when we actually go to sleep.
+         * For things like FREEZE and QUIESCE, if the device is already
+         * autosuspended then its current wakeup setting is okay.
+         */
+        if (msg.event == PM_EVENT_FREEZE || msg.event == PM_EVENT_QUIESCE) {
+                if (udev->state != USB_STATE_SUSPENDED)
+                        udev->do_remote_wakeup = 0;
+                return;
+        }
+        /* If remote wakeup is permitted, see whether any interface drivers
+         * actually want it.
+         */
+        w = 0;
+        if (device_may_wakeup(&udev->dev) && udev->actconfig) {
+                for (i = 0; i < udev->actconfig->desc.bNumInterfaces; i++) {
+                        intf = udev->actconfig->interface[i];
+                        w |= intf->needs_remote_wakeup;
+                }
+        }
+        /* If the device is autosuspended with the wrong wakeup setting,
+         * autoresume now so the setting can be changed.
+         */
+        if (udev->state == USB_STATE_SUSPENDED && w != udev->do_remote_wakeup)
+                pm_runtime_resume(&udev->dev);
+        udev->do_remote_wakeup = w;
+}
 /* The device lock is held by the PM core */
 int usb_suspend(struct device *dev, pm_message_t msg)
 {
        struct usb_device       *udev = to_usb_device(dev);
        do_unbind_rebind(udev, DO_UNBIND);
-        udev->do_remote_wakeup = device_may_wakeup(&udev->dev);
+        choose_wakeup(udev, msg);
        return usb_suspend_both(udev, msg);
 }
diff --git a/drivers/usb/core/generic.c b/drivers/usb/core/generic.c
index bdf87a8414a1..2c95153c0f24 100644
--- a/drivers/usb/core/generic.c
+++ b/drivers/usb/core/generic.c
@@ -120,7 +120,7 @@ int usb_choose_configuration(struct usb_device *udev)
                 * than a vendor-specific driver. */
                else if (udev->descriptor.bDeviceClass !=
                                                USB_CLASS_VENDOR_SPEC &&
-                                (!desc || desc->bInterfaceClass !=
+                                (desc && desc->bInterfaceClass !=
                                                USB_CLASS_VENDOR_SPEC)) {
                        best = c;
                        break;
diff --git a/drivers/usb/core/inode.c b/drivers/usb/core/inode.c
index 97b40ce133f0..4a6366a42129 100644
--- a/drivers/usb/core/inode.c
+++ b/drivers/usb/core/inode.c
@@ -515,13 +515,13 @@ static int fs_create_by_name (const char *name, mode_t mode,
        *dentry = NULL;
        mutex_lock(&parent->d_inode->i_mutex);
        *dentry = lookup_one_len(name, parent, strlen(name));
-        if (!IS_ERR(dentry)) {
+        if (!IS_ERR(*dentry)) {
                if ((mode & S_IFMT) == S_IFDIR)
                        error = usbfs_mkdir (parent->d_inode, *dentry, mode);
                else 
                        error = usbfs_create (parent->d_inode, *dentry, mode);
        } else
-                error = PTR_ERR(dentry);
+                error = PTR_ERR(*dentry);
        mutex_unlock(&parent->d_inode->i_mutex);
        return error;
diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c
index 1297e9b16a51..0561430f2ede 100644
--- a/drivers/usb/core/usb.c
+++ b/drivers/usb/core/usb.c
@@ -718,7 +718,7 @@ int __usb_get_extra_descriptor(char *buffer, unsigned size,
 EXPORT_SYMBOL_GPL(__usb_get_extra_descriptor);
 /**
- * usb_buffer_alloc - allocate dma-consistent buffer for URB_NO_xxx_DMA_MAP
+ * usb_alloc_coherent - allocate dma-consistent buffer for URB_NO_xxx_DMA_MAP
 * @dev: device the buffer will be used with
 * @size: requested buffer size
 * @mem_flags: affect whether allocation may block
@@ -737,30 +737,30 @@ EXPORT_SYMBOL_GPL(__usb_get_extra_descriptor);
 * architectures where CPU caches are not DMA-coherent.  On systems without
 * bus-snooping caches, these buffers are uncached.
 *
- * When the buffer is no longer used, free it with usb_buffer_free().
+ * When the buffer is no longer used, free it with usb_free_coherent().
 */
-void *usb_buffer_alloc(struct usb_device *dev, size_t size, gfp_t mem_flags,
+void *usb_alloc_coherent(struct usb_device *dev, size_t size, gfp_t mem_flags,
-                       dma_addr_t *dma)
+                         dma_addr_t *dma)
 {
        if (!dev || !dev->bus)
                return NULL;
        return hcd_buffer_alloc(dev->bus, size, mem_flags, dma);
 }
-EXPORT_SYMBOL_GPL(usb_buffer_alloc);
+EXPORT_SYMBOL_GPL(usb_alloc_coherent);
 /**
- * usb_buffer_free - free memory allocated with usb_buffer_alloc()
+ * usb_free_coherent - free memory allocated with usb_alloc_coherent()
 * @dev: device the buffer was used with
 * @size: requested buffer size
 * @addr: CPU address of buffer
 * @dma: DMA address of buffer
 *
 * This reclaims an I/O buffer, letting it be reused.  The memory must have
- * been allocated using usb_buffer_alloc(), and the parameters must match
+ * been allocated using usb_alloc_coherent(), and the parameters must match
 * those provided in that allocation request.
 */
-void usb_buffer_free(struct usb_device *dev, size_t size, void *addr,
+void usb_free_coherent(struct usb_device *dev, size_t size, void *addr,
-                     dma_addr_t dma)
+                       dma_addr_t dma)
 {
        if (!dev || !dev->bus)
                return;
@@ -768,7 +768,7 @@ void usb_buffer_free(struct usb_device *dev, size_t size, void *addr,
                return;
        hcd_buffer_free(dev->bus, size, addr, dma);
 }
-EXPORT_SYMBOL_GPL(usb_buffer_free);
+EXPORT_SYMBOL_GPL(usb_free_coherent);
 /**
 * usb_buffer_map - create DMA mapping(s) for an urb
diff --git a/drivers/usb/gadget/s3c-hsotg.c b/drivers/usb/gadget/s3c-hsotg.c
index 124a8ccfdcda..1f73b485732d 100644
--- a/drivers/usb/gadget/s3c-hsotg.c
+++ b/drivers/usb/gadget/s3c-hsotg.c
@@ -2145,6 +2145,7 @@ static int s3c_hsotg_ep_enable(struct usb_ep *ep,
        u32 epctrl;
        u32 mps;
        int dir_in;
+        int ret = 0;
        dev_dbg(hsotg->dev,
                "%s: ep %s: a 0x%02x, attr 0x%02x, mps 0x%04x, intr %d\n",
@@ -2196,7 +2197,8 @@ static int s3c_hsotg_ep_enable(struct usb_ep *ep,
        switch (desc->bmAttributes & USB_ENDPOINT_XFERTYPE_MASK) {
        case USB_ENDPOINT_XFER_ISOC:
                dev_err(hsotg->dev, "no current ISOC support\n");
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out;
        case USB_ENDPOINT_XFER_BULK:
                epctrl |= S3C_DxEPCTL_EPType_Bulk;
@@ -2235,8 +2237,9 @@ static int s3c_hsotg_ep_enable(struct usb_ep *ep,
        /* enable the endpoint interrupt */
        s3c_hsotg_ctrl_epint(hsotg, index, dir_in, 1);
+out:
        spin_unlock_irqrestore(&hs_ep->lock, flags);
-        return 0;
+        return ret;
 }
 static int s3c_hsotg_ep_disable(struct usb_ep *ep)
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index 207e7a85aeb0..13ead00aecd5 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -543,6 +543,7 @@ static int ehci_init(struct usb_hcd *hcd)
         */
        ehci->periodic_size = DEFAULT_I_TDPS;
        INIT_LIST_HEAD(&ehci->cached_itd_list);
+        INIT_LIST_HEAD(&ehci->cached_sitd_list);
        if ((retval = ehci_mem_init(ehci, GFP_KERNEL)) < 0)
                return retval;
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index 19372673bf09..c7178bcde67a 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -801,7 +801,7 @@ static int ehci_hub_control (
                         * this bit; seems too long to spin routinely...
                         */
                        retval = handshake(ehci, status_reg,
-                                        PORT_RESET, 0, 750);
+                                        PORT_RESET, 0, 1000);
                        if (retval != 0) {
                                ehci_err (ehci, "port %d reset error %d\n",
                                        wIndex + 1, retval);
diff --git a/drivers/usb/host/ehci-mem.c b/drivers/usb/host/ehci-mem.c
index aeda96e0af67..1f3f01eacaf0 100644
--- a/drivers/usb/host/ehci-mem.c
+++ b/drivers/usb/host/ehci-mem.c
@@ -136,7 +136,7 @@ static inline void qh_put (struct ehci_qh *qh)
 static void ehci_mem_cleanup (struct ehci_hcd *ehci)
 {
-        free_cached_itd_list(ehci);
+        free_cached_lists(ehci);
        if (ehci->async)
                qh_put (ehci->async);
        ehci->async = NULL;
diff --git a/drivers/usb/host/ehci-omap.c b/drivers/usb/host/ehci-omap.c
index a67a0030dd57..40a858335035 100644
--- a/drivers/usb/host/ehci-omap.c
+++ b/drivers/usb/host/ehci-omap.c
@@ -629,11 +629,13 @@ static int ehci_hcd_omap_probe(struct platform_device *pdev)
                }
                snprintf(supply, sizeof(supply), "hsusb%d", i);
                omap->regulator[i] = regulator_get(omap->dev, supply);
-                if (IS_ERR(omap->regulator[i]))
+                if (IS_ERR(omap->regulator[i])) {
+                        omap->regulator[i] = NULL;
                        dev_dbg(&pdev->dev,
                        "failed to get ehci port%d regulator\n", i);
-                else
+                } else {
                        regulator_enable(omap->regulator[i]);
+                }
        }
        ret = omap_start_ehc(omap, hcd);
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index a0aaaaff2560..805ec633a652 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -510,7 +510,7 @@ static int disable_periodic (struct ehci_hcd *ehci)
        ehci_writel(ehci, cmd, &ehci->regs->command);
        /* posted write ... */
-        free_cached_itd_list(ehci);
+        free_cached_lists(ehci);
        ehci->next_uframe = -1;
        return 0;
@@ -2139,13 +2139,27 @@ sitd_complete (
                        (stream->bEndpointAddress & USB_DIR_IN) ? "in" : "out");
        }
        iso_stream_put (ehci, stream);
-        /* OK to recycle this SITD now that its completion callback ran. */
 done:
        sitd->urb = NULL;
-        sitd->stream = NULL;
+        if (ehci->clock_frame != sitd->frame) {
-        list_move(&sitd->sitd_list, &stream->free_list);
+                /* OK to recycle this SITD now. */
-        iso_stream_put(ehci, stream);
+                sitd->stream = NULL;
+                list_move(&sitd->sitd_list, &stream->free_list);
+                iso_stream_put(ehci, stream);
+        } else {
+                /* HW might remember this SITD, so we can't recycle it yet.
+                 * Move it to a safe place until a new frame starts.
+                 */
+                list_move(&sitd->sitd_list, &ehci->cached_sitd_list);
+                if (stream->refcount == 2) {
+                        /* If iso_stream_put() were called here, stream
+                         * would be freed.  Instead, just prevent reuse.
+                         */
+                        stream->ep->hcpriv = NULL;
+                        stream->ep = NULL;
+                }
+        }
        return retval;
 }
@@ -2211,9 +2225,10 @@ done:
 /*-------------------------------------------------------------------------*/
-static void free_cached_itd_list(struct ehci_hcd *ehci)
+static void free_cached_lists(struct ehci_hcd *ehci)
 {
        struct ehci_itd *itd, *n;
+        struct ehci_sitd *sitd, *sn;
        list_for_each_entry_safe(itd, n, &ehci->cached_itd_list, itd_list) {
                struct ehci_iso_stream  *stream = itd->stream;
@@ -2221,6 +2236,13 @@ static void free_cached_itd_list(struct ehci_hcd *ehci)
                list_move(&itd->itd_list, &stream->free_list);
                iso_stream_put(ehci, stream);
        }
+        list_for_each_entry_safe(sitd, sn, &ehci->cached_sitd_list, sitd_list) {
+                struct ehci_iso_stream  *stream = sitd->stream;
+                sitd->stream = NULL;
+                list_move(&sitd->sitd_list, &stream->free_list);
+                iso_stream_put(ehci, stream);
+        }
 }
 /*-------------------------------------------------------------------------*/
@@ -2247,7 +2269,7 @@ scan_periodic (struct ehci_hcd *ehci)
                clock_frame = -1;
        }
        if (ehci->clock_frame != clock_frame) {
-                free_cached_itd_list(ehci);
+                free_cached_lists(ehci);
                ehci->clock_frame = clock_frame;
        }
        clock %= mod;
@@ -2414,7 +2436,7 @@ restart:
                        clock = now;
                        clock_frame = clock >> 3;
                        if (ehci->clock_frame != clock_frame) {
-                                free_cached_itd_list(ehci);
+                                free_cached_lists(ehci);
                                ehci->clock_frame = clock_frame;
                        }
                } else {
diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
index b1dce96dd621..556c0b48f3ab 100644
--- a/drivers/usb/host/ehci.h
+++ b/drivers/usb/host/ehci.h
@@ -87,8 +87,9 @@ struct ehci_hcd {			/* one per controller */
        int                     next_uframe;    /* scan periodic, start here */
        unsigned                periodic_sched; /* periodic activity count */
-        /* list of itds completed while clock_frame was still active */
+        /* list of itds & sitds completed while clock_frame was still active */
        struct list_head        cached_itd_list;
+        struct list_head        cached_sitd_list;
        unsigned                clock_frame;
        /* per root hub port */
@@ -195,7 +196,7 @@ timer_action_done (struct ehci_hcd *ehci, enum ehci_timer_action action)
        clear_bit (action, &ehci->actions);
 }
-static void free_cached_itd_list(struct ehci_hcd *ehci);
+static void free_cached_lists(struct ehci_hcd *ehci);
 /*-------------------------------------------------------------------------*/
diff --git a/drivers/usb/host/ohci-at91.c b/drivers/usb/host/ohci-at91.c
index 68b83ab70719..944291e10f97 100644
--- a/drivers/usb/host/ohci-at91.c
+++ b/drivers/usb/host/ohci-at91.c
@@ -331,6 +331,8 @@ ohci_hcd_at91_drv_suspend(struct platform_device *pdev, pm_message_t mesg)
         */
        if (at91_suspend_entering_slow_clock()) {
                ohci_usb_reset (ohci);
+                /* flush the writes */
+                (void) ohci_readl (ohci, &ohci->regs->control);
                at91_stop_clock();
        }
diff --git a/drivers/usb/host/ohci-da8xx.c b/drivers/usb/host/ohci-da8xx.c
index 4aa08d36d077..d22fb4d577b7 100644
--- a/drivers/usb/host/ohci-da8xx.c
+++ b/drivers/usb/host/ohci-da8xx.c
@@ -23,7 +23,7 @@
 #error "This file is DA8xx bus glue.  Define CONFIG_ARCH_DAVINCI_DA8XX."
 #endif
-#define CFGCHIP2        DA8XX_SYSCFG_VIRT(DA8XX_CFGCHIP2_REG)
+#define CFGCHIP2        DA8XX_SYSCFG0_VIRT(DA8XX_CFGCHIP2_REG)
 static struct clk *usb11_clk;
 static struct clk *usb20_clk;
diff --git a/drivers/usb/host/ohci-hub.c b/drivers/usb/host/ohci-hub.c
index 32bbce9718f0..65cac8cc8921 100644
--- a/drivers/usb/host/ohci-hub.c
+++ b/drivers/usb/host/ohci-hub.c
@@ -697,7 +697,7 @@ static int ohci_hub_control (
        u16             wLength
 ) {
        struct ohci_hcd *ohci = hcd_to_ohci (hcd);
-        int             ports = hcd_to_bus (hcd)->root_hub->maxchild;
+        int             ports = ohci->num_ports;
        u32             temp;
        int             retval = 0;
diff --git a/drivers/usb/host/oxu210hp-hcd.c b/drivers/usb/host/oxu210hp-hcd.c
index 50f57f468836..e62b30b3e429 100644
--- a/drivers/usb/host/oxu210hp-hcd.c
+++ b/drivers/usb/host/oxu210hp-hcd.c
@@ -660,13 +660,13 @@ static struct ehci_qh *oxu_qh_alloc(struct oxu_hcd *oxu)
                if (qh->dummy == NULL) {
                        oxu_dbg(oxu, "no dummy td\n");
                        oxu->qh_used[i] = 0;
+                        qh = NULL;
-                        return NULL;
+                        goto unlock;
                }
                oxu->qh_used[i] = 1;
        }
+unlock:
        spin_unlock(&oxu->mem_lock);
        return qh;
diff --git a/drivers/usb/host/sl811-hcd.c b/drivers/usb/host/sl811-hcd.c
index e11cc3aa4b82..3b867a8af7b2 100644
--- a/drivers/usb/host/sl811-hcd.c
+++ b/drivers/usb/host/sl811-hcd.c
@@ -720,10 +720,10 @@ retry:
                /* port status seems weird until after reset, so
                 * force the reset and make khubd clean up later.
                 */
-                if (sl811->stat_insrmv & 1)
+                if (irqstat & SL11H_INTMASK_RD)
-                        sl811->port1 |= 1 << USB_PORT_FEAT_CONNECTION;
-                else
                        sl811->port1 &= ~(1 << USB_PORT_FEAT_CONNECTION);
+                else
+                        sl811->port1 |= 1 << USB_PORT_FEAT_CONNECTION;
                sl811->port1 |= 1 << USB_PORT_FEAT_C_CONNECTION;
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index c09539bad1ee..d64f5724bfc4 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -582,6 +582,19 @@ static inline unsigned int xhci_get_endpoint_interval(struct usb_device *udev,
        return EP_INTERVAL(interval);
 }
+/* The "Mult" field in the endpoint context is only set for SuperSpeed devices.
+ * High speed endpoint descriptors can define "the number of additional
+ * transaction opportunities per microframe", but that goes in the Max Burst
+ * endpoint context field.
+ */
+static inline u32 xhci_get_endpoint_mult(struct usb_device *udev,
+                struct usb_host_endpoint *ep)
+{
+        if (udev->speed != USB_SPEED_SUPER || !ep->ss_ep_comp)
+                return 0;
+        return ep->ss_ep_comp->desc.bmAttributes;
+}
 static inline u32 xhci_get_endpoint_type(struct usb_device *udev,
                struct usb_host_endpoint *ep)
 {
@@ -612,6 +625,36 @@ static inline u32 xhci_get_endpoint_type(struct usb_device *udev,
        return type;
 }
+/* Return the maximum endpoint service interval time (ESIT) payload.
+ * Basically, this is the maxpacket size, multiplied by the burst size
+ * and mult size.
+ */
+static inline u32 xhci_get_max_esit_payload(struct xhci_hcd *xhci,
+                struct usb_device *udev,
+                struct usb_host_endpoint *ep)
+{
+        int max_burst;
+        int max_packet;
+        /* Only applies for interrupt or isochronous endpoints */
+        if (usb_endpoint_xfer_control(&ep->desc) ||
+                        usb_endpoint_xfer_bulk(&ep->desc))
+                return 0;
+        if (udev->speed == USB_SPEED_SUPER) {
+                if (ep->ss_ep_comp)
+                        return ep->ss_ep_comp->desc.wBytesPerInterval;
+                xhci_warn(xhci, "WARN no SS endpoint companion descriptor.\n");
+                /* Assume no bursts, no multiple opportunities to send. */
+                return ep->desc.wMaxPacketSize;
+        }
+        max_packet = ep->desc.wMaxPacketSize & 0x3ff;
+        max_burst = (ep->desc.wMaxPacketSize & 0x1800) >> 11;
+        /* A 0 in max burst means 1 transfer per ESIT */
+        return max_packet * (max_burst + 1);
+}
 int xhci_endpoint_init(struct xhci_hcd *xhci,
                struct xhci_virt_device *virt_dev,
                struct usb_device *udev,
@@ -623,6 +666,7 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
        struct xhci_ring *ep_ring;
        unsigned int max_packet;
        unsigned int max_burst;
+        u32 max_esit_payload;
        ep_index = xhci_get_endpoint_index(&ep->desc);
        ep_ctx = xhci_get_ep_ctx(xhci, virt_dev->in_ctx, ep_index);
@@ -644,6 +688,7 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
        ep_ctx->deq = ep_ring->first_seg->dma | ep_ring->cycle_state;
        ep_ctx->ep_info = xhci_get_endpoint_interval(udev, ep);
+        ep_ctx->ep_info |= EP_MULT(xhci_get_endpoint_mult(udev, ep));
        /* FIXME dig Mult and streams info out of ep companion desc */
@@ -689,6 +734,26 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
        default:
                BUG();
        }
+        max_esit_payload = xhci_get_max_esit_payload(xhci, udev, ep);
+        ep_ctx->tx_info = MAX_ESIT_PAYLOAD_FOR_EP(max_esit_payload);
+        /*
+         * XXX no idea how to calculate the average TRB buffer length for bulk
+         * endpoints, as the driver gives us no clue how big each scatter gather
+         * list entry (or buffer) is going to be.
+         *
+         * For isochronous and interrupt endpoints, we set it to the max
+         * available, until we have new API in the USB core to allow drivers to
+         * declare how much bandwidth they actually need.
+         *
+         * Normally, it would be calculated by taking the total of the buffer
+         * lengths in the TD and then dividing by the number of TRBs in a TD,
+         * including link TRBs, No-op TRBs, and Event data TRBs.  Since we don't
+         * use Event Data TRBs, and we don't chain in a link TRB on short
+         * transfers, we're basically dividing by 1.
+         */
+        ep_ctx->tx_info |= AVG_TRB_LENGTH_FOR_EP(max_esit_payload);
        /* FIXME Debug endpoint context */
        return 0;
 }
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index e5eb09b2f38e..ea389e9a4931 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -609,6 +609,10 @@ struct xhci_ep_ctx {
 #define MAX_PACKET_MASK         (0xffff << 16)
 #define MAX_PACKET_DECODED(p)   (((p) >> 16) & 0xffff)
+/* tx_info bitmasks */
+#define AVG_TRB_LENGTH_FOR_EP(p)        ((p) & 0xffff)
+#define MAX_ESIT_PAYLOAD_FOR_EP(p)      (((p) & 0xffff) << 16)
 /**
 * struct xhci_input_control_context
diff --git a/drivers/usb/misc/usbsevseg.c b/drivers/usb/misc/usbsevseg.c
index a9555cb901a1..de8ef945b536 100644
--- a/drivers/usb/misc/usbsevseg.c
+++ b/drivers/usb/misc/usbsevseg.c
@@ -49,6 +49,7 @@ struct usb_sevsegdev {
        u16 textlength;
        u8 shadow_power; /* for PM */
+        u8 has_interface_pm;
 };
 /* sysfs_streq can't replace this completely
@@ -68,12 +69,16 @@ static void update_display_powered(struct usb_sevsegdev *mydev)
 {
        int rc;
-        if (!mydev->shadow_power && mydev->powered) {
+        if (mydev->powered && !mydev->has_interface_pm) {
                rc = usb_autopm_get_interface(mydev->intf);
                if (rc < 0)
                        return;
+                mydev->has_interface_pm = 1;
        }
+        if (mydev->shadow_power != 1)
+                return;
        rc = usb_control_msg(mydev->udev,
                        usb_sndctrlpipe(mydev->udev, 0),
                        0x12,
@@ -86,8 +91,10 @@ static void update_display_powered(struct usb_sevsegdev *mydev)
        if (rc < 0)
                dev_dbg(&mydev->udev->dev, "power retval = %d\n", rc);
-        if (mydev->shadow_power && !mydev->powered)
+        if (!mydev->powered && mydev->has_interface_pm) {
                usb_autopm_put_interface(mydev->intf);
+                mydev->has_interface_pm = 0;
+        }
 }
 static void update_display_mode(struct usb_sevsegdev *mydev)
@@ -351,6 +358,10 @@ static int sevseg_probe(struct usb_interface *interface,
        mydev->intf = interface;
        usb_set_intfdata(interface, mydev);
+        /* PM */
+        mydev->shadow_power = 1; /* currently active */
+        mydev->has_interface_pm = 0; /* have not issued autopm_get */
        /*set defaults */
        mydev->textmode = 0x02; /* ascii mode */
        mydev->mode_msb = 0x06; /* 6 characters */
diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
index b4c783c284ba..07fe490b44d8 100644
--- a/drivers/usb/musb/Kconfig
+++ b/drivers/usb/musb/Kconfig
@@ -42,7 +42,7 @@ config USB_MUSB_SOC
        default y if (BF52x && !BF522 && !BF523)
 comment "DaVinci 35x and 644x USB support"
-        depends on USB_MUSB_HDRC && ARCH_DAVINCI
+        depends on USB_MUSB_HDRC && ARCH_DAVINCI_DMx
 comment "OMAP 243x high speed USB support"
        depends on USB_MUSB_HDRC && ARCH_OMAP2430
diff --git a/drivers/usb/musb/Makefile b/drivers/usb/musb/Makefile
index 85710ccc1887..3a485dabebbb 100644
--- a/drivers/usb/musb/Makefile
+++ b/drivers/usb/musb/Makefile
@@ -6,7 +6,7 @@ musb_hdrc-objs := musb_core.o
 obj-$(CONFIG_USB_MUSB_HDRC)     += musb_hdrc.o
-ifeq ($(CONFIG_ARCH_DAVINCI),y)
+ifeq ($(CONFIG_ARCH_DAVINCI_DMx),y)
        musb_hdrc-objs  += davinci.o
 endif
diff --git a/drivers/usb/musb/blackfin.c b/drivers/usb/musb/blackfin.c
index 719a22d664ef..ec8d324237f6 100644
--- a/drivers/usb/musb/blackfin.c
+++ b/drivers/usb/musb/blackfin.c
@@ -172,13 +172,7 @@ static irqreturn_t blackfin_interrupt(int irq, void *__hci)
        spin_unlock_irqrestore(&musb->lock, flags);
-        /* REVISIT we sometimes get spurious IRQs on g_ep0
+        return retval;
-         * not clear why... fall in BF54x too.
-         */
-        if (retval != IRQ_HANDLED)
-                DBG(5, "spurious?\n");
-        return IRQ_HANDLED;
 }
 static void musb_conn_timer_handler(unsigned long _musb)
diff --git a/drivers/usb/musb/davinci.c b/drivers/usb/musb/davinci.c
index 29bce5c0fd10..ce2e16fee0df 100644
--- a/drivers/usb/musb/davinci.c
+++ b/drivers/usb/musb/davinci.c
@@ -444,6 +444,8 @@ int __init musb_platform_init(struct musb *musb)
        return 0;
 fail:
+        clk_disable(musb->clock);
        usb_nop_xceiv_unregister();
        return -ENODEV;
 }
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 0e8b8ab1d168..705cc4ad8737 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -965,10 +965,8 @@ static void musb_shutdown(struct platform_device *pdev)
        spin_lock_irqsave(&musb->lock, flags);
        musb_platform_disable(musb);
        musb_generic_disable(musb);
-        if (musb->clock) {
+        if (musb->clock)
                clk_put(musb->clock);
-                musb->clock = NULL;
-        }
        spin_unlock_irqrestore(&musb->lock, flags);
        /* FIXME power down */
@@ -1853,15 +1851,6 @@ static void musb_free(struct musb *musb)
        put_device(musb->xceiv->dev);
 #endif
-        musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
-        musb_platform_exit(musb);
-        musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
-        if (musb->clock) {
-                clk_disable(musb->clock);
-                clk_put(musb->clock);
-        }
 #ifdef CONFIG_USB_MUSB_HDRC_HCD
        usb_put_hcd(musb_to_hcd(musb));
 #else
@@ -1889,8 +1878,10 @@ musb_init_controller(struct device *dev, int nIrq, void __iomem *ctrl)
         */
        if (!plat) {
                dev_dbg(dev, "no platform_data?\n");
-                return -ENODEV;
+                status = -ENODEV;
+                goto fail0;
        }
        switch (plat->mode) {
        case MUSB_HOST:
 #ifdef CONFIG_USB_MUSB_HDRC_HCD
@@ -1912,13 +1903,16 @@ bad_config:
 #endif
        default:
                dev_err(dev, "incompatible Kconfig role setting\n");
-                return -EINVAL;
+                status = -EINVAL;
+                goto fail0;
        }
        /* allocate */
        musb = allocate_instance(dev, plat->config, ctrl);
-        if (!musb)
+        if (!musb) {
-                return -ENOMEM;
+                status = -ENOMEM;
+                goto fail0;
+        }
        spin_lock_init(&musb->lock);
        musb->board_mode = plat->mode;
@@ -1936,7 +1930,7 @@ bad_config:
                if (IS_ERR(musb->clock)) {
                        status = PTR_ERR(musb->clock);
                        musb->clock = NULL;
-                        goto fail;
+                        goto fail1;
                }
        }
@@ -1955,12 +1949,12 @@ bad_config:
         */
        musb->isr = generic_interrupt;
        status = musb_platform_init(musb);
        if (status < 0)
-                goto fail;
+                goto fail2;
        if (!musb->isr) {
                status = -ENODEV;
-                goto fail2;
+                goto fail3;
        }
 #ifndef CONFIG_MUSB_PIO_ONLY
@@ -1986,7 +1980,7 @@ bad_config:
                        ? MUSB_CONTROLLER_MHDRC
                        : MUSB_CONTROLLER_HDRC, musb);
        if (status < 0)
-                goto fail2;
+                goto fail3;
 #ifdef CONFIG_USB_MUSB_OTG
        setup_timer(&musb->otg_timer, musb_otg_timer_func, (unsigned long) musb);
@@ -1999,7 +1993,7 @@ bad_config:
        if (request_irq(nIrq, musb->isr, 0, dev_name(dev), musb)) {
                dev_err(dev, "request_irq %d failed!\n", nIrq);
                status = -ENODEV;
-                goto fail2;
+                goto fail3;
        }
        musb->nIrq = nIrq;
 /* FIXME this handles wakeup irqs wrong */
@@ -2039,8 +2033,6 @@ bad_config:
                musb->xceiv->state = OTG_STATE_A_IDLE;
                status = usb_add_hcd(musb_to_hcd(musb), -1, 0);
-                if (status)
-                        goto fail;
                DBG(1, "%s mode, status %d, devctl %02x %c\n",
                        "HOST", status,
@@ -2055,8 +2047,6 @@ bad_config:
                musb->xceiv->state = OTG_STATE_B_IDLE;
                status = musb_gadget_setup(musb);
-                if (status)
-                        goto fail;
                DBG(1, "%s mode, status %d, dev%02x\n",
                        is_otg_enabled(musb) ? "OTG" : "PERIPHERAL",
@@ -2064,12 +2054,14 @@ bad_config:
                        musb_readb(musb->mregs, MUSB_DEVCTL));
        }
+        if (status < 0)
+                goto fail3;
 #ifdef CONFIG_SYSFS
        status = sysfs_create_group(&musb->controller->kobj, &musb_attr_group);
-#endif
        if (status)
-                goto fail2;
+                goto fail4;
+#endif
        dev_info(dev, "USB %s mode controller at %p using %s, IRQ %d\n",
                        ({char *s;
@@ -2085,17 +2077,29 @@ bad_config:
        return 0;
-fail2:
+fail4:
+        if (!is_otg_enabled(musb) && is_host_enabled(musb))
+                usb_remove_hcd(musb_to_hcd(musb));
+        else
+                musb_gadget_cleanup(musb);
+fail3:
+        if (musb->irq_wake)
+                device_init_wakeup(dev, 0);
        musb_platform_exit(musb);
-fail:
-        dev_err(musb->controller,
-                "musb_init_controller failed with status %d\n", status);
+fail2:
        if (musb->clock)
                clk_put(musb->clock);
-        device_init_wakeup(dev, 0);
+fail1:
+        dev_err(musb->controller,
+                "musb_init_controller failed with status %d\n", status);
        musb_free(musb);
+fail0:
        return status;
 }
@@ -2132,7 +2136,6 @@ static int __init musb_probe(struct platform_device *pdev)
        /* clobbered by use_dma=n */
        orig_dma_mask = dev->dma_mask;
 #endif
        status = musb_init_controller(dev, irq, base);
        if (status < 0)
                iounmap(base);
@@ -2155,6 +2158,10 @@ static int __exit musb_remove(struct platform_device *pdev)
        if (musb->board_mode == MUSB_HOST)
                usb_remove_hcd(musb_to_hcd(musb));
 #endif
+        musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
+        musb_platform_exit(musb);
+        musb_writeb(musb->mregs, MUSB_DEVCTL, 0);
        musb_free(musb);
        iounmap(ctrl_base);
        device_init_wakeup(&pdev->dev, 0);
@@ -2176,6 +2183,7 @@ void musb_save_context(struct musb *musb)
        if (is_host_enabled(musb)) {
                musb_context.frame = musb_readw(musb_base, MUSB_FRAME);
                musb_context.testmode = musb_readb(musb_base, MUSB_TESTMODE);
+                musb_context.busctl = musb_read_ulpi_buscontrol(musb->mregs);
        }
        musb_context.power = musb_readb(musb_base, MUSB_POWER);
        musb_context.intrtxe = musb_readw(musb_base, MUSB_INTRTXE);
@@ -2247,6 +2255,7 @@ void musb_restore_context(struct musb *musb)
        if (is_host_enabled(musb)) {
                musb_writew(musb_base, MUSB_FRAME, musb_context.frame);
                musb_writeb(musb_base, MUSB_TESTMODE, musb_context.testmode);
+                musb_write_ulpi_buscontrol(musb->mregs, musb_context.busctl);
        }
        musb_writeb(musb_base, MUSB_POWER, musb_context.power);
        musb_writew(musb_base, MUSB_INTRTXE, musb_context.intrtxe);
diff --git a/drivers/usb/musb/musb_core.h b/drivers/usb/musb/musb_core.h
index cd9f4a9a06c6..ac17b004909b 100644
--- a/drivers/usb/musb/musb_core.h
+++ b/drivers/usb/musb/musb_core.h
@@ -478,7 +478,7 @@ struct musb_context_registers {
        u16 frame;
        u8 index, testmode;
-        u8 devctl, misc;
+        u8 devctl, busctl, misc;
        struct musb_csr_regs index_regs[MUSB_C_NUM_EPS];
 };
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index dec896e888db..877d20b1dff9 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -2042,6 +2042,7 @@ static int musb_urb_enqueue(
                 * odd, rare, error prone, but legal.
                 */
                kfree(qh);
+                qh = NULL;
                ret = 0;
        } else
                ret = musb_schedule(musb, qh,
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index 490cdf15ccb6..82592633502f 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -331,8 +331,5 @@ int musb_platform_exit(struct musb *musb)
        musb_platform_suspend(musb);
-        clk_put(musb->clock);
-        musb->clock = NULL;
        return 0;
 }
diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c
index ab776a8d98ca..60d3938cafcf 100644
--- a/drivers/usb/musb/tusb6010.c
+++ b/drivers/usb/musb/tusb6010.c
@@ -29,6 +29,19 @@ static void tusb_source_power(struct musb *musb, int is_on);
 #define TUSB_REV_MAJOR(reg_val)         ((reg_val >> 4) & 0xf)
 #define TUSB_REV_MINOR(reg_val)         (reg_val & 0xf)
+#ifdef CONFIG_PM
+/* REVISIT: These should be only needed if somebody implements off idle */
+void musb_platform_save_context(struct musb *musb,
+                        struct musb_context_registers *musb_context)
+{
+}
+void musb_platform_restore_context(struct musb *musb,
+                        struct musb_context_registers *musb_context)
+{
+}
+#endif
 /*
 * Checks the revision. We need to use the DMA register as 3.0 does not
 * have correct versions for TUSB_PRCM_REV or TUSB_INT_CTRL_REV.
diff --git a/drivers/usb/musb/tusb6010_omap.c b/drivers/usb/musb/tusb6010_omap.c
index 5afa070d7dc9..c061a88f2b0f 100644
--- a/drivers/usb/musb/tusb6010_omap.c
+++ b/drivers/usb/musb/tusb6010_omap.c
@@ -39,7 +39,7 @@ struct tusb_omap_dma_ch {
        struct tusb_omap_dma    *tusb_dma;
-        void __iomem            *dma_addr;
+        dma_addr_t              dma_addr;
        u32                     len;
        u16                     packet_sz;
@@ -126,6 +126,7 @@ static void tusb_omap_dma_cb(int lch, u16 ch_status, void *data)
        struct tusb_omap_dma_ch *chdat = to_chdat(channel);
        struct tusb_omap_dma    *tusb_dma = chdat->tusb_dma;
        struct musb             *musb = chdat->musb;
+        struct device           *dev = musb->controller;
        struct musb_hw_ep       *hw_ep = chdat->hw_ep;
        void __iomem            *ep_conf = hw_ep->conf;
        void __iomem            *mbase = musb->mregs;
@@ -173,13 +174,15 @@ static void tusb_omap_dma_cb(int lch, u16 ch_status, void *data)
                DBG(3, "Using PIO for remaining %lu bytes\n", pio);
                buf = phys_to_virt((u32)chdat->dma_addr) + chdat->transfer_len;
                if (chdat->tx) {
-                        dma_cache_maint(phys_to_virt((u32)chdat->dma_addr),
+                        dma_unmap_single(dev, chdat->dma_addr,
-                                        chdat->transfer_len, DMA_TO_DEVICE);
+                                                chdat->transfer_len,
+                                                DMA_TO_DEVICE);
                        musb_write_fifo(hw_ep, pio, buf);
                } else {
+                        dma_unmap_single(dev, chdat->dma_addr,
+                                                chdat->transfer_len,
+                                                DMA_FROM_DEVICE);
                        musb_read_fifo(hw_ep, pio, buf);
-                        dma_cache_maint(phys_to_virt((u32)chdat->dma_addr),
-                                        chdat->transfer_len, DMA_FROM_DEVICE);
                }
                channel->actual_len += pio;
        }
@@ -224,6 +227,7 @@ static int tusb_omap_dma_program(struct dma_channel *channel, u16 packet_sz,
        struct tusb_omap_dma_ch         *chdat = to_chdat(channel);
        struct tusb_omap_dma            *tusb_dma = chdat->tusb_dma;
        struct musb                     *musb = chdat->musb;
+        struct device                   *dev = musb->controller;
        struct musb_hw_ep               *hw_ep = chdat->hw_ep;
        void __iomem                    *mbase = musb->mregs;
        void __iomem                    *ep_conf = hw_ep->conf;
@@ -299,14 +303,16 @@ static int tusb_omap_dma_program(struct dma_channel *channel, u16 packet_sz,
        chdat->packet_sz = packet_sz;
        chdat->len = len;
        channel->actual_len = 0;
-        chdat->dma_addr = (void __iomem *)dma_addr;
+        chdat->dma_addr = dma_addr;
        channel->status = MUSB_DMA_STATUS_BUSY;
        /* Since we're recycling dma areas, we need to clean or invalidate */
        if (chdat->tx)
-                dma_cache_maint(phys_to_virt(dma_addr), len, DMA_TO_DEVICE);
+                dma_map_single(dev, phys_to_virt(dma_addr), len,
+                                DMA_TO_DEVICE);
        else
-                dma_cache_maint(phys_to_virt(dma_addr), len, DMA_FROM_DEVICE);
+                dma_map_single(dev, phys_to_virt(dma_addr), len,
+                                DMA_FROM_DEVICE);
        /* Use 16-bit transfer if dma_addr is not 32-bit aligned */
        if ((dma_addr & 0x3) == 0) {
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index ca9d866672aa..84d0edad8e4f 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -305,6 +305,11 @@ static int  option_resume(struct usb_serial *serial);
 #define ZTE_PRODUCT_CDMA_TECH                   0xfffe
 #define ZTE_PRODUCT_AC8710                      0xfff1
 #define ZTE_PRODUCT_AC2726                      0xfff5
+#define ZTE_PRODUCT_AC8710T                     0xffff
+/* ZTE PRODUCTS -- alternate vendor ID */
+#define ZTE_VENDOR_ID2                          0x1d6b
+#define ZTE_PRODUCT_MF_330                      0x0002
 #define BENQ_VENDOR_ID                          0x04a5
 #define BENQ_PRODUCT_H10                        0x4068
@@ -373,6 +378,8 @@ static int  option_resume(struct usb_serial *serial);
 #define HAIER_VENDOR_ID                         0x201e
 #define HAIER_PRODUCT_CE100                     0x2009
+#define CINTERION_VENDOR_ID                     0x0681
 /* some devices interfaces need special handling due to a number of reasons */
 enum option_blacklist_reason {
                OPTION_BLACKLIST_NONE = 0,
@@ -679,6 +686,8 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710, 0xff, 0xff, 0xff) },
        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710T, 0xff, 0xff, 0xff) },
+        { USB_DEVICE(ZTE_VENDOR_ID2, ZTE_PRODUCT_MF_330) },
        { USB_DEVICE(BENQ_VENDOR_ID, BENQ_PRODUCT_H10) },
        { USB_DEVICE(DLINK_VENDOR_ID, DLINK_PRODUCT_DWM_652) },
        { USB_DEVICE(ALINK_VENDOR_ID, DLINK_PRODUCT_DWM_652_U5) }, /* Yes, ALINK_VENDOR_ID */
@@ -716,6 +725,7 @@ static const struct usb_device_id option_ids[] = {
        { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1011)},
        { USB_DEVICE(PIRELLI_VENDOR_ID, PIRELLI_PRODUCT_1012)},
+        { USB_DEVICE(CINTERION_VENDOR_ID, 0x0047) },
        { } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
index 73d5f346d3e0..c28b1607eacc 100644
--- a/drivers/usb/serial/pl2303.c
+++ b/drivers/usb/serial/pl2303.c
@@ -59,6 +59,7 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_ALDIGA) },
        { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MMX) },
        { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_GPRS) },
+        { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_HCR331) },
        { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) },
        { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) },
        { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) },
@@ -97,6 +98,7 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(CRESSI_VENDOR_ID, CRESSI_EDY_PRODUCT_ID) },
        { USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) },
        { USB_DEVICE(SANWA_VENDOR_ID, SANWA_PRODUCT_ID) },
+        { USB_DEVICE(ADLINK_VENDOR_ID, ADLINK_ND6530_PRODUCT_ID) },
        { }                                     /* Terminating entry */
 };
diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
index d640dc951568..23c09b38b9ec 100644
--- a/drivers/usb/serial/pl2303.h
+++ b/drivers/usb/serial/pl2303.h
@@ -20,6 +20,7 @@
 #define PL2303_PRODUCT_ID_ALDIGA        0x0611
 #define PL2303_PRODUCT_ID_MMX           0x0612
 #define PL2303_PRODUCT_ID_GPRS          0x0609
+#define PL2303_PRODUCT_ID_HCR331        0x331a
 #define ATEN_VENDOR_ID          0x0557
 #define ATEN_VENDOR_ID2         0x0547
@@ -134,3 +135,7 @@
 /* Sanwa KB-USB2 multimeter cable (ID: 11ad:0001) */
 #define SANWA_VENDOR_ID         0x11ad
 #define SANWA_PRODUCT_ID        0x0001
+/* ADLINK ND-6530 RS232,RS485 and RS422 adapter */
+#define ADLINK_VENDOR_ID        0x0b63
+#define ADLINK_ND6530_PRODUCT_ID       0x6530
diff --git a/drivers/usb/serial/qcaux.c b/drivers/usb/serial/qcaux.c
index 0b9362061713..7e3bea23600b 100644
--- a/drivers/usb/serial/qcaux.c
+++ b/drivers/usb/serial/qcaux.c
@@ -42,6 +42,14 @@
 #define CMOTECH_PRODUCT_CDU550                  0x5553
 #define CMOTECH_PRODUCT_CDX650                  0x6512
+/* LG devices */
+#define LG_VENDOR_ID                            0x1004
+#define LG_PRODUCT_VX4400_6000                  0x6000 /* VX4400/VX6000/Rumor */
+/* Sanyo devices */
+#define SANYO_VENDOR_ID                         0x0474
+#define SANYO_PRODUCT_KATANA_LX                 0x0754 /* SCP-3800 (Katana LX) */
 static struct usb_device_id id_table[] = {
        { USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, UTSTARCOM_PRODUCT_PC5740, 0xff, 0x00, 0x00) },
        { USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, UTSTARCOM_PRODUCT_PC5750, 0xff, 0x00, 0x00) },
@@ -51,6 +59,8 @@ static struct usb_device_id id_table[] = {
        { USB_DEVICE_AND_INTERFACE_INFO(UTSTARCOM_VENDOR_ID, UTSTARCOM_PRODUCT_UM175_ALLTEL, 0xff, 0x00, 0x00) },
        { USB_DEVICE_AND_INTERFACE_INFO(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CDU550, 0xff, 0xff, 0x00) },
        { USB_DEVICE_AND_INTERFACE_INFO(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CDX650, 0xff, 0xff, 0x00) },
+        { USB_DEVICE_AND_INTERFACE_INFO(LG_VENDOR_ID, LG_PRODUCT_VX4400_6000, 0xff, 0xff, 0x00) },
+        { USB_DEVICE_AND_INTERFACE_INFO(SANYO_VENDOR_ID, SANYO_PRODUCT_KATANA_LX, 0xff, 0xff, 0x00) },
        { },
 };
 MODULE_DEVICE_TABLE(usb, id_table);
diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
index 9202f94505e6..ef0bdb08d788 100644
--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -230,6 +230,7 @@ static const struct sierra_iface_info direct_ip_interface_blacklist = {
 static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x0F3D, 0x0112) }, /* Airprime/Sierra PC 5220 */
        { USB_DEVICE(0x03F0, 0x1B1D) }, /* HP ev2200 a.k.a MC5720 */
+        { USB_DEVICE(0x03F0, 0x211D) }, /* HP ev2210 a.k.a MC5725 */
        { USB_DEVICE(0x03F0, 0x1E1D) }, /* HP hs2300 a.k.a MC8775 */
        { USB_DEVICE(0x1199, 0x0017) }, /* Sierra Wireless EM5625 */
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index 0afe5c71c17e..e1bfda33f5b9 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -172,7 +172,7 @@ static unsigned int product_5052_count;
 /* the array dimension is the number of default entries plus */
 /* TI_EXTRA_VID_PID_COUNT user defined entries plus 1 terminating */
 /* null entry */
-static struct usb_device_id ti_id_table_3410[10+TI_EXTRA_VID_PID_COUNT+1] = {
+static struct usb_device_id ti_id_table_3410[13+TI_EXTRA_VID_PID_COUNT+1] = {
        { USB_DEVICE(TI_VENDOR_ID, TI_3410_PRODUCT_ID) },
        { USB_DEVICE(TI_VENDOR_ID, TI_3410_EZ430_ID) },
        { USB_DEVICE(MTS_VENDOR_ID, MTS_GSM_NO_FW_PRODUCT_ID) },
@@ -180,6 +180,9 @@ static struct usb_device_id ti_id_table_3410[10+TI_EXTRA_VID_PID_COUNT+1] = {
        { USB_DEVICE(MTS_VENDOR_ID, MTS_CDMA_PRODUCT_ID) },
        { USB_DEVICE(MTS_VENDOR_ID, MTS_GSM_PRODUCT_ID) },
        { USB_DEVICE(MTS_VENDOR_ID, MTS_EDGE_PRODUCT_ID) },
+        { USB_DEVICE(MTS_VENDOR_ID, MTS_MT9234MU_PRODUCT_ID) },
+        { USB_DEVICE(MTS_VENDOR_ID, MTS_MT9234ZBA_PRODUCT_ID) },
+        { USB_DEVICE(MTS_VENDOR_ID, MTS_MT9234ZBAOLD_PRODUCT_ID) },
        { USB_DEVICE(IBM_VENDOR_ID, IBM_4543_PRODUCT_ID) },
        { USB_DEVICE(IBM_VENDOR_ID, IBM_454B_PRODUCT_ID) },
        { USB_DEVICE(IBM_VENDOR_ID, IBM_454C_PRODUCT_ID) },
@@ -192,7 +195,7 @@ static struct usb_device_id ti_id_table_5052[5+TI_EXTRA_VID_PID_COUNT+1] = {
        { USB_DEVICE(TI_VENDOR_ID, TI_5052_FIRMWARE_PRODUCT_ID) },
 };
-static struct usb_device_id ti_id_table_combined[14+2*TI_EXTRA_VID_PID_COUNT+1] = {
+static struct usb_device_id ti_id_table_combined[17+2*TI_EXTRA_VID_PID_COUNT+1] = {
        { USB_DEVICE(TI_VENDOR_ID, TI_3410_PRODUCT_ID) },
        { USB_DEVICE(TI_VENDOR_ID, TI_3410_EZ430_ID) },
        { USB_DEVICE(MTS_VENDOR_ID, MTS_GSM_NO_FW_PRODUCT_ID) },
@@ -200,6 +203,9 @@ static struct usb_device_id ti_id_table_combined[14+2*TI_EXTRA_VID_PID_COUNT+1]
        { USB_DEVICE(MTS_VENDOR_ID, MTS_CDMA_PRODUCT_ID) },
        { USB_DEVICE(MTS_VENDOR_ID, MTS_GSM_PRODUCT_ID) },
        { USB_DEVICE(MTS_VENDOR_ID, MTS_EDGE_PRODUCT_ID) },
+        { USB_DEVICE(MTS_VENDOR_ID, MTS_MT9234MU_PRODUCT_ID) },
+        { USB_DEVICE(MTS_VENDOR_ID, MTS_MT9234ZBA_PRODUCT_ID) },
+        { USB_DEVICE(MTS_VENDOR_ID, MTS_MT9234ZBAOLD_PRODUCT_ID) },
        { USB_DEVICE(TI_VENDOR_ID, TI_5052_BOOT_PRODUCT_ID) },
        { USB_DEVICE(TI_VENDOR_ID, TI_5152_BOOT_PRODUCT_ID) },
        { USB_DEVICE(TI_VENDOR_ID, TI_5052_EEPROM_PRODUCT_ID) },
@@ -287,6 +293,8 @@ MODULE_FIRMWARE("ti_5052.fw");
 MODULE_FIRMWARE("mts_cdma.fw");
 MODULE_FIRMWARE("mts_gsm.fw");
 MODULE_FIRMWARE("mts_edge.fw");
+MODULE_FIRMWARE("mts_mt9234mu.fw");
+MODULE_FIRMWARE("mts_mt9234zba.fw");
 module_param(debug, bool, S_IRUGO | S_IWUSR);
 MODULE_PARM_DESC(debug, "Enable debugging, 0=no, 1=yes");
@@ -1687,6 +1695,7 @@ static int ti_download_firmware(struct ti_device *tdev)
        const struct firmware *fw_p;
        char buf[32];
+        dbg("%s\n", __func__);
        /* try ID specific firmware first, then try generic firmware */
        sprintf(buf, "ti_usb-v%04x-p%04x.fw", dev->descriptor.idVendor,
            dev->descriptor.idProduct);
@@ -1703,7 +1712,15 @@ static int ti_download_firmware(struct ti_device *tdev)
                        case MTS_EDGE_PRODUCT_ID:
                                strcpy(buf, "mts_edge.fw");
                                break;
-                        }
+                        case MTS_MT9234MU_PRODUCT_ID:
+                                strcpy(buf, "mts_mt9234mu.fw");
+                                break;
+                        case MTS_MT9234ZBA_PRODUCT_ID:
+                                strcpy(buf, "mts_mt9234zba.fw");
+                                break;
+                        case MTS_MT9234ZBAOLD_PRODUCT_ID:
+                                strcpy(buf, "mts_mt9234zba.fw");
+                                break;                  }
                }
                if (buf[0] == '\0') {
                        if (tdev->td_is_3410)
@@ -1718,7 +1735,7 @@ static int ti_download_firmware(struct ti_device *tdev)
                return -ENOENT;
        }
        if (fw_p->size > TI_FIRMWARE_BUF_SIZE) {
-                dev_err(&dev->dev, "%s - firmware too large\n", __func__);
+                dev_err(&dev->dev, "%s - firmware too large %zu\n", __func__, fw_p->size);
                return -ENOENT;
        }
@@ -1730,6 +1747,7 @@ static int ti_download_firmware(struct ti_device *tdev)
                status = ti_do_download(dev, pipe, buffer, fw_p->size);
                kfree(buffer);
        } else {
+                dbg("%s ENOMEM\n", __func__);
                status = -ENOMEM;
        }
        release_firmware(fw_p);
diff --git a/drivers/usb/serial/ti_usb_3410_5052.h b/drivers/usb/serial/ti_usb_3410_5052.h
index f323c6025858..2aac1953993b 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.h
+++ b/drivers/usb/serial/ti_usb_3410_5052.h
@@ -45,6 +45,9 @@
 #define MTS_CDMA_PRODUCT_ID             0xF110
 #define MTS_GSM_PRODUCT_ID              0xF111
 #define MTS_EDGE_PRODUCT_ID             0xF112
+#define MTS_MT9234MU_PRODUCT_ID         0xF114
+#define MTS_MT9234ZBA_PRODUCT_ID        0xF115
+#define MTS_MT9234ZBAOLD_PRODUCT_ID     0x0319
 /* Commands */
 #define TI_GET_VERSION                  0x01
diff --git a/drivers/usb/wusbcore/devconnect.c b/drivers/usb/wusbcore/devconnect.c
index 46e79d349498..7ec24e46b34b 100644
--- a/drivers/usb/wusbcore/devconnect.c
+++ b/drivers/usb/wusbcore/devconnect.c
@@ -438,7 +438,7 @@ static void __wusbhc_keep_alive(struct wusbhc *wusbhc)
        old_keep_alives = ie->hdr.bLength - sizeof(ie->hdr);
        keep_alives = 0;
        for (cnt = 0;
-             keep_alives <= WUIE_ELT_MAX && cnt < wusbhc->ports_max;
+             keep_alives < WUIE_ELT_MAX && cnt < wusbhc->ports_max;
             cnt++) {
                unsigned tt = msecs_to_jiffies(wusbhc->trust_timeout);
diff --git a/drivers/video/efifb.c b/drivers/video/efifb.c
index 581d2dbf675a..ecf405562f5c 100644
--- a/drivers/video/efifb.c
+++ b/drivers/video/efifb.c
@@ -49,6 +49,7 @@ enum {
        M_MBP_2,        /* MacBook Pro 2nd gen */
        M_MBP_SR,       /* MacBook Pro (Santa Rosa) */
        M_MBP_4,        /* MacBook Pro, 4th gen */
+        M_MBP_5_1,    /* MacBook Pro, 5,1th gen */
        M_UNKNOWN       /* placeholder */
 };
@@ -70,6 +71,7 @@ static struct efifb_dmi_info {
        [M_MBP_2] = { "mbp2", 0, 0, 0, 0 }, /* placeholder */
        [M_MBP_SR] = { "mbp3", 0x80030000, 2048 * 4, 1440, 900 },
        [M_MBP_4] = { "mbp4", 0xc0060000, 2048 * 4, 1920, 1200 },
+        [M_MBP_5_1] = { "mbp51", 0xc0010000, 2048 * 4, 1440, 900 },
        [M_UNKNOWN] = { NULL, 0, 0, 0, 0 }
 };
@@ -106,6 +108,7 @@ static struct dmi_system_id __initdata dmi_system_table[] = {
        EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "MacBookPro3,1", M_MBP_SR),
        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro3,1", M_MBP_SR),
        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro4,1", M_MBP_4),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro5,1", M_MBP_5_1),
        {},
 };
diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c
index 3aed38886f94..bfec7c29486d 100644
--- a/drivers/virtio/virtio_balloon.c
+++ b/drivers/virtio/virtio_balloon.c
@@ -103,7 +103,8 @@ static void fill_balloon(struct virtio_balloon *vb, size_t num)
        num = min(num, ARRAY_SIZE(vb->pfns));
        for (vb->num_pfns = 0; vb->num_pfns < num; vb->num_pfns++) {
-                struct page *page = alloc_page(GFP_HIGHUSER | __GFP_NORETRY);
+                struct page *page = alloc_page(GFP_HIGHUSER | __GFP_NORETRY |
+                                        __GFP_NOMEMALLOC | __GFP_NOWARN);
                if (!page) {
                        if (printk_ratelimit())
                                dev_printk(KERN_INFO, &vb->vdev->dev,
diff --git a/drivers/w1/masters/omap_hdq.c b/drivers/w1/masters/omap_hdq.c
index ef36fca2eed4..3a7e9ff8a746 100644
--- a/drivers/w1/masters/omap_hdq.c
+++ b/drivers/w1/masters/omap_hdq.c
@@ -16,6 +16,7 @@
 #include <linux/err.h>
 #include <linux/clk.h>
 #include <linux/io.h>
+#include <linux/sched.h>
 #include <asm/irq.h>
 #include <mach/hardware.h>
diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c
index 1ed3d554e372..17726a05a0a6 100644
--- a/drivers/w1/slaves/w1_therm.c
+++ b/drivers/w1/slaves/w1_therm.c
@@ -115,9 +115,8 @@ static struct w1_therm_family_converter w1_therm_families[] = {
 static inline int w1_DS18B20_convert_temp(u8 rom[9])
 {
-        int t = ((s16)rom[1] << 8) | rom[0];
+        s16 t = le16_to_cpup((__le16 *)rom);
-        t = t*1000/16;
+        return t*1000/16;
-        return t;
 }
 static inline int w1_DS18S20_convert_temp(u8 rom[9])
diff --git a/drivers/watchdog/booke_wdt.c b/drivers/watchdog/booke_wdt.c
index 500d38342e1e..801ead191499 100644
--- a/drivers/watchdog/booke_wdt.c
+++ b/drivers/watchdog/booke_wdt.c
@@ -121,7 +121,7 @@ static ssize_t booke_wdt_write(struct file *file, const char __user *buf,
        return count;
 }
-static const struct watchdog_info ident = {
+static struct watchdog_info ident = {
        .options = WDIOF_SETTIMEOUT | WDIOF_KEEPALIVEPING,
        .identity = "PowerPC Book-E Watchdog",
 };
diff --git a/drivers/watchdog/ep93xx_wdt.c b/drivers/watchdog/ep93xx_wdt.c
index 88ed54e50f74..59359c9a5e01 100644
--- a/drivers/watchdog/ep93xx_wdt.c
+++ b/drivers/watchdog/ep93xx_wdt.c
@@ -244,7 +244,7 @@ MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started");
 module_param(timeout, int, 0);
 MODULE_PARM_DESC(timeout,
        "Watchdog timeout in seconds. (1<=timeout<=3600, default="
-                                __MODULE_STRING(WATCHDOG_TIMEOUT) ")");
+                                __MODULE_STRING(WDT_TIMEOUT) ")");
 MODULE_AUTHOR("Ray Lehtiniemi <rayl@mail.com>,"
                "Alessandro Zummo <a.zummo@towertech.it>");
diff --git a/drivers/watchdog/sb_wdog.c b/drivers/watchdog/sb_wdog.c
index c8eadd478175..88c83aa57303 100644
--- a/drivers/watchdog/sb_wdog.c
+++ b/drivers/watchdog/sb_wdog.c
@@ -67,8 +67,8 @@ static DEFINE_SPINLOCK(sbwd_lock);
 void sbwdog_set(char __iomem *wdog, unsigned long t)
 {
        spin_lock(&sbwd_lock);
-        __raw_writeb(0, wdog - 0x10);
+        __raw_writeb(0, wdog);
-        __raw_writeq(t & 0x7fffffUL, wdog);
+        __raw_writeq(t & 0x7fffffUL, wdog - 0x10);
        spin_unlock(&sbwd_lock);
 }
diff --git a/drivers/watchdog/sbc_fitpc2_wdt.c b/drivers/watchdog/sbc_fitpc2_wdt.c
index 8d44c9b6fb5b..c7d67e9a7465 100644
--- a/drivers/watchdog/sbc_fitpc2_wdt.c
+++ b/drivers/watchdog/sbc_fitpc2_wdt.c
@@ -30,7 +30,7 @@
 static int nowayout = WATCHDOG_NOWAYOUT;
 static unsigned int margin = 60;        /* (secs) Default is 1 minute */
 static unsigned long wdt_status;
-static DEFINE_SPINLOCK(wdt_lock);
+static DEFINE_MUTEX(wdt_lock);
 #define WDT_IN_USE              0
 #define WDT_OK_TO_CLOSE         1
@@ -45,26 +45,26 @@ static DEFINE_SPINLOCK(wdt_lock);
 static void wdt_send_data(unsigned char command, unsigned char data)
 {
-        outb(command, COMMAND_PORT);
-        msleep(100);
        outb(data, DATA_PORT);
        msleep(200);
+        outb(command, COMMAND_PORT);
+        msleep(100);
 }
 static void wdt_enable(void)
 {
-        spin_lock(&wdt_lock);
+        mutex_lock(&wdt_lock);
        wdt_send_data(IFACE_ON_COMMAND, 1);
        wdt_send_data(REBOOT_COMMAND, margin);
-        spin_unlock(&wdt_lock);
+        mutex_unlock(&wdt_lock);
 }
 static void wdt_disable(void)
 {
-        spin_lock(&wdt_lock);
+        mutex_lock(&wdt_lock);
        wdt_send_data(IFACE_ON_COMMAND, 0);
        wdt_send_data(REBOOT_COMMAND, 0);
-        spin_unlock(&wdt_lock);
+        mutex_unlock(&wdt_lock);
 }
 static int fitpc2_wdt_open(struct inode *inode, struct file *file)