207 files changed, 2016 insertions, 1085 deletions
diff --git a/drivers/acpi/acpica/aclocal.h b/drivers/acpi/acpica/aclocal.h
index 54784bb42cec..edc25867ad9d 100644
--- a/drivers/acpi/acpica/aclocal.h
+++ b/drivers/acpi/acpica/aclocal.h
@@ -416,10 +416,15 @@ struct acpi_gpe_handler_info {
        u8 originally_enabled;  /* True if GPE was originally enabled */
 };
+struct acpi_gpe_notify_object {
+        struct acpi_namespace_node *node;
+        struct acpi_gpe_notify_object *next;
+};
 union acpi_gpe_dispatch_info {
        struct acpi_namespace_node *method_node;        /* Method node for this GPE level */
        struct acpi_gpe_handler_info *handler;  /* Installed GPE handler */
-        struct acpi_namespace_node *device_node;        /* Parent _PRW device for implicit notify */
+        struct acpi_gpe_notify_object device;   /* List of _PRW devices for implicit notify */
 };
 /*
diff --git a/drivers/acpi/acpica/evgpe.c b/drivers/acpi/acpica/evgpe.c
index 14988a86066f..f4725212eb48 100644
--- a/drivers/acpi/acpica/evgpe.c
+++ b/drivers/acpi/acpica/evgpe.c
@@ -457,6 +457,7 @@ static void ACPI_SYSTEM_XFACE acpi_ev_asynch_execute_gpe_method(void *context)
        acpi_status status;
        struct acpi_gpe_event_info *local_gpe_event_info;
        struct acpi_evaluate_info *info;
+        struct acpi_gpe_notify_object *notify_object;
        ACPI_FUNCTION_TRACE(ev_asynch_execute_gpe_method);
@@ -508,10 +509,18 @@ static void ACPI_SYSTEM_XFACE acpi_ev_asynch_execute_gpe_method(void *context)
                 * from this thread -- because handlers may in turn run other
                 * control methods.
                 */
-                status =
+                status = acpi_ev_queue_notify_request(
-                    acpi_ev_queue_notify_request(local_gpe_event_info->dispatch.
+                                local_gpe_event_info->dispatch.device.node,
-                                                 device_node,
+                                ACPI_NOTIFY_DEVICE_WAKE);
-                                                 ACPI_NOTIFY_DEVICE_WAKE);
+                notify_object = local_gpe_event_info->dispatch.device.next;
+                while (ACPI_SUCCESS(status) && notify_object) {
+                        status = acpi_ev_queue_notify_request(
+                                        notify_object->node,
+                                        ACPI_NOTIFY_DEVICE_WAKE);
+                        notify_object = notify_object->next;
+                }
                break;
        case ACPI_GPE_DISPATCH_METHOD:
diff --git a/drivers/acpi/acpica/evxfgpe.c b/drivers/acpi/acpica/evxfgpe.c
index 3b20a3401b64..52aaff3df562 100644
--- a/drivers/acpi/acpica/evxfgpe.c
+++ b/drivers/acpi/acpica/evxfgpe.c
@@ -198,7 +198,9 @@ acpi_setup_gpe_for_wake(acpi_handle wake_device,
        acpi_status status = AE_BAD_PARAMETER;
        struct acpi_gpe_event_info *gpe_event_info;
        struct acpi_namespace_node *device_node;
+        struct acpi_gpe_notify_object *notify_object;
        acpi_cpu_flags flags;
+        u8 gpe_dispatch_mask;
        ACPI_FUNCTION_TRACE(acpi_setup_gpe_for_wake);
@@ -221,27 +223,49 @@ acpi_setup_gpe_for_wake(acpi_handle wake_device,
                goto unlock_and_exit;
        }
+        if (wake_device == ACPI_ROOT_OBJECT) {
+                goto out;
+        }
        /*
         * If there is no method or handler for this GPE, then the
         * wake_device will be notified whenever this GPE fires (aka
         * "implicit notify") Note: The GPE is assumed to be
         * level-triggered (for windows compatibility).
         */
-        if (((gpe_event_info->flags & ACPI_GPE_DISPATCH_MASK) ==
+        gpe_dispatch_mask = gpe_event_info->flags & ACPI_GPE_DISPATCH_MASK;
-              ACPI_GPE_DISPATCH_NONE) && (wake_device != ACPI_ROOT_OBJECT)) {
+        if (gpe_dispatch_mask != ACPI_GPE_DISPATCH_NONE
+            && gpe_dispatch_mask != ACPI_GPE_DISPATCH_NOTIFY) {
+                goto out;
+        }
-                /* Validate wake_device is of type Device */
+        /* Validate wake_device is of type Device */
-                device_node = ACPI_CAST_PTR(struct acpi_namespace_node,
+        device_node = ACPI_CAST_PTR(struct acpi_namespace_node, wake_device);
-                                            wake_device);
+        if (device_node->type != ACPI_TYPE_DEVICE) {
-                if (device_node->type != ACPI_TYPE_DEVICE) {
+                goto unlock_and_exit;
-                        goto unlock_and_exit;
+        }
-                }
+        if (gpe_dispatch_mask == ACPI_GPE_DISPATCH_NONE) {
                gpe_event_info->flags = (ACPI_GPE_DISPATCH_NOTIFY |
                                         ACPI_GPE_LEVEL_TRIGGERED);
-                gpe_event_info->dispatch.device_node = device_node;
+                gpe_event_info->dispatch.device.node = device_node;
+                gpe_event_info->dispatch.device.next = NULL;
+        } else {
+                /* There are multiple devices to notify implicitly. */
+                notify_object = ACPI_ALLOCATE_ZEROED(sizeof(*notify_object));
+                if (!notify_object) {
+                        status = AE_NO_MEMORY;
+                        goto unlock_and_exit;
+                }
+                notify_object->node = device_node;
+                notify_object->next = gpe_event_info->dispatch.device.next;
+                gpe_event_info->dispatch.device.next = notify_object;
        }
+ out:
        gpe_event_info->flags |= ACPI_GPE_CAN_WAKE;
        status = AE_OK;
diff --git a/drivers/acpi/debugfs.c b/drivers/acpi/debugfs.c
index 5df67f1d6c61..384f7abcff77 100644
--- a/drivers/acpi/debugfs.c
+++ b/drivers/acpi/debugfs.c
@@ -26,7 +26,9 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf,
                        size_t count, loff_t *ppos)
 {
        static char *buf;
-        static int uncopied_bytes;
+        static u32 max_size;
+        static u32 uncopied_bytes;
        struct acpi_table_header table;
        acpi_status status;
@@ -37,19 +39,24 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf,
                if (copy_from_user(&table, user_buf,
                                   sizeof(struct acpi_table_header)))
                        return -EFAULT;
-                uncopied_bytes = table.length;
+                uncopied_bytes = max_size = table.length;
-                buf = kzalloc(uncopied_bytes, GFP_KERNEL);
+                buf = kzalloc(max_size, GFP_KERNEL);
                if (!buf)
                        return -ENOMEM;
        }
-        if (uncopied_bytes < count) {
+        if (buf == NULL)
-                kfree(buf);
+                return -EINVAL;
+        if ((*ppos > max_size) ||
+            (*ppos + count > max_size) ||
+            (*ppos + count < count) ||
+            (count > uncopied_bytes))
                return -EINVAL;
-        }
        if (copy_from_user(buf + (*ppos), user_buf, count)) {
                kfree(buf);
+                buf = NULL;
                return -EFAULT;
        }
@@ -59,6 +66,7 @@ static ssize_t cm_write(struct file *file, const char __user * user_buf,
        if (!uncopied_bytes) {
                status = acpi_install_method(buf);
                kfree(buf);
+                buf = NULL;
                if (ACPI_FAILURE(status))
                        return -EINVAL;
                add_taint(TAINT_OVERRIDDEN_ACPI_TABLE);
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index b9ba04fc2b34..77fc76f8aea9 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3281,7 +3281,7 @@ static int set_geometry(unsigned int cmd, struct floppy_struct *g,
                        struct block_device *bdev = opened_bdev[cnt];
                        if (!bdev || ITYPE(drive_state[cnt].fd_device) != type)
                                continue;
-                        __invalidate_device(bdev);
+                        __invalidate_device(bdev, true);
                }
                mutex_unlock(&open_lock);
        } else {
diff --git a/drivers/block/loop.c b/drivers/block/loop.c
index 49e6a545eb63..dbf31ec9114d 100644
--- a/drivers/block/loop.c
+++ b/drivers/block/loop.c
@@ -78,7 +78,6 @@
 #include <asm/uaccess.h>
-static DEFINE_MUTEX(loop_mutex);
 static LIST_HEAD(loop_devices);
 static DEFINE_MUTEX(loop_devices_mutex);
@@ -1501,11 +1500,9 @@ static int lo_open(struct block_device *bdev, fmode_t mode)
 {
        struct loop_device *lo = bdev->bd_disk->private_data;
-        mutex_lock(&loop_mutex);
        mutex_lock(&lo->lo_ctl_mutex);
        lo->lo_refcnt++;
        mutex_unlock(&lo->lo_ctl_mutex);
-        mutex_unlock(&loop_mutex);
        return 0;
 }
@@ -1515,7 +1512,6 @@ static int lo_release(struct gendisk *disk, fmode_t mode)
        struct loop_device *lo = disk->private_data;
        int err;
-        mutex_lock(&loop_mutex);
        mutex_lock(&lo->lo_ctl_mutex);
        if (--lo->lo_refcnt)
@@ -1540,7 +1536,6 @@ static int lo_release(struct gendisk *disk, fmode_t mode)
 out:
        mutex_unlock(&lo->lo_ctl_mutex);
 out_unlocked:
-        mutex_unlock(&loop_mutex);
        return 0;
 }
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index d7aa39e349a6..cc4514c9d8a6 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -281,7 +281,7 @@ static int blkif_queue_request(struct request *req)
        info->shadow[id].request = req;
        ring_req->id = id;
-        ring_req->sector_number = (blkif_sector_t)blk_rq_pos(req);
+        ring_req->u.rw.sector_number = (blkif_sector_t)blk_rq_pos(req);
        ring_req->handle = info->handle;
        ring_req->operation = rq_data_dir(req) ?
@@ -317,7 +317,7 @@ static int blkif_queue_request(struct request *req)
                                rq_data_dir(req) );
                info->shadow[id].frame[i] = mfn_to_pfn(buffer_mfn);
-                ring_req->seg[i] =
+                ring_req->u.rw.seg[i] =
                                (struct blkif_request_segment) {
                                        .gref       = ref,
                                        .first_sect = fsect,
@@ -615,7 +615,7 @@ static void blkif_completion(struct blk_shadow *s)
 {
        int i;
        for (i = 0; i < s->req.nr_segments; i++)
-                gnttab_end_foreign_access(s->req.seg[i].gref, 0, 0UL);
+                gnttab_end_foreign_access(s->req.u.rw.seg[i].gref, 0, 0UL);
 }
 static irqreturn_t blkif_interrupt(int irq, void *dev_id)
@@ -932,7 +932,7 @@ static int blkif_recover(struct blkfront_info *info)
                /* Rewrite any grant references invalidated by susp/resume. */
                for (j = 0; j < req->nr_segments; j++)
                        gnttab_grant_foreign_access_ref(
-                                req->seg[j].gref,
+                                req->u.rw.seg[j].gref,
                                info->xbdev->otherend_id,
                                pfn_to_mfn(info->shadow[req->id].frame[j]),
                                rq_data_dir(info->shadow[req->id].request));
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index 333c21289d97..6dcd55a74c0a 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -41,6 +41,9 @@ static struct usb_device_id ath3k_table[] = {
        /* Atheros AR9285 Malbec with sflash firmware */
        { USB_DEVICE(0x03F0, 0x311D) },
+        /* Atheros AR5BBU12 with sflash firmware */
+        { USB_DEVICE(0x0489, 0xE02C) },
        { }     /* Terminating entry */
 };
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 4cefa91e6c34..700a3840fddc 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -105,6 +105,9 @@ static struct usb_device_id blacklist_table[] = {
        /* Atheros AR9285 Malbec with sflash firmware */
        { USB_DEVICE(0x03f0, 0x311d), .driver_info = BTUSB_IGNORE },
+        /* Atheros AR5BBU12 with sflash firmware */
+        { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
        /* Broadcom BCM2035 */
        { USB_DEVICE(0x0a5c, 0x2035), .driver_info = BTUSB_WRONG_SCO_MTU },
        { USB_DEVICE(0x0a5c, 0x200a), .driver_info = BTUSB_WRONG_SCO_MTU },
@@ -829,7 +832,7 @@ static void btusb_work(struct work_struct *work)
        if (hdev->conn_hash.sco_num > 0) {
                if (!test_bit(BTUSB_DID_ISO_RESUME, &data->flags)) {
-                        err = usb_autopm_get_interface(data->isoc);
+                        err = usb_autopm_get_interface(data->isoc ? data->isoc : data->intf);
                        if (err < 0) {
                                clear_bit(BTUSB_ISOC_RUNNING, &data->flags);
                                usb_kill_anchored_urbs(&data->isoc_anchor);
@@ -858,7 +861,7 @@ static void btusb_work(struct work_struct *work)
                __set_isoc_interface(hdev, 0);
                if (test_and_clear_bit(BTUSB_DID_ISO_RESUME, &data->flags))
-                        usb_autopm_put_interface(data->isoc);
+                        usb_autopm_put_interface(data->isoc ? data->isoc : data->intf);
        }
 }
@@ -1041,8 +1044,6 @@ static int btusb_probe(struct usb_interface *intf,
        usb_set_intfdata(intf, data);
-        usb_enable_autosuspend(interface_to_usbdev(intf));
        return 0;
 }
diff --git a/drivers/char/agp/amd64-agp.c b/drivers/char/agp/amd64-agp.c
index 9252e85706ef..780498d76581 100644
--- a/drivers/char/agp/amd64-agp.c
+++ b/drivers/char/agp/amd64-agp.c
@@ -773,18 +773,23 @@ int __init agp_amd64_init(void)
 #else
                        printk(KERN_INFO PFX "You can boot with agp=try_unsupported\n");
 #endif
+                        pci_unregister_driver(&agp_amd64_pci_driver);
                        return -ENODEV;
                }
                /* First check that we have at least one AMD64 NB */
-                if (!pci_dev_present(amd_nb_misc_ids))
+                if (!pci_dev_present(amd_nb_misc_ids)) {
+                        pci_unregister_driver(&agp_amd64_pci_driver);
                        return -ENODEV;
+                }
                /* Look for any AGP bridge */
                agp_amd64_pci_driver.id_table = agp_amd64_pci_promisc_table;
                err = driver_attach(&agp_amd64_pci_driver.driver);
-                if (err == 0 && agp_bridges_found == 0)
+                if (err == 0 && agp_bridges_found == 0) {
+                        pci_unregister_driver(&agp_amd64_pci_driver);
                        err = -ENODEV;
+                }
        }
        return err;
 }
diff --git a/drivers/char/agp/intel-agp.h b/drivers/char/agp/intel-agp.h
index c195bfeade11..5feebe2800e9 100644
--- a/drivers/char/agp/intel-agp.h
+++ b/drivers/char/agp/intel-agp.h
@@ -130,6 +130,7 @@
 #define INTEL_GMCH_GMS_STOLEN_352M      (0xd << 4)
 #define I915_IFPADDR    0x60
+#define I830_HIC        0x70
 /* Intel 965G registers */
 #define I965_MSAC 0x62
diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c
index fab3d3265adb..0d09b537bb9a 100644
--- a/drivers/char/agp/intel-gtt.c
+++ b/drivers/char/agp/intel-gtt.c
@@ -21,6 +21,7 @@
 #include <linux/kernel.h>
 #include <linux/pagemap.h>
 #include <linux/agp_backend.h>
+#include <linux/delay.h>
 #include <asm/smp.h>
 #include "agp.h"
 #include "intel-agp.h"
@@ -70,12 +71,8 @@ static struct _intel_private {
        u32 __iomem *gtt;               /* I915G */
        bool clear_fake_agp; /* on first access via agp, fill with scratch */
        int num_dcache_entries;
-        union {
+        void __iomem *i9xx_flush_page;
-                void __iomem *i9xx_flush_page;
-                void *i8xx_flush_page;
-        };
        char *i81x_gtt_table;
-        struct page *i8xx_page;
        struct resource ifp_resource;
        int resource_valid;
        struct page *scratch_page;
@@ -722,28 +719,6 @@ static int intel_fake_agp_fetch_size(void)
 static void i830_cleanup(void)
 {
-        if (intel_private.i8xx_flush_page) {
-                kunmap(intel_private.i8xx_flush_page);
-                intel_private.i8xx_flush_page = NULL;
-        }
-        __free_page(intel_private.i8xx_page);
-        intel_private.i8xx_page = NULL;
-}
-static void intel_i830_setup_flush(void)
-{
-        /* return if we've already set the flush mechanism up */
-        if (intel_private.i8xx_page)
-                return;
-        intel_private.i8xx_page = alloc_page(GFP_KERNEL);
-        if (!intel_private.i8xx_page)
-                return;
-        intel_private.i8xx_flush_page = kmap(intel_private.i8xx_page);
-        if (!intel_private.i8xx_flush_page)
-                i830_cleanup();
 }
 /* The chipset_flush interface needs to get data that has already been
@@ -758,14 +733,27 @@ static void intel_i830_setup_flush(void)
 */
 static void i830_chipset_flush(void)
 {
-        unsigned int *pg = intel_private.i8xx_flush_page;
+        unsigned long timeout = jiffies + msecs_to_jiffies(1000);
+        /* Forcibly evict everything from the CPU write buffers.
+         * clflush appears to be insufficient.
+         */
+        wbinvd_on_all_cpus();
+        /* Now we've only seen documents for this magic bit on 855GM,
+         * we hope it exists for the other gen2 chipsets...
+         *
+         * Also works as advertised on my 845G.
+         */
+        writel(readl(intel_private.registers+I830_HIC) | (1<<31),
+               intel_private.registers+I830_HIC);
-        memset(pg, 0, 1024);
+        while (readl(intel_private.registers+I830_HIC) & (1<<31)) {
+                if (time_after(jiffies, timeout))
+                        break;
-        if (cpu_has_clflush)
+                udelay(50);
-                clflush_cache_range(pg, 1024);
+        }
-        else if (wbinvd_on_all_cpus() != 0)
-                printk(KERN_ERR "Timed out waiting for cache flush.\n");
 }
 static void i830_write_entry(dma_addr_t addr, unsigned int entry,
@@ -849,8 +837,6 @@ static int i830_setup(void)
        intel_private.gtt_bus_addr = reg_addr + I810_PTE_BASE;
-        intel_i830_setup_flush();
        return 0;
 }
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 7855f9f45b8e..62787e30d508 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -900,6 +900,14 @@ static void sender(void                *send_info,
        printk("**Enqueue: %d.%9.9d\n", t.tv_sec, t.tv_usec);
 #endif
+        /*
+         * last_timeout_jiffies is updated here to avoid
+         * smi_timeout() handler passing very large time_diff
+         * value to smi_event_handler() that causes
+         * the send command to abort.
+         */
+        smi_info->last_timeout_jiffies = jiffies;
        mod_timer(&smi_info->si_timer, jiffies + SI_TIMEOUT_JIFFIES);
        if (smi_info->thread)
diff --git a/drivers/char/pcmcia/cm4000_cs.c b/drivers/char/pcmcia/cm4000_cs.c
index 777181a2e603..bcbbc71febb7 100644
--- a/drivers/char/pcmcia/cm4000_cs.c
+++ b/drivers/char/pcmcia/cm4000_cs.c
@@ -830,8 +830,7 @@ static void monitor_card(unsigned long p)
                            test_bit(IS_ANY_T1, &dev->flags))) {
                                DEBUGP(4, dev, "Perform AUTOPPS\n");
                                set_bit(IS_AUTOPPS_ACT, &dev->flags);
-                                ptsreq.protocol = ptsreq.protocol =
+                                ptsreq.protocol = (0x01 << dev->proto);
-                                    (0x01 << dev->proto);
                                ptsreq.flags = 0x01;
                                ptsreq.pts1 = 0x00;
                                ptsreq.pts2 = 0x00;
diff --git a/drivers/char/pcmcia/ipwireless/main.c b/drivers/char/pcmcia/ipwireless/main.c
index 94b8eb4d691d..444155a305ae 100644
--- a/drivers/char/pcmcia/ipwireless/main.c
+++ b/drivers/char/pcmcia/ipwireless/main.c
@@ -78,7 +78,6 @@ static void signalled_reboot_callback(void *callback_data)
 static int ipwireless_probe(struct pcmcia_device *p_dev, void *priv_data)
 {
        struct ipw_dev *ipw = priv_data;
-        struct resource *io_resource;
        int ret;
        p_dev->resource[0]->flags &= ~IO_DATA_PATH_WIDTH;
@@ -92,9 +91,12 @@ static int ipwireless_probe(struct pcmcia_device *p_dev, void *priv_data)
        if (ret)
                return ret;
-        io_resource = request_region(p_dev->resource[0]->start,
+        if (!request_region(p_dev->resource[0]->start,
-                                resource_size(p_dev->resource[0]),
+                            resource_size(p_dev->resource[0]),
-                                IPWIRELESS_PCCARD_NAME);
+                            IPWIRELESS_PCCARD_NAME)) {
+                ret = -EBUSY;
+                goto exit;
+        }
        p_dev->resource[2]->flags |=
                WIN_DATA_WIDTH_16 | WIN_MEMORY_TYPE_CM | WIN_ENABLE;
@@ -105,22 +107,25 @@ static int ipwireless_probe(struct pcmcia_device *p_dev, void *priv_data)
        ret = pcmcia_map_mem_page(p_dev, p_dev->resource[2], p_dev->card_addr);
        if (ret != 0)
-                goto exit2;
+                goto exit1;
        ipw->is_v2_card = resource_size(p_dev->resource[2]) == 0x100;
-        ipw->attr_memory = ioremap(p_dev->resource[2]->start,
+        ipw->common_memory = ioremap(p_dev->resource[2]->start,
                                resource_size(p_dev->resource[2]));
-        request_mem_region(p_dev->resource[2]->start,
+        if (!request_mem_region(p_dev->resource[2]->start,
-                        resource_size(p_dev->resource[2]),
+                                resource_size(p_dev->resource[2]),
-                        IPWIRELESS_PCCARD_NAME);
+                                IPWIRELESS_PCCARD_NAME)) {
+                ret = -EBUSY;
+                goto exit2;
+        }
        p_dev->resource[3]->flags |= WIN_DATA_WIDTH_16 | WIN_MEMORY_TYPE_AM |
                                        WIN_ENABLE;
        p_dev->resource[3]->end = 0; /* this used to be 0x1000 */
        ret = pcmcia_request_window(p_dev, p_dev->resource[3], 0);
        if (ret != 0)
-                goto exit2;
+                goto exit3;
        ret = pcmcia_map_mem_page(p_dev, p_dev->resource[3], 0);
        if (ret != 0)
@@ -128,23 +133,28 @@ static int ipwireless_probe(struct pcmcia_device *p_dev, void *priv_data)
        ipw->attr_memory = ioremap(p_dev->resource[3]->start,
                                resource_size(p_dev->resource[3]));
-        request_mem_region(p_dev->resource[3]->start,
+        if (!request_mem_region(p_dev->resource[3]->start,
-                        resource_size(p_dev->resource[3]),
+                                resource_size(p_dev->resource[3]),
-                        IPWIRELESS_PCCARD_NAME);
+                                IPWIRELESS_PCCARD_NAME)) {
+                ret = -EBUSY;
+                goto exit4;
+        }
        return 0;
+exit4:
+        iounmap(ipw->attr_memory);
 exit3:
+        release_mem_region(p_dev->resource[2]->start,
+                        resource_size(p_dev->resource[2]));
 exit2:
-        if (ipw->common_memory) {
+        iounmap(ipw->common_memory);
-                release_mem_region(p_dev->resource[2]->start,
-                                resource_size(p_dev->resource[2]));
-                iounmap(ipw->common_memory);
-        }
 exit1:
-        release_resource(io_resource);
+        release_region(p_dev->resource[0]->start,
+                       resource_size(p_dev->resource[0]));
+exit:
        pcmcia_disable_device(p_dev);
-        return -1;
+        return ret;
 }
 static int config_ipwireless(struct ipw_dev *ipw)
@@ -219,6 +229,8 @@ exit:
 static void release_ipwireless(struct ipw_dev *ipw)
 {
+        release_region(ipw->link->resource[0]->start,
+                       resource_size(ipw->link->resource[0]));
        if (ipw->common_memory) {
                release_mem_region(ipw->link->resource[2]->start,
                                resource_size(ipw->link->resource[2]));
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index 36e0fa161c2b..1f46f1cd9225 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -364,14 +364,12 @@ unsigned long tpm_calc_ordinal_duration(struct tpm_chip *chip,
                    tpm_protected_ordinal_duration[ordinal &
                                                   TPM_PROTECTED_ORDINAL_MASK];
-        if (duration_idx != TPM_UNDEFINED) {
+        if (duration_idx != TPM_UNDEFINED)
                duration = chip->vendor.duration[duration_idx];
-                /* if duration is 0, it's because chip->vendor.duration wasn't */
+        if (duration <= 0)
-                /* filled yet, so we set the lowest timeout just to give enough */
-                /* time for tpm_get_timeouts() to succeed */
-                return (duration <= 0 ? HZ : duration);
-        } else
                return 2 * 60 * HZ;
+        else
+                return duration;
 }
 EXPORT_SYMBOL_GPL(tpm_calc_ordinal_duration);
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 490393186338..84b164d1eb2b 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -388,6 +388,10 @@ static void discard_port_data(struct port *port)
        unsigned int len;
        int ret;
+        if (!port->portdev) {
+                /* Device has been unplugged.  vqs are already gone. */
+                return;
+        }
        vq = port->in_vq;
        if (port->inbuf)
                buf = port->inbuf;
@@ -470,6 +474,10 @@ static void reclaim_consumed_buffers(struct port *port)
        void *buf;
        unsigned int len;
+        if (!port->portdev) {
+                /* Device has been unplugged.  vqs are already gone. */
+                return;
+        }
        while ((buf = virtqueue_get_buf(port->out_vq, &len))) {
                kfree(buf);
                port->outvq_full = false;
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 1109f6848a43..5cb4d09919d6 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -1919,8 +1919,10 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data)
        ret = sysdev_driver_register(&cpu_sysdev_class,
                                        &cpufreq_sysdev_driver);
+        if (ret)
+                goto err_null_driver;
-        if ((!ret) && !(cpufreq_driver->flags & CPUFREQ_STICKY)) {
+        if (!(cpufreq_driver->flags & CPUFREQ_STICKY)) {
                int i;
                ret = -ENODEV;
@@ -1935,21 +1937,22 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data)
                if (ret) {
                        dprintk("no CPU initialized for driver %s\n",
                                                        driver_data->name);
-                        sysdev_driver_unregister(&cpu_sysdev_class,
+                        goto err_sysdev_unreg;
-                                                &cpufreq_sysdev_driver);
-                        spin_lock_irqsave(&cpufreq_driver_lock, flags);
-                        cpufreq_driver = NULL;
-                        spin_unlock_irqrestore(&cpufreq_driver_lock, flags);
                }
        }
-        if (!ret) {
+        register_hotcpu_notifier(&cpufreq_cpu_notifier);
-                register_hotcpu_notifier(&cpufreq_cpu_notifier);
+        dprintk("driver %s up and running\n", driver_data->name);
-                dprintk("driver %s up and running\n", driver_data->name);
+        cpufreq_debug_enable_ratelimit();
-                cpufreq_debug_enable_ratelimit();
-        }
+        return 0;
+err_sysdev_unreg:
+        sysdev_driver_unregister(&cpu_sysdev_class,
+                        &cpufreq_sysdev_driver);
+err_null_driver:
+        spin_lock_irqsave(&cpufreq_driver_lock, flags);
+        cpufreq_driver = NULL;
+        spin_unlock_irqrestore(&cpufreq_driver_lock, flags);
        return ret;
 }
 EXPORT_SYMBOL_GPL(cpufreq_register_driver);
diff --git a/drivers/gpio/ml_ioh_gpio.c b/drivers/gpio/ml_ioh_gpio.c
index cead8e6ff345..7f6f01a4b145 100644
--- a/drivers/gpio/ml_ioh_gpio.c
+++ b/drivers/gpio/ml_ioh_gpio.c
@@ -326,6 +326,7 @@ static DEFINE_PCI_DEVICE_TABLE(ioh_gpio_pcidev_id) = {
        { PCI_DEVICE(PCI_VENDOR_ID_ROHM, 0x802E) },
        { 0, }
 };
+MODULE_DEVICE_TABLE(pci, ioh_gpio_pcidev_id);
 static struct pci_driver ioh_gpio_driver = {
        .name = "ml_ioh_gpio",
diff --git a/drivers/gpio/pch_gpio.c b/drivers/gpio/pch_gpio.c
index 0eba0a75c804..2c6af8705103 100644
--- a/drivers/gpio/pch_gpio.c
+++ b/drivers/gpio/pch_gpio.c
@@ -286,6 +286,7 @@ static DEFINE_PCI_DEVICE_TABLE(pch_gpio_pcidev_id) = {
        { PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x8803) },
        { 0, }
 };
+MODULE_DEVICE_TABLE(pci, pch_gpio_pcidev_id);
 static struct pci_driver pch_gpio_driver = {
        .name = "pch_gpio",
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 6977a1ce9d98..f73ef4390db6 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -672,7 +672,7 @@ int drm_fb_helper_setcmap(struct fb_cmap *cmap, struct fb_info *info)
        struct drm_crtc_helper_funcs *crtc_funcs;
        u16 *red, *green, *blue, *transp;
        struct drm_crtc *crtc;
-        int i, rc = 0;
+        int i, j, rc = 0;
        int start;
        for (i = 0; i < fb_helper->crtc_count; i++) {
@@ -685,7 +685,7 @@ int drm_fb_helper_setcmap(struct fb_cmap *cmap, struct fb_info *info)
                transp = cmap->transp;
                start = cmap->start;
-                for (i = 0; i < cmap->len; i++) {
+                for (j = 0; j < cmap->len; j++) {
                        u16 hred, hgreen, hblue, htransp = 0xffff;
                        hred = *red++;
diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
index 3dadfa2a8528..28d1d3c24d65 100644
--- a/drivers/gpu/drm/drm_irq.c
+++ b/drivers/gpu/drm/drm_irq.c
@@ -164,8 +164,10 @@ static void vblank_disable_and_save(struct drm_device *dev, int crtc)
         * available. In that case we can't account for this and just
         * hope for the best.
         */
-        if ((vblrc > 0) && (abs(diff_ns) > 1000000))
+        if ((vblrc > 0) && (abs64(diff_ns) > 1000000)) {
                atomic_inc(&dev->_vblank_count[crtc]);
+                smp_mb__after_atomic_inc();
+        }
        /* Invalidate all timestamps while vblank irq's are off. */
        clear_vblank_timestamps(dev, crtc);
@@ -491,6 +493,12 @@ void drm_calc_timestamping_constants(struct drm_crtc *crtc)
        /* Dot clock in Hz: */
        dotclock = (u64) crtc->hwmode.clock * 1000;
+        /* Fields of interlaced scanout modes are only halve a frame duration.
+         * Double the dotclock to get halve the frame-/line-/pixelduration.
+         */
+        if (crtc->hwmode.flags & DRM_MODE_FLAG_INTERLACE)
+                dotclock *= 2;
        /* Valid dotclock? */
        if (dotclock > 0) {
                /* Convert scanline length in pixels and video dot clock to
@@ -603,14 +611,6 @@ int drm_calc_vbltimestamp_from_scanoutpos(struct drm_device *dev, int crtc,
                return -EAGAIN;
        }
-        /* Don't know yet how to handle interlaced or
-         * double scan modes. Just no-op for now.
-         */
-        if (mode->flags & (DRM_MODE_FLAG_INTERLACE | DRM_MODE_FLAG_DBLSCAN)) {
-                DRM_DEBUG("crtc %d: Noop due to unsupported mode.\n", crtc);
-                return -ENOTSUPP;
-        }
        /* Get current scanout position with system timestamp.
         * Repeat query up to DRM_TIMESTAMP_MAXRETRIES times
         * if single query takes longer than max_error nanoseconds.
@@ -858,10 +858,11 @@ static void drm_update_vblank_count(struct drm_device *dev, int crtc)
        if (rc) {
                tslot = atomic_read(&dev->_vblank_count[crtc]) + diff;
                vblanktimestamp(dev, crtc, tslot) = t_vblank;
-                smp_wmb();
        }
+        smp_mb__before_atomic_inc();
        atomic_add(diff, &dev->_vblank_count[crtc]);
+        smp_mb__after_atomic_inc();
 }
 /**
@@ -1011,7 +1012,8 @@ int drm_modeset_ctl(struct drm_device *dev, void *data,
                    struct drm_file *file_priv)
 {
        struct drm_modeset_ctl *modeset = data;
-        int crtc, ret = 0;
+        int ret = 0;
+        unsigned int crtc;
        /* If drm_vblank_init() hasn't been called yet, just no-op */
        if (!dev->num_crtcs)
@@ -1293,15 +1295,16 @@ bool drm_handle_vblank(struct drm_device *dev, int crtc)
         * e.g., due to spurious vblank interrupts. We need to
         * ignore those for accounting.
         */
-        if (abs(diff_ns) > DRM_REDUNDANT_VBLIRQ_THRESH_NS) {
+        if (abs64(diff_ns) > DRM_REDUNDANT_VBLIRQ_THRESH_NS) {
                /* Store new timestamp in ringbuffer. */
                vblanktimestamp(dev, crtc, vblcount + 1) = tvblank;
-                smp_wmb();
                /* Increment cooked vblank count. This also atomically commits
                 * the timestamp computed above.
                 */
+                smp_mb__before_atomic_inc();
                atomic_inc(&dev->_vblank_count[crtc]);
+                smp_mb__after_atomic_inc();
        } else {
                DRM_DEBUG("crtc %d: Redundant vblirq ignored. diff_ns = %d\n",
                          crtc, (int) diff_ns);
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index 3601466c5502..4ff9b6cc973f 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -865,7 +865,7 @@ static int i915_cur_delayinfo(struct seq_file *m, void *unused)
                int max_freq;
                /* RPSTAT1 is in the GT power well */
-                __gen6_force_wake_get(dev_priv);
+                __gen6_gt_force_wake_get(dev_priv);
                seq_printf(m, "GT_PERF_STATUS: 0x%08x\n", gt_perf_status);
                seq_printf(m, "RPSTAT1: 0x%08x\n", I915_READ(GEN6_RPSTAT1));
@@ -888,7 +888,7 @@ static int i915_cur_delayinfo(struct seq_file *m, void *unused)
                seq_printf(m, "Max non-overclocked (RP0) frequency: %dMHz\n",
                           max_freq * 100);
-                __gen6_force_wake_put(dev_priv);
+                __gen6_gt_force_wake_put(dev_priv);
        } else {
                seq_printf(m, "no P-state info available\n");
        }
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 17bd766f2081..e33d9be7df3b 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1895,6 +1895,17 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
        if (IS_GEN2(dev))
                dma_set_coherent_mask(&dev->pdev->dev, DMA_BIT_MASK(30));
+        /* 965GM sometimes incorrectly writes to hardware status page (HWS)
+         * using 32bit addressing, overwriting memory if HWS is located
+         * above 4GB.
+         *
+         * The documentation also mentions an issue with undefined
+         * behaviour if any general state is accessed within a page above 4GB,
+         * which also needs to be handled carefully.
+         */
+        if (IS_BROADWATER(dev) || IS_CRESTLINE(dev))
+                dma_set_coherent_mask(&dev->pdev->dev, DMA_BIT_MASK(32));
        mmio_bar = IS_GEN2(dev) ? 1 : 0;
        dev_priv->regs = pci_iomap(dev->pdev, mmio_bar, 0);
        if (!dev_priv->regs) {
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 0ad533f06af9..22ec066adae6 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -46,6 +46,9 @@ module_param_named(fbpercrtc, i915_fbpercrtc, int, 0400);
 unsigned int i915_powersave = 1;
 module_param_named(powersave, i915_powersave, int, 0600);
+unsigned int i915_semaphores = 0;
+module_param_named(semaphores, i915_semaphores, int, 0600);
 unsigned int i915_enable_rc6 = 0;
 module_param_named(i915_enable_rc6, i915_enable_rc6, int, 0600);
@@ -254,7 +257,7 @@ void intel_detect_pch (struct drm_device *dev)
        }
 }
-void __gen6_force_wake_get(struct drm_i915_private *dev_priv)
+void __gen6_gt_force_wake_get(struct drm_i915_private *dev_priv)
 {
        int count;
@@ -270,12 +273,22 @@ void __gen6_force_wake_get(struct drm_i915_private *dev_priv)
                udelay(10);
 }
-void __gen6_force_wake_put(struct drm_i915_private *dev_priv)
+void __gen6_gt_force_wake_put(struct drm_i915_private *dev_priv)
 {
        I915_WRITE_NOTRACE(FORCEWAKE, 0);
        POSTING_READ(FORCEWAKE);
 }
+void __gen6_gt_wait_for_fifo(struct drm_i915_private *dev_priv)
+{
+        int loop = 500;
+        u32 fifo = I915_READ_NOTRACE(GT_FIFO_FREE_ENTRIES);
+        while (fifo < 20 && loop--) {
+                udelay(10);
+                fifo = I915_READ_NOTRACE(GT_FIFO_FREE_ENTRIES);
+        }
+}
 static int i915_drm_freeze(struct drm_device *dev)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 65dfe81d0035..456f40484838 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -956,6 +956,7 @@ extern struct drm_ioctl_desc i915_ioctls[];
 extern int i915_max_ioctl;
 extern unsigned int i915_fbpercrtc;
 extern unsigned int i915_powersave;
+extern unsigned int i915_semaphores;
 extern unsigned int i915_lvds_downclock;
 extern unsigned int i915_panel_use_ssc;
 extern unsigned int i915_enable_rc6;
@@ -1177,6 +1178,9 @@ void i915_gem_detach_phys_object(struct drm_device *dev,
 void i915_gem_free_all_phys_object(struct drm_device *dev);
 void i915_gem_release(struct drm_device *dev, struct drm_file *file);
+uint32_t
+i915_gem_get_unfenced_gtt_alignment(struct drm_i915_gem_object *obj);
 /* i915_gem_gtt.c */
 void i915_gem_restore_gtt_mappings(struct drm_device *dev);
 int __must_check i915_gem_gtt_bind_object(struct drm_i915_gem_object *obj);
@@ -1353,22 +1357,32 @@ __i915_write(64, q)
 * must be set to prevent GT core from power down and stale values being
 * returned.
 */
-void __gen6_force_wake_get(struct drm_i915_private *dev_priv);
+void __gen6_gt_force_wake_get(struct drm_i915_private *dev_priv);
-void __gen6_force_wake_put (struct drm_i915_private *dev_priv);
+void __gen6_gt_force_wake_put(struct drm_i915_private *dev_priv);
-static inline u32 i915_safe_read(struct drm_i915_private *dev_priv, u32 reg)
+void __gen6_gt_wait_for_fifo(struct drm_i915_private *dev_priv);
+static inline u32 i915_gt_read(struct drm_i915_private *dev_priv, u32 reg)
 {
        u32 val;
        if (dev_priv->info->gen >= 6) {
-                __gen6_force_wake_get(dev_priv);
+                __gen6_gt_force_wake_get(dev_priv);
                val = I915_READ(reg);
-                __gen6_force_wake_put(dev_priv);
+                __gen6_gt_force_wake_put(dev_priv);
        } else
                val = I915_READ(reg);
        return val;
 }
+static inline void i915_gt_write(struct drm_i915_private *dev_priv,
+                                u32 reg, u32 val)
+{
+        if (dev_priv->info->gen >= 6)
+                __gen6_gt_wait_for_fifo(dev_priv);
+        I915_WRITE(reg, val);
+}
 static inline void
 i915_write(struct drm_i915_private *dev_priv, u32 reg, u64 val, int len)
 {
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index cf4f74c7c6fb..36e66cc5225e 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1398,7 +1398,7 @@ i915_gem_get_gtt_alignment(struct drm_i915_gem_object *obj)
 * Return the required GTT alignment for an object, only taking into account
 * unfenced tiled surface requirements.
 */
-static uint32_t
+uint32_t
 i915_gem_get_unfenced_gtt_alignment(struct drm_i915_gem_object *obj)
 {
        struct drm_device *dev = obj->base.dev;
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index d2f445e825f2..50ab1614571c 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -772,8 +772,8 @@ i915_gem_execbuffer_sync_rings(struct drm_i915_gem_object *obj,
        if (from == NULL || to == from)
                return 0;
-        /* XXX gpu semaphores are currently causing hard hangs on SNB mobile */
+        /* XXX gpu semaphores are implicated in various hard hangs on SNB */
-        if (INTEL_INFO(obj->base.dev)->gen < 6 || IS_MOBILE(obj->base.dev))
+        if (INTEL_INFO(obj->base.dev)->gen < 6 || !i915_semaphores)
                return i915_gem_object_wait_rendering(obj, true);
        idx = intel_ring_sync_index(from, to);
diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
index 22a32b9932c5..d64843e18df2 100644
--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
@@ -349,14 +349,27 @@ i915_gem_set_tiling(struct drm_device *dev, void *data,
                        (obj->gtt_offset + obj->base.size <= dev_priv->mm.gtt_mappable_end &&
                         i915_gem_object_fence_ok(obj, args->tiling_mode));
-                obj->tiling_changed = true;
+                /* Rebind if we need a change of alignment */
-                obj->tiling_mode = args->tiling_mode;
+                if (!obj->map_and_fenceable) {
-                obj->stride = args->stride;
+                        u32 unfenced_alignment =
+                                i915_gem_get_unfenced_gtt_alignment(obj);
+                        if (obj->gtt_offset & (unfenced_alignment - 1))
+                                ret = i915_gem_object_unbind(obj);
+                }
+                if (ret == 0) {
+                        obj->tiling_changed = true;
+                        obj->tiling_mode = args->tiling_mode;
+                        obj->stride = args->stride;
+                }
        }
+        /* we have to maintain this existing ABI... */
+        args->stride = obj->stride;
+        args->tiling_mode = obj->tiling_mode;
        drm_gem_object_unreference(&obj->base);
        mutex_unlock(&dev->struct_mutex);
-        return 0;
+        return ret;
 }
 /**
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 97f946dcc1aa..8a9e08bf1cf7 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -316,6 +316,8 @@ static void i915_hotplug_work_func(struct work_struct *work)
        struct drm_mode_config *mode_config = &dev->mode_config;
        struct intel_encoder *encoder;
+        DRM_DEBUG_KMS("running encoder hotplug functions\n");
        list_for_each_entry(encoder, &mode_config->encoder_list, base.head)
                if (encoder->hot_plug)
                        encoder->hot_plug(encoder);
@@ -1649,9 +1651,7 @@ static int ironlake_irq_postinstall(struct drm_device *dev)
        } else {
                hotplug_mask = SDE_CRT_HOTPLUG | SDE_PORTB_HOTPLUG |
                               SDE_PORTC_HOTPLUG | SDE_PORTD_HOTPLUG;
-                hotplug_mask |= SDE_AUX_MASK | SDE_FDI_MASK | SDE_TRANS_MASK;
+                hotplug_mask |= SDE_AUX_MASK;
-                I915_WRITE(FDI_RXA_IMR, 0);
-                I915_WRITE(FDI_RXB_IMR, 0);
        }
        dev_priv->pch_irq_mask = ~hotplug_mask;
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 729d4233b763..2abe240dae58 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -1553,7 +1553,17 @@
 /* Backlight control */
 #define BLC_PWM_CTL             0x61254
+#define   BACKLIGHT_MODULATION_FREQ_SHIFT               (17)
 #define BLC_PWM_CTL2            0x61250 /* 965+ only */
+#define   BLM_COMBINATION_MODE (1 << 30)
+/*
+ * This is the most significant 15 bits of the number of backlight cycles in a
+ * complete cycle of the modulated backlight control.
+ *
+ * The actual value is this field multiplied by two.
+ */
+#define   BACKLIGHT_MODULATION_FREQ_MASK                (0x7fff << 17)
+#define   BLM_LEGACY_MODE                               (1 << 16)
 /*
 * This is the number of cycles out of the backlight modulation cycle for which
 * the backlight is on.
@@ -3261,6 +3271,8 @@
 #define  FORCEWAKE                              0xA18C
 #define  FORCEWAKE_ACK                          0x130090
+#define  GT_FIFO_FREE_ENTRIES                   0x120008
 #define GEN6_RPNSWREQ                           0xA008
 #define   GEN6_TURBO_DISABLE                    (1<<31)
 #define   GEN6_FREQUENCY(x)                     ((x)<<25)
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 3b006536b3d2..49fb54fd9a18 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -1219,7 +1219,7 @@ static void sandybridge_blit_fbc_update(struct drm_device *dev)
        u32 blt_ecoskpd;
        /* Make sure blitter notifies FBC of writes */
-        __gen6_force_wake_get(dev_priv);
+        __gen6_gt_force_wake_get(dev_priv);
        blt_ecoskpd = I915_READ(GEN6_BLITTER_ECOSKPD);
        blt_ecoskpd |= GEN6_BLITTER_FBC_NOTIFY <<
                GEN6_BLITTER_LOCK_SHIFT;
@@ -1230,7 +1230,7 @@ static void sandybridge_blit_fbc_update(struct drm_device *dev)
                         GEN6_BLITTER_LOCK_SHIFT);
        I915_WRITE(GEN6_BLITTER_ECOSKPD, blt_ecoskpd);
        POSTING_READ(GEN6_BLITTER_ECOSKPD);
-        __gen6_force_wake_put(dev_priv);
+        __gen6_gt_force_wake_put(dev_priv);
 }
 static void ironlake_enable_fbc(struct drm_crtc *crtc, unsigned long interval)
@@ -1630,19 +1630,19 @@ intel_pipe_set_base(struct drm_crtc *crtc, int x, int y,
                struct drm_i915_gem_object *obj = to_intel_framebuffer(old_fb)->obj;
                wait_event(dev_priv->pending_flip_queue,
+                           atomic_read(&dev_priv->mm.wedged) ||
                           atomic_read(&obj->pending_flip) == 0);
                /* Big Hammer, we also need to ensure that any pending
                 * MI_WAIT_FOR_EVENT inside a user batch buffer on the
                 * current scanout is retired before unpinning the old
                 * framebuffer.
+                 *
+                 * This should only fail upon a hung GPU, in which case we
+                 * can safely continue.
                 */
                ret = i915_gem_object_flush_gpu(obj, false);
-                if (ret) {
+                (void) ret;
-                        i915_gem_object_unpin(to_intel_framebuffer(crtc->fb)->obj);
-                        mutex_unlock(&dev->struct_mutex);
-                        return ret;
-                }
        }
        ret = intel_pipe_set_base_atomic(crtc, crtc->fb, x, y,
@@ -2045,6 +2045,31 @@ static void intel_crtc_wait_for_pending_flips(struct drm_crtc *crtc)
                   atomic_read(&obj->pending_flip) == 0);
 }
+static bool intel_crtc_driving_pch(struct drm_crtc *crtc)
+{
+        struct drm_device *dev = crtc->dev;
+        struct drm_mode_config *mode_config = &dev->mode_config;
+        struct intel_encoder *encoder;
+        /*
+         * If there's a non-PCH eDP on this crtc, it must be DP_A, and that
+         * must be driven by its own crtc; no sharing is possible.
+         */
+        list_for_each_entry(encoder, &mode_config->encoder_list, base.head) {
+                if (encoder->base.crtc != crtc)
+                        continue;
+                switch (encoder->type) {
+                case INTEL_OUTPUT_EDP:
+                        if (!intel_encoder_is_pch_edp(&encoder->base))
+                                return false;
+                        continue;
+                }
+        }
+        return true;
+}
 static void ironlake_crtc_enable(struct drm_crtc *crtc)
 {
        struct drm_device *dev = crtc->dev;
@@ -2053,6 +2078,7 @@ static void ironlake_crtc_enable(struct drm_crtc *crtc)
        int pipe = intel_crtc->pipe;
        int plane = intel_crtc->plane;
        u32 reg, temp;
+        bool is_pch_port = false;
        if (intel_crtc->active)
                return;
@@ -2066,7 +2092,56 @@ static void ironlake_crtc_enable(struct drm_crtc *crtc)
                        I915_WRITE(PCH_LVDS, temp | LVDS_PORT_EN);
        }
-        ironlake_fdi_enable(crtc);
+        is_pch_port = intel_crtc_driving_pch(crtc);
+        if (is_pch_port)
+                ironlake_fdi_enable(crtc);
+        else {
+                /* disable CPU FDI tx and PCH FDI rx */
+                reg = FDI_TX_CTL(pipe);
+                temp = I915_READ(reg);
+                I915_WRITE(reg, temp & ~FDI_TX_ENABLE);
+                POSTING_READ(reg);
+                reg = FDI_RX_CTL(pipe);
+                temp = I915_READ(reg);
+                temp &= ~(0x7 << 16);
+                temp |= (I915_READ(PIPECONF(pipe)) & PIPE_BPC_MASK) << 11;
+                I915_WRITE(reg, temp & ~FDI_RX_ENABLE);
+                POSTING_READ(reg);
+                udelay(100);
+                /* Ironlake workaround, disable clock pointer after downing FDI */
+                if (HAS_PCH_IBX(dev))
+                        I915_WRITE(FDI_RX_CHICKEN(pipe),
+                                   I915_READ(FDI_RX_CHICKEN(pipe) &
+                                             ~FDI_RX_PHASE_SYNC_POINTER_ENABLE));
+                /* still set train pattern 1 */
+                reg = FDI_TX_CTL(pipe);
+                temp = I915_READ(reg);
+                temp &= ~FDI_LINK_TRAIN_NONE;
+                temp |= FDI_LINK_TRAIN_PATTERN_1;
+                I915_WRITE(reg, temp);
+                reg = FDI_RX_CTL(pipe);
+                temp = I915_READ(reg);
+                if (HAS_PCH_CPT(dev)) {
+                        temp &= ~FDI_LINK_TRAIN_PATTERN_MASK_CPT;
+                        temp |= FDI_LINK_TRAIN_PATTERN_1_CPT;
+                } else {
+                        temp &= ~FDI_LINK_TRAIN_NONE;
+                        temp |= FDI_LINK_TRAIN_PATTERN_1;
+                }
+                /* BPC in FDI rx is consistent with that in PIPECONF */
+                temp &= ~(0x07 << 16);
+                temp |= (I915_READ(PIPECONF(pipe)) & PIPE_BPC_MASK) << 11;
+                I915_WRITE(reg, temp);
+                POSTING_READ(reg);
+                udelay(100);
+        }
        /* Enable panel fitting for LVDS */
        if (dev_priv->pch_pf_size &&
@@ -2100,6 +2175,10 @@ static void ironlake_crtc_enable(struct drm_crtc *crtc)
                intel_flush_display_plane(dev, plane);
        }
+        /* Skip the PCH stuff if possible */
+        if (!is_pch_port)
+                goto done;
        /* For PCH output, training FDI link */
        if (IS_GEN6(dev))
                gen6_fdi_link_train(crtc);
@@ -2184,7 +2263,7 @@ static void ironlake_crtc_enable(struct drm_crtc *crtc)
        I915_WRITE(reg, temp | TRANS_ENABLE);
        if (wait_for(I915_READ(reg) & TRANS_STATE_ENABLE, 100))
                DRM_ERROR("failed to enable transcoder %d\n", pipe);
+done:
        intel_crtc_load_lut(crtc);
        intel_update_fbc(dev);
        intel_crtc_update_cursor(crtc, true);
@@ -6203,7 +6282,7 @@ void gen6_enable_rps(struct drm_i915_private *dev_priv)
         * userspace...
         */
        I915_WRITE(GEN6_RC_STATE, 0);
-        __gen6_force_wake_get(dev_priv);
+        __gen6_gt_force_wake_get(dev_priv);
        /* disable the counters and set deterministic thresholds */
        I915_WRITE(GEN6_RC_CONTROL, 0);
@@ -6301,7 +6380,7 @@ void gen6_enable_rps(struct drm_i915_private *dev_priv)
        /* enable all PM interrupts */
        I915_WRITE(GEN6_PMINTRMSK, 0);
-        __gen6_force_wake_put(dev_priv);
+        __gen6_gt_force_wake_put(dev_priv);
 }
 void intel_enable_clock_gating(struct drm_device *dev)
@@ -6496,7 +6575,7 @@ static void ironlake_disable_rc6(struct drm_device *dev)
                POSTING_READ(RSTDBYCTL);
        }
-        ironlake_disable_rc6(dev);
+        ironlake_teardown_rc6(dev);
 }
 static int ironlake_setup_rc6(struct drm_device *dev)
diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
index d860abeda70f..f8f86e57df22 100644
--- a/drivers/gpu/drm/i915/intel_panel.c
+++ b/drivers/gpu/drm/i915/intel_panel.c
@@ -30,6 +30,8 @@
 #include "intel_drv.h"
+#define PCI_LBPC 0xf4 /* legacy/combination backlight modes */
 void
 intel_fixed_panel_mode(struct drm_display_mode *fixed_mode,
                       struct drm_display_mode *adjusted_mode)
@@ -110,6 +112,19 @@ done:
        dev_priv->pch_pf_size = (width << 16) | height;
 }
+static int is_backlight_combination_mode(struct drm_device *dev)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        if (INTEL_INFO(dev)->gen >= 4)
+                return I915_READ(BLC_PWM_CTL2) & BLM_COMBINATION_MODE;
+        if (IS_GEN2(dev))
+                return I915_READ(BLC_PWM_CTL) & BLM_LEGACY_MODE;
+        return 0;
+}
 static u32 i915_read_blc_pwm_ctl(struct drm_i915_private *dev_priv)
 {
        u32 val;
@@ -166,6 +181,9 @@ u32 intel_panel_get_max_backlight(struct drm_device *dev)
                        if (INTEL_INFO(dev)->gen < 4)
                                max &= ~1;
                }
+                if (is_backlight_combination_mode(dev))
+                        max *= 0xff;
        }
        DRM_DEBUG_DRIVER("max backlight PWM = %d\n", max);
@@ -183,6 +201,14 @@ u32 intel_panel_get_backlight(struct drm_device *dev)
                val = I915_READ(BLC_PWM_CTL) & BACKLIGHT_DUTY_CYCLE_MASK;
                if (IS_PINEVIEW(dev))
                        val >>= 1;
+                if (is_backlight_combination_mode(dev)){
+                        u8 lbpc;
+                        val &= ~1;
+                        pci_read_config_byte(dev->pdev, PCI_LBPC, &lbpc);
+                        val *= lbpc;
+                }
        }
        DRM_DEBUG_DRIVER("get backlight PWM = %d\n", val);
@@ -205,6 +231,16 @@ void intel_panel_set_backlight(struct drm_device *dev, u32 level)
        if (HAS_PCH_SPLIT(dev))
                return intel_pch_panel_set_backlight(dev, level);
+        if (is_backlight_combination_mode(dev)){
+                u32 max = intel_panel_get_max_backlight(dev);
+                u8 lbpc;
+                lbpc = level * 0xfe / max + 1;
+                level /= lbpc;
+                pci_write_config_byte(dev->pdev, PCI_LBPC, lbpc);
+        }
        tmp = I915_READ(BLC_PWM_CTL);
        if (IS_PINEVIEW(dev)) {
                tmp &= ~(BACKLIGHT_DUTY_CYCLE_MASK - 1);
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.h b/drivers/gpu/drm/i915/intel_ringbuffer.h
index 6d6fde85a636..34306865a5df 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.h
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.h
@@ -14,22 +14,23 @@ struct  intel_hw_status_page {
        struct          drm_i915_gem_object *obj;
 };
-#define I915_RING_READ(reg) i915_safe_read(dev_priv, reg)
+#define I915_RING_READ(reg) i915_gt_read(dev_priv, reg)
+#define I915_RING_WRITE(reg, val) i915_gt_write(dev_priv, reg, val)
 #define I915_READ_TAIL(ring) I915_RING_READ(RING_TAIL((ring)->mmio_base))
-#define I915_WRITE_TAIL(ring, val) I915_WRITE(RING_TAIL((ring)->mmio_base), val)
+#define I915_WRITE_TAIL(ring, val) I915_RING_WRITE(RING_TAIL((ring)->mmio_base), val)
 #define I915_READ_START(ring) I915_RING_READ(RING_START((ring)->mmio_base))
-#define I915_WRITE_START(ring, val) I915_WRITE(RING_START((ring)->mmio_base), val)
+#define I915_WRITE_START(ring, val) I915_RING_WRITE(RING_START((ring)->mmio_base), val)
 #define I915_READ_HEAD(ring)  I915_RING_READ(RING_HEAD((ring)->mmio_base))
-#define I915_WRITE_HEAD(ring, val) I915_WRITE(RING_HEAD((ring)->mmio_base), val)
+#define I915_WRITE_HEAD(ring, val) I915_RING_WRITE(RING_HEAD((ring)->mmio_base), val)
 #define I915_READ_CTL(ring) I915_RING_READ(RING_CTL((ring)->mmio_base))
-#define I915_WRITE_CTL(ring, val) I915_WRITE(RING_CTL((ring)->mmio_base), val)
+#define I915_WRITE_CTL(ring, val) I915_RING_WRITE(RING_CTL((ring)->mmio_base), val)
-#define I915_WRITE_IMR(ring, val) I915_WRITE(RING_IMR((ring)->mmio_base), val)
 #define I915_READ_IMR(ring) I915_RING_READ(RING_IMR((ring)->mmio_base))
+#define I915_WRITE_IMR(ring, val) I915_RING_WRITE(RING_IMR((ring)->mmio_base), val)
 #define I915_READ_NOPID(ring) I915_RING_READ(RING_NOPID((ring)->mmio_base))
 #define I915_READ_SYNC_0(ring) I915_RING_READ(RING_SYNC_0((ring)->mmio_base))
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
index d38a4d9f9b0b..a52184007f5f 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -49,7 +49,10 @@ nouveau_bo_del_ttm(struct ttm_buffer_object *bo)
                DRM_ERROR("bo %p still attached to GEM object\n", bo);
        nv10_mem_put_tile_region(dev, nvbo->tile, NULL);
-        nouveau_vm_put(&nvbo->vma);
+        if (nvbo->vma.node) {
+                nouveau_vm_unmap(&nvbo->vma);
+                nouveau_vm_put(&nvbo->vma);
+        }
        kfree(nvbo);
 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_dma.c b/drivers/gpu/drm/nouveau/nouveau_dma.c
index 65699bfaaaea..b368ed74aad7 100644
--- a/drivers/gpu/drm/nouveau/nouveau_dma.c
+++ b/drivers/gpu/drm/nouveau/nouveau_dma.c
@@ -83,7 +83,8 @@ nouveau_dma_init(struct nouveau_channel *chan)
                return ret;
        /* NV_MEMORY_TO_MEMORY_FORMAT requires a notifier object */
-        ret = nouveau_notifier_alloc(chan, NvNotify0, 32, &chan->m2mf_ntfy);
+        ret = nouveau_notifier_alloc(chan, NvNotify0, 32, 0xfd0, 0x1000,
+                                     &chan->m2mf_ntfy);
        if (ret)
                return ret;
diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h
index 9821fcacc3d2..982d70b12722 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drv.h
+++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
@@ -852,7 +852,8 @@ extern const struct ttm_mem_type_manager_func nouveau_vram_manager;
 extern int  nouveau_notifier_init_channel(struct nouveau_channel *);
 extern void nouveau_notifier_takedown_channel(struct nouveau_channel *);
 extern int  nouveau_notifier_alloc(struct nouveau_channel *, uint32_t handle,
-                                   int cout, uint32_t *offset);
+                                   int cout, uint32_t start, uint32_t end,
+                                   uint32_t *offset);
 extern int  nouveau_notifier_offset(struct nouveau_gpuobj *, uint32_t *);
 extern int  nouveau_ioctl_notifier_alloc(struct drm_device *, void *data,
                                         struct drm_file *);
diff --git a/drivers/gpu/drm/nouveau/nouveau_mem.c b/drivers/gpu/drm/nouveau/nouveau_mem.c
index 26347b7cd872..b0fb9bdcddb7 100644
--- a/drivers/gpu/drm/nouveau/nouveau_mem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_mem.c
@@ -725,8 +725,10 @@ nouveau_vram_manager_new(struct ttm_mem_type_manager *man,
        ret = vram->get(dev, mem->num_pages << PAGE_SHIFT,
                        mem->page_alignment << PAGE_SHIFT, size_nc,
                        (nvbo->tile_flags >> 8) & 0xff, &node);
-        if (ret)
+        if (ret) {
-                return ret;
+                mem->mm_node = NULL;
+                return (ret == -ENOSPC) ? 0 : ret;
+        }
        node->page_shift = 12;
        if (nvbo->vma.node)
diff --git a/drivers/gpu/drm/nouveau/nouveau_mm.c b/drivers/gpu/drm/nouveau/nouveau_mm.c
index 8844b50c3e54..7609756b6faf 100644
--- a/drivers/gpu/drm/nouveau/nouveau_mm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_mm.c
@@ -123,7 +123,7 @@ nouveau_mm_get(struct nouveau_mm *rmm, int type, u32 size, u32 size_nc,
                return 0;
        }
-        return -ENOMEM;
+        return -ENOSPC;
 }
 int
diff --git a/drivers/gpu/drm/nouveau/nouveau_notifier.c b/drivers/gpu/drm/nouveau/nouveau_notifier.c
index fe29d604b820..5ea167623a82 100644
--- a/drivers/gpu/drm/nouveau/nouveau_notifier.c
+++ b/drivers/gpu/drm/nouveau/nouveau_notifier.c
@@ -96,7 +96,8 @@ nouveau_notifier_gpuobj_dtor(struct drm_device *dev,
 int
 nouveau_notifier_alloc(struct nouveau_channel *chan, uint32_t handle,
-                       int size, uint32_t *b_offset)
+                       int size, uint32_t start, uint32_t end,
+                       uint32_t *b_offset)
 {
        struct drm_device *dev = chan->dev;
        struct nouveau_gpuobj *nobj = NULL;
@@ -104,9 +105,10 @@ nouveau_notifier_alloc(struct nouveau_channel *chan, uint32_t handle,
        uint32_t offset;
        int target, ret;
-        mem = drm_mm_search_free(&chan->notifier_heap, size, 0, 0);
+        mem = drm_mm_search_free_in_range(&chan->notifier_heap, size, 0,
+                                          start, end, 0);
        if (mem)
-                mem = drm_mm_get_block(mem, size, 0);
+                mem = drm_mm_get_block_range(mem, size, 0, start, end);
        if (!mem) {
                NV_ERROR(dev, "Channel %d notifier block full\n", chan->id);
                return -ENOMEM;
@@ -177,7 +179,8 @@ nouveau_ioctl_notifier_alloc(struct drm_device *dev, void *data,
        if (IS_ERR(chan))
                return PTR_ERR(chan);
-        ret = nouveau_notifier_alloc(chan, na->handle, na->size, &na->offset);
+        ret = nouveau_notifier_alloc(chan, na->handle, na->size, 0, 0x1000,
+                                     &na->offset);
        nouveau_channel_put(&chan);
        return ret;
 }
diff --git a/drivers/gpu/drm/nouveau/nv50_instmem.c b/drivers/gpu/drm/nouveau/nv50_instmem.c
index ea0041810ae3..e57caa2a00e3 100644
--- a/drivers/gpu/drm/nouveau/nv50_instmem.c
+++ b/drivers/gpu/drm/nouveau/nv50_instmem.c
@@ -403,16 +403,24 @@ nv50_instmem_unmap(struct nouveau_gpuobj *gpuobj)
 void
 nv50_instmem_flush(struct drm_device *dev)
 {
+        struct drm_nouveau_private *dev_priv = dev->dev_private;
+        spin_lock(&dev_priv->ramin_lock);
        nv_wr32(dev, 0x00330c, 0x00000001);
        if (!nv_wait(dev, 0x00330c, 0x00000002, 0x00000000))
                NV_ERROR(dev, "PRAMIN flush timeout\n");
+        spin_unlock(&dev_priv->ramin_lock);
 }
 void
 nv84_instmem_flush(struct drm_device *dev)
 {
+        struct drm_nouveau_private *dev_priv = dev->dev_private;
+        spin_lock(&dev_priv->ramin_lock);
        nv_wr32(dev, 0x070000, 0x00000001);
        if (!nv_wait(dev, 0x070000, 0x00000002, 0x00000000))
                NV_ERROR(dev, "PRAMIN flush timeout\n");
+        spin_unlock(&dev_priv->ramin_lock);
 }
diff --git a/drivers/gpu/drm/nouveau/nv50_vm.c b/drivers/gpu/drm/nouveau/nv50_vm.c
index 459ff08241e5..6144156f255a 100644
--- a/drivers/gpu/drm/nouveau/nv50_vm.c
+++ b/drivers/gpu/drm/nouveau/nv50_vm.c
@@ -169,7 +169,11 @@ nv50_vm_flush(struct nouveau_vm *vm)
 void
 nv50_vm_flush_engine(struct drm_device *dev, int engine)
 {
+        struct drm_nouveau_private *dev_priv = dev->dev_private;
+        spin_lock(&dev_priv->ramin_lock);
        nv_wr32(dev, 0x100c80, (engine << 16) | 1);
        if (!nv_wait(dev, 0x100c80, 0x00000001, 0x00000000))
                NV_ERROR(dev, "vm flush timeout: engine %d\n", engine);
+        spin_unlock(&dev_priv->ramin_lock);
 }
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index d270b3ff896b..6140ea1de45a 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -2194,7 +2194,6 @@ int evergreen_mc_init(struct radeon_device *rdev)
                rdev->mc.real_vram_size = RREG32(CONFIG_MEMSIZE) * 1024 * 1024;
        }
        rdev->mc.visible_vram_size = rdev->mc.aper_size;
-        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
        r700_vram_gtt_location(rdev, &rdev->mc);
        radeon_update_bandwidth_info(rdev);
@@ -2934,7 +2933,7 @@ static int evergreen_startup(struct radeon_device *rdev)
        /* XXX: ontario has problems blitting to gart at the moment */
        if (rdev->family == CHIP_PALM) {
                rdev->asic->copy = NULL;
-                rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
+                radeon_ttm_set_active_vram_size(rdev, rdev->mc.visible_vram_size);
        }
        /* allocate wb buffer */
diff --git a/drivers/gpu/drm/radeon/evergreen_blit_kms.c b/drivers/gpu/drm/radeon/evergreen_blit_kms.c
index 2adfb03f479b..2be698e78ff2 100644
--- a/drivers/gpu/drm/radeon/evergreen_blit_kms.c
+++ b/drivers/gpu/drm/radeon/evergreen_blit_kms.c
@@ -623,7 +623,7 @@ done:
                dev_err(rdev->dev, "(%d) pin blit object failed\n", r);
                return r;
        }
-        rdev->mc.active_vram_size = rdev->mc.real_vram_size;
+        radeon_ttm_set_active_vram_size(rdev, rdev->mc.real_vram_size);
        return 0;
 }
@@ -631,7 +631,7 @@ void evergreen_blit_fini(struct radeon_device *rdev)
 {
        int r;
-        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
+        radeon_ttm_set_active_vram_size(rdev, rdev->mc.visible_vram_size);
        if (rdev->r600_blit.shader_obj == NULL)
                return;
        /* If we can't reserve the bo, unref should be enough to destroy
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 56deae5bf02e..e372f9e1e5ce 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -70,23 +70,6 @@ MODULE_FIRMWARE(FIRMWARE_R520);
 void r100_pre_page_flip(struct radeon_device *rdev, int crtc)
 {
-        struct radeon_crtc *radeon_crtc = rdev->mode_info.crtcs[crtc];
-        u32 tmp;
-        /* make sure flip is at vb rather than hb */
-        tmp = RREG32(RADEON_CRTC_OFFSET_CNTL + radeon_crtc->crtc_offset);
-        tmp &= ~RADEON_CRTC_OFFSET_FLIP_CNTL;
-        /* make sure pending bit is asserted */
-        tmp |= RADEON_CRTC_GUI_TRIG_OFFSET_LEFT_EN;
-        WREG32(RADEON_CRTC_OFFSET_CNTL + radeon_crtc->crtc_offset, tmp);
-        /* set pageflip to happen as late as possible in the vblank interval.
-         * same field for crtc1/2
-         */
-        tmp = RREG32(RADEON_CRTC_GEN_CNTL);
-        tmp &= ~RADEON_CRTC_VSTAT_MODE_MASK;
-        WREG32(RADEON_CRTC_GEN_CNTL, tmp);
        /* enable the pflip int */
        radeon_irq_kms_pflip_irq_get(rdev, crtc);
 }
@@ -1041,7 +1024,7 @@ int r100_cp_init(struct radeon_device *rdev, unsigned ring_size)
                return r;
        }
        rdev->cp.ready = true;
-        rdev->mc.active_vram_size = rdev->mc.real_vram_size;
+        radeon_ttm_set_active_vram_size(rdev, rdev->mc.real_vram_size);
        return 0;
 }
@@ -1059,7 +1042,7 @@ void r100_cp_fini(struct radeon_device *rdev)
 void r100_cp_disable(struct radeon_device *rdev)
 {
        /* Disable ring */
-        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
+        radeon_ttm_set_active_vram_size(rdev, rdev->mc.visible_vram_size);
        rdev->cp.ready = false;
        WREG32(RADEON_CP_CSQ_MODE, 0);
        WREG32(RADEON_CP_CSQ_CNTL, 0);
@@ -2329,7 +2312,6 @@ void r100_vram_init_sizes(struct radeon_device *rdev)
        /* FIXME we don't use the second aperture yet when we could use it */
        if (rdev->mc.visible_vram_size > rdev->mc.aper_size)
                rdev->mc.visible_vram_size = rdev->mc.aper_size;
-        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
        config_aper_size = RREG32(RADEON_CONFIG_APER_SIZE);
        if (rdev->flags & RADEON_IS_IGP) {
                uint32_t tom;
@@ -3490,7 +3472,7 @@ void r100_cs_track_clear(struct radeon_device *rdev, struct r100_cs_track *track
                track->num_texture = 16;
                track->maxy = 4096;
                track->separate_cube = 0;
-                track->aaresolve = true;
+                track->aaresolve = false;
                track->aa.robj = NULL;
        }
@@ -3801,8 +3783,6 @@ static int r100_startup(struct radeon_device *rdev)
        r100_mc_program(rdev);
        /* Resume clock */
        r100_clock_startup(rdev);
-        /* Initialize GPU configuration (# pipes, ...) */
-//      r100_gpu_init(rdev);
        /* Initialize GART (initialize after TTM so we can allocate
         * memory through TTM but finalize after TTM) */
        r100_enable_bm(rdev);
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index de88624d5f87..9b3fad23b76c 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -1255,7 +1255,6 @@ int r600_mc_init(struct radeon_device *rdev)
        rdev->mc.mc_vram_size = RREG32(CONFIG_MEMSIZE);
        rdev->mc.real_vram_size = RREG32(CONFIG_MEMSIZE);
        rdev->mc.visible_vram_size = rdev->mc.aper_size;
-        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
        r600_vram_gtt_location(rdev, &rdev->mc);
        if (rdev->flags & RADEON_IS_IGP) {
@@ -1937,7 +1936,7 @@ void r600_pciep_wreg(struct radeon_device *rdev, u32 reg, u32 v)
 */
 void r600_cp_stop(struct radeon_device *rdev)
 {
-        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
+        radeon_ttm_set_active_vram_size(rdev, rdev->mc.visible_vram_size);
        WREG32(R_0086D8_CP_ME_CNTL, S_0086D8_CP_ME_HALT(1));
        WREG32(SCRATCH_UMSK, 0);
 }
diff --git a/drivers/gpu/drm/radeon/r600_blit_kms.c b/drivers/gpu/drm/radeon/r600_blit_kms.c
index 41f7aafc97c4..df68d91e8190 100644
--- a/drivers/gpu/drm/radeon/r600_blit_kms.c
+++ b/drivers/gpu/drm/radeon/r600_blit_kms.c
@@ -558,7 +558,7 @@ done:
                dev_err(rdev->dev, "(%d) pin blit object failed\n", r);
                return r;
        }
-        rdev->mc.active_vram_size = rdev->mc.real_vram_size;
+        radeon_ttm_set_active_vram_size(rdev, rdev->mc.real_vram_size);
        return 0;
 }
@@ -566,7 +566,7 @@ void r600_blit_fini(struct radeon_device *rdev)
 {
        int r;
-        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
+        radeon_ttm_set_active_vram_size(rdev, rdev->mc.visible_vram_size);
        if (rdev->r600_blit.shader_obj == NULL)
                return;
        /* If we can't reserve the bo, unref should be enough to destroy
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 56c48b67ef3d..6b3429495118 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -345,7 +345,6 @@ struct radeon_mc {
         * about vram size near mc fb location */
        u64                     mc_vram_size;
        u64                     visible_vram_size;
-        u64                     active_vram_size;
        u64                     gtt_size;
        u64                     gtt_start;
        u64                     gtt_end;
@@ -1448,6 +1447,7 @@ extern void radeon_vram_location(struct radeon_device *rdev, struct radeon_mc *m
 extern void radeon_gtt_location(struct radeon_device *rdev, struct radeon_mc *mc);
 extern int radeon_resume_kms(struct drm_device *dev);
 extern int radeon_suspend_kms(struct drm_device *dev, pm_message_t state);
+extern void radeon_ttm_set_active_vram_size(struct radeon_device *rdev, u64 size);
 /* r600, rv610, rv630, rv620, rv635, rv670, rs780, rs880 */
 extern bool r600_card_posted(struct radeon_device *rdev);
diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
index e75d63b8e21d..793c5e6026ad 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.c
+++ b/drivers/gpu/drm/radeon/radeon_asic.c
@@ -834,6 +834,9 @@ static struct radeon_asic sumo_asic = {
        .pm_finish = &evergreen_pm_finish,
        .pm_init_profile = &rs780_pm_init_profile,
        .pm_get_dynpm_state = &r600_pm_get_dynpm_state,
+        .pre_page_flip = &evergreen_pre_page_flip,
+        .page_flip = &evergreen_page_flip,
+        .post_page_flip = &evergreen_post_page_flip,
 };
 static struct radeon_asic btc_asic = {
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index 0e657095de7c..3e7e7f9eb781 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -971,7 +971,7 @@ void radeon_compute_pll_legacy(struct radeon_pll *pll,
                max_fractional_feed_div = pll->max_frac_feedback_div;
        }
-        for (post_div = min_post_div; post_div <= max_post_div; ++post_div) {
+        for (post_div = max_post_div; post_div >= min_post_div; --post_div) {
                uint32_t ref_div;
                if ((pll->flags & RADEON_PLL_NO_ODD_POST_DIV) && (post_div & 1))
diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c
index 66324b5bb5ba..cc44bdfec80f 100644
--- a/drivers/gpu/drm/radeon/radeon_fb.c
+++ b/drivers/gpu/drm/radeon/radeon_fb.c
@@ -113,11 +113,14 @@ static int radeonfb_create_pinned_object(struct radeon_fbdev *rfbdev,
        u32 tiling_flags = 0;
        int ret;
        int aligned_size, size;
+        int height = mode_cmd->height;
        /* need to align pitch with crtc limits */
        mode_cmd->pitch = radeon_align_pitch(rdev, mode_cmd->width, mode_cmd->bpp, fb_tiled) * ((mode_cmd->bpp + 1) / 8);
-        size = mode_cmd->pitch * mode_cmd->height;
+        if (rdev->family >= CHIP_R600)
+                height = ALIGN(mode_cmd->height, 8);
+        size = mode_cmd->pitch * height;
        aligned_size = ALIGN(size, PAGE_SIZE);
        ret = radeon_gem_object_create(rdev, aligned_size, 0,
                                       RADEON_GEM_DOMAIN_VRAM,
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
index df95eb83dac6..1fe95dfe48c9 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -156,9 +156,12 @@ int radeon_gem_info_ioctl(struct drm_device *dev, void *data,
 {
        struct radeon_device *rdev = dev->dev_private;
        struct drm_radeon_gem_info *args = data;
+        struct ttm_mem_type_manager *man;
+        man = &rdev->mman.bdev.man[TTM_PL_VRAM];
        args->vram_size = rdev->mc.real_vram_size;
-        args->vram_visible = rdev->mc.real_vram_size;
+        args->vram_visible = (u64)man->size << PAGE_SHIFT;
        if (rdev->stollen_vga_memory)
                args->vram_visible -= radeon_bo_size(rdev->stollen_vga_memory);
        args->vram_visible -= radeon_fbdev_total_size(rdev);
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
index cf0638c3b7c7..78968b738e88 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
@@ -443,7 +443,7 @@ int radeon_crtc_do_set_base(struct drm_crtc *crtc,
                       (target_fb->bits_per_pixel * 8));
        crtc_pitch |= crtc_pitch << 16;
+        crtc_offset_cntl |= RADEON_CRTC_GUI_TRIG_OFFSET_LEFT_EN;
        if (tiling_flags & RADEON_TILING_MACRO) {
                if (ASIC_IS_R300(rdev))
                        crtc_offset_cntl |= (R300_CRTC_X_Y_MODE_EN |
@@ -502,6 +502,7 @@ int radeon_crtc_do_set_base(struct drm_crtc *crtc,
        gen_cntl_val = RREG32(gen_cntl_reg);
        gen_cntl_val &= ~(0xf << 8);
        gen_cntl_val |= (format << 8);
+        gen_cntl_val &= ~RADEON_CRTC_VSTAT_MODE_MASK;
        WREG32(gen_cntl_reg, gen_cntl_val);
        crtc_offset = (u32)base;
diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
index e5b2cf10cbf4..8389b4c63d12 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -589,6 +589,20 @@ void radeon_ttm_fini(struct radeon_device *rdev)
        DRM_INFO("radeon: ttm finalized\n");
 }
+/* this should only be called at bootup or when userspace
+ * isn't running */
+void radeon_ttm_set_active_vram_size(struct radeon_device *rdev, u64 size)
+{
+        struct ttm_mem_type_manager *man;
+        if (!rdev->mman.initialized)
+                return;
+        man = &rdev->mman.bdev.man[TTM_PL_VRAM];
+        /* this just adjusts TTM size idea, which sets lpfn to the correct value */
+        man->size = size >> PAGE_SHIFT;
+}
 static struct vm_operations_struct radeon_ttm_vm_ops;
 static const struct vm_operations_struct *ttm_vm_ops = NULL;
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index 5afe294ed51f..8af4679db23e 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -751,7 +751,6 @@ void rs600_mc_init(struct radeon_device *rdev)
        rdev->mc.real_vram_size = RREG32(RADEON_CONFIG_MEMSIZE);
        rdev->mc.mc_vram_size = rdev->mc.real_vram_size;
        rdev->mc.visible_vram_size = rdev->mc.aper_size;
-        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
        rdev->mc.igp_sideport_enabled = radeon_atombios_sideport_present(rdev);
        base = RREG32_MC(R_000004_MC_FB_LOCATION);
        base = G_000004_MC_FB_START(base) << 16;
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index 6638c8e4c81b..66c949b7c18c 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -157,7 +157,6 @@ void rs690_mc_init(struct radeon_device *rdev)
        rdev->mc.aper_base = pci_resource_start(rdev->pdev, 0);
        rdev->mc.aper_size = pci_resource_len(rdev->pdev, 0);
        rdev->mc.visible_vram_size = rdev->mc.aper_size;
-        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
        base = RREG32_MC(R_000100_MCCFG_FB_LOCATION);
        base = G_000100_MC_FB_START(base) << 16;
        rdev->mc.igp_sideport_enabled = radeon_atombios_sideport_present(rdev);
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index d8ba67690656..714ad45757d0 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -307,7 +307,7 @@ static void rv770_mc_program(struct radeon_device *rdev)
 */
 void r700_cp_stop(struct radeon_device *rdev)
 {
-        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
+        radeon_ttm_set_active_vram_size(rdev, rdev->mc.visible_vram_size);
        WREG32(CP_ME_CNTL, (CP_ME_HALT | CP_PFP_HALT));
        WREG32(SCRATCH_UMSK, 0);
 }
@@ -1123,7 +1123,6 @@ int rv770_mc_init(struct radeon_device *rdev)
        rdev->mc.mc_vram_size = RREG32(CONFIG_MEMSIZE);
        rdev->mc.real_vram_size = RREG32(CONFIG_MEMSIZE);
        rdev->mc.visible_vram_size = rdev->mc.aper_size;
-        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
        r700_vram_gtt_location(rdev, &rdev->mc);
        radeon_update_bandwidth_info(rdev);
diff --git a/drivers/hwmon/ad7414.c b/drivers/hwmon/ad7414.c
index 86d822aa9bbf..d46c0c758ddf 100644
--- a/drivers/hwmon/ad7414.c
+++ b/drivers/hwmon/ad7414.c
@@ -242,6 +242,7 @@ static const struct i2c_device_id ad7414_id[] = {
        { "ad7414", 0 },
        {}
 };
+MODULE_DEVICE_TABLE(i2c, ad7414_id);
 static struct i2c_driver ad7414_driver = {
        .driver = {
diff --git a/drivers/hwmon/adt7411.c b/drivers/hwmon/adt7411.c
index f13c843a2964..5cc3e3784b42 100644
--- a/drivers/hwmon/adt7411.c
+++ b/drivers/hwmon/adt7411.c
@@ -334,6 +334,7 @@ static const struct i2c_device_id adt7411_id[] = {
        { "adt7411", 0 },
        { }
 };
+MODULE_DEVICE_TABLE(i2c, adt7411_id);
 static struct i2c_driver adt7411_driver = {
        .driver         = {
diff --git a/drivers/hwmon/f71882fg.c b/drivers/hwmon/f71882fg.c
index 3f49dd376f02..6e06019015a5 100644
--- a/drivers/hwmon/f71882fg.c
+++ b/drivers/hwmon/f71882fg.c
@@ -37,7 +37,7 @@
 #define SIO_F71858FG_LD_HWM     0x02    /* Hardware monitor logical device */
 #define SIO_F71882FG_LD_HWM     0x04    /* Hardware monitor logical device */
 #define SIO_UNLOCK_KEY          0x87    /* Key to enable Super-I/O */
-#define SIO_LOCK_KEY            0xAA    /* Key to diasble Super-I/O */
+#define SIO_LOCK_KEY            0xAA    /* Key to disable Super-I/O */
 #define SIO_REG_LDSEL           0x07    /* Logical device select */
 #define SIO_REG_DEVID           0x20    /* Device ID (2 bytes) */
@@ -2111,7 +2111,6 @@ static int f71882fg_remove(struct platform_device *pdev)
        int nr_fans = (data->type == f71882fg) ? 4 : 3;
        u8 start_reg = f71882fg_read8(data, F71882FG_REG_START);
-        platform_set_drvdata(pdev, NULL);
        if (data->hwmon_dev)
                hwmon_device_unregister(data->hwmon_dev);
@@ -2178,6 +2177,7 @@ static int f71882fg_remove(struct platform_device *pdev)
                }
        }
+        platform_set_drvdata(pdev, NULL);
        kfree(data);
        return 0;
diff --git a/drivers/i2c/busses/i2c-eg20t.c b/drivers/i2c/busses/i2c-eg20t.c
index 2e067dd2ee51..50ea1f43bdc1 100644
--- a/drivers/i2c/busses/i2c-eg20t.c
+++ b/drivers/i2c/busses/i2c-eg20t.c
@@ -29,6 +29,7 @@
 #include <linux/pci.h>
 #include <linux/mutex.h>
 #include <linux/ktime.h>
+#include <linux/slab.h>
 #define PCH_EVENT_SET   0       /* I2C Interrupt Event Set Status */
 #define PCH_EVENT_NONE  1       /* I2C Interrupt Event Clear Status */
diff --git a/drivers/i2c/busses/i2c-ocores.c b/drivers/i2c/busses/i2c-ocores.c
index ef3bcb1ce864..61653f079671 100644
--- a/drivers/i2c/busses/i2c-ocores.c
+++ b/drivers/i2c/busses/i2c-ocores.c
@@ -249,7 +249,7 @@ static struct i2c_adapter ocores_adapter = {
 static int ocores_i2c_of_probe(struct platform_device* pdev,
                                struct ocores_i2c* i2c)
 {
-        __be32* val;
+        const __be32* val;
        val = of_get_property(pdev->dev.of_node, "regstep", NULL);
        if (!val) {
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index b605ff3a1fa0..58a58c7eaa17 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -378,9 +378,7 @@ static int omap_i2c_init(struct omap_i2c_dev *dev)
                         * REVISIT: Some wkup sources might not be needed.
                         */
                        dev->westate = OMAP_I2C_WE_ALL;
-                        if (dev->rev < OMAP_I2C_REV_ON_4430)
+                        omap_i2c_write_reg(dev, OMAP_I2C_WE_REG, dev->westate);
-                                omap_i2c_write_reg(dev, OMAP_I2C_WE_REG,
-                                                                dev->westate);
                }
        }
        omap_i2c_write_reg(dev, OMAP_I2C_CON_REG, 0);
@@ -847,11 +845,15 @@ complete:
                        dev_err(dev->dev, "Arbitration lost\n");
                        err |= OMAP_I2C_STAT_AL;
                }
+                /*
+                 * ProDB0017052: Clear ARDY bit twice
+                 */
                if (stat & (OMAP_I2C_STAT_ARDY | OMAP_I2C_STAT_NACK |
                                        OMAP_I2C_STAT_AL)) {
                        omap_i2c_ack_stat(dev, stat &
                                (OMAP_I2C_STAT_RRDY | OMAP_I2C_STAT_RDR |
-                                OMAP_I2C_STAT_XRDY | OMAP_I2C_STAT_XDR));
+                                OMAP_I2C_STAT_XRDY | OMAP_I2C_STAT_XDR |
+                                OMAP_I2C_STAT_ARDY));
                        omap_i2c_complete_cmd(dev, err);
                        return IRQ_HANDLED;
                }
@@ -1137,12 +1139,41 @@ omap_i2c_remove(struct platform_device *pdev)
        return 0;
 }
+#ifdef CONFIG_SUSPEND
+static int omap_i2c_suspend(struct device *dev)
+{
+        if (!pm_runtime_suspended(dev))
+                if (dev->bus && dev->bus->pm && dev->bus->pm->runtime_suspend)
+                        dev->bus->pm->runtime_suspend(dev);
+        return 0;
+}
+static int omap_i2c_resume(struct device *dev)
+{
+        if (!pm_runtime_suspended(dev))
+                if (dev->bus && dev->bus->pm && dev->bus->pm->runtime_resume)
+                        dev->bus->pm->runtime_resume(dev);
+        return 0;
+}
+static struct dev_pm_ops omap_i2c_pm_ops = {
+        .suspend = omap_i2c_suspend,
+        .resume = omap_i2c_resume,
+};
+#define OMAP_I2C_PM_OPS (&omap_i2c_pm_ops)
+#else
+#define OMAP_I2C_PM_OPS NULL
+#endif
 static struct platform_driver omap_i2c_driver = {
        .probe          = omap_i2c_probe,
        .remove         = omap_i2c_remove,
        .driver         = {
                .name   = "omap_i2c",
                .owner  = THIS_MODULE,
+                .pm     = OMAP_I2C_PM_OPS,
        },
 };
diff --git a/drivers/i2c/busses/i2c-stu300.c b/drivers/i2c/busses/i2c-stu300.c
index 495be451d326..266135ddf7fa 100644
--- a/drivers/i2c/busses/i2c-stu300.c
+++ b/drivers/i2c/busses/i2c-stu300.c
@@ -942,7 +942,7 @@ stu300_probe(struct platform_device *pdev)
        adap->owner = THIS_MODULE;
        /* DDC class but actually often used for more generic I2C */
        adap->class = I2C_CLASS_DDC;
-        strncpy(adap->name, "ST Microelectronics DDC I2C adapter",
+        strlcpy(adap->name, "ST Microelectronics DDC I2C adapter",
                sizeof(adap->name));
        adap->nr = bus_nr;
        adap->algo = &stu300_algo;
diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
index 1fa091e05690..4a5c4a44ffb1 100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -62,6 +62,7 @@
 #include <linux/notifier.h>
 #include <linux/cpu.h>
 #include <asm/mwait.h>
+#include <asm/msr.h>
 #define INTEL_IDLE_VERSION "0.4"
 #define PREFIX "intel_idle: "
@@ -85,6 +86,12 @@ static int intel_idle(struct cpuidle_device *dev, struct cpuidle_state *state);
 static struct cpuidle_state *cpuidle_state_table;
 /*
+ * Hardware C-state auto-demotion may not always be optimal.
+ * Indicate which enable bits to clear here.
+ */
+static unsigned long long auto_demotion_disable_flags;
+/*
 * Set this flag for states where the HW flushes the TLB for us
 * and so we don't need cross-calls to keep it consistent.
 * If this flag is set, SW flushes the TLB, so even if the
@@ -281,6 +288,15 @@ static struct notifier_block setup_broadcast_notifier = {
        .notifier_call = setup_broadcast_cpuhp_notify,
 };
+static void auto_demotion_disable(void *dummy)
+{
+        unsigned long long msr_bits;
+        rdmsrl(MSR_NHM_SNB_PKG_CST_CFG_CTL, msr_bits);
+        msr_bits &= ~auto_demotion_disable_flags;
+        wrmsrl(MSR_NHM_SNB_PKG_CST_CFG_CTL, msr_bits);
+}
 /*
 * intel_idle_probe()
 */
@@ -324,11 +340,17 @@ static int intel_idle_probe(void)
        case 0x25:      /* Westmere */
        case 0x2C:      /* Westmere */
                cpuidle_state_table = nehalem_cstates;
+                auto_demotion_disable_flags =
+                        (NHM_C1_AUTO_DEMOTE | NHM_C3_AUTO_DEMOTE);
                break;
        case 0x1C:      /* 28 - Atom Processor */
+                cpuidle_state_table = atom_cstates;
+                break;
        case 0x26:      /* 38 - Lincroft Atom Processor */
                cpuidle_state_table = atom_cstates;
+                auto_demotion_disable_flags = ATM_LNC_C6_AUTO_DEMOTE;
                break;
        case 0x2A:      /* SNB */
@@ -436,6 +458,8 @@ static int intel_idle_cpuidle_devices_init(void)
                        return -EIO;
                }
        }
+        if (auto_demotion_disable_flags)
+                smp_call_function(auto_demotion_disable, NULL, 1);
        return 0;
 }
diff --git a/drivers/input/gameport/gameport.c b/drivers/input/gameport/gameport.c
index 23cf8fc933ec..5b8f59d6c3e8 100644
--- a/drivers/input/gameport/gameport.c
+++ b/drivers/input/gameport/gameport.c
@@ -360,7 +360,7 @@ static int gameport_queue_event(void *object, struct module *owner,
        event->owner = owner;
        list_add_tail(&event->node, &gameport_event_list);
-        schedule_work(&gameport_event_work);
+        queue_work(system_long_wq, &gameport_event_work);
 out:
        spin_unlock_irqrestore(&gameport_event_lock, flags);
diff --git a/drivers/input/keyboard/tegra-kbc.c b/drivers/input/keyboard/tegra-kbc.c
index ac471b77c18e..99ce9032d08c 100644
--- a/drivers/input/keyboard/tegra-kbc.c
+++ b/drivers/input/keyboard/tegra-kbc.c
@@ -71,8 +71,9 @@ struct tegra_kbc {
        spinlock_t lock;
        unsigned int repoll_dly;
        unsigned long cp_dly_jiffies;
+        bool use_fn_map;
        const struct tegra_kbc_platform_data *pdata;
-        unsigned short keycode[KBC_MAX_KEY];
+        unsigned short keycode[KBC_MAX_KEY * 2];
        unsigned short current_keys[KBC_MAX_KPENT];
        unsigned int num_pressed_keys;
        struct timer_list timer;
@@ -178,6 +179,40 @@ static const u32 tegra_kbc_default_keymap[] = {
        KEY(15, 5, KEY_F2),
        KEY(15, 6, KEY_CAPSLOCK),
        KEY(15, 7, KEY_F6),
+        /* Software Handled Function Keys */
+        KEY(20, 0, KEY_KP7),
+        KEY(21, 0, KEY_KP9),
+        KEY(21, 1, KEY_KP8),
+        KEY(21, 2, KEY_KP4),
+        KEY(21, 4, KEY_KP1),
+        KEY(22, 1, KEY_KPSLASH),
+        KEY(22, 2, KEY_KP6),
+        KEY(22, 3, KEY_KP5),
+        KEY(22, 4, KEY_KP3),
+        KEY(22, 5, KEY_KP2),
+        KEY(22, 7, KEY_KP0),
+        KEY(27, 1, KEY_KPASTERISK),
+        KEY(27, 3, KEY_KPMINUS),
+        KEY(27, 4, KEY_KPPLUS),
+        KEY(27, 5, KEY_KPDOT),
+        KEY(28, 5, KEY_VOLUMEUP),
+        KEY(29, 3, KEY_HOME),
+        KEY(29, 4, KEY_END),
+        KEY(29, 5, KEY_BRIGHTNESSDOWN),
+        KEY(29, 6, KEY_VOLUMEDOWN),
+        KEY(29, 7, KEY_BRIGHTNESSUP),
+        KEY(30, 0, KEY_NUMLOCK),
+        KEY(30, 1, KEY_SCROLLLOCK),
+        KEY(30, 2, KEY_MUTE),
+        KEY(31, 4, KEY_HELP),
 };
 static const struct matrix_keymap_data tegra_kbc_default_keymap_data = {
@@ -224,6 +259,7 @@ static void tegra_kbc_report_keys(struct tegra_kbc *kbc)
        unsigned int i;
        unsigned int num_down = 0;
        unsigned long flags;
+        bool fn_keypress = false;
        spin_lock_irqsave(&kbc->lock, flags);
        for (i = 0; i < KBC_MAX_KPENT; i++) {
@@ -237,11 +273,28 @@ static void tegra_kbc_report_keys(struct tegra_kbc *kbc)
                                MATRIX_SCAN_CODE(row, col, KBC_ROW_SHIFT);
                        scancodes[num_down] = scancode;
-                        keycodes[num_down++] = kbc->keycode[scancode];
+                        keycodes[num_down] = kbc->keycode[scancode];
+                        /* If driver uses Fn map, do not report the Fn key. */
+                        if ((keycodes[num_down] == KEY_FN) && kbc->use_fn_map)
+                                fn_keypress = true;
+                        else
+                                num_down++;
                }
                val >>= 8;
        }
+        /*
+         * If the platform uses Fn keymaps, translate keys on a Fn keypress.
+         * Function keycodes are KBC_MAX_KEY apart from the plain keycodes.
+         */
+        if (fn_keypress) {
+                for (i = 0; i < num_down; i++) {
+                        scancodes[i] += KBC_MAX_KEY;
+                        keycodes[i] = kbc->keycode[scancodes[i]];
+                }
+        }
        spin_unlock_irqrestore(&kbc->lock, flags);
        tegra_kbc_report_released_keys(kbc->idev,
@@ -594,8 +647,11 @@ static int __devinit tegra_kbc_probe(struct platform_device *pdev)
        input_dev->keycode = kbc->keycode;
        input_dev->keycodesize = sizeof(kbc->keycode[0]);
-        input_dev->keycodemax = ARRAY_SIZE(kbc->keycode);
+        input_dev->keycodemax = KBC_MAX_KEY;
+        if (pdata->use_fn_map)
+                input_dev->keycodemax *= 2;
+        kbc->use_fn_map = pdata->use_fn_map;
        keymap_data = pdata->keymap_data ?: &tegra_kbc_default_keymap_data;
        matrix_keypad_build_keymap(keymap_data, KBC_ROW_SHIFT,
                                   input_dev->keycode, input_dev->keybit);
diff --git a/drivers/input/mouse/synaptics.h b/drivers/input/mouse/synaptics.h
index 25e5d042a72c..7453938bf5ef 100644
--- a/drivers/input/mouse/synaptics.h
+++ b/drivers/input/mouse/synaptics.h
@@ -51,6 +51,29 @@
 #define SYN_EXT_CAP_REQUESTS(c)         (((c) & 0x700000) >> 20)
 #define SYN_CAP_MULTI_BUTTON_NO(ec)     (((ec) & 0x00f000) >> 12)
 #define SYN_CAP_PRODUCT_ID(ec)          (((ec) & 0xff0000) >> 16)
+/*
+ * The following describes response for the 0x0c query.
+ *
+ * byte mask    name                    meaning
+ * ---- ----    -------                 ------------
+ * 1    0x01    adjustable threshold    capacitive button sensitivity
+ *                                      can be adjusted
+ * 1    0x02    report max              query 0x0d gives max coord reported
+ * 1    0x04    clearpad                sensor is ClearPad product
+ * 1    0x08    advanced gesture        not particularly meaningful
+ * 1    0x10    clickpad bit 0          1-button ClickPad
+ * 1    0x60    multifinger mode        identifies firmware finger counting
+ *                                      (not reporting!) algorithm.
+ *                                      Not particularly meaningful
+ * 1    0x80    covered pad             W clipped to 14, 15 == pad mostly covered
+ * 2    0x01    clickpad bit 1          2-button ClickPad
+ * 2    0x02    deluxe LED controls     touchpad support LED commands
+ *                                      ala multimedia control bar
+ * 2    0x04    reduced filtering       firmware does less filtering on
+ *                                      position data, driver should watch
+ *                                      for noise.
+ */
 #define SYN_CAP_CLICKPAD(ex0c)          ((ex0c) & 0x100000) /* 1-button ClickPad */
 #define SYN_CAP_CLICKPAD2BTN(ex0c)      ((ex0c) & 0x000100) /* 2-button ClickPad */
 #define SYN_CAP_MAX_DIMENSIONS(ex0c)    ((ex0c) & 0x020000)
diff --git a/drivers/input/serio/serio.c b/drivers/input/serio/serio.c
index 7c38d1fbabf2..ba70058e2be3 100644
--- a/drivers/input/serio/serio.c
+++ b/drivers/input/serio/serio.c
@@ -299,7 +299,7 @@ static int serio_queue_event(void *object, struct module *owner,
        event->owner = owner;
        list_add_tail(&event->node, &serio_event_list);
-        schedule_work(&serio_event_work);
+        queue_work(system_long_wq, &serio_event_work);
 out:
        spin_unlock_irqrestore(&serio_event_lock, flags);
diff --git a/drivers/isdn/hardware/eicon/istream.c b/drivers/isdn/hardware/eicon/istream.c
index 18f8798442fa..7bd5baa547be 100644
--- a/drivers/isdn/hardware/eicon/istream.c
+++ b/drivers/isdn/hardware/eicon/istream.c
@@ -62,7 +62,7 @@ void diva_xdi_provide_istream_info (ADAPTER* a,
  stream interface.
  If synchronous service was requested, then function
  does return amount of data written to stream.
-  'final' does indicate that pice of data to be written is
+  'final' does indicate that piece of data to be written is
  final part of frame (necessary only by structured datatransfer)
  return  0 if zero lengh packet was written
  return -1 if stream is full
diff --git a/drivers/md/linear.c b/drivers/md/linear.c
index 8a2f767f26d8..0ed7f6bc2a7f 100644
--- a/drivers/md/linear.c
+++ b/drivers/md/linear.c
@@ -216,7 +216,6 @@ static int linear_run (mddev_t *mddev)
        if (md_check_no_bitmap(mddev))
                return -EINVAL;
-        mddev->queue->queue_lock = &mddev->queue->__queue_lock;
        conf = linear_conf(mddev, mddev->raid_disks);
        if (!conf)
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 0cc30ecda4c1..818313e277e7 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -553,6 +553,9 @@ static mddev_t * mddev_find(dev_t unit)
 {
        mddev_t *mddev, *new = NULL;
+        if (unit && MAJOR(unit) != MD_MAJOR)
+                unit &= ~((1<<MdpMinorShift)-1);
 retry:
        spin_lock(&all_mddevs_lock);
@@ -4138,10 +4141,10 @@ array_size_store(mddev_t *mddev, const char *buf, size_t len)
        }
        mddev->array_sectors = sectors;
-        set_capacity(mddev->gendisk, mddev->array_sectors);
+        if (mddev->pers) {
-        if (mddev->pers)
+                set_capacity(mddev->gendisk, mddev->array_sectors);
                revalidate_disk(mddev->gendisk);
+        }
        return len;
 }
@@ -4624,6 +4627,7 @@ static int do_md_run(mddev_t *mddev)
        }
        set_capacity(mddev->gendisk, mddev->array_sectors);
        revalidate_disk(mddev->gendisk);
+        mddev->changed = 1;
        kobject_uevent(&disk_to_dev(mddev->gendisk)->kobj, KOBJ_CHANGE);
 out:
        return err;
@@ -4712,6 +4716,7 @@ static void md_clean(mddev_t *mddev)
        mddev->sync_speed_min = mddev->sync_speed_max = 0;
        mddev->recovery = 0;
        mddev->in_sync = 0;
+        mddev->changed = 0;
        mddev->degraded = 0;
        mddev->safemode = 0;
        mddev->bitmap_info.offset = 0;
@@ -4827,6 +4832,7 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
                set_capacity(disk, 0);
                mutex_unlock(&mddev->open_mutex);
+                mddev->changed = 1;
                revalidate_disk(disk);
                if (mddev->ro)
@@ -6011,7 +6017,7 @@ static int md_open(struct block_device *bdev, fmode_t mode)
        atomic_inc(&mddev->openers);
        mutex_unlock(&mddev->open_mutex);
-        check_disk_size_change(mddev->gendisk, bdev);
+        check_disk_change(bdev);
 out:
        return err;
 }
@@ -6026,6 +6032,21 @@ static int md_release(struct gendisk *disk, fmode_t mode)
        return 0;
 }
+static int md_media_changed(struct gendisk *disk)
+{
+        mddev_t *mddev = disk->private_data;
+        return mddev->changed;
+}
+static int md_revalidate(struct gendisk *disk)
+{
+        mddev_t *mddev = disk->private_data;
+        mddev->changed = 0;
+        return 0;
+}
 static const struct block_device_operations md_fops =
 {
        .owner          = THIS_MODULE,
@@ -6036,6 +6057,8 @@ static const struct block_device_operations md_fops =
        .compat_ioctl   = md_compat_ioctl,
 #endif
        .getgeo         = md_getgeo,
+        .media_changed  = md_media_changed,
+        .revalidate_disk= md_revalidate,
 };
 static int md_thread(void * arg)
diff --git a/drivers/md/md.h b/drivers/md/md.h
index 7e90b8593b2a..12215d437fcc 100644
--- a/drivers/md/md.h
+++ b/drivers/md/md.h
@@ -274,6 +274,8 @@ struct mddev_s
        atomic_t                        active;         /* general refcount */
        atomic_t                        openers;        /* number of active opens */
+        int                             changed;        /* True if we might need to
+                                                         * reread partition info */
        int                             degraded;       /* whether md should consider
                                                         * adding a spare
                                                         */
diff --git a/drivers/md/multipath.c b/drivers/md/multipath.c
index 6d7ddf32ef2e..3a62d440e27b 100644
--- a/drivers/md/multipath.c
+++ b/drivers/md/multipath.c
@@ -435,7 +435,6 @@ static int multipath_run (mddev_t *mddev)
         * bookkeeping area. [whatever we allocate in multipath_run(),
         * should be freed in multipath_stop()]
         */
-        mddev->queue->queue_lock = &mddev->queue->__queue_lock;
        conf = kzalloc(sizeof(multipath_conf_t), GFP_KERNEL);
        mddev->private = conf;
diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index 637a96855edb..c0ac457f1218 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c
@@ -361,7 +361,6 @@ static int raid0_run(mddev_t *mddev)
        if (md_check_no_bitmap(mddev))
                return -EINVAL;
        blk_queue_max_hw_sectors(mddev->queue, mddev->chunk_sectors);
-        mddev->queue->queue_lock = &mddev->queue->__queue_lock;
        /* if private is not null, we are here after takeover */
        if (mddev->private == NULL) {
@@ -670,6 +669,7 @@ static void *raid0_takeover_raid1(mddev_t *mddev)
        mddev->new_layout = 0;
        mddev->new_chunk_sectors = 128; /* by default set chunk size to 64k */
        mddev->delta_disks = 1 - mddev->raid_disks;
+        mddev->raid_disks = 1;
        /* make sure it will be not marked as dirty */
        mddev->recovery_cp = MaxSector;
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index a23ffa397ba9..06cd712807d0 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -593,7 +593,10 @@ static int flush_pending_writes(conf_t *conf)
        if (conf->pending_bio_list.head) {
                struct bio *bio;
                bio = bio_list_get(&conf->pending_bio_list);
+                /* Only take the spinlock to quiet a warning */
+                spin_lock(conf->mddev->queue->queue_lock);
                blk_remove_plug(conf->mddev->queue);
+                spin_unlock(conf->mddev->queue->queue_lock);
                spin_unlock_irq(&conf->device_lock);
                /* flush any pending bitmap writes to
                 * disk before proceeding w/ I/O */
@@ -959,7 +962,7 @@ static int make_request(mddev_t *mddev, struct bio * bio)
                atomic_inc(&r1_bio->remaining);
                spin_lock_irqsave(&conf->device_lock, flags);
                bio_list_add(&conf->pending_bio_list, mbio);
-                blk_plug_device(mddev->queue);
+                blk_plug_device_unlocked(mddev->queue);
                spin_unlock_irqrestore(&conf->device_lock, flags);
        }
        r1_bio_write_done(r1_bio, bio->bi_vcnt, behind_pages, behind_pages != NULL);
@@ -2021,7 +2024,6 @@ static int run(mddev_t *mddev)
        if (IS_ERR(conf))
                return PTR_ERR(conf);
-        mddev->queue->queue_lock = &conf->device_lock;
        list_for_each_entry(rdev, &mddev->disks, same_set) {
                disk_stack_limits(mddev->gendisk, rdev->bdev,
                                  rdev->data_offset << 9);
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 3b607b28741b..747d061d8e05 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -662,7 +662,10 @@ static int flush_pending_writes(conf_t *conf)
        if (conf->pending_bio_list.head) {
                struct bio *bio;
                bio = bio_list_get(&conf->pending_bio_list);
+                /* Spinlock only taken to quiet a warning */
+                spin_lock(conf->mddev->queue->queue_lock);
                blk_remove_plug(conf->mddev->queue);
+                spin_unlock(conf->mddev->queue->queue_lock);
                spin_unlock_irq(&conf->device_lock);
                /* flush any pending bitmap writes to disk
                 * before proceeding w/ I/O */
@@ -971,7 +974,7 @@ static int make_request(mddev_t *mddev, struct bio * bio)
                atomic_inc(&r10_bio->remaining);
                spin_lock_irqsave(&conf->device_lock, flags);
                bio_list_add(&conf->pending_bio_list, mbio);
-                blk_plug_device(mddev->queue);
+                blk_plug_device_unlocked(mddev->queue);
                spin_unlock_irqrestore(&conf->device_lock, flags);
        }
@@ -2304,8 +2307,6 @@ static int run(mddev_t *mddev)
        if (!conf)
                goto out;
-        mddev->queue->queue_lock = &conf->device_lock;
        mddev->thread = conf->thread;
        conf->thread = NULL;
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 702812824195..78536fdbd87f 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -5204,7 +5204,6 @@ static int run(mddev_t *mddev)
                mddev->queue->backing_dev_info.congested_data = mddev;
                mddev->queue->backing_dev_info.congested_fn = raid5_congested;
-                mddev->queue->queue_lock = &conf->device_lock;
                mddev->queue->unplug_fn = raid5_unplug_queue;
                chunk_size = mddev->chunk_sectors << 9;
diff --git a/drivers/media/common/tuners/tda8290.c b/drivers/media/common/tuners/tda8290.c
index bc6a67768af1..8c4852114eeb 100644
--- a/drivers/media/common/tuners/tda8290.c
+++ b/drivers/media/common/tuners/tda8290.c
@@ -658,13 +658,13 @@ static int tda8290_probe(struct tuner_i2c_props *i2c_props)
 #define TDA8290_ID 0x89
        u8 reg = 0x1f, id;
        struct i2c_msg msg_read[] = {
-                { .addr = 0x4b, .flags = 0, .len = 1, .buf = &reg },
+                { .addr = i2c_props->addr, .flags = 0, .len = 1, .buf = &reg },
-                { .addr = 0x4b, .flags = I2C_M_RD, .len = 1, .buf = &id },
+                { .addr = i2c_props->addr, .flags = I2C_M_RD, .len = 1, .buf = &id },
        };
        /* detect tda8290 */
        if (i2c_transfer(i2c_props->adap, msg_read, 2) != 2) {
-                printk(KERN_WARNING "%s: tda8290 couldn't read register 0x%02x\n",
+                printk(KERN_WARNING "%s: couldn't read register 0x%02x\n",
                               __func__, reg);
                return -ENODEV;
        }
@@ -685,13 +685,13 @@ static int tda8295_probe(struct tuner_i2c_props *i2c_props)
 #define TDA8295C2_ID 0x8b
        u8 reg = 0x2f, id;
        struct i2c_msg msg_read[] = {
-                { .addr = 0x4b, .flags = 0, .len = 1, .buf = &reg },
+                { .addr = i2c_props->addr, .flags = 0, .len = 1, .buf = &reg },
-                { .addr = 0x4b, .flags = I2C_M_RD, .len = 1, .buf = &id },
+                { .addr = i2c_props->addr, .flags = I2C_M_RD, .len = 1, .buf = &id },
        };
-        /* detect tda8290 */
+        /* detect tda8295 */
        if (i2c_transfer(i2c_props->adap, msg_read, 2) != 2) {
-                printk(KERN_WARNING "%s: tda8290 couldn't read register 0x%02x\n",
+                printk(KERN_WARNING "%s: couldn't read register 0x%02x\n",
                               __func__, reg);
                return -ENODEV;
        }
diff --git a/drivers/media/dvb/dvb-usb/dib0700_devices.c b/drivers/media/dvb/dvb-usb/dib0700_devices.c
index defd83964ce2..193cdb77b76a 100644
--- a/drivers/media/dvb/dvb-usb/dib0700_devices.c
+++ b/drivers/media/dvb/dvb-usb/dib0700_devices.c
@@ -870,6 +870,23 @@ static int dib7070p_tuner_attach(struct dvb_usb_adapter *adap)
        return 0;
 }
+static int stk7700p_pid_filter(struct dvb_usb_adapter *adapter, int index,
+                u16 pid, int onoff)
+{
+        struct dib0700_state *st = adapter->dev->priv;
+        if (st->is_dib7000pc)
+                return dib7000p_pid_filter(adapter->fe, index, pid, onoff);
+        return dib7000m_pid_filter(adapter->fe, index, pid, onoff);
+}
+static int stk7700p_pid_filter_ctrl(struct dvb_usb_adapter *adapter, int onoff)
+{
+        struct dib0700_state *st = adapter->dev->priv;
+        if (st->is_dib7000pc)
+                return dib7000p_pid_filter_ctrl(adapter->fe, onoff);
+        return dib7000m_pid_filter_ctrl(adapter->fe, onoff);
+}
 static int stk70x0p_pid_filter(struct dvb_usb_adapter *adapter, int index, u16 pid, int onoff)
 {
    return dib7000p_pid_filter(adapter->fe, index, pid, onoff);
@@ -1875,8 +1892,8 @@ struct dvb_usb_device_properties dib0700_devices[] = {
                        {
                                .caps = DVB_USB_ADAP_HAS_PID_FILTER | DVB_USB_ADAP_PID_FILTER_CAN_BE_TURNED_OFF,
                                .pid_filter_count = 32,
-                                .pid_filter       = stk70x0p_pid_filter,
+                                .pid_filter       = stk7700p_pid_filter,
-                                .pid_filter_ctrl  = stk70x0p_pid_filter_ctrl,
+                                .pid_filter_ctrl  = stk7700p_pid_filter_ctrl,
                                .frontend_attach  = stk7700p_frontend_attach,
                                .tuner_attach     = stk7700p_tuner_attach,
diff --git a/drivers/media/dvb/dvb-usb/lmedm04.c b/drivers/media/dvb/dvb-usb/lmedm04.c
index 9eea4188303b..46ccd01a7696 100644
--- a/drivers/media/dvb/dvb-usb/lmedm04.c
+++ b/drivers/media/dvb/dvb-usb/lmedm04.c
@@ -659,7 +659,7 @@ static int lme2510_download_firmware(struct usb_device *dev,
 }
 /* Default firmware for LME2510C */
-const char lme_firmware[50] = "dvb-usb-lme2510c-s7395.fw";
+char lme_firmware[50] = "dvb-usb-lme2510c-s7395.fw";
 static void lme_coldreset(struct usb_device *dev)
 {
@@ -1006,7 +1006,7 @@ static struct dvb_usb_device_properties lme2510c_properties = {
        .caps = DVB_USB_IS_AN_I2C_ADAPTER,
        .usb_ctrl = DEVICE_SPECIFIC,
        .download_firmware = lme2510_download_firmware,
-        .firmware = lme_firmware,
+        .firmware = (const char *)&lme_firmware,
        .size_of_priv = sizeof(struct lme2510_state),
        .num_adapters = 1,
        .adapter = {
@@ -1109,5 +1109,5 @@ module_exit(lme2510_module_exit);
 MODULE_AUTHOR("Malcolm Priestley <tvboxspy@gmail.com>");
 MODULE_DESCRIPTION("LME2510(C) DVB-S USB2.0");
-MODULE_VERSION("1.74");
+MODULE_VERSION("1.75");
 MODULE_LICENSE("GPL");
diff --git a/drivers/media/dvb/frontends/dib7000m.c b/drivers/media/dvb/frontends/dib7000m.c
index c7f5ccf54aa5..289a79837f24 100644
--- a/drivers/media/dvb/frontends/dib7000m.c
+++ b/drivers/media/dvb/frontends/dib7000m.c
@@ -1285,6 +1285,25 @@ struct i2c_adapter * dib7000m_get_i2c_master(struct dvb_frontend *demod, enum di
 }
 EXPORT_SYMBOL(dib7000m_get_i2c_master);
+int dib7000m_pid_filter_ctrl(struct dvb_frontend *fe, u8 onoff)
+{
+        struct dib7000m_state *state = fe->demodulator_priv;
+        u16 val = dib7000m_read_word(state, 294 + state->reg_offs) & 0xffef;
+        val |= (onoff & 0x1) << 4;
+        dprintk("PID filter enabled %d", onoff);
+        return dib7000m_write_word(state, 294 + state->reg_offs, val);
+}
+EXPORT_SYMBOL(dib7000m_pid_filter_ctrl);
+int dib7000m_pid_filter(struct dvb_frontend *fe, u8 id, u16 pid, u8 onoff)
+{
+        struct dib7000m_state *state = fe->demodulator_priv;
+        dprintk("PID filter: index %x, PID %d, OnOff %d", id, pid, onoff);
+        return dib7000m_write_word(state, 300 + state->reg_offs + id,
+                        onoff ? (1 << 13) | pid : 0);
+}
+EXPORT_SYMBOL(dib7000m_pid_filter);
 #if 0
 /* used with some prototype boards */
 int dib7000m_i2c_enumeration(struct i2c_adapter *i2c, int no_of_demods,
diff --git a/drivers/media/dvb/frontends/dib7000m.h b/drivers/media/dvb/frontends/dib7000m.h
index 113819ce9f0d..81fcf2241c64 100644
--- a/drivers/media/dvb/frontends/dib7000m.h
+++ b/drivers/media/dvb/frontends/dib7000m.h
@@ -46,6 +46,8 @@ extern struct dvb_frontend *dib7000m_attach(struct i2c_adapter *i2c_adap,
 extern struct i2c_adapter *dib7000m_get_i2c_master(struct dvb_frontend *,
                                                   enum dibx000_i2c_interface,
                                                   int);
+extern int dib7000m_pid_filter(struct dvb_frontend *, u8 id, u16 pid, u8 onoff);
+extern int dib7000m_pid_filter_ctrl(struct dvb_frontend *fe, u8 onoff);
 #else
 static inline
 struct dvb_frontend *dib7000m_attach(struct i2c_adapter *i2c_adap,
@@ -63,6 +65,19 @@ struct i2c_adapter *dib7000m_get_i2c_master(struct dvb_frontend *demod,
        printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
        return NULL;
 }
+static inline int dib7000m_pid_filter(struct dvb_frontend *fe, u8 id,
+                                                u16 pid, u8 onoff)
+{
+        printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
+        return -ENODEV;
+}
+static inline int dib7000m_pid_filter_ctrl(struct dvb_frontend *fe,
+                                                uint8_t onoff)
+{
+        printk(KERN_WARNING "%s: driver disabled by Kconfig\n", __func__);
+        return -ENODEV;
+}
 #endif
 /* TODO
diff --git a/drivers/media/dvb/mantis/mantis_pci.c b/drivers/media/dvb/mantis/mantis_pci.c
index 59feeb84aec7..10a432a79d00 100644
--- a/drivers/media/dvb/mantis/mantis_pci.c
+++ b/drivers/media/dvb/mantis/mantis_pci.c
@@ -22,7 +22,6 @@
 #include <linux/moduleparam.h>
 #include <linux/kernel.h>
 #include <asm/io.h>
-#include <asm/pgtable.h>
 #include <asm/page.h>
 #include <linux/kmod.h>
 #include <linux/vmalloc.h>
diff --git a/drivers/media/rc/ir-raw.c b/drivers/media/rc/ir-raw.c
index 73230ff93b8a..01f258a2a57a 100644
--- a/drivers/media/rc/ir-raw.c
+++ b/drivers/media/rc/ir-raw.c
@@ -112,7 +112,7 @@ int ir_raw_event_store_edge(struct rc_dev *dev, enum raw_event_type type)
 {
        ktime_t                 now;
        s64                     delta; /* ns */
-        struct ir_raw_event     ev;
+        DEFINE_IR_RAW_EVENT(ev);
        int                     rc = 0;
        if (!dev->raw)
@@ -125,7 +125,6 @@ int ir_raw_event_store_edge(struct rc_dev *dev, enum raw_event_type type)
         * being called for the first time, note that delta can't
         * possibly be negative.
         */
-        ev.duration = 0;
        if (delta > IR_MAX_DURATION || !dev->raw->last_type)
                type |= IR_START_EVENT;
        else
diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c
index 6df0a4980645..e4f8eac7f717 100644
--- a/drivers/media/rc/mceusb.c
+++ b/drivers/media/rc/mceusb.c
@@ -148,6 +148,7 @@ enum mceusb_model_type {
        MCE_GEN2_TX_INV,
        POLARIS_EVK,
        CX_HYBRID_TV,
+        MULTIFUNCTION,
 };
 struct mceusb_model {
@@ -155,9 +156,10 @@ struct mceusb_model {
        u32 mce_gen2:1;
        u32 mce_gen3:1;
        u32 tx_mask_normal:1;
-        u32 is_polaris:1;
        u32 no_tx:1;
+        int ir_intfnum;
        const char *rc_map;     /* Allow specify a per-board map */
        const char *name;       /* per-board name */
 };
@@ -179,7 +181,6 @@ static const struct mceusb_model mceusb_model[] = {
                .tx_mask_normal = 1,
        },
        [POLARIS_EVK] = {
-                .is_polaris = 1,
                /*
                 * In fact, the EVK is shipped without
                 * remotes, but we should have something handy,
@@ -189,10 +190,13 @@ static const struct mceusb_model mceusb_model[] = {
                .name = "Conexant Hybrid TV (cx231xx) MCE IR",
        },
        [CX_HYBRID_TV] = {
-                .is_polaris = 1,
                .no_tx = 1, /* tx isn't wired up at all */
                .name = "Conexant Hybrid TV (cx231xx) MCE IR",
        },
+        [MULTIFUNCTION] = {
+                .mce_gen2 = 1,
+                .ir_intfnum = 2,
+        },
 };
 static struct usb_device_id mceusb_dev_table[] = {
@@ -216,8 +220,9 @@ static struct usb_device_id mceusb_dev_table[] = {
        { USB_DEVICE(VENDOR_PHILIPS, 0x206c) },
        /* Philips/Spinel plus IR transceiver for ASUS */
        { USB_DEVICE(VENDOR_PHILIPS, 0x2088) },
-        /* Realtek MCE IR Receiver */
+        /* Realtek MCE IR Receiver and card reader */
-        { USB_DEVICE(VENDOR_REALTEK, 0x0161) },
+        { USB_DEVICE(VENDOR_REALTEK, 0x0161),
+          .driver_info = MULTIFUNCTION },
        /* SMK/Toshiba G83C0004D410 */
        { USB_DEVICE(VENDOR_SMK, 0x031d),
          .driver_info = MCE_GEN2_TX_INV },
@@ -1101,7 +1106,7 @@ static int __devinit mceusb_dev_probe(struct usb_interface *intf,
        bool is_gen3;
        bool is_microsoft_gen1;
        bool tx_mask_normal;
-        bool is_polaris;
+        int ir_intfnum;
        dev_dbg(&intf->dev, "%s called\n", __func__);
@@ -1110,13 +1115,11 @@ static int __devinit mceusb_dev_probe(struct usb_interface *intf,
        is_gen3 = mceusb_model[model].mce_gen3;
        is_microsoft_gen1 = mceusb_model[model].mce_gen1;
        tx_mask_normal = mceusb_model[model].tx_mask_normal;
-        is_polaris = mceusb_model[model].is_polaris;
+        ir_intfnum = mceusb_model[model].ir_intfnum;
-        if (is_polaris) {
+        /* There are multi-function devices with non-IR interfaces */
-                /* Interface 0 is IR */
+        if (idesc->desc.bInterfaceNumber != ir_intfnum)
-                if (idesc->desc.bInterfaceNumber)
+                return -ENODEV;
-                        return -ENODEV;
-        }
        /* step through the endpoints to find first bulk in and out endpoint */
        for (i = 0; i < idesc->desc.bNumEndpoints; ++i) {
diff --git a/drivers/media/rc/nuvoton-cir.c b/drivers/media/rc/nuvoton-cir.c
index 273d9d674792..d4d64492a057 100644
--- a/drivers/media/rc/nuvoton-cir.c
+++ b/drivers/media/rc/nuvoton-cir.c
@@ -385,8 +385,9 @@ static void nvt_cir_regs_init(struct nvt_dev *nvt)
 static void nvt_cir_wake_regs_init(struct nvt_dev *nvt)
 {
-        /* set number of bytes needed for wake key comparison (default 67) */
+        /* set number of bytes needed for wake from s3 (default 65) */
-        nvt_cir_wake_reg_write(nvt, CIR_WAKE_FIFO_LEN, CIR_WAKE_FIFO_CMP_DEEP);
+        nvt_cir_wake_reg_write(nvt, CIR_WAKE_FIFO_CMP_BYTES,
+                               CIR_WAKE_FIFO_CMP_DEEP);
        /* set tolerance/variance allowed per byte during wake compare */
        nvt_cir_wake_reg_write(nvt, CIR_WAKE_CMP_TOLERANCE,
diff --git a/drivers/media/rc/nuvoton-cir.h b/drivers/media/rc/nuvoton-cir.h
index 1df82351cb03..048135eea702 100644
--- a/drivers/media/rc/nuvoton-cir.h
+++ b/drivers/media/rc/nuvoton-cir.h
@@ -305,8 +305,11 @@ struct nvt_dev {
 #define CIR_WAKE_IRFIFOSTS_RX_EMPTY     0x20
 #define CIR_WAKE_IRFIFOSTS_RX_FULL      0x10
-/* CIR Wake FIFO buffer is 67 bytes long */
+/*
-#define CIR_WAKE_FIFO_LEN               67
+ * The CIR Wake FIFO buffer is 67 bytes long, but the stock remote wakes
+ * the system comparing only 65 bytes (fails with this set to 67)
+ */
+#define CIR_WAKE_FIFO_CMP_BYTES         65
 /* CIR Wake byte comparison tolerance */
 #define CIR_WAKE_CMP_TOLERANCE          5
diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c
index 512a2f4ada0e..5b4422ef4e6d 100644
--- a/drivers/media/rc/rc-main.c
+++ b/drivers/media/rc/rc-main.c
@@ -850,7 +850,7 @@ static ssize_t store_protocols(struct device *device,
                        count++;
                } else {
                        for (i = 0; i < ARRAY_SIZE(proto_names); i++) {
-                                if (!strncasecmp(tmp, proto_names[i].name, strlen(proto_names[i].name))) {
+                                if (!strcasecmp(tmp, proto_names[i].name)) {
                                        tmp += strlen(proto_names[i].name);
                                        mask = proto_names[i].type;
                                        break;
diff --git a/drivers/media/video/au0828/au0828-video.c b/drivers/media/video/au0828/au0828-video.c
index e41e4ad5cc40..9c475c600fc9 100644
--- a/drivers/media/video/au0828/au0828-video.c
+++ b/drivers/media/video/au0828/au0828-video.c
@@ -1758,7 +1758,12 @@ static int vidioc_reqbufs(struct file *file, void *priv,
        if (rc < 0)
                return rc;
-        return videobuf_reqbufs(&fh->vb_vidq, rb);
+        if (fh->type == V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                rc = videobuf_reqbufs(&fh->vb_vidq, rb);
+        else if (fh->type == V4L2_BUF_TYPE_VBI_CAPTURE)
+                rc = videobuf_reqbufs(&fh->vb_vbiq, rb);
+        return rc;
 }
 static int vidioc_querybuf(struct file *file, void *priv,
@@ -1772,7 +1777,12 @@ static int vidioc_querybuf(struct file *file, void *priv,
        if (rc < 0)
                return rc;
-        return videobuf_querybuf(&fh->vb_vidq, b);
+        if (fh->type == V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                rc = videobuf_querybuf(&fh->vb_vidq, b);
+        else if (fh->type == V4L2_BUF_TYPE_VBI_CAPTURE)
+                rc = videobuf_querybuf(&fh->vb_vbiq, b);
+        return rc;
 }
 static int vidioc_qbuf(struct file *file, void *priv, struct v4l2_buffer *b)
@@ -1785,7 +1795,12 @@ static int vidioc_qbuf(struct file *file, void *priv, struct v4l2_buffer *b)
        if (rc < 0)
                return rc;
-        return videobuf_qbuf(&fh->vb_vidq, b);
+        if (fh->type == V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                rc = videobuf_qbuf(&fh->vb_vidq, b);
+        else if (fh->type == V4L2_BUF_TYPE_VBI_CAPTURE)
+                rc = videobuf_qbuf(&fh->vb_vbiq, b);
+        return rc;
 }
 static int vidioc_dqbuf(struct file *file, void *priv, struct v4l2_buffer *b)
@@ -1806,7 +1821,12 @@ static int vidioc_dqbuf(struct file *file, void *priv, struct v4l2_buffer *b)
                dev->greenscreen_detected = 0;
        }
-        return videobuf_dqbuf(&fh->vb_vidq, b, file->f_flags & O_NONBLOCK);
+        if (fh->type == V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                rc = videobuf_dqbuf(&fh->vb_vidq, b, file->f_flags & O_NONBLOCK);
+        else if (fh->type == V4L2_BUF_TYPE_VBI_CAPTURE)
+                rc = videobuf_dqbuf(&fh->vb_vbiq, b, file->f_flags & O_NONBLOCK);
+        return rc;
 }
 static struct v4l2_file_operations au0828_v4l_fops = {
diff --git a/drivers/media/video/cx18/cx18-cards.c b/drivers/media/video/cx18/cx18-cards.c
index 87177733cf92..68ad1963f421 100644
--- a/drivers/media/video/cx18/cx18-cards.c
+++ b/drivers/media/video/cx18/cx18-cards.c
@@ -95,6 +95,53 @@ static const struct cx18_card cx18_card_hvr1600_esmt = {
        .i2c = &cx18_i2c_std,
 };
+static const struct cx18_card cx18_card_hvr1600_s5h1411 = {
+        .type = CX18_CARD_HVR_1600_S5H1411,
+        .name = "Hauppauge HVR-1600",
+        .comment = "Simultaneous Digital and Analog TV capture supported\n",
+        .v4l2_capabilities = CX18_CAP_ENCODER,
+        .hw_audio_ctrl = CX18_HW_418_AV,
+        .hw_muxer = CX18_HW_CS5345,
+        .hw_all = CX18_HW_TVEEPROM | CX18_HW_418_AV | CX18_HW_TUNER |
+                  CX18_HW_CS5345 | CX18_HW_DVB | CX18_HW_GPIO_RESET_CTRL |
+                  CX18_HW_Z8F0811_IR_HAUP,
+        .video_inputs = {
+                { CX18_CARD_INPUT_VID_TUNER,  0, CX18_AV_COMPOSITE7 },
+                { CX18_CARD_INPUT_SVIDEO1,    1, CX18_AV_SVIDEO1    },
+                { CX18_CARD_INPUT_COMPOSITE1, 1, CX18_AV_COMPOSITE3 },
+                { CX18_CARD_INPUT_SVIDEO2,    2, CX18_AV_SVIDEO2    },
+                { CX18_CARD_INPUT_COMPOSITE2, 2, CX18_AV_COMPOSITE4 },
+        },
+        .audio_inputs = {
+                { CX18_CARD_INPUT_AUD_TUNER,
+                  CX18_AV_AUDIO8, CS5345_IN_1 | CS5345_MCLK_1_5 },
+                { CX18_CARD_INPUT_LINE_IN1,
+                  CX18_AV_AUDIO_SERIAL1, CS5345_IN_2 },
+                { CX18_CARD_INPUT_LINE_IN2,
+                  CX18_AV_AUDIO_SERIAL1, CS5345_IN_3 },
+        },
+        .radio_input = { CX18_CARD_INPUT_AUD_TUNER,
+                         CX18_AV_AUDIO_SERIAL1, CS5345_IN_4 },
+        .ddr = {
+                /* ESMT M13S128324A-5B memory */
+                .chip_config = 0x003,
+                .refresh = 0x30c,
+                .timing1 = 0x44220e82,
+                .timing2 = 0x08,
+                .tune_lane = 0,
+                .initial_emrs = 0,
+        },
+        .gpio_init.initial_value = 0x3001,
+        .gpio_init.direction = 0x3001,
+        .gpio_i2c_slave_reset = {
+                .active_lo_mask = 0x3001,
+                .msecs_asserted = 10,
+                .msecs_recovery = 40,
+                .ir_reset_mask  = 0x0001,
+        },
+        .i2c = &cx18_i2c_std,
+};
 static const struct cx18_card cx18_card_hvr1600_samsung = {
        .type = CX18_CARD_HVR_1600_SAMSUNG,
        .name = "Hauppauge HVR-1600 (Preproduction)",
@@ -523,7 +570,8 @@ static const struct cx18_card *cx18_card_list[] = {
        &cx18_card_toshiba_qosmio_dvbt,
        &cx18_card_leadtek_pvr2100,
        &cx18_card_leadtek_dvr3100h,
-        &cx18_card_gotview_dvd3
+        &cx18_card_gotview_dvd3,
+        &cx18_card_hvr1600_s5h1411
 };
 const struct cx18_card *cx18_get_card(u16 index)
diff --git a/drivers/media/video/cx18/cx18-driver.c b/drivers/media/video/cx18/cx18-driver.c
index 944af8adbe0c..b1c3cbd92743 100644
--- a/drivers/media/video/cx18/cx18-driver.c
+++ b/drivers/media/video/cx18/cx18-driver.c
@@ -157,6 +157,7 @@ MODULE_PARM_DESC(cardtype,
                 "\t\t\t 7 = Leadtek WinFast PVR2100\n"
                 "\t\t\t 8 = Leadtek WinFast DVR3100 H\n"
                 "\t\t\t 9 = GoTView PCI DVD3 Hybrid\n"
+                 "\t\t\t 10 = Hauppauge HVR 1600 (S5H1411)\n"
                 "\t\t\t 0 = Autodetect (default)\n"
                 "\t\t\t-1 = Ignore this card\n\t\t");
 MODULE_PARM_DESC(pal, "Set PAL standard: B, G, H, D, K, I, M, N, Nc, 60");
@@ -337,6 +338,7 @@ void cx18_read_eeprom(struct cx18 *cx, struct tveeprom *tv)
        switch (cx->card->type) {
        case CX18_CARD_HVR_1600_ESMT:
        case CX18_CARD_HVR_1600_SAMSUNG:
+        case CX18_CARD_HVR_1600_S5H1411:
                tveeprom_hauppauge_analog(&c, tv, eedata);
                break;
        case CX18_CARD_YUAN_MPC718:
@@ -365,7 +367,25 @@ static void cx18_process_eeprom(struct cx18 *cx)
           from the model number. Use the cardtype module option if you
           have one of these preproduction models. */
        switch (tv.model) {
-        case 74000 ... 74999:
+        case 74301: /* Retail models */
+        case 74321:
+        case 74351: /* OEM models */
+        case 74361:
+                /* Digital side is s5h1411/tda18271 */
+                cx->card = cx18_get_card(CX18_CARD_HVR_1600_S5H1411);
+                break;
+        case 74021: /* Retail models */
+        case 74031:
+        case 74041:
+        case 74141:
+        case 74541: /* OEM models */
+        case 74551:
+        case 74591:
+        case 74651:
+        case 74691:
+        case 74751:
+        case 74891:
+                /* Digital side is s5h1409/mxl5005s */
                cx->card = cx18_get_card(CX18_CARD_HVR_1600_ESMT);
                break;
        case 0x718:
@@ -377,7 +397,8 @@ static void cx18_process_eeprom(struct cx18 *cx)
                CX18_ERR("Invalid EEPROM\n");
                return;
        default:
-                CX18_ERR("Unknown model %d, defaulting to HVR-1600\n", tv.model);
+                CX18_ERR("Unknown model %d, defaulting to original HVR-1600 "
+                         "(cardtype=1)\n", tv.model);
                cx->card = cx18_get_card(CX18_CARD_HVR_1600_ESMT);
                break;
        }
diff --git a/drivers/media/video/cx18/cx18-driver.h b/drivers/media/video/cx18/cx18-driver.h
index 306caac6d3fc..f736679d2517 100644
--- a/drivers/media/video/cx18/cx18-driver.h
+++ b/drivers/media/video/cx18/cx18-driver.h
@@ -85,7 +85,8 @@
 #define CX18_CARD_LEADTEK_PVR2100     6 /* Leadtek WinFast PVR2100 */
 #define CX18_CARD_LEADTEK_DVR3100H    7 /* Leadtek WinFast DVR3100 H */
 #define CX18_CARD_GOTVIEW_PCI_DVD3    8 /* GoTView PCI DVD3 Hybrid */
-#define CX18_CARD_LAST                8
+#define CX18_CARD_HVR_1600_S5H1411    9 /* Hauppauge HVR 1600 s5h1411/tda18271*/
+#define CX18_CARD_LAST                9
 #define CX18_ENC_STREAM_TYPE_MPG  0
 #define CX18_ENC_STREAM_TYPE_TS   1
diff --git a/drivers/media/video/cx18/cx18-dvb.c b/drivers/media/video/cx18/cx18-dvb.c
index f0381d62518d..f41922bd4020 100644
--- a/drivers/media/video/cx18/cx18-dvb.c
+++ b/drivers/media/video/cx18/cx18-dvb.c
@@ -29,6 +29,8 @@
 #include "cx18-gpio.h"
 #include "s5h1409.h"
 #include "mxl5005s.h"
+#include "s5h1411.h"
+#include "tda18271.h"
 #include "zl10353.h"
 #include <linux/firmware.h>
@@ -77,6 +79,32 @@ static struct s5h1409_config hauppauge_hvr1600_config = {
 };
 /*
+ * CX18_CARD_HVR_1600_S5H1411
+ */
+static struct s5h1411_config hcw_s5h1411_config = {
+        .output_mode   = S5H1411_SERIAL_OUTPUT,
+        .gpio          = S5H1411_GPIO_OFF,
+        .vsb_if        = S5H1411_IF_44000,
+        .qam_if        = S5H1411_IF_4000,
+        .inversion     = S5H1411_INVERSION_ON,
+        .status_mode   = S5H1411_DEMODLOCKING,
+        .mpeg_timing   = S5H1411_MPEGTIMING_CONTINOUS_NONINVERTING_CLOCK,
+};
+static struct tda18271_std_map hauppauge_tda18271_std_map = {
+        .atsc_6   = { .if_freq = 5380, .agc_mode = 3, .std = 3,
+                      .if_lvl = 6, .rfagc_top = 0x37 },
+        .qam_6    = { .if_freq = 4000, .agc_mode = 3, .std = 0,
+                      .if_lvl = 6, .rfagc_top = 0x37 },
+};
+static struct tda18271_config hauppauge_tda18271_config = {
+        .std_map = &hauppauge_tda18271_std_map,
+        .gate    = TDA18271_GATE_DIGITAL,
+        .output_opt = TDA18271_OUTPUT_LT_OFF,
+};
+/*
 * CX18_CARD_LEADTEK_DVR3100H
 */
 /* Information/confirmation of proper config values provided by Terry Wu */
@@ -244,6 +272,7 @@ static int cx18_dvb_start_feed(struct dvb_demux_feed *feed)
        switch (cx->card->type) {
        case CX18_CARD_HVR_1600_ESMT:
        case CX18_CARD_HVR_1600_SAMSUNG:
+        case CX18_CARD_HVR_1600_S5H1411:
                v = cx18_read_reg(cx, CX18_REG_DMUX_NUM_PORT_0_CONTROL);
                v |= 0x00400000; /* Serial Mode */
                v |= 0x00002000; /* Data Length - Byte */
@@ -455,6 +484,15 @@ static int dvb_register(struct cx18_stream *stream)
                        ret = 0;
                }
                break;
+        case CX18_CARD_HVR_1600_S5H1411:
+                dvb->fe = dvb_attach(s5h1411_attach,
+                                     &hcw_s5h1411_config,
+                                     &cx->i2c_adap[0]);
+                if (dvb->fe != NULL)
+                        dvb_attach(tda18271_attach, dvb->fe,
+                                   0x60, &cx->i2c_adap[0],
+                                   &hauppauge_tda18271_config);
+                break;
        case CX18_CARD_LEADTEK_DVR3100H:
                dvb->fe = dvb_attach(zl10353_attach,
                                     &leadtek_dvr3100h_demod,
diff --git a/drivers/media/video/cx23885/cx23885-i2c.c b/drivers/media/video/cx23885/cx23885-i2c.c
index ed3d8f55029b..307ff543c254 100644
--- a/drivers/media/video/cx23885/cx23885-i2c.c
+++ b/drivers/media/video/cx23885/cx23885-i2c.c
@@ -122,10 +122,6 @@ static int i2c_sendbytes(struct i2c_adapter *i2c_adap,
        if (!i2c_wait_done(i2c_adap))
                goto eio;
-        if (!i2c_slave_did_ack(i2c_adap)) {
-                retval = -ENXIO;
-                goto err;
-        }
        if (i2c_debug) {
                printk(" <W %02x %02x", msg->addr << 1, msg->buf[0]);
                if (!(ctrl & I2C_NOSTOP))
@@ -158,7 +154,6 @@ static int i2c_sendbytes(struct i2c_adapter *i2c_adap,
 eio:
        retval = -EIO;
- err:
        if (i2c_debug)
                printk(KERN_ERR " ERR: %d\n", retval);
        return retval;
@@ -209,10 +204,6 @@ static int i2c_readbytes(struct i2c_adapter *i2c_adap,
                if (!i2c_wait_done(i2c_adap))
                        goto eio;
-                if (cnt == 0 && !i2c_slave_did_ack(i2c_adap)) {
-                        retval = -ENXIO;
-                        goto err;
-                }
                msg->buf[cnt] = cx_read(bus->reg_rdata) & 0xff;
                if (i2c_debug) {
                        dprintk(1, " %02x", msg->buf[cnt]);
@@ -224,7 +215,6 @@ static int i2c_readbytes(struct i2c_adapter *i2c_adap,
 eio:
        retval = -EIO;
- err:
        if (i2c_debug)
                printk(KERN_ERR " ERR: %d\n", retval);
        return retval;
diff --git a/drivers/media/video/cx25840/cx25840-core.c b/drivers/media/video/cx25840/cx25840-core.c
index 6fc09dd41b9d..35796e035247 100644
--- a/drivers/media/video/cx25840/cx25840-core.c
+++ b/drivers/media/video/cx25840/cx25840-core.c
@@ -2015,7 +2015,8 @@ static int cx25840_probe(struct i2c_client *client,
                kfree(state);
                return err;
        }
-        v4l2_ctrl_cluster(2, &state->volume);
+        if (!is_cx2583x(state))
+                v4l2_ctrl_cluster(2, &state->volume);
        v4l2_ctrl_handler_setup(&state->hdl);
        if (client->dev.platform_data) {
diff --git a/drivers/media/video/ivtv/ivtv-irq.c b/drivers/media/video/ivtv/ivtv-irq.c
index 9b4faf009196..9c29e964d400 100644
--- a/drivers/media/video/ivtv/ivtv-irq.c
+++ b/drivers/media/video/ivtv/ivtv-irq.c
@@ -628,22 +628,66 @@ static void ivtv_irq_enc_pio_complete(struct ivtv *itv)
 static void ivtv_irq_dma_err(struct ivtv *itv)
 {
        u32 data[CX2341X_MBOX_MAX_DATA];
+        u32 status;
        del_timer(&itv->dma_timer);
        ivtv_api_get_data(&itv->enc_mbox, IVTV_MBOX_DMA_END, 2, data);
+        status = read_reg(IVTV_REG_DMASTATUS);
        IVTV_DEBUG_WARN("DMA ERROR %08x %08x %08x %d\n", data[0], data[1],
-                                read_reg(IVTV_REG_DMASTATUS), itv->cur_dma_stream);
+                                status, itv->cur_dma_stream);
-        write_reg(read_reg(IVTV_REG_DMASTATUS) & 3, IVTV_REG_DMASTATUS);
+        /*
+         * We do *not* write back to the IVTV_REG_DMASTATUS register to
+         * clear the error status, if either the encoder write (0x02) or
+         * decoder read (0x01) bus master DMA operation do not indicate
+         * completed.  We can race with the DMA engine, which may have
+         * transitioned to completed status *after* we read the register.
+         * Setting a IVTV_REG_DMASTATUS flag back to "busy" status, after the
+         * DMA engine has completed, will cause the DMA engine to stop working.
+         */
+        status &= 0x3;
+        if (status == 0x3)
+                write_reg(status, IVTV_REG_DMASTATUS);
        if (!test_bit(IVTV_F_I_UDMA, &itv->i_flags) &&
            itv->cur_dma_stream >= 0 && itv->cur_dma_stream < IVTV_MAX_STREAMS) {
                struct ivtv_stream *s = &itv->streams[itv->cur_dma_stream];
-                /* retry */
+                if (s->type >= IVTV_DEC_STREAM_TYPE_MPG) {
-                if (s->type >= IVTV_DEC_STREAM_TYPE_MPG)
+                        /* retry */
+                        /*
+                         * FIXME - handle cases of DMA error similar to
+                         * encoder below, except conditioned on status & 0x1
+                         */
                        ivtv_dma_dec_start(s);
-                else
+                        return;
-                        ivtv_dma_enc_start(s);
+                } else {
-                return;
+                        if ((status & 0x2) == 0) {
+                                /*
+                                 * CX2341x Bus Master DMA write is ongoing.
+                                 * Reset the timer and let it complete.
+                                 */
+                                itv->dma_timer.expires =
+                                                jiffies + msecs_to_jiffies(600);
+                                add_timer(&itv->dma_timer);
+                                return;
+                        }
+                        if (itv->dma_retries < 3) {
+                                /*
+                                 * CX2341x Bus Master DMA write has ended.
+                                 * Retry the write, starting with the first
+                                 * xfer segment. Just retrying the current
+                                 * segment is not sufficient.
+                                 */
+                                s->sg_processed = 0;
+                                itv->dma_retries++;
+                                ivtv_dma_enc_start_xfer(s);
+                                return;
+                        }
+                        /* Too many retries, give up on this one */
+                }
        }
        if (test_bit(IVTV_F_I_UDMA, &itv->i_flags)) {
                ivtv_udma_start(itv);
diff --git a/drivers/media/video/mem2mem_testdev.c b/drivers/media/video/mem2mem_testdev.c
index c179041d91f8..e7e717800ee2 100644
--- a/drivers/media/video/mem2mem_testdev.c
+++ b/drivers/media/video/mem2mem_testdev.c
@@ -1011,7 +1011,6 @@ static int m2mtest_remove(struct platform_device *pdev)
        v4l2_m2m_release(dev->m2m_dev);
        del_timer_sync(&dev->timer);
        video_unregister_device(dev->vfd);
-        video_device_release(dev->vfd);
        v4l2_device_unregister(&dev->v4l2_dev);
        kfree(dev);
diff --git a/drivers/media/video/s2255drv.c b/drivers/media/video/s2255drv.c
index b63f8cafa671..561909b65ce6 100644
--- a/drivers/media/video/s2255drv.c
+++ b/drivers/media/video/s2255drv.c
@@ -57,7 +57,7 @@
 #include <linux/usb.h>
 #define S2255_MAJOR_VERSION     1
-#define S2255_MINOR_VERSION     20
+#define S2255_MINOR_VERSION     21
 #define S2255_RELEASE           0
 #define S2255_VERSION           KERNEL_VERSION(S2255_MAJOR_VERSION, \
                                               S2255_MINOR_VERSION, \
@@ -312,9 +312,9 @@ struct s2255_fh {
 };
 /* current cypress EEPROM firmware version */
-#define S2255_CUR_USB_FWVER     ((3 << 8) | 6)
+#define S2255_CUR_USB_FWVER     ((3 << 8) | 11)
 /* current DSP FW version */
-#define S2255_CUR_DSP_FWVER     8
+#define S2255_CUR_DSP_FWVER     10102
 /* Need DSP version 5+ for video status feature */
 #define S2255_MIN_DSP_STATUS      5
 #define S2255_MIN_DSP_COLORFILTER 8
@@ -492,9 +492,11 @@ static void planar422p_to_yuv_packed(const unsigned char *in,
 static void s2255_reset_dsppower(struct s2255_dev *dev)
 {
-        s2255_vendor_req(dev, 0x40, 0x0b0b, 0x0b0b, NULL, 0, 1);
+        s2255_vendor_req(dev, 0x40, 0x0b0b, 0x0b01, NULL, 0, 1);
        msleep(10);
        s2255_vendor_req(dev, 0x50, 0x0000, 0x0000, NULL, 0, 1);
+        msleep(600);
+        s2255_vendor_req(dev, 0x10, 0x0000, 0x0000, NULL, 0, 1);
        return;
 }
diff --git a/drivers/mfd/asic3.c b/drivers/mfd/asic3.c
index 6a1f94042612..c45e6305b26f 100644
--- a/drivers/mfd/asic3.c
+++ b/drivers/mfd/asic3.c
@@ -143,9 +143,9 @@ static void asic3_irq_demux(unsigned int irq, struct irq_desc *desc)
        unsigned long flags;
        struct asic3 *asic;
-        desc->chip->ack(irq);
+        desc->irq_data.chip->irq_ack(&desc->irq_data);
-        asic = desc->handler_data;
+        asic = get_irq_data(irq);
        for (iter = 0 ; iter < MAX_ASIC_ISR_LOOPS; iter++) {
                u32 status;
diff --git a/drivers/mfd/davinci_voicecodec.c b/drivers/mfd/davinci_voicecodec.c
index 33c923d215c7..fdd8a1b8bc67 100644
--- a/drivers/mfd/davinci_voicecodec.c
+++ b/drivers/mfd/davinci_voicecodec.c
@@ -118,12 +118,12 @@ static int __init davinci_vc_probe(struct platform_device *pdev)
        /* Voice codec interface client */
        cell = &davinci_vc->cells[DAVINCI_VC_VCIF_CELL];
-        cell->name = "davinci_vcif";
+        cell->name = "davinci-vcif";
        cell->driver_data = davinci_vc;
        /* Voice codec CQ93VC client */
        cell = &davinci_vc->cells[DAVINCI_VC_CQ93VC_CELL];
-        cell->name = "cq93vc";
+        cell->name = "cq93vc-codec";
        cell->driver_data = davinci_vc;
        ret = mfd_add_devices(&pdev->dev, pdev->id, davinci_vc->cells,
diff --git a/drivers/mfd/tps6586x.c b/drivers/mfd/tps6586x.c
index 627cf577b16d..e9018d1394ee 100644
--- a/drivers/mfd/tps6586x.c
+++ b/drivers/mfd/tps6586x.c
@@ -150,12 +150,12 @@ static inline int __tps6586x_write(struct i2c_client *client,
 static inline int __tps6586x_writes(struct i2c_client *client, int reg,
                                  int len, uint8_t *val)
 {
-        int ret;
+        int ret, i;
-        ret = i2c_smbus_write_i2c_block_data(client, reg, len, val);
+        for (i = 0; i < len; i++) {
-        if (ret < 0) {
+                ret = __tps6586x_write(client, reg + i, *(val + i));
-                dev_err(&client->dev, "failed writings to 0x%02x\n", reg);
+                if (ret < 0)
-                return ret;
+                        return ret;
        }
        return 0;
diff --git a/drivers/mfd/ucb1x00-ts.c b/drivers/mfd/ucb1x00-ts.c
index 000cb414a78a..92b85e28a15e 100644
--- a/drivers/mfd/ucb1x00-ts.c
+++ b/drivers/mfd/ucb1x00-ts.c
@@ -385,12 +385,18 @@ static int ucb1x00_ts_add(struct ucb1x00_dev *dev)
        idev->close      = ucb1x00_ts_close;
        __set_bit(EV_ABS, idev->evbit);
-        __set_bit(ABS_X, idev->absbit);
-        __set_bit(ABS_Y, idev->absbit);
-        __set_bit(ABS_PRESSURE, idev->absbit);
        input_set_drvdata(idev, ts);
+        ucb1x00_adc_enable(ts->ucb);
+        ts->x_res = ucb1x00_ts_read_xres(ts);
+        ts->y_res = ucb1x00_ts_read_yres(ts);
+        ucb1x00_adc_disable(ts->ucb);
+        input_set_abs_params(idev, ABS_X, 0, ts->x_res, 0, 0);
+        input_set_abs_params(idev, ABS_Y, 0, ts->y_res, 0, 0);
+        input_set_abs_params(idev, ABS_PRESSURE, 0, 0, 0, 0);
        err = input_register_device(idev);
        if (err)
                goto fail;
diff --git a/drivers/mfd/wm8994-core.c b/drivers/mfd/wm8994-core.c
index 41233c7fa581..f4016a075fd6 100644
--- a/drivers/mfd/wm8994-core.c
+++ b/drivers/mfd/wm8994-core.c
@@ -246,6 +246,16 @@ static int wm8994_suspend(struct device *dev)
        struct wm8994 *wm8994 = dev_get_drvdata(dev);
        int ret;
+        /* Don't actually go through with the suspend if the CODEC is
+         * still active (eg, for audio passthrough from CP. */
+        ret = wm8994_reg_read(wm8994, WM8994_POWER_MANAGEMENT_1);
+        if (ret < 0) {
+                dev_err(dev, "Failed to read power status: %d\n", ret);
+        } else if (ret & WM8994_VMID_SEL_MASK) {
+                dev_dbg(dev, "CODEC still active, ignoring suspend\n");
+                return 0;
+        }
        /* GPIO configuration state is saved here since we may be configuring
         * the GPIO alternate functions even if we're not using the gpiolib
         * driver for them.
@@ -261,6 +271,8 @@ static int wm8994_suspend(struct device *dev)
        if (ret < 0)
                dev_err(dev, "Failed to save LDO registers: %d\n", ret);
+        wm8994->suspended = true;
        ret = regulator_bulk_disable(wm8994->num_supplies,
                                     wm8994->supplies);
        if (ret != 0) {
@@ -276,6 +288,10 @@ static int wm8994_resume(struct device *dev)
        struct wm8994 *wm8994 = dev_get_drvdata(dev);
        int ret;
+        /* We may have lied to the PM core about suspending */
+        if (!wm8994->suspended)
+                return 0;
        ret = regulator_bulk_enable(wm8994->num_supplies,
                                    wm8994->supplies);
        if (ret != 0) {
@@ -298,6 +314,8 @@ static int wm8994_resume(struct device *dev)
        if (ret < 0)
                dev_err(dev, "Failed to restore GPIO registers: %d\n", ret);
+        wm8994->suspended = false;
        return 0;
 }
 #endif
diff --git a/drivers/misc/bmp085.c b/drivers/misc/bmp085.c
index 63ee4c1a5315..b6e1c9a6679e 100644
--- a/drivers/misc/bmp085.c
+++ b/drivers/misc/bmp085.c
@@ -449,6 +449,7 @@ static const struct i2c_device_id bmp085_id[] = {
        { "bmp085", 0 },
        { }
 };
+MODULE_DEVICE_TABLE(i2c, bmp085_id);
 static struct i2c_driver bmp085_driver = {
        .driver = {
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 6625c057be05..150b5f3cd401 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -1529,7 +1529,7 @@ void mmc_rescan(struct work_struct *work)
         * still present
         */
        if (host->bus_ops && host->bus_ops->detect && !host->bus_dead
-            && mmc_card_is_removable(host))
+            && !(host->caps & MMC_CAP_NONREMOVABLE))
                host->bus_ops->detect(host);
        /*
diff --git a/drivers/mmc/core/sdio.c b/drivers/mmc/core/sdio.c
index 5c4a54d9b6a4..ebc62ad4cc56 100644
--- a/drivers/mmc/core/sdio.c
+++ b/drivers/mmc/core/sdio.c
@@ -792,7 +792,6 @@ int mmc_attach_sdio(struct mmc_host *host)
         */
        mmc_release_host(host);
        err = mmc_add_card(host->card);
-        mmc_claim_host(host);
        if (err)
                goto remove_added;
@@ -805,12 +804,12 @@ int mmc_attach_sdio(struct mmc_host *host)
                        goto remove_added;
        }
+        mmc_claim_host(host);
        return 0;
 remove_added:
        /* Remove without lock if the device has been added. */
-        mmc_release_host(host);
        mmc_sdio_remove(host);
        mmc_claim_host(host);
 remove:
diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c
index a8c3e1c9b02a..4aaa88f8ab5f 100644
--- a/drivers/mtd/chips/cfi_cmdset_0001.c
+++ b/drivers/mtd/chips/cfi_cmdset_0001.c
@@ -1230,10 +1230,32 @@ static int inval_cache_and_wait_for_operation(
        sleep_time = chip_op_time / 2;
        for (;;) {
+                if (chip->state != chip_state) {
+                        /* Someone's suspended the operation: sleep */
+                        DECLARE_WAITQUEUE(wait, current);
+                        set_current_state(TASK_UNINTERRUPTIBLE);
+                        add_wait_queue(&chip->wq, &wait);
+                        mutex_unlock(&chip->mutex);
+                        schedule();
+                        remove_wait_queue(&chip->wq, &wait);
+                        mutex_lock(&chip->mutex);
+                        continue;
+                }
                status = map_read(map, cmd_adr);
                if (map_word_andequal(map, status, status_OK, status_OK))
                        break;
+                if (chip->erase_suspended && chip_state == FL_ERASING)  {
+                        /* Erase suspend occured while sleep: reset timeout */
+                        timeo = reset_timeo;
+                        chip->erase_suspended = 0;
+                }
+                if (chip->write_suspended && chip_state == FL_WRITING)  {
+                        /* Write suspend occured while sleep: reset timeout */
+                        timeo = reset_timeo;
+                        chip->write_suspended = 0;
+                }
                if (!timeo) {
                        map_write(map, CMD(0x70), cmd_adr);
                        chip->state = FL_STATUS;
@@ -1257,27 +1279,6 @@ static int inval_cache_and_wait_for_operation(
                        timeo--;
                }
                mutex_lock(&chip->mutex);
-                while (chip->state != chip_state) {
-                        /* Someone's suspended the operation: sleep */
-                        DECLARE_WAITQUEUE(wait, current);
-                        set_current_state(TASK_UNINTERRUPTIBLE);
-                        add_wait_queue(&chip->wq, &wait);
-                        mutex_unlock(&chip->mutex);
-                        schedule();
-                        remove_wait_queue(&chip->wq, &wait);
-                        mutex_lock(&chip->mutex);
-                }
-                if (chip->erase_suspended && chip_state == FL_ERASING)  {
-                        /* Erase suspend occured while sleep: reset timeout */
-                        timeo = reset_timeo;
-                        chip->erase_suspended = 0;
-                }
-                if (chip->write_suspended && chip_state == FL_WRITING)  {
-                        /* Write suspend occured while sleep: reset timeout */
-                        timeo = reset_timeo;
-                        chip->write_suspended = 0;
-                }
        }
        /* Done and happy. */
diff --git a/drivers/mtd/chips/jedec_probe.c b/drivers/mtd/chips/jedec_probe.c
index d72a5fb2d041..4e1be51cc122 100644
--- a/drivers/mtd/chips/jedec_probe.c
+++ b/drivers/mtd/chips/jedec_probe.c
@@ -1935,14 +1935,14 @@ static void jedec_reset(u32 base, struct map_info *map, struct cfi_private *cfi)
 }
-static int cfi_jedec_setup(struct cfi_private *p_cfi, int index)
+static int cfi_jedec_setup(struct map_info *map, struct cfi_private *cfi, int index)
 {
        int i,num_erase_regions;
        uint8_t uaddr;
-        if (! (jedec_table[index].devtypes & p_cfi->device_type)) {
+        if (!(jedec_table[index].devtypes & cfi->device_type)) {
                DEBUG(MTD_DEBUG_LEVEL1, "Rejecting potential %s with incompatible %d-bit device type\n",
-                      jedec_table[index].name, 4 * (1<<p_cfi->device_type));
+                      jedec_table[index].name, 4 * (1<<cfi->device_type));
                return 0;
        }
@@ -1950,27 +1950,28 @@ static int cfi_jedec_setup(struct cfi_private *p_cfi, int index)
        num_erase_regions = jedec_table[index].nr_regions;
-        p_cfi->cfiq = kmalloc(sizeof(struct cfi_ident) + num_erase_regions * 4, GFP_KERNEL);
+        cfi->cfiq = kmalloc(sizeof(struct cfi_ident) + num_erase_regions * 4, GFP_KERNEL);
-        if (!p_cfi->cfiq) {
+        if (!cfi->cfiq) {
                //xx printk(KERN_WARNING "%s: kmalloc failed for CFI ident structure\n", map->name);
                return 0;
        }
-        memset(p_cfi->cfiq,0,sizeof(struct cfi_ident));
+        memset(cfi->cfiq, 0, sizeof(struct cfi_ident));
-        p_cfi->cfiq->P_ID = jedec_table[index].cmd_set;
+        cfi->cfiq->P_ID = jedec_table[index].cmd_set;
-        p_cfi->cfiq->NumEraseRegions = jedec_table[index].nr_regions;
+        cfi->cfiq->NumEraseRegions = jedec_table[index].nr_regions;
-        p_cfi->cfiq->DevSize = jedec_table[index].dev_size;
+        cfi->cfiq->DevSize = jedec_table[index].dev_size;
-        p_cfi->cfi_mode = CFI_MODE_JEDEC;
+        cfi->cfi_mode = CFI_MODE_JEDEC;
+        cfi->sector_erase_cmd = CMD(0x30);
        for (i=0; i<num_erase_regions; i++){
-                p_cfi->cfiq->EraseRegionInfo[i] = jedec_table[index].regions[i];
+                cfi->cfiq->EraseRegionInfo[i] = jedec_table[index].regions[i];
        }
-        p_cfi->cmdset_priv = NULL;
+        cfi->cmdset_priv = NULL;
        /* This may be redundant for some cases, but it doesn't hurt */
-        p_cfi->mfr = jedec_table[index].mfr_id;
+        cfi->mfr = jedec_table[index].mfr_id;
-        p_cfi->id = jedec_table[index].dev_id;
+        cfi->id = jedec_table[index].dev_id;
        uaddr = jedec_table[index].uaddr;
@@ -1978,8 +1979,8 @@ static int cfi_jedec_setup(struct cfi_private *p_cfi, int index)
           our brains explode when we see the datasheets talking about address
           lines numbered from A-1 to A18. The CFI table has unlock addresses
           in device-words according to the mode the device is connected in */
-        p_cfi->addr_unlock1 = unlock_addrs[uaddr].addr1 / p_cfi->device_type;
+        cfi->addr_unlock1 = unlock_addrs[uaddr].addr1 / cfi->device_type;
-        p_cfi->addr_unlock2 = unlock_addrs[uaddr].addr2 / p_cfi->device_type;
+        cfi->addr_unlock2 = unlock_addrs[uaddr].addr2 / cfi->device_type;
        return 1;       /* ok */
 }
@@ -2175,7 +2176,7 @@ static int jedec_probe_chip(struct map_info *map, __u32 base,
                                       "MTD %s(): matched device 0x%x,0x%x unlock_addrs: 0x%.4x 0x%.4x\n",
                                       __func__, cfi->mfr, cfi->id,
                                       cfi->addr_unlock1, cfi->addr_unlock2 );
-                                if (!cfi_jedec_setup(cfi, i))
+                                if (!cfi_jedec_setup(map, cfi, i))
                                        return 0;
                                goto ok_out;
                        }
diff --git a/drivers/mtd/maps/amd76xrom.c b/drivers/mtd/maps/amd76xrom.c
index 77d64ce19e9f..92de7e3a49a5 100644
--- a/drivers/mtd/maps/amd76xrom.c
+++ b/drivers/mtd/maps/amd76xrom.c
@@ -151,6 +151,7 @@ static int __devinit amd76xrom_init_one (struct pci_dev *pdev,
                printk(KERN_ERR MOD_NAME
                       " %s(): Unable to register resource %pR - kernel bug?\n",
                       __func__, &window->rsrc);
+                return -EBUSY;
        }
diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
index cb20c67995d8..e0a2373bf0e2 100644
--- a/drivers/mtd/mtd_blkdevs.c
+++ b/drivers/mtd/mtd_blkdevs.c
@@ -413,7 +413,6 @@ error3:
 error2:
        list_del(&new->list);
 error1:
-        kfree(new);
        return ret;
 }
diff --git a/drivers/mtd/nand/omap2.c b/drivers/mtd/nand/omap2.c
index 15682ec8530e..28af71c61834 100644
--- a/drivers/mtd/nand/omap2.c
+++ b/drivers/mtd/nand/omap2.c
@@ -968,6 +968,6 @@ static void __exit omap_nand_exit(void)
 module_init(omap_nand_init);
 module_exit(omap_nand_exit);
-MODULE_ALIAS(DRIVER_NAME);
+MODULE_ALIAS("platform:" DRIVER_NAME);
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("Glue layer for NAND flash on TI OMAP boards");
diff --git a/drivers/mtd/onenand/generic.c b/drivers/mtd/onenand/generic.c
index e78914938c5c..ac08750748a3 100644
--- a/drivers/mtd/onenand/generic.c
+++ b/drivers/mtd/onenand/generic.c
@@ -131,7 +131,7 @@ static struct platform_driver generic_onenand_driver = {
        .remove         = __devexit_p(generic_onenand_remove),
 };
-MODULE_ALIAS(DRIVER_NAME);
+MODULE_ALIAS("platform:" DRIVER_NAME);
 static int __init generic_onenand_init(void)
 {
diff --git a/drivers/mtd/onenand/omap2.c b/drivers/mtd/onenand/omap2.c
index ac31f461cc1c..c849cacf4b2f 100644
--- a/drivers/mtd/onenand/omap2.c
+++ b/drivers/mtd/onenand/omap2.c
@@ -860,7 +860,7 @@ static void __exit omap2_onenand_exit(void)
 module_init(omap2_onenand_init);
 module_exit(omap2_onenand_exit);
-MODULE_ALIAS(DRIVER_NAME);
+MODULE_ALIAS("platform:" DRIVER_NAME);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Jarkko Lavinen <jarkko.lavinen@nokia.com>");
 MODULE_DESCRIPTION("Glue layer for OneNAND flash on OMAP2 / OMAP3");
diff --git a/drivers/net/ariadne.c b/drivers/net/ariadne.c
index 39214e512452..7ca0eded2561 100644
--- a/drivers/net/ariadne.c
+++ b/drivers/net/ariadne.c
@@ -425,11 +425,6 @@ static irqreturn_t ariadne_interrupt(int irq, void *data)
    int csr0, boguscnt;
    int handled = 0;
-    if (dev == NULL) {
-        printk(KERN_WARNING "ariadne_interrupt(): irq for unknown device.\n");
-        return IRQ_NONE;
-    }
    lance->RAP = CSR0;                  /* PCnet-ISA Controller Status */
    if (!(lance->RDP & INTR))           /* Check if any interrupt has been */
diff --git a/drivers/net/bnx2x/bnx2x.h b/drivers/net/bnx2x/bnx2x.h
index 653c62475cb6..8849699c66c4 100644
--- a/drivers/net/bnx2x/bnx2x.h
+++ b/drivers/net/bnx2x/bnx2x.h
@@ -22,7 +22,7 @@
 * (you will need to reboot afterwards) */
 /* #define BNX2X_STOP_ON_ERROR */
-#define DRV_MODULE_VERSION      "1.62.00-5"
+#define DRV_MODULE_VERSION      "1.62.00-6"
 #define DRV_MODULE_RELDATE      "2011/01/30"
 #define BNX2X_BC_VER            0x040200
@@ -1211,6 +1211,7 @@ struct bnx2x {
        /* DCBX Negotation results */
        struct dcbx_features                    dcbx_local_feat;
        u32                                     dcbx_error;
+        u32                                     pending_max;
 };
 /**
@@ -1613,19 +1614,23 @@ static inline u32 reg_poll(struct bnx2x *bp, u32 reg, u32 expected, int ms,
 #define BNX2X_BTR                       4
 #define MAX_SPQ_PENDING                 8
+/* CMNG constants, as derived from system spec calculations */
-/* CMNG constants
+/* default MIN rate in case VNIC min rate is configured to zero - 100Mbps */
-   derived from lab experiments, and not from system spec calculations !!! */
+#define DEF_MIN_RATE                                    100
-#define DEF_MIN_RATE                    100
+/* resolution of the rate shaping timer - 400 usec */
-/* resolution of the rate shaping timer - 100 usec */
+#define RS_PERIODIC_TIMEOUT_USEC                        400
-#define RS_PERIODIC_TIMEOUT_USEC        100
-/* resolution of fairness algorithm in usecs -
-   coefficient for calculating the actual t fair */
-#define T_FAIR_COEF                     10000000
 /* number of bytes in single QM arbitration cycle -
-   coefficient for calculating the fairness timer */
+ * coefficient for calculating the fairness timer */
-#define QM_ARB_BYTES                    40000
+#define QM_ARB_BYTES                                    160000
-#define FAIR_MEM                        2
+/* resolution of Min algorithm 1:100 */
+#define MIN_RES                                         100
+/* how many bytes above threshold for the minimal credit of Min algorithm*/
+#define MIN_ABOVE_THRESH                                32768
+/* Fairness algorithm integration time coefficient -
+ * for calculating the actual Tfair */
+#define T_FAIR_COEF     ((MIN_ABOVE_THRESH +  QM_ARB_BYTES) * 8 * MIN_RES)
+/* Memory of fairness algorithm . 2 cycles */
+#define FAIR_MEM                                        2
 #define ATTN_NIG_FOR_FUNC               (1L << 8)
diff --git a/drivers/net/bnx2x/bnx2x_cmn.c b/drivers/net/bnx2x/bnx2x_cmn.c
index 710ce5d04c53..a71b32940533 100644
--- a/drivers/net/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/bnx2x/bnx2x_cmn.c
@@ -259,10 +259,44 @@ static void bnx2x_tpa_start(struct bnx2x_fastpath *fp, u16 queue,
 #endif
 }
+/* Timestamp option length allowed for TPA aggregation:
+ *
+ *              nop nop kind length echo val
+ */
+#define TPA_TSTAMP_OPT_LEN      12
+/**
+ * Calculate the approximate value of the MSS for this
+ * aggregation using the first packet of it.
+ *
+ * @param bp
+ * @param parsing_flags Parsing flags from the START CQE
+ * @param len_on_bd Total length of the first packet for the
+ *                   aggregation.
+ */
+static inline u16 bnx2x_set_lro_mss(struct bnx2x *bp, u16 parsing_flags,
+                                    u16 len_on_bd)
+{
+        /* TPA arrgregation won't have an IP options and TCP options
+         * other than timestamp.
+         */
+        u16 hdrs_len = ETH_HLEN + sizeof(struct iphdr) + sizeof(struct tcphdr);
+        /* Check if there was a TCP timestamp, if there is it's will
+         * always be 12 bytes length: nop nop kind length echo val.
+         *
+         * Otherwise FW would close the aggregation.
+         */
+        if (parsing_flags & PARSING_FLAGS_TIME_STAMP_EXIST_FLAG)
+                hdrs_len += TPA_TSTAMP_OPT_LEN;
+        return len_on_bd - hdrs_len;
+}
 static int bnx2x_fill_frag_skb(struct bnx2x *bp, struct bnx2x_fastpath *fp,
                               struct sk_buff *skb,
                               struct eth_fast_path_rx_cqe *fp_cqe,
-                               u16 cqe_idx)
+                               u16 cqe_idx, u16 parsing_flags)
 {
        struct sw_rx_page *rx_pg, old_rx_pg;
        u16 len_on_bd = le16_to_cpu(fp_cqe->len_on_bd);
@@ -275,8 +309,8 @@ static int bnx2x_fill_frag_skb(struct bnx2x *bp, struct bnx2x_fastpath *fp,
        /* This is needed in order to enable forwarding support */
        if (frag_size)
-                skb_shinfo(skb)->gso_size = min((u32)SGE_PAGE_SIZE,
+                skb_shinfo(skb)->gso_size = bnx2x_set_lro_mss(bp, parsing_flags,
-                                               max(frag_size, (u32)len_on_bd));
+                                                              len_on_bd);
 #ifdef BNX2X_STOP_ON_ERROR
        if (pages > min_t(u32, 8, MAX_SKB_FRAGS)*SGE_PAGE_SIZE*PAGES_PER_SGE) {
@@ -344,6 +378,8 @@ static void bnx2x_tpa_stop(struct bnx2x *bp, struct bnx2x_fastpath *fp,
        if (likely(new_skb)) {
                /* fix ip xsum and give it to the stack */
                /* (no need to map the new skb) */
+                u16 parsing_flags =
+                        le16_to_cpu(cqe->fast_path_cqe.pars_flags.flags);
                prefetch(skb);
                prefetch(((char *)(skb)) + L1_CACHE_BYTES);
@@ -373,9 +409,9 @@ static void bnx2x_tpa_stop(struct bnx2x *bp, struct bnx2x_fastpath *fp,
                }
                if (!bnx2x_fill_frag_skb(bp, fp, skb,
-                                         &cqe->fast_path_cqe, cqe_idx)) {
+                                         &cqe->fast_path_cqe, cqe_idx,
-                        if ((le16_to_cpu(cqe->fast_path_cqe.
+                                         parsing_flags)) {
-                            pars_flags.flags) & PARSING_FLAGS_VLAN))
+                        if (parsing_flags & PARSING_FLAGS_VLAN)
                                __vlan_hwaccel_put_tag(skb,
                                                 le16_to_cpu(cqe->fast_path_cqe.
                                                             vlan_tag));
@@ -703,19 +739,20 @@ u16 bnx2x_get_mf_speed(struct bnx2x *bp)
 {
        u16 line_speed = bp->link_vars.line_speed;
        if (IS_MF(bp)) {
-                u16 maxCfg = (bp->mf_config[BP_VN(bp)] &
+                u16 maxCfg = bnx2x_extract_max_cfg(bp,
-                                                FUNC_MF_CFG_MAX_BW_MASK) >>
+                                                   bp->mf_config[BP_VN(bp)]);
-                                                FUNC_MF_CFG_MAX_BW_SHIFT;
-                /* Calculate the current MAX line speed limit for the DCC
+                /* Calculate the current MAX line speed limit for the MF
-                 * capable devices
+                 * devices
                 */
-                if (IS_MF_SD(bp)) {
+                if (IS_MF_SI(bp))
+                        line_speed = (line_speed * maxCfg) / 100;
+                else { /* SD mode */
                        u16 vn_max_rate = maxCfg * 100;
                        if (vn_max_rate < line_speed)
                                line_speed = vn_max_rate;
-                } else /* IS_MF_SI(bp)) */
+                }
-                        line_speed = (line_speed * maxCfg) / 100;
        }
        return line_speed;
@@ -959,6 +996,23 @@ void bnx2x_free_skbs(struct bnx2x *bp)
        bnx2x_free_rx_skbs(bp);
 }
+void bnx2x_update_max_mf_config(struct bnx2x *bp, u32 value)
+{
+        /* load old values */
+        u32 mf_cfg = bp->mf_config[BP_VN(bp)];
+        if (value != bnx2x_extract_max_cfg(bp, mf_cfg)) {
+                /* leave all but MAX value */
+                mf_cfg &= ~FUNC_MF_CFG_MAX_BW_MASK;
+                /* set new MAX value */
+                mf_cfg |= (value << FUNC_MF_CFG_MAX_BW_SHIFT)
+                                & FUNC_MF_CFG_MAX_BW_MASK;
+                bnx2x_fw_command(bp, DRV_MSG_CODE_SET_MF_BW, mf_cfg);
+        }
+}
 static void bnx2x_free_msix_irqs(struct bnx2x *bp)
 {
        int i, offset = 1;
@@ -1427,6 +1481,11 @@ int bnx2x_nic_load(struct bnx2x *bp, int load_mode)
        bnx2x_set_eth_mac(bp, 1);
+        if (bp->pending_max) {
+                bnx2x_update_max_mf_config(bp, bp->pending_max);
+                bp->pending_max = 0;
+        }
        if (bp->port.pmf)
                bnx2x_initial_phy_init(bp, load_mode);
diff --git a/drivers/net/bnx2x/bnx2x_cmn.h b/drivers/net/bnx2x/bnx2x_cmn.h
index 03eb4d68e6bb..85ea7f26b51f 100644
--- a/drivers/net/bnx2x/bnx2x_cmn.h
+++ b/drivers/net/bnx2x/bnx2x_cmn.h
@@ -341,6 +341,15 @@ void bnx2x_dcbx_init(struct bnx2x *bp);
 */
 int bnx2x_set_power_state(struct bnx2x *bp, pci_power_t state);
+/**
+ * Updates MAX part of MF configuration in HW
+ * (if required)
+ *
+ * @param bp
+ * @param value
+ */
+void bnx2x_update_max_mf_config(struct bnx2x *bp, u32 value);
 /* dev_close main block */
 int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode);
@@ -1044,4 +1053,24 @@ static inline void storm_memset_cmng(struct bnx2x *bp,
 void bnx2x_acquire_phy_lock(struct bnx2x *bp);
 void bnx2x_release_phy_lock(struct bnx2x *bp);
+/**
+ * Extracts MAX BW part from MF configuration.
+ *
+ * @param bp
+ * @param mf_cfg
+ *
+ * @return u16
+ */
+static inline u16 bnx2x_extract_max_cfg(struct bnx2x *bp, u32 mf_cfg)
+{
+        u16 max_cfg = (mf_cfg & FUNC_MF_CFG_MAX_BW_MASK) >>
+                              FUNC_MF_CFG_MAX_BW_SHIFT;
+        if (!max_cfg) {
+                BNX2X_ERR("Illegal configuration detected for Max BW - "
+                          "using 100 instead\n");
+                max_cfg = 100;
+        }
+        return max_cfg;
+}
 #endif /* BNX2X_CMN_H */
diff --git a/drivers/net/bnx2x/bnx2x_ethtool.c b/drivers/net/bnx2x/bnx2x_ethtool.c
index 5b44a8b48509..7e92f9d0dcfd 100644
--- a/drivers/net/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/bnx2x/bnx2x_ethtool.c
@@ -238,7 +238,7 @@ static int bnx2x_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
        speed |= (cmd->speed_hi << 16);
        if (IS_MF_SI(bp)) {
-                u32 param = 0;
+                u32 part;
                u32 line_speed = bp->link_vars.line_speed;
                /* use 10G if no link detected */
@@ -251,23 +251,22 @@ static int bnx2x_set_settings(struct net_device *dev, struct ethtool_cmd *cmd)
                                       REQ_BC_VER_4_SET_MF_BW);
                        return -EINVAL;
                }
-                if (line_speed < speed) {
-                        BNX2X_DEV_INFO("New speed should be less or equal "
+                part = (speed * 100) / line_speed;
-                                       "to actual line speed\n");
+                if (line_speed < speed || !part) {
+                        BNX2X_DEV_INFO("Speed setting should be in a range "
+                                       "from 1%% to 100%% "
+                                       "of actual line speed\n");
                        return -EINVAL;
                }
-                /* load old values */
-                param = bp->mf_config[BP_VN(bp)];
-                /* leave only MIN value */
-                param &= FUNC_MF_CFG_MIN_BW_MASK;
-                /* set new MAX value */
+                if (bp->state != BNX2X_STATE_OPEN)
-                param |= (((speed * 100) / line_speed)
+                        /* store value for following "load" */
-                                 << FUNC_MF_CFG_MAX_BW_SHIFT)
+                        bp->pending_max = part;
-                                  & FUNC_MF_CFG_MAX_BW_MASK;
+                else
+                        bnx2x_update_max_mf_config(bp, part);
-                bnx2x_fw_command(bp, DRV_MSG_CODE_SET_MF_BW, param);
                return 0;
        }
@@ -1781,9 +1780,7 @@ static int bnx2x_test_nvram(struct bnx2x *bp)
                { 0x100, 0x350 }, /* manuf_info */
                { 0x450,  0xf0 }, /* feature_info */
                { 0x640,  0x64 }, /* upgrade_key_info */
-                { 0x6a4,  0x64 },
                { 0x708,  0x70 }, /* manuf_key_info */
-                { 0x778,  0x70 },
                {     0,     0 }
        };
        __be32 buf[0x350 / 4];
@@ -1933,11 +1930,11 @@ static void bnx2x_self_test(struct net_device *dev,
                buf[4] = 1;
                etest->flags |= ETH_TEST_FL_FAILED;
        }
-        if (bp->port.pmf)
-                if (bnx2x_link_test(bp, is_serdes) != 0) {
+        if (bnx2x_link_test(bp, is_serdes) != 0) {
-                        buf[5] = 1;
+                buf[5] = 1;
-                        etest->flags |= ETH_TEST_FL_FAILED;
+                etest->flags |= ETH_TEST_FL_FAILED;
-                }
+        }
 #ifdef BNX2X_EXTRA_DEBUG
        bnx2x_panic_dump(bp);
diff --git a/drivers/net/bnx2x/bnx2x_init.h b/drivers/net/bnx2x/bnx2x_init.h
index 5a268e9a0895..fa6dbe3f2058 100644
--- a/drivers/net/bnx2x/bnx2x_init.h
+++ b/drivers/net/bnx2x/bnx2x_init.h
@@ -241,7 +241,7 @@ static const struct {
        /* Block IGU, MISC, PXP and PXP2 parity errors as long as we don't
         * want to handle "system kill" flow at the moment.
         */
-        BLOCK_PRTY_INFO(PXP, 0x3ffffff, 0x3ffffff, 0x3ffffff, 0x3ffffff),
+        BLOCK_PRTY_INFO(PXP, 0x7ffffff, 0x3ffffff, 0x3ffffff, 0x7ffffff),
        BLOCK_PRTY_INFO_0(PXP2, 0xffffffff, 0xffffffff, 0xffffffff, 0xffffffff),
        BLOCK_PRTY_INFO_1(PXP2, 0x7ff, 0x7f, 0x7f, 0x7ff),
        BLOCK_PRTY_INFO(HC, 0x7, 0x7, 0x7, 0),
diff --git a/drivers/net/bnx2x/bnx2x_main.c b/drivers/net/bnx2x/bnx2x_main.c
index d584d32c747d..aa032339e321 100644
--- a/drivers/net/bnx2x/bnx2x_main.c
+++ b/drivers/net/bnx2x/bnx2x_main.c
@@ -1974,13 +1974,22 @@ static void bnx2x_init_vn_minmax(struct bnx2x *bp, int vn)
                vn_max_rate = 0;
        } else {
+                u32 maxCfg = bnx2x_extract_max_cfg(bp, vn_cfg);
                vn_min_rate = ((vn_cfg & FUNC_MF_CFG_MIN_BW_MASK) >>
                                FUNC_MF_CFG_MIN_BW_SHIFT) * 100;
-                /* If min rate is zero - set it to 1 */
+                /* If fairness is enabled (not all min rates are zeroes) and
+                   if current min rate is zero - set it to 1.
+                   This is a requirement of the algorithm. */
                if (bp->vn_weight_sum && (vn_min_rate == 0))
                        vn_min_rate = DEF_MIN_RATE;
-                vn_max_rate = ((vn_cfg & FUNC_MF_CFG_MAX_BW_MASK) >>
-                                FUNC_MF_CFG_MAX_BW_SHIFT) * 100;
+                if (IS_MF_SI(bp))
+                        /* maxCfg in percents of linkspeed */
+                        vn_max_rate = (bp->link_vars.line_speed * maxCfg) / 100;
+                else
+                        /* maxCfg is absolute in 100Mb units */
+                        vn_max_rate = maxCfg * 100;
        }
        DP(NETIF_MSG_IFUP,
@@ -2006,7 +2015,8 @@ static void bnx2x_init_vn_minmax(struct bnx2x *bp, int vn)
                m_fair_vn.vn_credit_delta =
                        max_t(u32, (vn_min_rate * (T_FAIR_COEF /
                                                   (8 * bp->vn_weight_sum))),
-                              (bp->cmng.fair_vars.fair_threshold * 2));
+                              (bp->cmng.fair_vars.fair_threshold +
+                                                        MIN_ABOVE_THRESH));
                DP(NETIF_MSG_IFUP, "m_fair_vn.vn_credit_delta %d\n",
                   m_fair_vn.vn_credit_delta);
        }
@@ -2082,8 +2092,9 @@ static void bnx2x_cmng_fns_init(struct bnx2x *bp, u8 read_cfg, u8 cmng_type)
                bnx2x_calc_vn_weight_sum(bp);
                /* calculate and set min-max rate for each vn */
-                for (vn = VN_0; vn < E1HVN_MAX; vn++)
+                if (bp->port.pmf)
-                        bnx2x_init_vn_minmax(bp, vn);
+                        for (vn = VN_0; vn < E1HVN_MAX; vn++)
+                                bnx2x_init_vn_minmax(bp, vn);
                /* always enable rate shaping and fairness */
                bp->cmng.flags.cmng_enables |=
@@ -2152,13 +2163,6 @@ static void bnx2x_link_attn(struct bnx2x *bp)
                        bnx2x_stats_handle(bp, STATS_EVENT_LINK_UP);
        }
-        /* indicate link status only if link status actually changed */
-        if (prev_link_status != bp->link_vars.link_status)
-                bnx2x_link_report(bp);
-        if (IS_MF(bp))
-                bnx2x_link_sync_notify(bp);
        if (bp->link_vars.link_up && bp->link_vars.line_speed) {
                int cmng_fns = bnx2x_get_cmng_fns_mode(bp);
@@ -2170,6 +2174,13 @@ static void bnx2x_link_attn(struct bnx2x *bp)
                        DP(NETIF_MSG_IFUP,
                           "single function mode without fairness\n");
        }
+        if (IS_MF(bp))
+                bnx2x_link_sync_notify(bp);
+        /* indicate link status only if link status actually changed */
+        if (prev_link_status != bp->link_vars.link_status)
+                bnx2x_link_report(bp);
 }
 void bnx2x__link_status_update(struct bnx2x *bp)
diff --git a/drivers/net/bnx2x/bnx2x_stats.c b/drivers/net/bnx2x/bnx2x_stats.c
index bda60d590fa8..3445ded6674f 100644
--- a/drivers/net/bnx2x/bnx2x_stats.c
+++ b/drivers/net/bnx2x/bnx2x_stats.c
@@ -1239,14 +1239,14 @@ void bnx2x_stats_handle(struct bnx2x *bp, enum bnx2x_stats_event event)
        if (unlikely(bp->panic))
                return;
+        bnx2x_stats_stm[bp->stats_state][event].action(bp);
        /* Protect a state change flow */
        spin_lock_bh(&bp->stats_lock);
        state = bp->stats_state;
        bp->stats_state = bnx2x_stats_stm[state][event].next_state;
        spin_unlock_bh(&bp->stats_lock);
-        bnx2x_stats_stm[state][event].action(bp);
        if ((event != STATS_EVENT_UPDATE) || netif_msg_timer(bp))
                DP(BNX2X_MSG_STATS, "state %d -> event %d -> state %d\n",
                   state, event, bp->stats_state);
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index 1024ae158227..a5d5d0b5b155 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -281,23 +281,23 @@ static inline int __check_agg_selection_timer(struct port *port)
 }
 /**
- * __get_rx_machine_lock - lock the port's RX machine
+ * __get_state_machine_lock - lock the port's state machines
 * @port: the port we're looking at
 *
 */
-static inline void __get_rx_machine_lock(struct port *port)
+static inline void __get_state_machine_lock(struct port *port)
 {
-        spin_lock_bh(&(SLAVE_AD_INFO(port->slave).rx_machine_lock));
+        spin_lock_bh(&(SLAVE_AD_INFO(port->slave).state_machine_lock));
 }
 /**
- * __release_rx_machine_lock - unlock the port's RX machine
+ * __release_state_machine_lock - unlock the port's state machines
 * @port: the port we're looking at
 *
 */
-static inline void __release_rx_machine_lock(struct port *port)
+static inline void __release_state_machine_lock(struct port *port)
 {
-        spin_unlock_bh(&(SLAVE_AD_INFO(port->slave).rx_machine_lock));
+        spin_unlock_bh(&(SLAVE_AD_INFO(port->slave).state_machine_lock));
 }
 /**
@@ -388,14 +388,14 @@ static u8 __get_duplex(struct port *port)
 }
 /**
- * __initialize_port_locks - initialize a port's RX machine spinlock
+ * __initialize_port_locks - initialize a port's STATE machine spinlock
 * @port: the port we're looking at
 *
 */
 static inline void __initialize_port_locks(struct port *port)
 {
        // make sure it isn't called twice
-        spin_lock_init(&(SLAVE_AD_INFO(port->slave).rx_machine_lock));
+        spin_lock_init(&(SLAVE_AD_INFO(port->slave).state_machine_lock));
 }
 //conversions
@@ -1025,9 +1025,6 @@ static void ad_rx_machine(struct lacpdu *lacpdu, struct port *port)
 {
        rx_states_t last_state;
-        // Lock to prevent 2 instances of this function to run simultaneously(rx interrupt and periodic machine callback)
-        __get_rx_machine_lock(port);
        // keep current State Machine state to compare later if it was changed
        last_state = port->sm_rx_state;
@@ -1133,7 +1130,6 @@ static void ad_rx_machine(struct lacpdu *lacpdu, struct port *port)
                                pr_err("%s: An illegal loopback occurred on adapter (%s).\n"
                                       "Check the configuration to verify that all adapters are connected to 802.3ad compliant switch ports\n",
                                       port->slave->dev->master->name, port->slave->dev->name);
-                                __release_rx_machine_lock(port);
                                return;
                        }
                        __update_selected(lacpdu, port);
@@ -1153,7 +1149,6 @@ static void ad_rx_machine(struct lacpdu *lacpdu, struct port *port)
                        break;
                }
        }
-        __release_rx_machine_lock(port);
 }
 /**
@@ -2155,6 +2150,12 @@ void bond_3ad_state_machine_handler(struct work_struct *work)
                        goto re_arm;
                }
+                /* Lock around state machines to protect data accessed
+                 * by all (e.g., port->sm_vars).  ad_rx_machine may run
+                 * concurrently due to incoming LACPDU.
+                 */
+                __get_state_machine_lock(port);
                ad_rx_machine(NULL, port);
                ad_periodic_machine(port);
                ad_port_selection_logic(port);
@@ -2164,6 +2165,8 @@ void bond_3ad_state_machine_handler(struct work_struct *work)
                // turn off the BEGIN bit, since we already handled it
                if (port->sm_vars & AD_PORT_BEGIN)
                        port->sm_vars &= ~AD_PORT_BEGIN;
+                __release_state_machine_lock(port);
        }
 re_arm:
@@ -2200,7 +2203,10 @@ static void bond_3ad_rx_indication(struct lacpdu *lacpdu, struct slave *slave, u
                case AD_TYPE_LACPDU:
                        pr_debug("Received LACPDU on port %d\n",
                                 port->actor_port_number);
+                        /* Protect against concurrent state machines */
+                        __get_state_machine_lock(port);
                        ad_rx_machine(lacpdu, port);
+                        __release_state_machine_lock(port);
                        break;
                case AD_TYPE_MARKER:
diff --git a/drivers/net/bonding/bond_3ad.h b/drivers/net/bonding/bond_3ad.h
index 2c46a154f2c6..b28baff70864 100644
--- a/drivers/net/bonding/bond_3ad.h
+++ b/drivers/net/bonding/bond_3ad.h
@@ -264,7 +264,8 @@ struct ad_bond_info {
 struct ad_slave_info {
        struct aggregator aggregator;       // 802.3ad aggregator structure
        struct port port;                   // 802.3ad port structure
-        spinlock_t rx_machine_lock; // To avoid race condition between callback and receive interrupt
+        spinlock_t state_machine_lock; /* mutex state machines vs.
+                                          incoming LACPDU */
        u16 id;
 };
diff --git a/drivers/net/can/softing/softing_main.c b/drivers/net/can/softing/softing_main.c
index 5157e15e96eb..aeea9f9ff6e8 100644
--- a/drivers/net/can/softing/softing_main.c
+++ b/drivers/net/can/softing/softing_main.c
@@ -633,6 +633,7 @@ static const struct net_device_ops softing_netdev_ops = {
 };
 static const struct can_bittiming_const softing_btr_const = {
+        .name = "softing",
        .tseg1_min = 1,
        .tseg1_max = 16,
        .tseg2_min = 1,
diff --git a/drivers/net/cnic.c b/drivers/net/cnic.c
index 7ff170cbc7dc..302be4aa69d6 100644
--- a/drivers/net/cnic.c
+++ b/drivers/net/cnic.c
@@ -2760,6 +2760,8 @@ static u32 cnic_service_bnx2_queues(struct cnic_dev *dev)
        u32 status_idx = (u16) *cp->kcq1.status_idx_ptr;
        int kcqe_cnt;
+        /* status block index must be read before reading other fields */
+        rmb();
        cp->kwq_con_idx = *cp->kwq_con_idx_ptr;
        while ((kcqe_cnt = cnic_get_kcqes(dev, &cp->kcq1))) {
@@ -2770,6 +2772,8 @@ static u32 cnic_service_bnx2_queues(struct cnic_dev *dev)
                barrier();
                if (status_idx != *cp->kcq1.status_idx_ptr) {
                        status_idx = (u16) *cp->kcq1.status_idx_ptr;
+                        /* status block index must be read first */
+                        rmb();
                        cp->kwq_con_idx = *cp->kwq_con_idx_ptr;
                } else
                        break;
@@ -2888,6 +2892,8 @@ static u32 cnic_service_bnx2x_kcq(struct cnic_dev *dev, struct kcq_info *info)
        u32 last_status = *info->status_idx_ptr;
        int kcqe_cnt;
+        /* status block index must be read before reading the KCQ */
+        rmb();
        while ((kcqe_cnt = cnic_get_kcqes(dev, info))) {
                service_kcqes(dev, kcqe_cnt);
@@ -2898,6 +2904,8 @@ static u32 cnic_service_bnx2x_kcq(struct cnic_dev *dev, struct kcq_info *info)
                        break;
                last_status = *info->status_idx_ptr;
+                /* status block index must be read before reading the KCQ */
+                rmb();
        }
        return last_status;
 }
@@ -2906,26 +2914,35 @@ static void cnic_service_bnx2x_bh(unsigned long data)
 {
        struct cnic_dev *dev = (struct cnic_dev *) data;
        struct cnic_local *cp = dev->cnic_priv;
-        u32 status_idx;
+        u32 status_idx, new_status_idx;
        if (unlikely(!test_bit(CNIC_F_CNIC_UP, &dev->flags)))
                return;
-        status_idx = cnic_service_bnx2x_kcq(dev, &cp->kcq1);
+        while (1) {
+                status_idx = cnic_service_bnx2x_kcq(dev, &cp->kcq1);
-        CNIC_WR16(dev, cp->kcq1.io_addr, cp->kcq1.sw_prod_idx + MAX_KCQ_IDX);
+                CNIC_WR16(dev, cp->kcq1.io_addr,
+                          cp->kcq1.sw_prod_idx + MAX_KCQ_IDX);
-        if (BNX2X_CHIP_IS_E2(cp->chip_id)) {
+                if (!BNX2X_CHIP_IS_E2(cp->chip_id)) {
-                status_idx = cnic_service_bnx2x_kcq(dev, &cp->kcq2);
+                        cnic_ack_bnx2x_int(dev, cp->bnx2x_igu_sb_id, USTORM_ID,
+                                           status_idx, IGU_INT_ENABLE, 1);
+                        break;
+                }
+                new_status_idx = cnic_service_bnx2x_kcq(dev, &cp->kcq2);
+                if (new_status_idx != status_idx)
+                        continue;
                CNIC_WR16(dev, cp->kcq2.io_addr, cp->kcq2.sw_prod_idx +
                          MAX_KCQ_IDX);
                cnic_ack_igu_sb(dev, cp->bnx2x_igu_sb_id, IGU_SEG_ACCESS_DEF,
                                status_idx, IGU_INT_ENABLE, 1);
-        } else {
-                cnic_ack_bnx2x_int(dev, cp->bnx2x_igu_sb_id, USTORM_ID,
+                break;
-                                   status_idx, IGU_INT_ENABLE, 1);
        }
 }
diff --git a/drivers/net/davinci_emac.c b/drivers/net/davinci_emac.c
index 2a628d17d178..7018bfe408a4 100644
--- a/drivers/net/davinci_emac.c
+++ b/drivers/net/davinci_emac.c
@@ -1008,7 +1008,7 @@ static void emac_rx_handler(void *token, int len, int status)
        int                     ret;
        /* free and bail if we are shutting down */
-        if (unlikely(!netif_running(ndev))) {
+        if (unlikely(!netif_running(ndev) || !netif_carrier_ok(ndev))) {
                dev_kfree_skb_any(skb);
                return;
        }
diff --git a/drivers/net/dm9000.c b/drivers/net/dm9000.c
index 2d4c4fc1d900..461dd6f905f7 100644
--- a/drivers/net/dm9000.c
+++ b/drivers/net/dm9000.c
@@ -802,10 +802,7 @@ dm9000_init_dm9000(struct net_device *dev)
        /* Checksum mode */
        dm9000_set_rx_csum_unlocked(dev, db->rx_csum);
-        /* GPIO0 on pre-activate PHY */
-        iow(db, DM9000_GPR, 0); /* REG_1F bit0 activate phyxcer */
        iow(db, DM9000_GPCR, GPCR_GEP_CNTL);    /* Let GPIO0 output */
-        iow(db, DM9000_GPR, 0); /* Enable PHY */
        ncr = (db->flags & DM9000_PLATF_EXT_PHY) ? NCR_EXT_PHY : 0;
@@ -852,8 +849,8 @@ static void dm9000_timeout(struct net_device *dev)
        unsigned long flags;
        /* Save previous register address */
-        reg_save = readb(db->io_addr);
        spin_lock_irqsave(&db->lock, flags);
+        reg_save = readb(db->io_addr);
        netif_stop_queue(dev);
        dm9000_reset(db);
@@ -1194,6 +1191,10 @@ dm9000_open(struct net_device *dev)
        if (request_irq(dev->irq, dm9000_interrupt, irqflags, dev->name, dev))
                return -EAGAIN;
+        /* GPIO0 on pre-activate PHY, Reg 1F is not set by reset */
+        iow(db, DM9000_GPR, 0); /* REG_1F bit0 activate phyxcer */
+        mdelay(1); /* delay needs by DM9000B */
        /* Initialize DM9000 board */
        dm9000_reset(db);
        dm9000_init_dm9000(dev);
diff --git a/drivers/net/dnet.c b/drivers/net/dnet.c
index 9d8a20b72fa9..8318ea06cb6d 100644
--- a/drivers/net/dnet.c
+++ b/drivers/net/dnet.c
@@ -337,8 +337,6 @@ static int dnet_mii_init(struct dnet *bp)
        for (i = 0; i < PHY_MAX_ADDR; i++)
                bp->mii_bus->irq[i] = PHY_POLL;
-        platform_set_drvdata(bp->dev, bp->mii_bus);
        if (mdiobus_register(bp->mii_bus)) {
                err = -ENXIO;
                goto err_out_free_mdio_irq;
@@ -863,6 +861,7 @@ static int __devinit dnet_probe(struct platform_device *pdev)
        bp = netdev_priv(dev);
        bp->dev = dev;
+        platform_set_drvdata(pdev, dev);
        SET_NETDEV_DEV(dev, &pdev->dev);
        spin_lock_init(&bp->lock);
diff --git a/drivers/net/e1000/e1000_osdep.h b/drivers/net/e1000/e1000_osdep.h
index 55c1711f1688..33e7c45a4fe4 100644
--- a/drivers/net/e1000/e1000_osdep.h
+++ b/drivers/net/e1000/e1000_osdep.h
@@ -42,7 +42,8 @@
 #define GBE_CONFIG_RAM_BASE \
        ((unsigned int)(CONFIG_RAM_BASE + GBE_CONFIG_OFFSET))
-#define GBE_CONFIG_BASE_VIRT    phys_to_virt(GBE_CONFIG_RAM_BASE)
+#define GBE_CONFIG_BASE_VIRT \
+        ((void __iomem *)phys_to_virt(GBE_CONFIG_RAM_BASE))
 #define GBE_CONFIG_FLASH_WRITE(base, offset, count, data) \
        (iowrite16_rep(base + offset, data, count))
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 3fa110ddb041..2e5022849f18 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -5967,7 +5967,8 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
                /* APME bit in EEPROM is mapped to WUC.APME */
                eeprom_data = er32(WUC);
                eeprom_apme_mask = E1000_WUC_APME;
-                if (eeprom_data & E1000_WUC_PHY_WAKE)
+                if ((hw->mac.type > e1000_ich10lan) &&
+                    (eeprom_data & E1000_WUC_PHY_WAKE))
                        adapter->flags2 |= FLAG2_HAS_PHY_WAKEUP;
        } else if (adapter->flags & FLAG_APME_IN_CTRL3) {
                if (adapter->flags & FLAG_APME_CHECK_PORT_B &&
diff --git a/drivers/net/fec.c b/drivers/net/fec.c
index 2a71373719ae..cd0282d5d40f 100644
--- a/drivers/net/fec.c
+++ b/drivers/net/fec.c
@@ -74,7 +74,8 @@ static struct platform_device_id fec_devtype[] = {
        }, {
                .name = "imx28-fec",
                .driver_data = FEC_QUIRK_ENET_MAC | FEC_QUIRK_SWAP_FRAME,
-        }
+        },
+        { }
 };
 static unsigned char macaddr[ETH_ALEN];
diff --git a/drivers/net/igbvf/vf.c b/drivers/net/igbvf/vf.c
index 74486a8b009a..af3822f9ea9a 100644
--- a/drivers/net/igbvf/vf.c
+++ b/drivers/net/igbvf/vf.c
@@ -220,7 +220,7 @@ static u32 e1000_hash_mc_addr_vf(struct e1000_hw *hw, u8 *mc_addr)
 *  The parameter rar_count will usually be hw->mac.rar_entry_count
 *  unless there are workarounds that change this.
 **/
-void e1000_update_mc_addr_list_vf(struct e1000_hw *hw,
+static void e1000_update_mc_addr_list_vf(struct e1000_hw *hw,
                                  u8 *mc_addr_list, u32 mc_addr_count,
                                  u32 rar_used_count, u32 rar_count)
 {
diff --git a/drivers/net/macb.c b/drivers/net/macb.c
index f69e73e2191e..79ccb54ab00c 100644
--- a/drivers/net/macb.c
+++ b/drivers/net/macb.c
@@ -260,7 +260,7 @@ static int macb_mii_init(struct macb *bp)
        for (i = 0; i < PHY_MAX_ADDR; i++)
                bp->mii_bus->irq[i] = PHY_POLL;
-        platform_set_drvdata(bp->dev, bp->mii_bus);
+        dev_set_drvdata(&bp->dev->dev, bp->mii_bus);
        if (mdiobus_register(bp->mii_bus))
                goto err_out_free_mdio_irq;
diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
index 5933621ac3ff..fc27a9926d9e 100644
--- a/drivers/net/macvtap.c
+++ b/drivers/net/macvtap.c
@@ -528,8 +528,9 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q,
                vnet_hdr_len = q->vnet_hdr_sz;
                err = -EINVAL;
-                if ((len -= vnet_hdr_len) < 0)
+                if (len < vnet_hdr_len)
                        goto err;
+                len -= vnet_hdr_len;
                err = memcpy_fromiovecend((void *)&vnet_hdr, iv, 0,
                                           sizeof(vnet_hdr));
diff --git a/drivers/net/pcmcia/fmvj18x_cs.c b/drivers/net/pcmcia/fmvj18x_cs.c
index 9226cda4d054..530ab5a10bd3 100644
--- a/drivers/net/pcmcia/fmvj18x_cs.c
+++ b/drivers/net/pcmcia/fmvj18x_cs.c
@@ -691,6 +691,7 @@ static struct pcmcia_device_id fmvj18x_ids[] = {
        PCMCIA_PFC_DEVICE_MANF_CARD(0, 0x0105, 0x0e0a),
        PCMCIA_PFC_DEVICE_MANF_CARD(0, 0x0032, 0x0e01),
        PCMCIA_PFC_DEVICE_MANF_CARD(0, 0x0032, 0x0a05),
+        PCMCIA_PFC_DEVICE_MANF_CARD(0, 0x0032, 0x0b05),
        PCMCIA_PFC_DEVICE_MANF_CARD(0, 0x0032, 0x1101),
        PCMCIA_DEVICE_NULL,
 };
diff --git a/drivers/net/r6040.c b/drivers/net/r6040.c
index 27e6f6d43cac..e3ebd90ae651 100644
--- a/drivers/net/r6040.c
+++ b/drivers/net/r6040.c
@@ -49,8 +49,8 @@
 #include <asm/processor.h>
 #define DRV_NAME        "r6040"
-#define DRV_VERSION     "0.26"
+#define DRV_VERSION     "0.27"
-#define DRV_RELDATE     "30May2010"
+#define DRV_RELDATE     "23Feb2011"
 /* PHY CHIP Address */
 #define PHY1_ADDR       1       /* For MAC1 */
@@ -69,6 +69,8 @@
 /* MAC registers */
 #define MCR0            0x00    /* Control register 0 */
+#define  MCR0_PROMISC   0x0020  /* Promiscuous mode */
+#define  MCR0_HASH_EN   0x0100  /* Enable multicast hash table function */
 #define MCR1            0x04    /* Control register 1 */
 #define  MAC_RST        0x0001  /* Reset the MAC */
 #define MBCR            0x08    /* Bus control */
@@ -851,77 +853,92 @@ static void r6040_multicast_list(struct net_device *dev)
 {
        struct r6040_private *lp = netdev_priv(dev);
        void __iomem *ioaddr = lp->base;
-        u16 *adrp;
-        u16 reg;
        unsigned long flags;
        struct netdev_hw_addr *ha;
        int i;
+        u16 *adrp;
+        u16 hash_table[4] = { 0 };
+        spin_lock_irqsave(&lp->lock, flags);
-        /* MAC Address */
+        /* Keep our MAC Address */
        adrp = (u16 *)dev->dev_addr;
        iowrite16(adrp[0], ioaddr + MID_0L);
        iowrite16(adrp[1], ioaddr + MID_0M);
        iowrite16(adrp[2], ioaddr + MID_0H);
-        /* Promiscous Mode */
-        spin_lock_irqsave(&lp->lock, flags);
        /* Clear AMCP & PROM bits */
-        reg = ioread16(ioaddr) & ~0x0120;
+        lp->mcr0 = ioread16(ioaddr + MCR0) & ~(MCR0_PROMISC | MCR0_HASH_EN);
-        if (dev->flags & IFF_PROMISC) {
-                reg |= 0x0020;
-                lp->mcr0 |= 0x0020;
-        }
-        /* Too many multicast addresses
-         * accept all traffic */
-        else if ((netdev_mc_count(dev) > MCAST_MAX) ||
-                 (dev->flags & IFF_ALLMULTI))
-                reg |= 0x0020;
-        iowrite16(reg, ioaddr);
+        /* Promiscuous mode */
-        spin_unlock_irqrestore(&lp->lock, flags);
+        if (dev->flags & IFF_PROMISC)
+                lp->mcr0 |= MCR0_PROMISC;
-        /* Build the hash table */
+        /* Enable multicast hash table function to
-        if (netdev_mc_count(dev) > MCAST_MAX) {
+         * receive all multicast packets. */
-                u16 hash_table[4];
+        else if (dev->flags & IFF_ALLMULTI) {
-                u32 crc;
+                lp->mcr0 |= MCR0_HASH_EN;
-                for (i = 0; i < 4; i++)
+                for (i = 0; i < MCAST_MAX ; i++) {
-                        hash_table[i] = 0;
+                        iowrite16(0, ioaddr + MID_1L + 8 * i);
+                        iowrite16(0, ioaddr + MID_1M + 8 * i);
+                        iowrite16(0, ioaddr + MID_1H + 8 * i);
+                }
+                for (i = 0; i < 4; i++)
+                        hash_table[i] = 0xffff;
+        }
+        /* Use internal multicast address registers if the number of
+         * multicast addresses is not greater than MCAST_MAX. */
+        else if (netdev_mc_count(dev) <= MCAST_MAX) {
+                i = 0;
                netdev_for_each_mc_addr(ha, dev) {
-                        char *addrs = ha->addr;
+                        u16 *adrp = (u16 *) ha->addr;
+                        iowrite16(adrp[0], ioaddr + MID_1L + 8 * i);
+                        iowrite16(adrp[1], ioaddr + MID_1M + 8 * i);
+                        iowrite16(adrp[2], ioaddr + MID_1H + 8 * i);
+                        i++;
+                }
+                while (i < MCAST_MAX) {
+                        iowrite16(0, ioaddr + MID_1L + 8 * i);
+                        iowrite16(0, ioaddr + MID_1M + 8 * i);
+                        iowrite16(0, ioaddr + MID_1H + 8 * i);
+                        i++;
+                }
+        }
+        /* Otherwise, Enable multicast hash table function. */
+        else {
+                u32 crc;
-                        if (!(*addrs & 1))
+                lp->mcr0 |= MCR0_HASH_EN;
-                                continue;
+                for (i = 0; i < MCAST_MAX ; i++) {
+                        iowrite16(0, ioaddr + MID_1L + 8 * i);
+                        iowrite16(0, ioaddr + MID_1M + 8 * i);
+                        iowrite16(0, ioaddr + MID_1H + 8 * i);
+                }
-                        crc = ether_crc_le(6, addrs);
+                /* Build multicast hash table */
+                netdev_for_each_mc_addr(ha, dev) {
+                        u8 *addrs = ha->addr;
+                        crc = ether_crc(ETH_ALEN, addrs);
                        crc >>= 26;
-                        hash_table[crc >> 4] |= 1 << (15 - (crc & 0xf));
+                        hash_table[crc >> 4] |= 1 << (crc & 0xf);
                }
-                /* Fill the MAC hash tables with their values */
+        }
+        iowrite16(lp->mcr0, ioaddr + MCR0);
+        /* Fill the MAC hash tables with their values */
+        if (lp->mcr0 && MCR0_HASH_EN) {
                iowrite16(hash_table[0], ioaddr + MAR0);
                iowrite16(hash_table[1], ioaddr + MAR1);
                iowrite16(hash_table[2], ioaddr + MAR2);
                iowrite16(hash_table[3], ioaddr + MAR3);
        }
-        /* Multicast Address 1~4 case */
-        i = 0;
+        spin_unlock_irqrestore(&lp->lock, flags);
-        netdev_for_each_mc_addr(ha, dev) {
-                if (i >= MCAST_MAX)
-                        break;
-                adrp = (u16 *) ha->addr;
-                iowrite16(adrp[0], ioaddr + MID_1L + 8 * i);
-                iowrite16(adrp[1], ioaddr + MID_1M + 8 * i);
-                iowrite16(adrp[2], ioaddr + MID_1H + 8 * i);
-                i++;
-        }
-        while (i < MCAST_MAX) {
-                iowrite16(0xffff, ioaddr + MID_1L + 8 * i);
-                iowrite16(0xffff, ioaddr + MID_1M + 8 * i);
-                iowrite16(0xffff, ioaddr + MID_1H + 8 * i);
-                i++;
-        }
 }
 static void netdev_get_drvinfo(struct net_device *dev,
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 469ab0b7ce31..7ffdb80adf40 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -25,6 +25,7 @@
 #include <linux/dma-mapping.h>
 #include <linux/pm_runtime.h>
 #include <linux/firmware.h>
+#include <linux/pci-aspm.h>
 #include <asm/system.h>
 #include <asm/io.h>
@@ -617,8 +618,9 @@ static void ocp_write(struct rtl8169_private *tp, u8 mask, u16 reg, u32 data)
        }
 }
-static void rtl8168_oob_notify(void __iomem *ioaddr, u8 cmd)
+static void rtl8168_oob_notify(struct rtl8169_private *tp, u8 cmd)
 {
+        void __iomem *ioaddr = tp->mmio_addr;
        int i;
        RTL_W8(ERIDR, cmd);
@@ -630,7 +632,7 @@ static void rtl8168_oob_notify(void __iomem *ioaddr, u8 cmd)
                        break;
        }
-        ocp_write(ioaddr, 0x1, 0x30, 0x00000001);
+        ocp_write(tp, 0x1, 0x30, 0x00000001);
 }
 #define OOB_CMD_RESET           0x00
@@ -2868,8 +2870,11 @@ static void r8168_pll_power_down(struct rtl8169_private *tp)
 {
        void __iomem *ioaddr = tp->mmio_addr;
-        if (tp->mac_version == RTL_GIGA_MAC_VER_27)
+        if (((tp->mac_version == RTL_GIGA_MAC_VER_27) ||
+             (tp->mac_version == RTL_GIGA_MAC_VER_28)) &&
+            (ocp_read(tp, 0x0f, 0x0010) & 0x00008000)) {
                return;
+        }
        if (((tp->mac_version == RTL_GIGA_MAC_VER_23) ||
             (tp->mac_version == RTL_GIGA_MAC_VER_24)) &&
@@ -2891,6 +2896,8 @@ static void r8168_pll_power_down(struct rtl8169_private *tp)
        switch (tp->mac_version) {
        case RTL_GIGA_MAC_VER_25:
        case RTL_GIGA_MAC_VER_26:
+        case RTL_GIGA_MAC_VER_27:
+        case RTL_GIGA_MAC_VER_28:
                RTL_W8(PMCH, RTL_R8(PMCH) & ~0x80);
                break;
        }
@@ -2900,12 +2907,17 @@ static void r8168_pll_power_up(struct rtl8169_private *tp)
 {
        void __iomem *ioaddr = tp->mmio_addr;
-        if (tp->mac_version == RTL_GIGA_MAC_VER_27)
+        if (((tp->mac_version == RTL_GIGA_MAC_VER_27) ||
+             (tp->mac_version == RTL_GIGA_MAC_VER_28)) &&
+            (ocp_read(tp, 0x0f, 0x0010) & 0x00008000)) {
                return;
+        }
        switch (tp->mac_version) {
        case RTL_GIGA_MAC_VER_25:
        case RTL_GIGA_MAC_VER_26:
+        case RTL_GIGA_MAC_VER_27:
+        case RTL_GIGA_MAC_VER_28:
                RTL_W8(PMCH, RTL_R8(PMCH) | 0x80);
                break;
        }
@@ -3009,6 +3021,11 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
        mii->reg_num_mask = 0x1f;
        mii->supports_gmii = !!(cfg->features & RTL_FEATURE_GMII);
+        /* disable ASPM completely as that cause random device stop working
+         * problems as well as full system hangs for some PCIe devices users */
+        pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S | PCIE_LINK_STATE_L1 |
+                                     PCIE_LINK_STATE_CLKPM);
        /* enable device (incl. PCI PM wakeup and hotplug setup) */
        rc = pci_enable_device(pdev);
        if (rc < 0) {
@@ -3042,7 +3059,7 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                goto err_out_mwi_2;
        }
-        tp->cp_cmd = PCIMulRW | RxChkSum;
+        tp->cp_cmd = RxChkSum;
        if ((sizeof(dma_addr_t) > 4) &&
            !pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) && use_dac) {
@@ -3318,7 +3335,8 @@ static void rtl8169_hw_reset(struct rtl8169_private *tp)
        /* Disable interrupts */
        rtl8169_irq_mask_and_ack(ioaddr);
-        if (tp->mac_version == RTL_GIGA_MAC_VER_28) {
+        if (tp->mac_version == RTL_GIGA_MAC_VER_27 ||
+            tp->mac_version == RTL_GIGA_MAC_VER_28) {
                while (RTL_R8(TxPoll) & NPQ)
                        udelay(20);
@@ -3847,8 +3865,7 @@ static void rtl_hw_start_8168(struct net_device *dev)
        Cxpl_dbg_sel | \
        ASF | \
        PktCntrDisable | \
-        PCIDAC | \
+        Mac_dbgo_sel)
-        PCIMulRW)
 static void rtl_hw_start_8102e_1(void __iomem *ioaddr, struct pci_dev *pdev)
 {
@@ -3878,8 +3895,6 @@ static void rtl_hw_start_8102e_1(void __iomem *ioaddr, struct pci_dev *pdev)
        if ((cfg1 & LEDS0) && (cfg1 & LEDS1))
                RTL_W8(Config1, cfg1 & ~LEDS0);
-        RTL_W16(CPlusCmd, RTL_R16(CPlusCmd) & ~R810X_CPCMD_QUIRK_MASK);
        rtl_ephy_init(ioaddr, e_info_8102e_1, ARRAY_SIZE(e_info_8102e_1));
 }
@@ -3891,8 +3906,6 @@ static void rtl_hw_start_8102e_2(void __iomem *ioaddr, struct pci_dev *pdev)
        RTL_W8(Config1, MEMMAP | IOMAP | VPD | PMEnable);
        RTL_W8(Config3, RTL_R8(Config3) & ~Beacon_en);
-        RTL_W16(CPlusCmd, RTL_R16(CPlusCmd) & ~R810X_CPCMD_QUIRK_MASK);
 }
 static void rtl_hw_start_8102e_3(void __iomem *ioaddr, struct pci_dev *pdev)
@@ -3918,6 +3931,8 @@ static void rtl_hw_start_8101(struct net_device *dev)
                }
        }
+        RTL_W8(Cfg9346, Cfg9346_Unlock);
        switch (tp->mac_version) {
        case RTL_GIGA_MAC_VER_07:
                rtl_hw_start_8102e_1(ioaddr, pdev);
@@ -3932,14 +3947,13 @@ static void rtl_hw_start_8101(struct net_device *dev)
                break;
        }
-        RTL_W8(Cfg9346, Cfg9346_Unlock);
+        RTL_W8(Cfg9346, Cfg9346_Lock);
        RTL_W8(MaxTxPacketSize, TxPacketMax);
        rtl_set_rx_max_size(ioaddr, rx_buf_sz);
-        tp->cp_cmd |= rtl_rw_cpluscmd(ioaddr) | PCIMulRW;
+        tp->cp_cmd &= ~R810X_CPCMD_QUIRK_MASK;
        RTL_W16(CPlusCmd, tp->cp_cmd);
        RTL_W16(IntrMitigate, 0x0000);
@@ -3949,14 +3963,10 @@ static void rtl_hw_start_8101(struct net_device *dev)
        RTL_W8(ChipCmd, CmdTxEnb | CmdRxEnb);
        rtl_set_rx_tx_config_registers(tp);
-        RTL_W8(Cfg9346, Cfg9346_Lock);
        RTL_R8(IntrMask);
        rtl_set_rx_mode(dev);
-        RTL_W8(ChipCmd, CmdTxEnb | CmdRxEnb);
        RTL_W16(MultiIntr, RTL_R16(MultiIntr) & 0xf000);
        RTL_W16(IntrMask, tp->intr_event);
diff --git a/drivers/net/sfc/ethtool.c b/drivers/net/sfc/ethtool.c
index 0e8bb19ed60d..ca886d98bdc7 100644
--- a/drivers/net/sfc/ethtool.c
+++ b/drivers/net/sfc/ethtool.c
@@ -569,9 +569,14 @@ static void efx_ethtool_self_test(struct net_device *net_dev,
                                  struct ethtool_test *test, u64 *data)
 {
        struct efx_nic *efx = netdev_priv(net_dev);
-        struct efx_self_tests efx_tests;
+        struct efx_self_tests *efx_tests;
        int already_up;
-        int rc;
+        int rc = -ENOMEM;
+        efx_tests = kzalloc(sizeof(*efx_tests), GFP_KERNEL);
+        if (!efx_tests)
+                goto fail;
        ASSERT_RTNL();
        if (efx->state != STATE_RUNNING) {
@@ -589,13 +594,11 @@ static void efx_ethtool_self_test(struct net_device *net_dev,
                if (rc) {
                        netif_err(efx, drv, efx->net_dev,
                                  "failed opening device.\n");
-                        goto fail2;
+                        goto fail1;
                }
        }
-        memset(&efx_tests, 0, sizeof(efx_tests));
+        rc = efx_selftest(efx, efx_tests, test->flags);
-        rc = efx_selftest(efx, &efx_tests, test->flags);
        if (!already_up)
                dev_close(efx->net_dev);
@@ -604,10 +607,11 @@ static void efx_ethtool_self_test(struct net_device *net_dev,
                   rc == 0 ? "passed" : "failed",
                   (test->flags & ETH_TEST_FL_OFFLINE) ? "off" : "on");
- fail2:
+fail1:
- fail1:
        /* Fill ethtool results structures */
-        efx_ethtool_fill_self_tests(efx, &efx_tests, NULL, data);
+        efx_ethtool_fill_self_tests(efx, efx_tests, NULL, data);
+        kfree(efx_tests);
+fail:
        if (rc)
                test->flags |= ETH_TEST_FL_FAILED;
 }
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index 42daf98ba736..35b28f42d208 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -3856,9 +3856,6 @@ static struct net_device *skge_devinit(struct skge_hw *hw, int port,
        memcpy_fromio(dev->dev_addr, hw->regs + B2_MAC_1 + port*8, ETH_ALEN);
        memcpy(dev->perm_addr, dev->dev_addr, dev->addr_len);
-        /* device is off until link detection */
-        netif_carrier_off(dev);
        return dev;
 }
diff --git a/drivers/net/smsc911x.c b/drivers/net/smsc911x.c
index 64bfdae5956f..d70bde95460b 100644
--- a/drivers/net/smsc911x.c
+++ b/drivers/net/smsc911x.c
@@ -1178,6 +1178,11 @@ static int smsc911x_open(struct net_device *dev)
        smsc911x_reg_write(pdata, HW_CFG, 0x00050000);
        smsc911x_reg_write(pdata, AFC_CFG, 0x006E3740);
+        /* Increase the legal frame size of VLAN tagged frames to 1522 bytes */
+        spin_lock_irq(&pdata->mac_lock);
+        smsc911x_mac_write(pdata, VLAN1, ETH_P_8021Q);
+        spin_unlock_irq(&pdata->mac_lock);
        /* Make sure EEPROM has finished loading before setting GPIO_CFG */
        timeout = 50;
        while ((smsc911x_reg_read(pdata, E2P_CMD) & E2P_CMD_EPC_BUSY_) &&
diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c
index 02b622e3b9fb..5002f5be47be 100644
--- a/drivers/net/usb/dm9601.c
+++ b/drivers/net/usb/dm9601.c
@@ -651,6 +651,10 @@ static const struct usb_device_id products[] = {
        .driver_info = (unsigned long)&dm9601_info,
         },
        {
+         USB_DEVICE(0x0fe6, 0x9700),    /* DM9601 USB to Fast Ethernet Adapter */
+         .driver_info = (unsigned long)&dm9601_info,
+         },
+        {
         USB_DEVICE(0x0a46, 0x9000),    /* DM9000E */
         .driver_info = (unsigned long)&dm9601_info,
         },
diff --git a/drivers/net/wireless/ath/ath5k/phy.c b/drivers/net/wireless/ath/ath5k/phy.c
index 78c26fdccad1..62ce2f4e8605 100644
--- a/drivers/net/wireless/ath/ath5k/phy.c
+++ b/drivers/net/wireless/ath/ath5k/phy.c
@@ -282,6 +282,34 @@ int ath5k_hw_phy_disable(struct ath5k_hw *ah)
        return 0;
 }
+/*
+ * Wait for synth to settle
+ */
+static void ath5k_hw_wait_for_synth(struct ath5k_hw *ah,
+                        struct ieee80211_channel *channel)
+{
+        /*
+         * On 5211+ read activation -> rx delay
+         * and use it (100ns steps).
+         */
+        if (ah->ah_version != AR5K_AR5210) {
+                u32 delay;
+                delay = ath5k_hw_reg_read(ah, AR5K_PHY_RX_DELAY) &
+                        AR5K_PHY_RX_DELAY_M;
+                delay = (channel->hw_value & CHANNEL_CCK) ?
+                        ((delay << 2) / 22) : (delay / 10);
+                if (ah->ah_bwmode == AR5K_BWMODE_10MHZ)
+                        delay = delay << 1;
+                if (ah->ah_bwmode == AR5K_BWMODE_5MHZ)
+                        delay = delay << 2;
+                /* XXX: /2 on turbo ? Let's be safe
+                 * for now */
+                udelay(100 + delay);
+        } else {
+                mdelay(1);
+        }
+}
 /**********************\
 * RF Gain optimization *
@@ -1253,6 +1281,7 @@ static int ath5k_hw_channel(struct ath5k_hw *ah,
        case AR5K_RF5111:
                ret = ath5k_hw_rf5111_channel(ah, channel);
                break;
+        case AR5K_RF2317:
        case AR5K_RF2425:
                ret = ath5k_hw_rf2425_channel(ah, channel);
                break;
@@ -3237,6 +3266,13 @@ int ath5k_hw_phy_init(struct ath5k_hw *ah, struct ieee80211_channel *channel,
                /* Failed */
                if (i >= 100)
                        return -EIO;
+                /* Set channel and wait for synth */
+                ret = ath5k_hw_channel(ah, channel);
+                if (ret)
+                        return ret;
+                ath5k_hw_wait_for_synth(ah, channel);
        }
        /*
@@ -3251,13 +3287,53 @@ int ath5k_hw_phy_init(struct ath5k_hw *ah, struct ieee80211_channel *channel,
        if (ret)
                return ret;
+        /* Write OFDM timings on 5212*/
+        if (ah->ah_version == AR5K_AR5212 &&
+                channel->hw_value & CHANNEL_OFDM) {
+                ret = ath5k_hw_write_ofdm_timings(ah, channel);
+                if (ret)
+                        return ret;
+                /* Spur info is available only from EEPROM versions
+                 * greater than 5.3, but the EEPROM routines will use
+                 * static values for older versions */
+                if (ah->ah_mac_srev >= AR5K_SREV_AR5424)
+                        ath5k_hw_set_spur_mitigation_filter(ah,
+                                                            channel);
+        }
+        /* If we used fast channel switching
+         * we are done, release RF bus and
+         * fire up NF calibration.
+         *
+         * Note: Only NF calibration due to
+         * channel change, not AGC calibration
+         * since AGC is still running !
+         */
+        if (fast) {
+                /*
+                 * Release RF Bus grant
+                 */
+                AR5K_REG_DISABLE_BITS(ah, AR5K_PHY_RFBUS_REQ,
+                                    AR5K_PHY_RFBUS_REQ_REQUEST);
+                /*
+                 * Start NF calibration
+                 */
+                AR5K_REG_ENABLE_BITS(ah, AR5K_PHY_AGCCTL,
+                                        AR5K_PHY_AGCCTL_NF);
+                return ret;
+        }
        /*
         * For 5210 we do all initialization using
         * initvals, so we don't have to modify
         * any settings (5210 also only supports
         * a/aturbo modes)
         */
-        if ((ah->ah_version != AR5K_AR5210) && !fast) {
+        if (ah->ah_version != AR5K_AR5210) {
                /*
                 * Write initial RF gain settings
@@ -3276,22 +3352,6 @@ int ath5k_hw_phy_init(struct ath5k_hw *ah, struct ieee80211_channel *channel,
                if (ret)
                        return ret;
-                /* Write OFDM timings on 5212*/
-                if (ah->ah_version == AR5K_AR5212 &&
-                        channel->hw_value & CHANNEL_OFDM) {
-                        ret = ath5k_hw_write_ofdm_timings(ah, channel);
-                        if (ret)
-                                return ret;
-                        /* Spur info is available only from EEPROM versions
-                         * greater than 5.3, but the EEPROM routines will use
-                         * static values for older versions */
-                        if (ah->ah_mac_srev >= AR5K_SREV_AR5424)
-                                ath5k_hw_set_spur_mitigation_filter(ah,
-                                                                    channel);
-                }
                /*Enable/disable 802.11b mode on 5111
                (enable 2111 frequency converter + CCK)*/
                if (ah->ah_radio == AR5K_RF5111) {
@@ -3322,47 +3382,20 @@ int ath5k_hw_phy_init(struct ath5k_hw *ah, struct ieee80211_channel *channel,
         */
        ath5k_hw_reg_write(ah, AR5K_PHY_ACT_ENABLE, AR5K_PHY_ACT);
+        ath5k_hw_wait_for_synth(ah, channel);
        /*
-         * On 5211+ read activation -> rx delay
+         * Perform ADC test to see if baseband is ready
-         * and use it.
+         * Set tx hold and check adc test register
         */
-        if (ah->ah_version != AR5K_AR5210) {
+        phy_tst1 = ath5k_hw_reg_read(ah, AR5K_PHY_TST1);
-                u32 delay;
+        ath5k_hw_reg_write(ah, AR5K_PHY_TST1_TXHOLD, AR5K_PHY_TST1);
-                delay = ath5k_hw_reg_read(ah, AR5K_PHY_RX_DELAY) &
+        for (i = 0; i <= 20; i++) {
-                        AR5K_PHY_RX_DELAY_M;
+                if (!(ath5k_hw_reg_read(ah, AR5K_PHY_ADC_TEST) & 0x10))
-                delay = (channel->hw_value & CHANNEL_CCK) ?
+                        break;
-                        ((delay << 2) / 22) : (delay / 10);
+                udelay(200);
-                if (ah->ah_bwmode == AR5K_BWMODE_10MHZ)
-                        delay = delay << 1;
-                if (ah->ah_bwmode == AR5K_BWMODE_5MHZ)
-                        delay = delay << 2;
-                /* XXX: /2 on turbo ? Let's be safe
-                 * for now */
-                udelay(100 + delay);
-        } else {
-                mdelay(1);
-        }
-        if (fast)
-                /*
-                 * Release RF Bus grant
-                 */
-                AR5K_REG_DISABLE_BITS(ah, AR5K_PHY_RFBUS_REQ,
-                                    AR5K_PHY_RFBUS_REQ_REQUEST);
-        else {
-                /*
-                 * Perform ADC test to see if baseband is ready
-                 * Set tx hold and check adc test register
-                 */
-                phy_tst1 = ath5k_hw_reg_read(ah, AR5K_PHY_TST1);
-                ath5k_hw_reg_write(ah, AR5K_PHY_TST1_TXHOLD, AR5K_PHY_TST1);
-                for (i = 0; i <= 20; i++) {
-                        if (!(ath5k_hw_reg_read(ah, AR5K_PHY_ADC_TEST) & 0x10))
-                                break;
-                        udelay(200);
-                }
-                ath5k_hw_reg_write(ah, phy_tst1, AR5K_PHY_TST1);
        }
+        ath5k_hw_reg_write(ah, phy_tst1, AR5K_PHY_TST1);
        /*
         * Start automatic gain control calibration
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 23838e37d45f..1a7fa6ea4cf5 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -21,7 +21,6 @@
 #include <linux/device.h>
 #include <linux/leds.h>
 #include <linux/completion.h>
-#include <linux/pm_qos_params.h>
 #include "debug.h"
 #include "common.h"
@@ -57,8 +56,6 @@ struct ath_node;
 #define A_MAX(a, b) ((a) > (b) ? (a) : (b))
-#define ATH9K_PM_QOS_DEFAULT_VALUE      55
 #define TSF_TO_TU(_h,_l) \
        ((((u32)(_h)) << 22) | (((u32)(_l)) >> 10))
@@ -633,8 +630,6 @@ struct ath_softc {
        struct ath_descdma txsdma;
        struct ath_ant_comb ant_comb;
-        struct pm_qos_request_list pm_qos_req;
 };
 struct ath_wiphy {
@@ -666,7 +661,6 @@ static inline void ath_read_cachesize(struct ath_common *common, int *csz)
 extern struct ieee80211_ops ath9k_ops;
 extern int ath9k_modparam_nohwcrypt;
 extern int led_blink;
-extern int ath9k_pm_qos_value;
 extern bool is_ath9k_unloaded;
 irqreturn_t ath_isr(int irq, void *dev);
diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c
index 5ab3084eb9cb..07b1633b7f3f 100644
--- a/drivers/net/wireless/ath/ath9k/hif_usb.c
+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c
@@ -219,8 +219,9 @@ static int __hif_usb_tx(struct hif_device_usb *hif_dev)
        struct tx_buf *tx_buf = NULL;
        struct sk_buff *nskb = NULL;
        int ret = 0, i;
-        u16 *hdr, tx_skb_cnt = 0;
+        u16 tx_skb_cnt = 0;
        u8 *buf;
+        __le16 *hdr;
        if (hif_dev->tx.tx_skb_cnt == 0)
                return 0;
@@ -245,9 +246,9 @@ static int __hif_usb_tx(struct hif_device_usb *hif_dev)
                buf = tx_buf->buf;
                buf += tx_buf->offset;
-                hdr = (u16 *)buf;
+                hdr = (__le16 *)buf;
-                *hdr++ = nskb->len;
+                *hdr++ = cpu_to_le16(nskb->len);
-                *hdr++ = ATH_USB_TX_STREAM_MODE_TAG;
+                *hdr++ = cpu_to_le16(ATH_USB_TX_STREAM_MODE_TAG);
                buf += 4;
                memcpy(buf, nskb->data, nskb->len);
                tx_buf->len = nskb->len + 4;
diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c
index 087a6a95edd5..a033d01bf8a0 100644
--- a/drivers/net/wireless/ath/ath9k/init.c
+++ b/drivers/net/wireless/ath/ath9k/init.c
@@ -41,10 +41,6 @@ static int ath9k_btcoex_enable;
 module_param_named(btcoex_enable, ath9k_btcoex_enable, int, 0444);
 MODULE_PARM_DESC(btcoex_enable, "Enable wifi-BT coexistence");
-int ath9k_pm_qos_value = ATH9K_PM_QOS_DEFAULT_VALUE;
-module_param_named(pmqos, ath9k_pm_qos_value, int, S_IRUSR | S_IRGRP | S_IROTH);
-MODULE_PARM_DESC(pmqos, "User specified PM-QOS value");
 bool is_ath9k_unloaded;
 /* We use the hw_value as an index into our private channel structure */
@@ -762,9 +758,6 @@ int ath9k_init_device(u16 devid, struct ath_softc *sc, u16 subsysid,
        ath_init_leds(sc);
        ath_start_rfkill_poll(sc);
-        pm_qos_add_request(&sc->pm_qos_req, PM_QOS_CPU_DMA_LATENCY,
-                           PM_QOS_DEFAULT_VALUE);
        return 0;
 error_world:
@@ -831,7 +824,6 @@ void ath9k_deinit_device(struct ath_softc *sc)
        }
        ieee80211_unregister_hw(hw);
-        pm_qos_remove_request(&sc->pm_qos_req);
        ath_rx_cleanup(sc);
        ath_tx_cleanup(sc);
        ath9k_deinit_softc(sc);
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index 180170d3ce25..2915b11edefb 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -885,7 +885,7 @@ void ath9k_hw_set_interrupts(struct ath_hw *ah, enum ath9k_int ints)
        struct ath_common *common = ath9k_hw_common(ah);
        if (!(ints & ATH9K_INT_GLOBAL))
-                ath9k_hw_enable_interrupts(ah);
+                ath9k_hw_disable_interrupts(ah);
        ath_dbg(common, ATH_DBG_INTERRUPT, "0x%x => 0x%x\n", omask, ints);
@@ -963,7 +963,8 @@ void ath9k_hw_set_interrupts(struct ath_hw *ah, enum ath9k_int ints)
                        REG_CLR_BIT(ah, AR_IMR_S5, AR_IMR_S5_TIM_TIMER);
        }
-        ath9k_hw_enable_interrupts(ah);
+        if (ints & ATH9K_INT_GLOBAL)
+                ath9k_hw_enable_interrupts(ah);
        return;
 }
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index da5c64597c1f..a09d15f7aa6e 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -1173,12 +1173,6 @@ static int ath9k_start(struct ieee80211_hw *hw)
                        ath9k_btcoex_timer_resume(sc);
        }
-        /* User has the option to provide pm-qos value as a module
-         * parameter rather than using the default value of
-         * 'ATH9K_PM_QOS_DEFAULT_VALUE'.
-         */
-        pm_qos_update_request(&sc->pm_qos_req, ath9k_pm_qos_value);
        if (ah->caps.pcie_lcr_extsync_en && common->bus_ops->extn_synch_en)
                common->bus_ops->extn_synch_en(common);
@@ -1345,8 +1339,6 @@ static void ath9k_stop(struct ieee80211_hw *hw)
        sc->sc_flags |= SC_OP_INVALID;
-        pm_qos_update_request(&sc->pm_qos_req, PM_QOS_DEFAULT_VALUE);
        mutex_unlock(&sc->mutex);
        ath_dbg(common, ATH_DBG_CONFIG, "Driver halt\n");
diff --git a/drivers/net/wireless/ath/carl9170/usb.c b/drivers/net/wireless/ath/carl9170/usb.c
index 537732e5964f..f82c400be288 100644
--- a/drivers/net/wireless/ath/carl9170/usb.c
+++ b/drivers/net/wireless/ath/carl9170/usb.c
@@ -118,6 +118,8 @@ static struct usb_device_id carl9170_usb_ids[] = {
        { USB_DEVICE(0x057c, 0x8402) },
        /* Qwest/Actiontec 802AIN Wireless N USB Network Adapter */
        { USB_DEVICE(0x1668, 0x1200) },
+        /* Airlive X.USB a/b/g/n */
+        { USB_DEVICE(0x1b75, 0x9170) },
        /* terminate */
        {}
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index 79ab0a6b1386..537fb8c84e3a 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -51,7 +51,7 @@
 #include "iwl-agn-debugfs.h"
 /* Highest firmware API version supported */
-#define IWL5000_UCODE_API_MAX 2
+#define IWL5000_UCODE_API_MAX 5
 #define IWL5150_UCODE_API_MAX 2
 /* Lowest firmware API version supported */
diff --git a/drivers/net/wireless/p54/p54pci.c b/drivers/net/wireless/p54/p54pci.c
index 1eacba4daa5b..0494d7b102d4 100644
--- a/drivers/net/wireless/p54/p54pci.c
+++ b/drivers/net/wireless/p54/p54pci.c
@@ -199,6 +199,7 @@ static void p54p_check_rx_ring(struct ieee80211_hw *dev, u32 *index,
        while (i != idx) {
                u16 len;
                struct sk_buff *skb;
+                dma_addr_t dma_addr;
                desc = &ring[i];
                len = le16_to_cpu(desc->len);
                skb = rx_buf[i];
@@ -216,17 +217,20 @@ static void p54p_check_rx_ring(struct ieee80211_hw *dev, u32 *index,
                        len = priv->common.rx_mtu;
                }
+                dma_addr = le32_to_cpu(desc->host_addr);
+                pci_dma_sync_single_for_cpu(priv->pdev, dma_addr,
+                        priv->common.rx_mtu + 32, PCI_DMA_FROMDEVICE);
                skb_put(skb, len);
                if (p54_rx(dev, skb)) {
-                        pci_unmap_single(priv->pdev,
+                        pci_unmap_single(priv->pdev, dma_addr,
-                                         le32_to_cpu(desc->host_addr),
+                                priv->common.rx_mtu + 32, PCI_DMA_FROMDEVICE);
-                                         priv->common.rx_mtu + 32,
-                                         PCI_DMA_FROMDEVICE);
                        rx_buf[i] = NULL;
-                        desc->host_addr = 0;
+                        desc->host_addr = cpu_to_le32(0);
                } else {
                        skb_trim(skb, 0);
+                        pci_dma_sync_single_for_device(priv->pdev, dma_addr,
+                                priv->common.rx_mtu + 32, PCI_DMA_FROMDEVICE);
                        desc->len = cpu_to_le16(priv->common.rx_mtu + 32);
                }
diff --git a/drivers/net/wireless/p54/p54usb.c b/drivers/net/wireless/p54/p54usb.c
index 21713a7638c4..9b344a921e74 100644
--- a/drivers/net/wireless/p54/p54usb.c
+++ b/drivers/net/wireless/p54/p54usb.c
@@ -98,6 +98,7 @@ static struct usb_device_id p54u_table[] __devinitdata = {
        {USB_DEVICE(0x1413, 0x5400)},   /* Telsey 802.11g USB2.0 Adapter */
        {USB_DEVICE(0x1435, 0x0427)},   /* Inventel UR054G */
        {USB_DEVICE(0x1668, 0x1050)},   /* Actiontec 802UIG-1 */
+        {USB_DEVICE(0x1740, 0x1000)},   /* Senao NUB-350 */
        {USB_DEVICE(0x2001, 0x3704)},   /* DLink DWL-G122 rev A2 */
        {USB_DEVICE(0x2001, 0x3705)},   /* D-Link DWL-G120 rev C1 */
        {USB_DEVICE(0x413c, 0x5513)},   /* Dell WLA3310 USB Wireless Adapter */
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index 848cc2cce247..518542b4bf9e 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -2597,6 +2597,9 @@ static int rndis_set_power_mgmt(struct wiphy *wiphy, struct net_device *dev,
        __le32 mode;
        int ret;
+        if (priv->device_type != RNDIS_BCM4320B)
+                return -ENOTSUPP;
        netdev_dbg(usbdev->net, "%s(): %s, %d\n", __func__,
                                enabled ? "enabled" : "disabled",
                                timeout);
diff --git a/drivers/net/wireless/rt2x00/rt2800pci.c b/drivers/net/wireless/rt2x00/rt2800pci.c
index aa97971a38af..3b3f1e45ab3e 100644
--- a/drivers/net/wireless/rt2x00/rt2800pci.c
+++ b/drivers/net/wireless/rt2x00/rt2800pci.c
@@ -652,6 +652,12 @@ static void rt2800pci_fill_rxdone(struct queue_entry *entry,
                 */
                rxdesc->flags |= RX_FLAG_IV_STRIPPED;
+                /*
+                 * The hardware has already checked the Michael Mic and has
+                 * stripped it from the frame. Signal this to mac80211.
+                 */
+                rxdesc->flags |= RX_FLAG_MMIC_STRIPPED;
                if (rxdesc->cipher_status == RX_CRYPTO_SUCCESS)
                        rxdesc->flags |= RX_FLAG_DECRYPTED;
                else if (rxdesc->cipher_status == RX_CRYPTO_FAIL_MIC)
@@ -1065,6 +1071,8 @@ static DEFINE_PCI_DEVICE_TABLE(rt2800pci_device_table) = {
        { PCI_DEVICE(0x1814, 0x3390), PCI_DEVICE_DATA(&rt2800pci_ops) },
 #endif
 #ifdef CONFIG_RT2800PCI_RT35XX
+        { PCI_DEVICE(0x1432, 0x7711), PCI_DEVICE_DATA(&rt2800pci_ops) },
+        { PCI_DEVICE(0x1432, 0x7722), PCI_DEVICE_DATA(&rt2800pci_ops) },
        { PCI_DEVICE(0x1814, 0x3060), PCI_DEVICE_DATA(&rt2800pci_ops) },
        { PCI_DEVICE(0x1814, 0x3062), PCI_DEVICE_DATA(&rt2800pci_ops) },
        { PCI_DEVICE(0x1814, 0x3562), PCI_DEVICE_DATA(&rt2800pci_ops) },
diff --git a/drivers/net/wireless/rt2x00/rt2800usb.c b/drivers/net/wireless/rt2x00/rt2800usb.c
index b97a4a54ff4c..197a36c05fda 100644
--- a/drivers/net/wireless/rt2x00/rt2800usb.c
+++ b/drivers/net/wireless/rt2x00/rt2800usb.c
@@ -486,6 +486,12 @@ static void rt2800usb_fill_rxdone(struct queue_entry *entry,
                 */
                rxdesc->flags |= RX_FLAG_IV_STRIPPED;
+                /*
+                 * The hardware has already checked the Michael Mic and has
+                 * stripped it from the frame. Signal this to mac80211.
+                 */
+                rxdesc->flags |= RX_FLAG_MMIC_STRIPPED;
                if (rxdesc->cipher_status == RX_CRYPTO_SUCCESS)
                        rxdesc->flags |= RX_FLAG_DECRYPTED;
                else if (rxdesc->cipher_status == RX_CRYPTO_FAIL_MIC)
diff --git a/drivers/nfc/Kconfig b/drivers/nfc/Kconfig
index ffedfd492754..ea1580085347 100644
--- a/drivers/nfc/Kconfig
+++ b/drivers/nfc/Kconfig
@@ -3,7 +3,7 @@
 #
 menuconfig NFC_DEVICES
-        bool "NFC devices"
+        bool "Near Field Communication (NFC) devices"
        default n
        ---help---
          You'll have to say Y if your computer contains an NFC device that
diff --git a/drivers/nfc/pn544.c b/drivers/nfc/pn544.c
index bae647264dd6..724f65d8f9e4 100644
--- a/drivers/nfc/pn544.c
+++ b/drivers/nfc/pn544.c
@@ -60,7 +60,7 @@ enum pn544_irq {
 struct pn544_info {
        struct miscdevice miscdev;
        struct i2c_client *i2c_dev;
-        struct regulator_bulk_data regs[2];
+        struct regulator_bulk_data regs[3];
        enum pn544_state state;
        wait_queue_head_t read_wait;
@@ -74,6 +74,7 @@ struct pn544_info {
 static const char reg_vdd_io[]  = "Vdd_IO";
 static const char reg_vbat[]    = "VBat";
+static const char reg_vsim[]    = "VSim";
 /* sysfs interface */
 static ssize_t pn544_test(struct device *dev,
@@ -740,6 +741,7 @@ static int __devinit pn544_probe(struct i2c_client *client,
        info->regs[0].supply = reg_vdd_io;
        info->regs[1].supply = reg_vbat;
+        info->regs[2].supply = reg_vsim;
        r = regulator_bulk_get(&client->dev, ARRAY_SIZE(info->regs),
                                 info->regs);
        if (r < 0)
diff --git a/drivers/of/pdt.c b/drivers/of/pdt.c
index 28295d0a50f6..4d87b5dc9284 100644
--- a/drivers/of/pdt.c
+++ b/drivers/of/pdt.c
@@ -36,19 +36,55 @@ unsigned int of_pdt_unique_id __initdata;
        (p)->unique_id = of_pdt_unique_id++; \
 } while (0)
-static inline const char *of_pdt_node_name(struct device_node *dp)
+static char * __init of_pdt_build_full_name(struct device_node *dp)
 {
-        return dp->path_component_name;
+        int len, ourlen, plen;
+        char *n;
+        dp->path_component_name = build_path_component(dp);
+        plen = strlen(dp->parent->full_name);
+        ourlen = strlen(dp->path_component_name);
+        len = ourlen + plen + 2;
+        n = prom_early_alloc(len);
+        strcpy(n, dp->parent->full_name);
+        if (!of_node_is_root(dp->parent)) {
+                strcpy(n + plen, "/");
+                plen++;
+        }
+        strcpy(n + plen, dp->path_component_name);
+        return n;
 }
-#else
+#else /* CONFIG_SPARC */
 static inline void of_pdt_incr_unique_id(void *p) { }
 static inline void irq_trans_init(struct device_node *dp) { }
-static inline const char *of_pdt_node_name(struct device_node *dp)
+static char * __init of_pdt_build_full_name(struct device_node *dp)
 {
-        return dp->name;
+        static int failsafe_id = 0; /* for generating unique names on failure */
+        char *buf;
+        int len;
+        if (of_pdt_prom_ops->pkg2path(dp->phandle, NULL, 0, &len))
+                goto failsafe;
+        buf = prom_early_alloc(len + 1);
+        if (of_pdt_prom_ops->pkg2path(dp->phandle, buf, len, &len))
+                goto failsafe;
+        return buf;
+ failsafe:
+        buf = prom_early_alloc(strlen(dp->parent->full_name) +
+                               strlen(dp->name) + 16);
+        sprintf(buf, "%s/%s@unknown%i",
+                of_node_is_root(dp->parent) ? "" : dp->parent->full_name,
+                dp->name, failsafe_id++);
+        pr_err("%s: pkg2path failed; assigning %s\n", __func__, buf);
+        return buf;
 }
 #endif /* !CONFIG_SPARC */
@@ -132,47 +168,6 @@ static char * __init of_pdt_get_one_property(phandle node, const char *name)
        return buf;
 }
-static char * __init of_pdt_try_pkg2path(phandle node)
-{
-        char *res, *buf = NULL;
-        int len;
-        if (!of_pdt_prom_ops->pkg2path)
-                return NULL;
-        if (of_pdt_prom_ops->pkg2path(node, buf, 0, &len))
-                return NULL;
-        buf = prom_early_alloc(len + 1);
-        if (of_pdt_prom_ops->pkg2path(node, buf, len, &len)) {
-                pr_err("%s: package-to-path failed\n", __func__);
-                return NULL;
-        }
-        res = strrchr(buf, '/');
-        if (!res) {
-                pr_err("%s: couldn't find / in %s\n", __func__, buf);
-                return NULL;
-        }
-        return res+1;
-}
-/*
- * When fetching the node's name, first try using package-to-path; if
- * that fails (either because the arch hasn't supplied a PROM callback,
- * or some other random failure), fall back to just looking at the node's
- * 'name' property.
- */
-static char * __init of_pdt_build_name(phandle node)
-{
-        char *buf;
-        buf = of_pdt_try_pkg2path(node);
-        if (!buf)
-                buf = of_pdt_get_one_property(node, "name");
-        return buf;
-}
 static struct device_node * __init of_pdt_create_node(phandle node,
                                                    struct device_node *parent)
 {
@@ -187,7 +182,7 @@ static struct device_node * __init of_pdt_create_node(phandle node,
        kref_init(&dp->kref);
-        dp->name = of_pdt_build_name(node);
+        dp->name = of_pdt_get_one_property(node, "name");
        dp->type = of_pdt_get_one_property(node, "device_type");
        dp->phandle = node;
@@ -198,26 +193,6 @@ static struct device_node * __init of_pdt_create_node(phandle node,
        return dp;
 }
-static char * __init of_pdt_build_full_name(struct device_node *dp)
-{
-        int len, ourlen, plen;
-        char *n;
-        plen = strlen(dp->parent->full_name);
-        ourlen = strlen(of_pdt_node_name(dp));
-        len = ourlen + plen + 2;
-        n = prom_early_alloc(len);
-        strcpy(n, dp->parent->full_name);
-        if (!of_node_is_root(dp->parent)) {
-                strcpy(n + plen, "/");
-                plen++;
-        }
-        strcpy(n + plen, of_pdt_node_name(dp));
-        return n;
-}
 static struct device_node * __init of_pdt_build_tree(struct device_node *parent,
                                                   phandle node,
                                                   struct device_node ***nextp)
@@ -240,9 +215,6 @@ static struct device_node * __init of_pdt_build_tree(struct device_node *parent,
                *(*nextp) = dp;
                *nextp = &dp->allnext;
-#if defined(CONFIG_SPARC)
-                dp->path_component_name = build_path_component(dp);
-#endif
                dp->full_name = of_pdt_build_full_name(dp);
                dp->child = of_pdt_build_tree(dp,
diff --git a/drivers/pci/xen-pcifront.c b/drivers/pci/xen-pcifront.c
index 3a5a6fcc0ead..492b7d807fe8 100644
--- a/drivers/pci/xen-pcifront.c
+++ b/drivers/pci/xen-pcifront.c
@@ -243,7 +243,7 @@ struct pci_ops pcifront_bus_ops = {
 #ifdef CONFIG_PCI_MSI
 static int pci_frontend_enable_msix(struct pci_dev *dev,
-                                    int **vector, int nvec)
+                                    int vector[], int nvec)
 {
        int err;
        int i;
@@ -277,18 +277,24 @@ static int pci_frontend_enable_msix(struct pci_dev *dev,
        if (likely(!err)) {
                if (likely(!op.value)) {
                        /* we get the result */
-                        for (i = 0; i < nvec; i++)
+                        for (i = 0; i < nvec; i++) {
-                                *(*vector+i) = op.msix_entries[i].vector;
+                                if (op.msix_entries[i].vector <= 0) {
-                        return 0;
+                                        dev_warn(&dev->dev, "MSI-X entry %d is invalid: %d!\n",
+                                                i, op.msix_entries[i].vector);
+                                        err = -EINVAL;
+                                        vector[i] = -1;
+                                        continue;
+                                }
+                                vector[i] = op.msix_entries[i].vector;
+                        }
                } else {
                        printk(KERN_DEBUG "enable msix get value %x\n",
                                op.value);
-                        return op.value;
                }
        } else {
                dev_err(&dev->dev, "enable msix get err %x\n", err);
-                return err;
        }
+        return err;
 }
 static void pci_frontend_disable_msix(struct pci_dev *dev)
@@ -310,7 +316,7 @@ static void pci_frontend_disable_msix(struct pci_dev *dev)
                dev_err(&dev->dev, "pci_disable_msix get err %x\n", err);
 }
-static int pci_frontend_enable_msi(struct pci_dev *dev, int **vector)
+static int pci_frontend_enable_msi(struct pci_dev *dev, int vector[])
 {
        int err;
        struct xen_pci_op op = {
@@ -324,7 +330,13 @@ static int pci_frontend_enable_msi(struct pci_dev *dev, int **vector)
        err = do_pci_op(pdev, &op);
        if (likely(!err)) {
-                *(*vector) = op.value;
+                vector[0] = op.value;
+                if (op.value <= 0) {
+                        dev_warn(&dev->dev, "MSI entry is invalid: %d!\n",
+                                op.value);
+                        err = -EINVAL;
+                        vector[0] = -1;
+                }
        } else {
                dev_err(&dev->dev, "pci frontend enable msi failed for dev "
                                    "%x:%x\n", op.bus, op.devfn);
@@ -733,8 +745,7 @@ static void free_pdev(struct pcifront_device *pdev)
        pcifront_free_roots(pdev);
-        /*For PCIE_AER error handling job*/
+        cancel_work_sync(&pdev->op_work);
-        flush_scheduled_work();
        if (pdev->irq >= 0)
                unbind_from_irqhandler(pdev->irq, pdev);
diff --git a/drivers/pcmcia/pcmcia_resource.c b/drivers/pcmcia/pcmcia_resource.c
index 0bdda5b3ed55..42fbf1a75576 100644
--- a/drivers/pcmcia/pcmcia_resource.c
+++ b/drivers/pcmcia/pcmcia_resource.c
@@ -518,6 +518,8 @@ int pcmcia_enable_device(struct pcmcia_device *p_dev)
                flags |= CONF_ENABLE_IOCARD;
        if (flags & CONF_ENABLE_IOCARD)
                s->socket.flags |= SS_IOCARD;
+        if (flags & CONF_ENABLE_ZVCARD)
+                s->socket.flags |= SS_ZVCARD | SS_IOCARD;
        if (flags & CONF_ENABLE_SPKR) {
                s->socket.flags |= SS_SPKR_ENA;
                status = CCSR_AUDIO_ENA;
diff --git a/drivers/pcmcia/pxa2xx_base.c b/drivers/pcmcia/pxa2xx_base.c
index 3755e7c8c715..2c540542b5af 100644
--- a/drivers/pcmcia/pxa2xx_base.c
+++ b/drivers/pcmcia/pxa2xx_base.c
@@ -215,7 +215,7 @@ pxa2xx_pcmcia_frequency_change(struct soc_pcmcia_socket *skt,
 }
 #endif
-static void pxa2xx_configure_sockets(struct device *dev)
+void pxa2xx_configure_sockets(struct device *dev)
 {
        struct pcmcia_low_level *ops = dev->platform_data;
        /*
diff --git a/drivers/pcmcia/pxa2xx_base.h b/drivers/pcmcia/pxa2xx_base.h
index bb62ea87b8f9..b609b45469ed 100644
--- a/drivers/pcmcia/pxa2xx_base.h
+++ b/drivers/pcmcia/pxa2xx_base.h
@@ -1,3 +1,4 @@
 int pxa2xx_drv_pcmcia_add_one(struct soc_pcmcia_socket *skt);
 void pxa2xx_drv_pcmcia_ops(struct pcmcia_low_level *ops);
+void pxa2xx_configure_sockets(struct device *dev);
diff --git a/drivers/pcmcia/pxa2xx_colibri.c b/drivers/pcmcia/pxa2xx_colibri.c
index c3f72192af66..a52039564e74 100644
--- a/drivers/pcmcia/pxa2xx_colibri.c
+++ b/drivers/pcmcia/pxa2xx_colibri.c
@@ -181,6 +181,9 @@ static int __init colibri_pcmcia_init(void)
 {
        int ret;
+        if (!machine_is_colibri() && !machine_is_colibri320())
+                return -ENODEV;
        colibri_pcmcia_device = platform_device_alloc("pxa2xx-pcmcia", -1);
        if (!colibri_pcmcia_device)
                return -ENOMEM;
diff --git a/drivers/pcmcia/pxa2xx_lubbock.c b/drivers/pcmcia/pxa2xx_lubbock.c
index b9f8c8fb42bd..25afe637c657 100644
--- a/drivers/pcmcia/pxa2xx_lubbock.c
+++ b/drivers/pcmcia/pxa2xx_lubbock.c
@@ -226,6 +226,7 @@ int pcmcia_lubbock_init(struct sa1111_dev *sadev)
                lubbock_set_misc_wr((1 << 15) | (1 << 14), 0);
                pxa2xx_drv_pcmcia_ops(&lubbock_pcmcia_ops);
+                pxa2xx_configure_sockets(&sadev->dev);
                ret = sa1111_pcmcia_add(sadev, &lubbock_pcmcia_ops,
                                pxa2xx_drv_pcmcia_add_one);
        }
diff --git a/drivers/pps/generators/Kconfig b/drivers/pps/generators/Kconfig
index f3a73dd77660..e4c4f3dc0728 100644
--- a/drivers/pps/generators/Kconfig
+++ b/drivers/pps/generators/Kconfig
@@ -6,7 +6,7 @@ comment "PPS generators support"
 config PPS_GENERATOR_PARPORT
        tristate "Parallel port PPS signal generator"
-        depends on PARPORT
+        depends on PARPORT && BROKEN
        help
          If you say yes here you get support for a PPS signal generator which
          utilizes STROBE pin of a parallel port to send PPS signals. It uses
diff --git a/drivers/pps/kapi.c b/drivers/pps/kapi.c
index cba1b43f7519..a4e8eb9fece6 100644
--- a/drivers/pps/kapi.c
+++ b/drivers/pps/kapi.c
@@ -168,7 +168,7 @@ void pps_event(struct pps_device *pps, struct pps_event_time *ts, int event,
 {
        unsigned long flags;
        int captured = 0;
-        struct pps_ktime ts_real;
+        struct pps_ktime ts_real = { .sec = 0, .nsec = 0, .flags = 0 };
        /* check event type */
        BUG_ON((event & (PPS_CAPTUREASSERT | PPS_CAPTURECLEAR)) == 0);
diff --git a/drivers/rapidio/rio-sysfs.c b/drivers/rapidio/rio-sysfs.c
index 76b41853a877..1269fbd2deca 100644
--- a/drivers/rapidio/rio-sysfs.c
+++ b/drivers/rapidio/rio-sysfs.c
@@ -77,9 +77,9 @@ rio_read_config(struct file *filp, struct kobject *kobj,
        /* Several chips lock up trying to read undefined config space */
        if (capable(CAP_SYS_ADMIN))
-                size = 0x200000;
+                size = RIO_MAINT_SPACE_SZ;
-        if (off > size)
+        if (off >= size)
                return 0;
        if (off + count > size) {
                size -= off;
@@ -147,10 +147,10 @@ rio_write_config(struct file *filp, struct kobject *kobj,
        loff_t init_off = off;
        u8 *data = (u8 *) buf;
-        if (off > 0x200000)
+        if (off >= RIO_MAINT_SPACE_SZ)
                return 0;
-        if (off + count > 0x200000) {
+        if (off + count > RIO_MAINT_SPACE_SZ) {
-                size = 0x200000 - off;
+                size = RIO_MAINT_SPACE_SZ - off;
                count = size;
        }
@@ -200,7 +200,7 @@ static struct bin_attribute rio_config_attr = {
                 .name = "config",
                 .mode = S_IRUGO | S_IWUSR,
                 },
-        .size = 0x200000,
+        .size = RIO_MAINT_SPACE_SZ,
        .read = rio_read_config,
        .write = rio_write_config,
 };
diff --git a/drivers/regulator/mc13xxx-regulator-core.c b/drivers/regulator/mc13xxx-regulator-core.c
index f53d31b950d4..2bb5de1f2421 100644
--- a/drivers/regulator/mc13xxx-regulator-core.c
+++ b/drivers/regulator/mc13xxx-regulator-core.c
@@ -174,7 +174,7 @@ static int mc13xxx_regulator_get_voltage(struct regulator_dev *rdev)
        dev_dbg(rdev_get_dev(rdev), "%s id: %d val: %d\n", __func__, id, val);
-        BUG_ON(val < 0 || val > mc13xxx_regulators[id].desc.n_voltages);
+        BUG_ON(val > mc13xxx_regulators[id].desc.n_voltages);
        return mc13xxx_regulators[id].voltages[val];
 }
diff --git a/drivers/regulator/wm831x-dcdc.c b/drivers/regulator/wm831x-dcdc.c
index 8b0d2c4bde91..06df898842c0 100644
--- a/drivers/regulator/wm831x-dcdc.c
+++ b/drivers/regulator/wm831x-dcdc.c
@@ -120,6 +120,7 @@ static unsigned int wm831x_dcdc_get_mode(struct regulator_dev *rdev)
                return REGULATOR_MODE_IDLE;
        default:
                BUG();
+                return -EINVAL;
        }
 }
diff --git a/drivers/rtc/rtc-at91sam9.c b/drivers/rtc/rtc-at91sam9.c
index c36749e4c926..5469c52cba3d 100644
--- a/drivers/rtc/rtc-at91sam9.c
+++ b/drivers/rtc/rtc-at91sam9.c
@@ -309,7 +309,7 @@ static const struct rtc_class_ops at91_rtc_ops = {
        .read_alarm     = at91_rtc_readalarm,
        .set_alarm      = at91_rtc_setalarm,
        .proc           = at91_rtc_proc,
-        .alarm_irq_enabled = at91_rtc_alarm_irq_enable,
+        .alarm_irq_enable = at91_rtc_alarm_irq_enable,
 };
 /*
diff --git a/drivers/rtc/rtc-ds3232.c b/drivers/rtc/rtc-ds3232.c
index 23a9ee19764c..950735415a7c 100644
--- a/drivers/rtc/rtc-ds3232.c
+++ b/drivers/rtc/rtc-ds3232.c
@@ -1,7 +1,7 @@
 /*
 * RTC client/driver for the Maxim/Dallas DS3232 Real-Time Clock over I2C
 *
- * Copyright (C) 2009-2010 Freescale Semiconductor.
+ * Copyright (C) 2009-2011 Freescale Semiconductor.
 * Author: Jack Lan <jack.lan@freescale.com>
 *
 * This program is free software; you can redistribute  it and/or modify it
@@ -141,9 +141,11 @@ static int ds3232_read_time(struct device *dev, struct rtc_time *time)
                time->tm_hour = bcd2bin(hour);
        }
-        time->tm_wday = bcd2bin(week);
+        /* Day of the week in linux range is 0~6 while 1~7 in RTC chip */
+        time->tm_wday = bcd2bin(week) - 1;
        time->tm_mday = bcd2bin(day);
-        time->tm_mon = bcd2bin(month & 0x7F);
+        /* linux tm_mon range:0~11, while month range is 1~12 in RTC chip */
+        time->tm_mon = bcd2bin(month & 0x7F) - 1;
        if (century)
                add_century = 100;
@@ -162,9 +164,11 @@ static int ds3232_set_time(struct device *dev, struct rtc_time *time)
        buf[0] = bin2bcd(time->tm_sec);
        buf[1] = bin2bcd(time->tm_min);
        buf[2] = bin2bcd(time->tm_hour);
-        buf[3] = bin2bcd(time->tm_wday); /* Day of the week */
+        /* Day of the week in linux range is 0~6 while 1~7 in RTC chip */
+        buf[3] = bin2bcd(time->tm_wday + 1);
        buf[4] = bin2bcd(time->tm_mday); /* Date */
-        buf[5] = bin2bcd(time->tm_mon);
+        /* linux tm_mon range:0~11, while month range is 1~12 in RTC chip */
+        buf[5] = bin2bcd(time->tm_mon + 1);
        if (time->tm_year >= 100) {
                buf[5] |= 0x80;
                buf[6] = bin2bcd(time->tm_year - 100);
diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
index cf953ecbfca9..b80fa2882408 100644
--- a/drivers/rtc/rtc-s3c.c
+++ b/drivers/rtc/rtc-s3c.c
@@ -77,18 +77,20 @@ static irqreturn_t s3c_rtc_tickirq(int irq, void *id)
 }
 /* Update control registers */
-static void s3c_rtc_setaie(int to)
+static int s3c_rtc_setaie(struct device *dev, unsigned int enabled)
 {
        unsigned int tmp;
-        pr_debug("%s: aie=%d\n", __func__, to);
+        pr_debug("%s: aie=%d\n", __func__, enabled);
        tmp = readb(s3c_rtc_base + S3C2410_RTCALM) & ~S3C2410_RTCALM_ALMEN;
-        if (to)
+        if (enabled)
                tmp |= S3C2410_RTCALM_ALMEN;
        writeb(tmp, s3c_rtc_base + S3C2410_RTCALM);
+        return 0;
 }
 static int s3c_rtc_setpie(struct device *dev, int enabled)
@@ -308,7 +310,7 @@ static int s3c_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
        writeb(alrm_en, base + S3C2410_RTCALM);
-        s3c_rtc_setaie(alrm->enabled);
+        s3c_rtc_setaie(dev, alrm->enabled);
        return 0;
 }
@@ -440,7 +442,7 @@ static int __devexit s3c_rtc_remove(struct platform_device *dev)
        rtc_device_unregister(rtc);
        s3c_rtc_setpie(&dev->dev, 0);
-        s3c_rtc_setaie(0);
+        s3c_rtc_setaie(&dev->dev, 0);
        clk_disable(rtc_clk);
        clk_put(rtc_clk);
diff --git a/drivers/s390/block/xpram.c b/drivers/s390/block/xpram.c
index c881a14fa5dd..1f6a4d894e73 100644
--- a/drivers/s390/block/xpram.c
+++ b/drivers/s390/block/xpram.c
@@ -62,8 +62,8 @@ static int xpram_devs;
 /*
 * Parameter parsing functions.
 */
-static int __initdata devs = XPRAM_DEVS;
+static int devs = XPRAM_DEVS;
-static char __initdata *sizes[XPRAM_MAX_DEVS];
+static char *sizes[XPRAM_MAX_DEVS];
 module_param(devs, int, 0);
 module_param_array(sizes, charp, NULL, 0);
diff --git a/drivers/s390/char/keyboard.c b/drivers/s390/char/keyboard.c
index 8cd58e412b5e..5ad44daef73b 100644
--- a/drivers/s390/char/keyboard.c
+++ b/drivers/s390/char/keyboard.c
@@ -460,7 +460,8 @@ kbd_ioctl(struct kbd_data *kbd, struct file *file,
          unsigned int cmd, unsigned long arg)
 {
        void __user *argp;
-        int ct, perm;
+        unsigned int ct;
+        int perm;
        argp = (void __user *)arg;
diff --git a/drivers/s390/char/tape.h b/drivers/s390/char/tape.h
index 7a242f073632..267b54e8ff5a 100644
--- a/drivers/s390/char/tape.h
+++ b/drivers/s390/char/tape.h
@@ -280,6 +280,14 @@ tape_do_io_free(struct tape_device *device, struct tape_request *request)
        return rc;
 }
+static inline void
+tape_do_io_async_free(struct tape_device *device, struct tape_request *request)
+{
+        request->callback = (void *) tape_free_request;
+        request->callback_data = NULL;
+        tape_do_io_async(device, request);
+}
 extern int tape_oper_handler(int irq, int status);
 extern void tape_noper_handler(int irq, int status);
 extern int tape_open(struct tape_device *);
diff --git a/drivers/s390/char/tape_34xx.c b/drivers/s390/char/tape_34xx.c
index c17f35b6136a..c26511171ffe 100644
--- a/drivers/s390/char/tape_34xx.c
+++ b/drivers/s390/char/tape_34xx.c
@@ -53,23 +53,11 @@ static void tape_34xx_delete_sbid_from(struct tape_device *, int);
 * Medium sense for 34xx tapes. There is no 'real' medium sense call.
 * So we just do a normal sense.
 */
-static int
+static void __tape_34xx_medium_sense(struct tape_request *request)
-tape_34xx_medium_sense(struct tape_device *device)
 {
-        struct tape_request *request;
+        struct tape_device *device = request->device;
-        unsigned char       *sense;
+        unsigned char *sense;
-        int                  rc;
-        request = tape_alloc_request(1, 32);
-        if (IS_ERR(request)) {
-                DBF_EXCEPTION(6, "MSEN fail\n");
-                return PTR_ERR(request);
-        }
-        request->op = TO_MSEN;
-        tape_ccw_end(request->cpaddr, SENSE, 32, request->cpdata);
-        rc = tape_do_io_interruptible(device, request);
        if (request->rc == 0) {
                sense = request->cpdata;
@@ -88,15 +76,47 @@ tape_34xx_medium_sense(struct tape_device *device)
                        device->tape_generic_status |= GMT_WR_PROT(~0);
                else
                        device->tape_generic_status &= ~GMT_WR_PROT(~0);
-        } else {
+        } else
                DBF_EVENT(4, "tape_34xx: medium sense failed with rc=%d\n",
                        request->rc);
-        }
        tape_free_request(request);
+}
+static int tape_34xx_medium_sense(struct tape_device *device)
+{
+        struct tape_request *request;
+        int rc;
+        request = tape_alloc_request(1, 32);
+        if (IS_ERR(request)) {
+                DBF_EXCEPTION(6, "MSEN fail\n");
+                return PTR_ERR(request);
+        }
+        request->op = TO_MSEN;
+        tape_ccw_end(request->cpaddr, SENSE, 32, request->cpdata);
+        rc = tape_do_io_interruptible(device, request);
+        __tape_34xx_medium_sense(request);
        return rc;
 }
+static void tape_34xx_medium_sense_async(struct tape_device *device)
+{
+        struct tape_request *request;
+        request = tape_alloc_request(1, 32);
+        if (IS_ERR(request)) {
+                DBF_EXCEPTION(6, "MSEN fail\n");
+                return;
+        }
+        request->op = TO_MSEN;
+        tape_ccw_end(request->cpaddr, SENSE, 32, request->cpdata);
+        request->callback = (void *) __tape_34xx_medium_sense;
+        request->callback_data = NULL;
+        tape_do_io_async(device, request);
+}
 struct tape_34xx_work {
        struct tape_device      *device;
        enum tape_op             op;
@@ -109,6 +129,9 @@ struct tape_34xx_work {
 * is inserted but cannot call tape_do_io* from an interrupt context.
 * Maybe that's useful for other actions we want to start from the
 * interrupt handler.
+ * Note: the work handler is called by the system work queue. The tape
+ * commands started by the handler need to be asynchrounous, otherwise
+ * a deadlock can occur e.g. in case of a deferred cc=1 (see __tape_do_irq).
 */
 static void
 tape_34xx_work_handler(struct work_struct *work)
@@ -119,7 +142,7 @@ tape_34xx_work_handler(struct work_struct *work)
        switch(p->op) {
                case TO_MSEN:
-                        tape_34xx_medium_sense(device);
+                        tape_34xx_medium_sense_async(device);
                        break;
                default:
                        DBF_EVENT(3, "T34XX: internal error: unknown work\n");
diff --git a/drivers/s390/char/tape_3590.c b/drivers/s390/char/tape_3590.c
index fbe361fcd2c0..de2e99e0a71b 100644
--- a/drivers/s390/char/tape_3590.c
+++ b/drivers/s390/char/tape_3590.c
@@ -329,17 +329,17 @@ out:
 /*
 * Enable encryption
 */
-static int tape_3592_enable_crypt(struct tape_device *device)
+static struct tape_request *__tape_3592_enable_crypt(struct tape_device *device)
 {
        struct tape_request *request;
        char *data;
        DBF_EVENT(6, "tape_3592_enable_crypt\n");
        if (!crypt_supported(device))
-                return -ENOSYS;
+                return ERR_PTR(-ENOSYS);
        request = tape_alloc_request(2, 72);
        if (IS_ERR(request))
-                return PTR_ERR(request);
+                return request;
        data = request->cpdata;
        memset(data,0,72);
@@ -354,23 +354,42 @@ static int tape_3592_enable_crypt(struct tape_device *device)
        request->op = TO_CRYPT_ON;
        tape_ccw_cc(request->cpaddr, MODE_SET_CB, 36, data);
        tape_ccw_end(request->cpaddr + 1, MODE_SET_CB, 36, data + 36);
+        return request;
+}
+static int tape_3592_enable_crypt(struct tape_device *device)
+{
+        struct tape_request *request;
+        request = __tape_3592_enable_crypt(device);
+        if (IS_ERR(request))
+                return PTR_ERR(request);
        return tape_do_io_free(device, request);
 }
+static void tape_3592_enable_crypt_async(struct tape_device *device)
+{
+        struct tape_request *request;
+        request = __tape_3592_enable_crypt(device);
+        if (!IS_ERR(request))
+                tape_do_io_async_free(device, request);
+}
 /*
 * Disable encryption
 */
-static int tape_3592_disable_crypt(struct tape_device *device)
+static struct tape_request *__tape_3592_disable_crypt(struct tape_device *device)
 {
        struct tape_request *request;
        char *data;
        DBF_EVENT(6, "tape_3592_disable_crypt\n");
        if (!crypt_supported(device))
-                return -ENOSYS;
+                return ERR_PTR(-ENOSYS);
        request = tape_alloc_request(2, 72);
        if (IS_ERR(request))
-                return PTR_ERR(request);
+                return request;
        data = request->cpdata;
        memset(data,0,72);
@@ -383,9 +402,28 @@ static int tape_3592_disable_crypt(struct tape_device *device)
        tape_ccw_cc(request->cpaddr, MODE_SET_CB, 36, data);
        tape_ccw_end(request->cpaddr + 1, MODE_SET_CB, 36, data + 36);
+        return request;
+}
+static int tape_3592_disable_crypt(struct tape_device *device)
+{
+        struct tape_request *request;
+        request = __tape_3592_disable_crypt(device);
+        if (IS_ERR(request))
+                return PTR_ERR(request);
        return tape_do_io_free(device, request);
 }
+static void tape_3592_disable_crypt_async(struct tape_device *device)
+{
+        struct tape_request *request;
+        request = __tape_3592_disable_crypt(device);
+        if (!IS_ERR(request))
+                tape_do_io_async_free(device, request);
+}
 /*
 * IOCTL: Set encryption status
 */
@@ -457,8 +495,7 @@ tape_3590_ioctl(struct tape_device *device, unsigned int cmd, unsigned long arg)
 /*
 * SENSE Medium: Get Sense data about medium state
 */
-static int
+static int tape_3590_sense_medium(struct tape_device *device)
-tape_3590_sense_medium(struct tape_device *device)
 {
        struct tape_request *request;
@@ -470,6 +507,18 @@ tape_3590_sense_medium(struct tape_device *device)
        return tape_do_io_free(device, request);
 }
+static void tape_3590_sense_medium_async(struct tape_device *device)
+{
+        struct tape_request *request;
+        request = tape_alloc_request(1, 128);
+        if (IS_ERR(request))
+                return;
+        request->op = TO_MSEN;
+        tape_ccw_end(request->cpaddr, MEDIUM_SENSE, 128, request->cpdata);
+        tape_do_io_async_free(device, request);
+}
 /*
 * MTTELL: Tell block. Return the number of block relative to current file.
 */
@@ -546,15 +595,14 @@ tape_3590_read_opposite(struct tape_device *device,
 * 2. The attention msg is written to the "read subsystem data" buffer.
 * In this case we probably should print it to the console.
 */
-static int
+static void tape_3590_read_attmsg_async(struct tape_device *device)
-tape_3590_read_attmsg(struct tape_device *device)
 {
        struct tape_request *request;
        char *buf;
        request = tape_alloc_request(3, 4096);
        if (IS_ERR(request))
-                return PTR_ERR(request);
+                return;
        request->op = TO_READ_ATTMSG;
        buf = request->cpdata;
        buf[0] = PREP_RD_SS_DATA;
@@ -562,12 +610,15 @@ tape_3590_read_attmsg(struct tape_device *device)
        tape_ccw_cc(request->cpaddr, PERFORM_SS_FUNC, 12, buf);
        tape_ccw_cc(request->cpaddr + 1, READ_SS_DATA, 4096 - 12, buf + 12);
        tape_ccw_end(request->cpaddr + 2, NOP, 0, NULL);
-        return tape_do_io_free(device, request);
+        tape_do_io_async_free(device, request);
 }
 /*
 * These functions are used to schedule follow-up actions from within an
 * interrupt context (like unsolicited interrupts).
+ * Note: the work handler is called by the system work queue. The tape
+ * commands started by the handler need to be asynchrounous, otherwise
+ * a deadlock can occur e.g. in case of a deferred cc=1 (see __tape_do_irq).
 */
 struct work_handler_data {
        struct tape_device *device;
@@ -583,16 +634,16 @@ tape_3590_work_handler(struct work_struct *work)
        switch (p->op) {
        case TO_MSEN:
-                tape_3590_sense_medium(p->device);
+                tape_3590_sense_medium_async(p->device);
                break;
        case TO_READ_ATTMSG:
-                tape_3590_read_attmsg(p->device);
+                tape_3590_read_attmsg_async(p->device);
                break;
        case TO_CRYPT_ON:
-                tape_3592_enable_crypt(p->device);
+                tape_3592_enable_crypt_async(p->device);
                break;
        case TO_CRYPT_OFF:
-                tape_3592_disable_crypt(p->device);
+                tape_3592_disable_crypt_async(p->device);
                break;
        default:
                DBF_EVENT(3, "T3590: work handler undefined for "
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 9045c52abd25..fb2bb35c62cb 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -443,7 +443,7 @@ static void scsi_run_queue(struct request_queue *q)
                                        &sdev->request_queue->queue_flags);
                if (flagset)
                        queue_flag_set(QUEUE_FLAG_REENTER, sdev->request_queue);
-                __blk_run_queue(sdev->request_queue);
+                __blk_run_queue(sdev->request_queue, false);
                if (flagset)
                        queue_flag_clear(QUEUE_FLAG_REENTER, sdev->request_queue);
                spin_unlock(sdev->request_queue->queue_lock);
diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index 998c01be3234..5c3ccfc6b622 100644
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -3829,7 +3829,7 @@ fc_bsg_goose_queue(struct fc_rport *rport)
                  !test_bit(QUEUE_FLAG_REENTER, &rport->rqst_q->queue_flags);
        if (flagset)
                queue_flag_set(QUEUE_FLAG_REENTER, rport->rqst_q);
-        __blk_run_queue(rport->rqst_q);
+        __blk_run_queue(rport->rqst_q, false);
        if (flagset)
                queue_flag_clear(QUEUE_FLAG_REENTER, rport->rqst_q);
        spin_unlock_irqrestore(rport->rqst_q->queue_lock, flags);
diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
index 158cecbec718..4a109835e420 100644
--- a/drivers/target/target_core_tmr.c
+++ b/drivers/target/target_core_tmr.c
@@ -282,6 +282,9 @@ int core_tmr_lun_reset(
                        atomic_set(&task->task_active, 0);
                        atomic_set(&task->task_stop, 0);
+                } else {
+                        if (atomic_read(&task->task_execute_queue) != 0)
+                                transport_remove_task_from_execute_queue(task, dev);
                }
                __transport_stop_task_timer(task, &flags);
@@ -301,6 +304,7 @@ int core_tmr_lun_reset(
                        DEBUG_LR("LUN_RESET: got t_transport_active = 1 for"
                                " task: %p, t_fe_count: %d dev: %p\n", task,
                                fe_count, dev);
+                        atomic_set(&T_TASK(cmd)->t_transport_aborted, 1);
                        spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock,
                                                flags);
                        core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count);
@@ -310,6 +314,7 @@ int core_tmr_lun_reset(
                }
                DEBUG_LR("LUN_RESET: Got t_transport_active = 0 for task: %p,"
                        " t_fe_count: %d dev: %p\n", task, fe_count, dev);
+                atomic_set(&T_TASK(cmd)->t_transport_aborted, 1);
                spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
                core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count);
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 236e22d8cfae..4bbf6c147f89 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -1207,7 +1207,7 @@ transport_get_task_from_execute_queue(struct se_device *dev)
 *
 *
 */
-static void transport_remove_task_from_execute_queue(
+void transport_remove_task_from_execute_queue(
        struct se_task *task,
        struct se_device *dev)
 {
@@ -5549,7 +5549,8 @@ static void transport_generic_wait_for_tasks(
                atomic_set(&T_TASK(cmd)->transport_lun_stop, 0);
        }
-        if (!atomic_read(&T_TASK(cmd)->t_transport_active))
+        if (!atomic_read(&T_TASK(cmd)->t_transport_active) ||
+             atomic_read(&T_TASK(cmd)->t_transport_aborted))
                goto remove;
        atomic_set(&T_TASK(cmd)->t_transport_stop, 1);
@@ -5956,6 +5957,9 @@ static void transport_processing_shutdown(struct se_device *dev)
                        atomic_set(&task->task_active, 0);
                        atomic_set(&task->task_stop, 0);
+                } else {
+                        if (atomic_read(&task->task_execute_queue) != 0)
+                                transport_remove_task_from_execute_queue(task, dev);
                }
                __transport_stop_task_timer(task, &flags);
diff --git a/drivers/thermal/Kconfig b/drivers/thermal/Kconfig
index f7a5dba3ca23..bf7c687519ef 100644
--- a/drivers/thermal/Kconfig
+++ b/drivers/thermal/Kconfig
@@ -4,7 +4,6 @@
 menuconfig THERMAL
        tristate "Generic Thermal sysfs driver"
-        depends on NET
        help
          Generic Thermal Sysfs driver offers a generic mechanism for
          thermal management. Usually it's made up of one or more thermal
diff --git a/drivers/thermal/thermal_sys.c b/drivers/thermal/thermal_sys.c
index 7d0e63c79280..713b7ea4a607 100644
--- a/drivers/thermal/thermal_sys.c
+++ b/drivers/thermal/thermal_sys.c
@@ -62,20 +62,6 @@ static DEFINE_MUTEX(thermal_list_lock);
 static unsigned int thermal_event_seqnum;
-static struct genl_family thermal_event_genl_family = {
-        .id = GENL_ID_GENERATE,
-        .name = THERMAL_GENL_FAMILY_NAME,
-        .version = THERMAL_GENL_VERSION,
-        .maxattr = THERMAL_GENL_ATTR_MAX,
-};
-static struct genl_multicast_group thermal_event_mcgrp = {
-        .name = THERMAL_GENL_MCAST_GROUP_NAME,
-};
-static int genetlink_init(void);
-static void genetlink_exit(void);
 static int get_idr(struct idr *idr, struct mutex *lock, int *id)
 {
        int err;
@@ -1225,6 +1211,18 @@ void thermal_zone_device_unregister(struct thermal_zone_device *tz)
 EXPORT_SYMBOL(thermal_zone_device_unregister);
+#ifdef CONFIG_NET
+static struct genl_family thermal_event_genl_family = {
+        .id = GENL_ID_GENERATE,
+        .name = THERMAL_GENL_FAMILY_NAME,
+        .version = THERMAL_GENL_VERSION,
+        .maxattr = THERMAL_GENL_ATTR_MAX,
+};
+static struct genl_multicast_group thermal_event_mcgrp = {
+        .name = THERMAL_GENL_MCAST_GROUP_NAME,
+};
 int generate_netlink_event(u32 orig, enum events event)
 {
        struct sk_buff *skb;
@@ -1301,6 +1299,15 @@ static int genetlink_init(void)
        return result;
 }
+static void genetlink_exit(void)
+{
+        genl_unregister_family(&thermal_event_genl_family);
+}
+#else /* !CONFIG_NET */
+static inline int genetlink_init(void) { return 0; }
+static inline void genetlink_exit(void) {}
+#endif /* !CONFIG_NET */
 static int __init thermal_init(void)
 {
        int result = 0;
@@ -1316,11 +1323,6 @@ static int __init thermal_init(void)
        return result;
 }
-static void genetlink_exit(void)
-{
-        genl_unregister_family(&thermal_event_genl_family);
-}
 static void __exit thermal_exit(void)
 {
        class_unregister(&thermal_class);
diff --git a/drivers/tty/serial/serial_cs.c b/drivers/tty/serial/serial_cs.c
index 93760b2ea172..1ef4df9bf7e4 100644
--- a/drivers/tty/serial/serial_cs.c
+++ b/drivers/tty/serial/serial_cs.c
@@ -712,6 +712,7 @@ static struct pcmcia_device_id serial_ids[] = {
        PCMCIA_PFC_DEVICE_PROD_ID12(1, "Xircom", "CreditCard Ethernet+Modem II", 0x2e3ee845, 0xeca401bf),
        PCMCIA_PFC_DEVICE_MANF_CARD(1, 0x0032, 0x0e01),
        PCMCIA_PFC_DEVICE_MANF_CARD(1, 0x0032, 0x0a05),
+        PCMCIA_PFC_DEVICE_MANF_CARD(1, 0x0032, 0x0b05),
        PCMCIA_PFC_DEVICE_MANF_CARD(1, 0x0032, 0x1101),
        PCMCIA_MFC_DEVICE_MANF_CARD(0, 0x0104, 0x0070),
        PCMCIA_MFC_DEVICE_MANF_CARD(1, 0x0101, 0x0562),
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index d041c6826e43..0f299b7aad60 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2681,17 +2681,13 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1,
        mutex_lock(&usb_address0_mutex);
-        if (!udev->config && oldspeed == USB_SPEED_SUPER) {
+        /* Reset the device; full speed may morph to high speed */
-                /* Don't reset USB 3.0 devices during an initial setup */
+        /* FIXME a USB 2.0 device may morph into SuperSpeed on reset. */
-                usb_set_device_state(udev, USB_STATE_DEFAULT);
+        retval = hub_port_reset(hub, port1, udev, delay);
-        } else {
+        if (retval < 0)         /* error or disconnect */
-                /* Reset the device; full speed may morph to high speed */
+                goto fail;
-                /* FIXME a USB 2.0 device may morph into SuperSpeed on reset. */
+        /* success, speed is known */
-                retval = hub_port_reset(hub, port1, udev, delay);
-                if (retval < 0)         /* error or disconnect */
-                        goto fail;
-                /* success, speed is known */
-        }
        retval = -ENODEV;
        if (oldspeed != USB_SPEED_UNKNOWN && oldspeed != udev->speed) {
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 44c595432d6f..81ce6a8e1d94 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -48,6 +48,10 @@ static const struct usb_device_id usb_quirk_list[] = {
        { USB_DEVICE(0x04b4, 0x0526), .driver_info =
                        USB_QUIRK_CONFIG_INTF_STRINGS },
+        /* Samsung Android phone modem - ID conflict with SPH-I500 */
+        { USB_DEVICE(0x04e8, 0x6601), .driver_info =
+                        USB_QUIRK_CONFIG_INTF_STRINGS },
        /* Roland SC-8820 */
        { USB_DEVICE(0x0582, 0x0007), .driver_info = USB_QUIRK_RESET_RESUME },
@@ -68,6 +72,10 @@ static const struct usb_device_id usb_quirk_list[] = {
        /* M-Systems Flash Disk Pioneers */
        { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME },
+        /* Keytouch QWERTY Panel keyboard */
+        { USB_DEVICE(0x0926, 0x3333), .driver_info =
+                        USB_QUIRK_CONFIG_INTF_STRINGS },
        /* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */
        { USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF },
diff --git a/drivers/usb/gadget/f_phonet.c b/drivers/usb/gadget/f_phonet.c
index 3c6e1a058745..5e1495097ec3 100644
--- a/drivers/usb/gadget/f_phonet.c
+++ b/drivers/usb/gadget/f_phonet.c
@@ -346,14 +346,19 @@ static void pn_rx_complete(struct usb_ep *ep, struct usb_request *req)
                if (unlikely(!skb))
                        break;
-                skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page, 0,
-                                req->actual);
-                page = NULL;
-                if (req->actual < req->length) { /* Last fragment */
+                if (skb->len == 0) { /* First fragment */
                        skb->protocol = htons(ETH_P_PHONET);
                        skb_reset_mac_header(skb);
-                        pskb_pull(skb, 1);
+                        /* Can't use pskb_pull() on page in IRQ */
+                        memcpy(skb_put(skb, 1), page_address(page), 1);
+                }
+                skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page,
+                                skb->len == 0, req->actual);
+                page = NULL;
+                if (req->actual < req->length) { /* Last fragment */
                        skb->dev = dev;
                        dev->stats.rx_packets++;
                        dev->stats.rx_bytes += skb->len;
diff --git a/drivers/usb/host/ehci-xilinx-of.c b/drivers/usb/host/ehci-xilinx-of.c
index e8f4f36fdf0b..a6f21b891f68 100644
--- a/drivers/usb/host/ehci-xilinx-of.c
+++ b/drivers/usb/host/ehci-xilinx-of.c
@@ -29,6 +29,7 @@
 #include <linux/of.h>
 #include <linux/of_platform.h>
+#include <linux/of_address.h>
 /**
 * ehci_xilinx_of_setup - Initialize the device for ehci_reset()
diff --git a/drivers/usb/host/xhci-dbg.c b/drivers/usb/host/xhci-dbg.c
index fcbf4abbf381..0231814a97a5 100644
--- a/drivers/usb/host/xhci-dbg.c
+++ b/drivers/usb/host/xhci-dbg.c
@@ -169,9 +169,10 @@ static void xhci_print_ports(struct xhci_hcd *xhci)
        }
 }
-void xhci_print_ir_set(struct xhci_hcd *xhci, struct xhci_intr_reg *ir_set, int set_num)
+void xhci_print_ir_set(struct xhci_hcd *xhci, int set_num)
 {
-        void *addr;
+        struct xhci_intr_reg __iomem *ir_set = &xhci->run_regs->ir_set[set_num];
+        void __iomem *addr;
        u32 temp;
        u64 temp_64;
@@ -449,7 +450,7 @@ char *xhci_get_slot_state(struct xhci_hcd *xhci,
        }
 }
-void xhci_dbg_slot_ctx(struct xhci_hcd *xhci, struct xhci_container_ctx *ctx)
+static void xhci_dbg_slot_ctx(struct xhci_hcd *xhci, struct xhci_container_ctx *ctx)
 {
        /* Fields are 32 bits wide, DMA addresses are in bytes */
        int field_size = 32 / 8;
@@ -488,7 +489,7 @@ void xhci_dbg_slot_ctx(struct xhci_hcd *xhci, struct xhci_container_ctx *ctx)
                dbg_rsvd64(xhci, (u64 *)slot_ctx, dma);
 }
-void xhci_dbg_ep_ctx(struct xhci_hcd *xhci,
+static void xhci_dbg_ep_ctx(struct xhci_hcd *xhci,
                     struct xhci_container_ctx *ctx,
                     unsigned int last_ep)
 {
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 1d0f45f0e7a6..a9534396e85b 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -307,7 +307,7 @@ struct xhci_ep_ctx *xhci_get_ep_ctx(struct xhci_hcd *xhci,
 /***************** Streams structures manipulation *************************/
-void xhci_free_stream_ctx(struct xhci_hcd *xhci,
+static void xhci_free_stream_ctx(struct xhci_hcd *xhci,
                unsigned int num_stream_ctxs,
                struct xhci_stream_ctx *stream_ctx, dma_addr_t dma)
 {
@@ -335,7 +335,7 @@ void xhci_free_stream_ctx(struct xhci_hcd *xhci,
 * The stream context array must be a power of 2, and can be as small as
 * 64 bytes or as large as 1MB.
 */
-struct xhci_stream_ctx *xhci_alloc_stream_ctx(struct xhci_hcd *xhci,
+static struct xhci_stream_ctx *xhci_alloc_stream_ctx(struct xhci_hcd *xhci,
                unsigned int num_stream_ctxs, dma_addr_t *dma,
                gfp_t mem_flags)
 {
@@ -1900,11 +1900,11 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
        val &= DBOFF_MASK;
        xhci_dbg(xhci, "// Doorbell array is located at offset 0x%x"
                        " from cap regs base addr\n", val);
-        xhci->dba = (void *) xhci->cap_regs + val;
+        xhci->dba = (void __iomem *) xhci->cap_regs + val;
        xhci_dbg_regs(xhci);
        xhci_print_run_regs(xhci);
        /* Set ir_set to interrupt register set 0 */
-        xhci->ir_set = (void *) xhci->run_regs->ir_set;
+        xhci->ir_set = &xhci->run_regs->ir_set[0];
        /*
         * Event ring setup: Allocate a normal ring, but also setup
@@ -1961,7 +1961,7 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
        /* Set the event ring dequeue address */
        xhci_set_hc_event_deq(xhci);
        xhci_dbg(xhci, "Wrote ERST address to ir_set 0.\n");
-        xhci_print_ir_set(xhci, xhci->ir_set, 0);
+        xhci_print_ir_set(xhci, 0);
        /*
         * XXX: Might need to set the Interrupter Moderation Register to
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 3e8211c1ce5a..3289bf4832c9 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -474,8 +474,11 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
        state->new_deq_seg = find_trb_seg(cur_td->start_seg,
                        dev->eps[ep_index].stopped_trb,
                        &state->new_cycle_state);
-        if (!state->new_deq_seg)
+        if (!state->new_deq_seg) {
-                BUG();
+                WARN_ON(1);
+                return;
+        }
        /* Dig out the cycle state saved by the xHC during the stop ep cmd */
        xhci_dbg(xhci, "Finding endpoint context\n");
        ep_ctx = xhci_get_ep_ctx(xhci, dev->out_ctx, ep_index);
@@ -486,8 +489,10 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
        state->new_deq_seg = find_trb_seg(state->new_deq_seg,
                        state->new_deq_ptr,
                        &state->new_cycle_state);
-        if (!state->new_deq_seg)
+        if (!state->new_deq_seg) {
-                BUG();
+                WARN_ON(1);
+                return;
+        }
        trb = &state->new_deq_ptr->generic;
        if ((trb->field[3] & TRB_TYPE_BITMASK) == TRB_TYPE(TRB_LINK) &&
@@ -2363,12 +2368,13 @@ static unsigned int count_sg_trbs_needed(struct xhci_hcd *xhci, struct urb *urb)
                /* Scatter gather list entries may cross 64KB boundaries */
                running_total = TRB_MAX_BUFF_SIZE -
-                        (sg_dma_address(sg) & ((1 << TRB_MAX_BUFF_SHIFT) - 1));
+                        (sg_dma_address(sg) & (TRB_MAX_BUFF_SIZE - 1));
+                running_total &= TRB_MAX_BUFF_SIZE - 1;
                if (running_total != 0)
                        num_trbs++;
                /* How many more 64KB chunks to transfer, how many more TRBs? */
-                while (running_total < sg_dma_len(sg)) {
+                while (running_total < sg_dma_len(sg) && running_total < temp) {
                        num_trbs++;
                        running_total += TRB_MAX_BUFF_SIZE;
                }
@@ -2394,11 +2400,11 @@ static unsigned int count_sg_trbs_needed(struct xhci_hcd *xhci, struct urb *urb)
 static void check_trb_math(struct urb *urb, int num_trbs, int running_total)
 {
        if (num_trbs != 0)
-                dev_dbg(&urb->dev->dev, "%s - ep %#x - Miscalculated number of "
+                dev_err(&urb->dev->dev, "%s - ep %#x - Miscalculated number of "
                                "TRBs, %d left\n", __func__,
                                urb->ep->desc.bEndpointAddress, num_trbs);
        if (running_total != urb->transfer_buffer_length)
-                dev_dbg(&urb->dev->dev, "%s - ep %#x - Miscalculated tx length, "
+                dev_err(&urb->dev->dev, "%s - ep %#x - Miscalculated tx length, "
                                "queued %#x (%d), asked for %#x (%d)\n",
                                __func__,
                                urb->ep->desc.bEndpointAddress,
@@ -2533,8 +2539,7 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
        sg = urb->sg;
        addr = (u64) sg_dma_address(sg);
        this_sg_len = sg_dma_len(sg);
-        trb_buff_len = TRB_MAX_BUFF_SIZE -
+        trb_buff_len = TRB_MAX_BUFF_SIZE - (addr & (TRB_MAX_BUFF_SIZE - 1));
-                (addr & ((1 << TRB_MAX_BUFF_SHIFT) - 1));
        trb_buff_len = min_t(int, trb_buff_len, this_sg_len);
        if (trb_buff_len > urb->transfer_buffer_length)
                trb_buff_len = urb->transfer_buffer_length;
@@ -2572,7 +2577,7 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                                (unsigned int) (addr + TRB_MAX_BUFF_SIZE) & ~(TRB_MAX_BUFF_SIZE - 1),
                                (unsigned int) addr + trb_buff_len);
                if (TRB_MAX_BUFF_SIZE -
-                                (addr & ((1 << TRB_MAX_BUFF_SHIFT) - 1)) < trb_buff_len) {
+                                (addr & (TRB_MAX_BUFF_SIZE - 1)) < trb_buff_len) {
                        xhci_warn(xhci, "WARN: sg dma xfer crosses 64KB boundaries!\n");
                        xhci_dbg(xhci, "Next boundary at %#x, end dma = %#x\n",
                                        (unsigned int) (addr + TRB_MAX_BUFF_SIZE) & ~(TRB_MAX_BUFF_SIZE - 1),
@@ -2616,7 +2621,7 @@ static int queue_bulk_sg_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                }
                trb_buff_len = TRB_MAX_BUFF_SIZE -
-                        (addr & ((1 << TRB_MAX_BUFF_SHIFT) - 1));
+                        (addr & (TRB_MAX_BUFF_SIZE - 1));
                trb_buff_len = min_t(int, trb_buff_len, this_sg_len);
                if (running_total + trb_buff_len > urb->transfer_buffer_length)
                        trb_buff_len =
@@ -2656,7 +2661,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
        num_trbs = 0;
        /* How much data is (potentially) left before the 64KB boundary? */
        running_total = TRB_MAX_BUFF_SIZE -
-                (urb->transfer_dma & ((1 << TRB_MAX_BUFF_SHIFT) - 1));
+                (urb->transfer_dma & (TRB_MAX_BUFF_SIZE - 1));
+        running_total &= TRB_MAX_BUFF_SIZE - 1;
        /* If there's some data on this 64KB chunk, or we have to send a
         * zero-length transfer, we need at least one TRB
@@ -2700,8 +2706,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
        /* How much data is in the first TRB? */
        addr = (u64) urb->transfer_dma;
        trb_buff_len = TRB_MAX_BUFF_SIZE -
-                (urb->transfer_dma & ((1 << TRB_MAX_BUFF_SHIFT) - 1));
+                (urb->transfer_dma & (TRB_MAX_BUFF_SIZE - 1));
-        if (urb->transfer_buffer_length < trb_buff_len)
+        if (trb_buff_len > urb->transfer_buffer_length)
                trb_buff_len = urb->transfer_buffer_length;
        first_trb = true;
@@ -2879,8 +2885,8 @@ static int count_isoc_trbs_needed(struct xhci_hcd *xhci,
        addr = (u64) (urb->transfer_dma + urb->iso_frame_desc[i].offset);
        td_len = urb->iso_frame_desc[i].length;
-        running_total = TRB_MAX_BUFF_SIZE -
+        running_total = TRB_MAX_BUFF_SIZE - (addr & (TRB_MAX_BUFF_SIZE - 1));
-                        (addr & ((1 << TRB_MAX_BUFF_SHIFT) - 1));
+        running_total &= TRB_MAX_BUFF_SIZE - 1;
        if (running_total != 0)
                num_trbs++;
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 34cf4e165877..2083fc2179b2 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -109,7 +109,7 @@ int xhci_halt(struct xhci_hcd *xhci)
 /*
 * Set the run bit and wait for the host to be running.
 */
-int xhci_start(struct xhci_hcd *xhci)
+static int xhci_start(struct xhci_hcd *xhci)
 {
        u32 temp;
        int ret;
@@ -329,7 +329,7 @@ int xhci_init(struct usb_hcd *hcd)
 #ifdef CONFIG_USB_XHCI_HCD_DEBUGGING
-void xhci_event_ring_work(unsigned long arg)
+static void xhci_event_ring_work(unsigned long arg)
 {
        unsigned long flags;
        int temp;
@@ -473,7 +473,7 @@ int xhci_run(struct usb_hcd *hcd)
                        xhci->ir_set, (unsigned int) ER_IRQ_ENABLE(temp));
        xhci_writel(xhci, ER_IRQ_ENABLE(temp),
                        &xhci->ir_set->irq_pending);
-        xhci_print_ir_set(xhci, xhci->ir_set, 0);
+        xhci_print_ir_set(xhci, 0);
        if (NUM_TEST_NOOPS > 0)
                doorbell = xhci_setup_one_noop(xhci);
@@ -528,7 +528,7 @@ void xhci_stop(struct usb_hcd *hcd)
        temp = xhci_readl(xhci, &xhci->ir_set->irq_pending);
        xhci_writel(xhci, ER_IRQ_DISABLE(temp),
                        &xhci->ir_set->irq_pending);
-        xhci_print_ir_set(xhci, xhci->ir_set, 0);
+        xhci_print_ir_set(xhci, 0);
        xhci_dbg(xhci, "cleaning up memory\n");
        xhci_mem_cleanup(xhci);
@@ -755,7 +755,7 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
                temp = xhci_readl(xhci, &xhci->ir_set->irq_pending);
                xhci_writel(xhci, ER_IRQ_DISABLE(temp),
                                &xhci->ir_set->irq_pending);
-                xhci_print_ir_set(xhci, xhci->ir_set, 0);
+                xhci_print_ir_set(xhci, 0);
                xhci_dbg(xhci, "cleaning up memory\n");
                xhci_mem_cleanup(xhci);
@@ -857,7 +857,7 @@ unsigned int xhci_last_valid_endpoint(u32 added_ctxs)
 /* Returns 1 if the arguments are OK;
 * returns 0 this is a root hub; returns -EINVAL for NULL pointers.
 */
-int xhci_check_args(struct usb_hcd *hcd, struct usb_device *udev,
+static int xhci_check_args(struct usb_hcd *hcd, struct usb_device *udev,
                struct usb_host_endpoint *ep, int check_ep, bool check_virt_dev,
                const char *func) {
        struct xhci_hcd *xhci;
@@ -1693,7 +1693,7 @@ static void xhci_setup_input_ctx_for_config_ep(struct xhci_hcd *xhci,
        xhci_dbg_ctx(xhci, in_ctx, xhci_last_valid_endpoint(add_flags));
 }
-void xhci_setup_input_ctx_for_quirk(struct xhci_hcd *xhci,
+static void xhci_setup_input_ctx_for_quirk(struct xhci_hcd *xhci,
                unsigned int slot_id, unsigned int ep_index,
                struct xhci_dequeue_state *deq_state)
 {
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 7f236fd22015..7f127df6dd55 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1348,7 +1348,7 @@ static inline int xhci_link_trb_quirk(struct xhci_hcd *xhci)
 }
 /* xHCI debugging */
-void xhci_print_ir_set(struct xhci_hcd *xhci, struct xhci_intr_reg *ir_set, int set_num);
+void xhci_print_ir_set(struct xhci_hcd *xhci, int set_num);
 void xhci_print_registers(struct xhci_hcd *xhci);
 void xhci_dbg_regs(struct xhci_hcd *xhci);
 void xhci_print_run_regs(struct xhci_hcd *xhci);
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 54a8bd1047d6..c292d5c499e7 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -1864,6 +1864,7 @@ allocate_instance(struct device *dev,
        INIT_LIST_HEAD(&musb->out_bulk);
        hcd->uses_new_polling = 1;
+        hcd->has_tt = 1;
        musb->vbuserr_retry = VBUSERR_RETRY_COUNT;
        musb->a_wait_bcon = OTG_TIME_A_WAIT_BCON;
diff --git a/drivers/usb/musb/musb_core.h b/drivers/usb/musb/musb_core.h
index d74a8113ae74..e6400be8a0f8 100644
--- a/drivers/usb/musb/musb_core.h
+++ b/drivers/usb/musb/musb_core.h
@@ -488,6 +488,15 @@ struct musb {
        unsigned                set_address:1;
        unsigned                test_mode:1;
        unsigned                softconnect:1;
+        u8                      address;
+        u8                      test_mode_nr;
+        u16                     ackpend;                /* ep0 */
+        enum musb_g_ep0_state   ep0_state;
+        struct usb_gadget       g;                      /* the gadget */
+        struct usb_gadget_driver *gadget_driver;        /* its driver */
+#endif
        /*
         * FIXME: Remove this flag.
         *
@@ -501,14 +510,6 @@ struct musb {
         */
        unsigned                double_buffer_not_ok:1 __deprecated;
-        u8                      address;
-        u8                      test_mode_nr;
-        u16                     ackpend;                /* ep0 */
-        enum musb_g_ep0_state   ep0_state;
-        struct usb_gadget       g;                      /* the gadget */
-        struct usb_gadget_driver *gadget_driver;        /* its driver */
-#endif
        struct musb_hdrc_config *config;
 #ifdef MUSB_CONFIG_PROC_FS
diff --git a/drivers/usb/musb/omap2430.c b/drivers/usb/musb/omap2430.c
index a3f12333fc41..bc8badd16897 100644
--- a/drivers/usb/musb/omap2430.c
+++ b/drivers/usb/musb/omap2430.c
@@ -362,6 +362,7 @@ static int omap2430_musb_init(struct musb *musb)
 static int omap2430_musb_exit(struct musb *musb)
 {
+        del_timer_sync(&musb_idle_timer);
        omap2430_low_level_exit(musb);
        otg_put_transceiver(musb->xceiv);
diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
index 7481ff8a49e4..0457813eebee 100644
--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -301,6 +301,9 @@ static const struct usb_device_id id_table[] = {
        { USB_DEVICE(0x1199, 0x68A3),   /* Sierra Wireless Direct IP modems */
          .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
        },
+        { USB_DEVICE(0x0f3d, 0x68A3),   /* Airprime/Sierra Wireless Direct IP modems */
+          .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
+        },
       { USB_DEVICE(0x413C, 0x08133) }, /* Dell Computer Corp. Wireless 5720 VZW Mobile Broadband (EVDO Rev-A) Minicard GPS Port */
        { }
diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c
index b004b2a485c3..9c014e2ecd68 100644
--- a/drivers/usb/serial/usb_wwan.c
+++ b/drivers/usb/serial/usb_wwan.c
@@ -295,12 +295,15 @@ static void usb_wwan_indat_callback(struct urb *urb)
                    __func__, status, endpoint);
        } else {
                tty = tty_port_tty_get(&port->port);
-                if (urb->actual_length) {
+                if (tty) {
-                        tty_insert_flip_string(tty, data, urb->actual_length);
+                        if (urb->actual_length) {
-                        tty_flip_buffer_push(tty);
+                                tty_insert_flip_string(tty, data,
-                } else
+                                                urb->actual_length);
-                        dbg("%s: empty read urb received", __func__);
+                                tty_flip_buffer_push(tty);
-                tty_kref_put(tty);
+                        } else
+                                dbg("%s: empty read urb received", __func__);
+                        tty_kref_put(tty);
+                }
                /* Resubmit urb so we continue receiving */
                if (status != -ESHUTDOWN) {
diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c
index 15a5d89b7f39..1c11959a7d58 100644
--- a/drivers/usb/serial/visor.c
+++ b/drivers/usb/serial/visor.c
@@ -27,6 +27,7 @@
 #include <linux/uaccess.h>
 #include <linux/usb.h>
 #include <linux/usb/serial.h>
+#include <linux/usb/cdc.h>
 #include "visor.h"
 /*
@@ -479,6 +480,17 @@ static int visor_probe(struct usb_serial *serial,
        dbg("%s", __func__);
+        /*
+         * some Samsung Android phones in modem mode have the same ID
+         * as SPH-I500, but they are ACM devices, so dont bind to them
+         */
+        if (id->idVendor == SAMSUNG_VENDOR_ID &&
+                id->idProduct == SAMSUNG_SPH_I500_ID &&
+                serial->dev->descriptor.bDeviceClass == USB_CLASS_COMM &&
+                serial->dev->descriptor.bDeviceSubClass ==
+                        USB_CDC_SUBCLASS_ACM)
+                return -ENODEV;
        if (serial->dev->actconfig->desc.bConfigurationValue != 1) {
                dev_err(&serial->dev->dev, "active config #%d != 1 ??\n",
                        serial->dev->actconfig->desc.bConfigurationValue);
diff --git a/drivers/video/backlight/ltv350qv.c b/drivers/video/backlight/ltv350qv.c
index 8010aaeb5adb..dd0e84a9bd2f 100644
--- a/drivers/video/backlight/ltv350qv.c
+++ b/drivers/video/backlight/ltv350qv.c
@@ -239,11 +239,15 @@ static int __devinit ltv350qv_probe(struct spi_device *spi)
        lcd->spi = spi;
        lcd->power = FB_BLANK_POWERDOWN;
        lcd->buffer = kzalloc(8, GFP_KERNEL);
+        if (!lcd->buffer) {
+                ret = -ENOMEM;
+                goto out_free_lcd;
+        }
        ld = lcd_device_register("ltv350qv", &spi->dev, lcd, &ltv_ops);
        if (IS_ERR(ld)) {
                ret = PTR_ERR(ld);
-                goto out_free_lcd;
+                goto out_free_buffer;
        }
        lcd->ld = ld;
@@ -257,6 +261,8 @@ static int __devinit ltv350qv_probe(struct spi_device *spi)
 out_unregister:
        lcd_device_unregister(ld);
+out_free_buffer:
+        kfree(lcd->buffer);
 out_free_lcd:
        kfree(lcd);
        return ret;
@@ -268,6 +274,7 @@ static int __devexit ltv350qv_remove(struct spi_device *spi)
        ltv350qv_power(lcd, FB_BLANK_POWERDOWN);
        lcd_device_unregister(lcd->ld);
+        kfree(lcd->buffer);
        kfree(lcd);
        return 0;
diff --git a/drivers/watchdog/cpwd.c b/drivers/watchdog/cpwd.c
index eca855a55c0d..3de4ba0260a5 100644
--- a/drivers/watchdog/cpwd.c
+++ b/drivers/watchdog/cpwd.c
@@ -646,7 +646,7 @@ static int __devexit cpwd_remove(struct platform_device *op)
        struct cpwd *p = dev_get_drvdata(&op->dev);
        int i;
-        for (i = 0; i < 4; i++) {
+        for (i = 0; i < WD_NUMDEVS; i++) {
                misc_deregister(&p->devs[i].misc);
                if (!p->enabled) {
diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
index 24b966d5061a..204a5603c4ae 100644
--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -710,7 +710,7 @@ static int __devinit hpwdt_init_nmi_decoding(struct pci_dev *dev)
        return 0;
 }
-static void __devexit hpwdt_exit_nmi_decoding(void)
+static void hpwdt_exit_nmi_decoding(void)
 {
        unregister_die_notifier(&die_notifier);
        if (cru_rom_addr)
@@ -726,7 +726,7 @@ static int __devinit hpwdt_init_nmi_decoding(struct pci_dev *dev)
        return 0;
 }
-static void __devexit hpwdt_exit_nmi_decoding(void)
+static void hpwdt_exit_nmi_decoding(void)
 {
 }
 #endif /* CONFIG_HPWDT_NMI_DECODING */
diff --git a/drivers/watchdog/sbc_fitpc2_wdt.c b/drivers/watchdog/sbc_fitpc2_wdt.c
index c7d67e9a7465..79906255eeb6 100644
--- a/drivers/watchdog/sbc_fitpc2_wdt.c
+++ b/drivers/watchdog/sbc_fitpc2_wdt.c
@@ -201,11 +201,14 @@ static struct miscdevice fitpc2_wdt_miscdev = {
 static int __init fitpc2_wdt_init(void)
 {
        int err;
+        const char *brd_name;
-        if (!strstr(dmi_get_system_info(DMI_BOARD_NAME), "SBC-FITPC2"))
+        brd_name = dmi_get_system_info(DMI_BOARD_NAME);
+        if (!brd_name || !strstr(brd_name, "SBC-FITPC2"))
                return -ENODEV;
-        pr_info("%s found\n", dmi_get_system_info(DMI_BOARD_NAME));
+        pr_info("%s found\n", brd_name);
        if (!request_region(COMMAND_PORT, 1, WATCHDOG_NAME)) {
                pr_err("I/O address 0x%04x already in use\n", COMMAND_PORT);
diff --git a/drivers/watchdog/sch311x_wdt.c b/drivers/watchdog/sch311x_wdt.c
index 0461858e07d0..b61ab1c54293 100644
--- a/drivers/watchdog/sch311x_wdt.c
+++ b/drivers/watchdog/sch311x_wdt.c
@@ -508,7 +508,7 @@ static int __init sch311x_detect(int sio_config_port, unsigned short *addr)
        sch311x_sio_outb(sio_config_port, 0x07, 0x0a);
        /* Check if Logical Device Register is currently active */
-        if (sch311x_sio_inb(sio_config_port, 0x30) && 0x01 == 0)
+        if ((sch311x_sio_inb(sio_config_port, 0x30) & 0x01) == 0)
                printk(KERN_INFO PFX "Seems that LDN 0x0a is not active...\n");
        /* Get the base address of the runtime registers */
diff --git a/drivers/watchdog/w83697ug_wdt.c b/drivers/watchdog/w83697ug_wdt.c
index a6c12dec91a1..df2a64dc9672 100644
--- a/drivers/watchdog/w83697ug_wdt.c
+++ b/drivers/watchdog/w83697ug_wdt.c
@@ -109,7 +109,7 @@ static int w83697ug_select_wd_register(void)
        outb_p(0x08, WDT_EFDR); /* select logical device 8 (GPIO2) */
        outb_p(0x30, WDT_EFER); /* select CR30 */
        c = inb_p(WDT_EFDR);
-        outb_p(c || 0x01, WDT_EFDR); /* set bit 0 to activate GPIO2 */
+        outb_p(c | 0x01, WDT_EFDR); /* set bit 0 to activate GPIO2 */
        return 0;
 }
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index 43f9f02c7db0..b1661cd416b0 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -296,7 +296,7 @@ static int decrease_reservation(unsigned long nr_pages)
        /* No more mappings: invalidate P2M and add to balloon. */
        for (i = 0; i < nr_pages; i++) {
                pfn = mfn_to_pfn(frame_list[i]);
-                set_phys_to_machine(pfn, INVALID_P2M_ENTRY);
+                __set_phys_to_machine(pfn, INVALID_P2M_ENTRY);
                balloon_append(pfn_to_page(pfn));
        }
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
index 74681478100a..149fa875e396 100644
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
@@ -114,7 +114,7 @@ struct cpu_evtchn_s {
 static __initdata struct cpu_evtchn_s init_evtchn_mask = {
        .bits[0 ... (NR_EVENT_CHANNELS/BITS_PER_LONG)-1] = ~0ul,
 };
-static struct cpu_evtchn_s *cpu_evtchn_mask_p = &init_evtchn_mask;
+static struct cpu_evtchn_s __refdata *cpu_evtchn_mask_p = &init_evtchn_mask;
 static inline unsigned long *cpu_evtchn_mask(int cpu)
 {
@@ -277,7 +277,7 @@ static void bind_evtchn_to_cpu(unsigned int chn, unsigned int cpu)
        BUG_ON(irq == -1);
 #ifdef CONFIG_SMP
-        cpumask_copy(irq_to_desc(irq)->affinity, cpumask_of(cpu));
+        cpumask_copy(irq_to_desc(irq)->irq_data.affinity, cpumask_of(cpu));
 #endif
        clear_bit(chn, cpu_evtchn_mask(cpu_from_irq(irq)));
@@ -294,7 +294,7 @@ static void init_evtchn_cpu_bindings(void)
        /* By default all event channels notify CPU#0. */
        for_each_irq_desc(i, desc) {
-                cpumask_copy(desc->affinity, cpumask_of(0));
+                cpumask_copy(desc->irq_data.affinity, cpumask_of(0));
        }
 #endif
@@ -376,81 +376,69 @@ static void unmask_evtchn(int port)
        put_cpu();
 }
-static int get_nr_hw_irqs(void)
+static int xen_allocate_irq_dynamic(void)
 {
-        int ret = 1;
+        int first = 0;
+        int irq;
 #ifdef CONFIG_X86_IO_APIC
-        ret = get_nr_irqs_gsi();
+        /*
+         * For an HVM guest or domain 0 which see "real" (emulated or
+         * actual repectively) GSIs we allocate dynamic IRQs
+         * e.g. those corresponding to event channels or MSIs
+         * etc. from the range above those "real" GSIs to avoid
+         * collisions.
+         */
+        if (xen_initial_domain() || xen_hvm_domain())
+                first = get_nr_irqs_gsi();
 #endif
-        return ret;
+retry:
-}
+        irq = irq_alloc_desc_from(first, -1);
-static int find_unbound_pirq(int type)
+        if (irq == -ENOMEM && first > NR_IRQS_LEGACY) {
-{
+                printk(KERN_ERR "Out of dynamic IRQ space and eating into GSI space. You should increase nr_irqs\n");
-        int rc, i;
+                first = max(NR_IRQS_LEGACY, first - NR_IRQS_LEGACY);
-        struct physdev_get_free_pirq op_get_free_pirq;
+                goto retry;
-        op_get_free_pirq.type = type;
+        }
-        rc = HYPERVISOR_physdev_op(PHYSDEVOP_get_free_pirq, &op_get_free_pirq);
+        if (irq < 0)
-        if (!rc)
+                panic("No available IRQ to bind to: increase nr_irqs!\n");
-                return op_get_free_pirq.pirq;
-        for (i = 0; i < nr_irqs; i++) {
+        return irq;
-                if (pirq_to_irq[i] < 0)
-                        return i;
-        }
-        return -1;
 }
-static int find_unbound_irq(void)
+static int xen_allocate_irq_gsi(unsigned gsi)
 {
-        struct irq_data *data;
+        int irq;
-        int irq, res;
-        int bottom = get_nr_hw_irqs();
-        int top = nr_irqs-1;
-        if (bottom == nr_irqs)
-                goto no_irqs;
-        /* This loop starts from the top of IRQ space and goes down.
+        /*
-         * We need this b/c if we have a PCI device in a Xen PV guest
+         * A PV guest has no concept of a GSI (since it has no ACPI
-         * we do not have an IO-APIC (though the backend might have them)
+         * nor access to/knowledge of the physical APICs). Therefore
-         * mapped in. To not have a collision of physical IRQs with the Xen
+         * all IRQs are dynamically allocated from the entire IRQ
-         * event channels start at the top of the IRQ space for virtual IRQs.
+         * space.
         */
-        for (irq = top; irq > bottom; irq--) {
+        if (xen_pv_domain() && !xen_initial_domain())
-                data = irq_get_irq_data(irq);
+                return xen_allocate_irq_dynamic();
-                /* only 15->0 have init'd desc; handle irq > 16 */
-                if (!data)
-                        break;
-                if (data->chip == &no_irq_chip)
-                        break;
-                if (data->chip != &xen_dynamic_chip)
-                        continue;
-                if (irq_info[irq].type == IRQT_UNBOUND)
-                        return irq;
-        }
-        if (irq == bottom)
-                goto no_irqs;
-        res = irq_alloc_desc_at(irq, -1);
+        /* Legacy IRQ descriptors are already allocated by the arch. */
+        if (gsi < NR_IRQS_LEGACY)
+                return gsi;
-        if (WARN_ON(res != irq))
+        irq = irq_alloc_desc_at(gsi, -1);
-                return -1;
+        if (irq < 0)
+                panic("Unable to allocate to IRQ%d (%d)\n", gsi, irq);
        return irq;
-no_irqs:
-        panic("No available IRQ to bind to: increase nr_irqs!\n");
 }
-static bool identity_mapped_irq(unsigned irq)
+static void xen_free_irq(unsigned irq)
 {
-        /* identity map all the hardware irqs */
+        /* Legacy IRQ descriptors are managed by the arch. */
-        return irq < get_nr_hw_irqs();
+        if (irq < NR_IRQS_LEGACY)
+                return;
+        irq_free_desc(irq);
 }
 static void pirq_unmask_notify(int irq)
@@ -486,7 +474,7 @@ static bool probing_irq(int irq)
        return desc && desc->action == NULL;
 }
-static unsigned int startup_pirq(unsigned int irq)
+static unsigned int __startup_pirq(unsigned int irq)
 {
        struct evtchn_bind_pirq bind_pirq;
        struct irq_info *info = info_for_irq(irq);
@@ -524,9 +512,15 @@ out:
        return 0;
 }
-static void shutdown_pirq(unsigned int irq)
+static unsigned int startup_pirq(struct irq_data *data)
+{
+        return __startup_pirq(data->irq);
+}
+static void shutdown_pirq(struct irq_data *data)
 {
        struct evtchn_close close;
+        unsigned int irq = data->irq;
        struct irq_info *info = info_for_irq(irq);
        int evtchn = evtchn_from_irq(irq);
@@ -546,20 +540,20 @@ static void shutdown_pirq(unsigned int irq)
        info->evtchn = 0;
 }
-static void enable_pirq(unsigned int irq)
+static void enable_pirq(struct irq_data *data)
 {
-        startup_pirq(irq);
+        startup_pirq(data);
 }
-static void disable_pirq(unsigned int irq)
+static void disable_pirq(struct irq_data *data)
 {
 }
-static void ack_pirq(unsigned int irq)
+static void ack_pirq(struct irq_data *data)
 {
-        int evtchn = evtchn_from_irq(irq);
+        int evtchn = evtchn_from_irq(data->irq);
-        move_native_irq(irq);
+        move_native_irq(data->irq);
        if (VALID_EVTCHN(evtchn)) {
                mask_evtchn(evtchn);
@@ -567,23 +561,6 @@ static void ack_pirq(unsigned int irq)
        }
 }
-static void end_pirq(unsigned int irq)
-{
-        int evtchn = evtchn_from_irq(irq);
-        struct irq_desc *desc = irq_to_desc(irq);
-        if (WARN_ON(!desc))
-                return;
-        if ((desc->status & (IRQ_DISABLED|IRQ_PENDING)) ==
-            (IRQ_DISABLED|IRQ_PENDING)) {
-                shutdown_pirq(irq);
-        } else if (VALID_EVTCHN(evtchn)) {
-                unmask_evtchn(evtchn);
-                pirq_unmask_notify(irq);
-        }
-}
 static int find_irq_by_gsi(unsigned gsi)
 {
        int irq;
@@ -638,14 +615,7 @@ int xen_map_pirq_gsi(unsigned pirq, unsigned gsi, int shareable, char *name)
                goto out;       /* XXX need refcount? */
        }
-        /* If we are a PV guest, we don't have GSIs (no ACPI passed). Therefore
+        irq = xen_allocate_irq_gsi(gsi);
-         * we are using the !xen_initial_domain() to drop in the function.*/
-        if (identity_mapped_irq(gsi) || (!xen_initial_domain() &&
-                                xen_pv_domain())) {
-                irq = gsi;
-                irq_alloc_desc_at(irq, -1);
-        } else
-                irq = find_unbound_irq();
        set_irq_chip_and_handler_name(irq, &xen_pirq_chip,
                                      handle_level_irq, name);
@@ -658,7 +628,7 @@ int xen_map_pirq_gsi(unsigned pirq, unsigned gsi, int shareable, char *name)
         * this in the priv domain. */
        if (xen_initial_domain() &&
            HYPERVISOR_physdev_op(PHYSDEVOP_alloc_irq_vector, &irq_op)) {
-                irq_free_desc(irq);
+                xen_free_irq(irq);
                irq = -ENOSPC;
                goto out;
        }
@@ -674,87 +644,46 @@ out:
 }
 #ifdef CONFIG_PCI_MSI
-#include <linux/msi.h>
+int xen_allocate_pirq_msi(struct pci_dev *dev, struct msi_desc *msidesc)
-#include "../pci/msi.h"
-void xen_allocate_pirq_msi(char *name, int *irq, int *pirq, int alloc)
 {
-        spin_lock(&irq_mapping_update_lock);
+        int rc;
+        struct physdev_get_free_pirq op_get_free_pirq;
-        if (alloc & XEN_ALLOC_IRQ) {
-                *irq = find_unbound_irq();
-                if (*irq == -1)
-                        goto out;
-        }
-        if (alloc & XEN_ALLOC_PIRQ) {
-                *pirq = find_unbound_pirq(MAP_PIRQ_TYPE_MSI);
-                if (*pirq == -1)
-                        goto out;
-        }
-        set_irq_chip_and_handler_name(*irq, &xen_pirq_chip,
+        op_get_free_pirq.type = MAP_PIRQ_TYPE_MSI;
-                                      handle_level_irq, name);
+        rc = HYPERVISOR_physdev_op(PHYSDEVOP_get_free_pirq, &op_get_free_pirq);
-        irq_info[*irq] = mk_pirq_info(0, *pirq, 0, 0);
+        WARN_ONCE(rc == -ENOSYS,
-        pirq_to_irq[*pirq] = *irq;
+                  "hypervisor does not support the PHYSDEVOP_get_free_pirq interface\n");
-out:
+        return rc ? -1 : op_get_free_pirq.pirq;
-        spin_unlock(&irq_mapping_update_lock);
 }
-int xen_create_msi_irq(struct pci_dev *dev, struct msi_desc *msidesc, int type)
+int xen_bind_pirq_msi_to_irq(struct pci_dev *dev, struct msi_desc *msidesc,
+                             int pirq, int vector, const char *name)
 {
-        int irq = -1;
+        int irq, ret;
-        struct physdev_map_pirq map_irq;
-        int rc;
-        int pos;
-        u32 table_offset, bir;
-        memset(&map_irq, 0, sizeof(map_irq));
-        map_irq.domid = DOMID_SELF;
-        map_irq.type = MAP_PIRQ_TYPE_MSI;
-        map_irq.index = -1;
-        map_irq.pirq = -1;
-        map_irq.bus = dev->bus->number;
-        map_irq.devfn = dev->devfn;
-        if (type == PCI_CAP_ID_MSIX) {
-                pos = pci_find_capability(dev, PCI_CAP_ID_MSIX);
-                pci_read_config_dword(dev, msix_table_offset_reg(pos),
-                                        &table_offset);
-                bir = (u8)(table_offset & PCI_MSIX_FLAGS_BIRMASK);
-                map_irq.table_base = pci_resource_start(dev, bir);
-                map_irq.entry_nr = msidesc->msi_attrib.entry_nr;
-        }
        spin_lock(&irq_mapping_update_lock);
-        irq = find_unbound_irq();
+        irq = xen_allocate_irq_dynamic();
        if (irq == -1)
                goto out;
-        rc = HYPERVISOR_physdev_op(PHYSDEVOP_map_pirq, &map_irq);
-        if (rc) {
-                printk(KERN_WARNING "xen map irq failed %d\n", rc);
-                irq_free_desc(irq);
-                irq = -1;
-                goto out;
-        }
-        irq_info[irq] = mk_pirq_info(0, map_irq.pirq, 0, map_irq.index);
        set_irq_chip_and_handler_name(irq, &xen_pirq_chip,
-                        handle_level_irq,
+                                      handle_level_irq, name);
-                        (type == PCI_CAP_ID_MSIX) ? "msi-x":"msi");
+        irq_info[irq] = mk_pirq_info(0, pirq, 0, vector);
+        pirq_to_irq[pirq] = irq;
+        ret = set_irq_msi(irq, msidesc);
+        if (ret < 0)
+                goto error_irq;
 out:
        spin_unlock(&irq_mapping_update_lock);
        return irq;
+error_irq:
+        spin_unlock(&irq_mapping_update_lock);
+        xen_free_irq(irq);
+        return -1;
 }
 #endif
@@ -779,11 +708,12 @@ int xen_destroy_irq(int irq)
                        printk(KERN_WARNING "unmap irq failed %d\n", rc);
                        goto out;
                }
-                pirq_to_irq[info->u.pirq.pirq] = -1;
        }
+        pirq_to_irq[info->u.pirq.pirq] = -1;
        irq_info[irq] = mk_unbound_info();
-        irq_free_desc(irq);
+        xen_free_irq(irq);
 out:
        spin_unlock(&irq_mapping_update_lock);
@@ -814,7 +744,7 @@ int bind_evtchn_to_irq(unsigned int evtchn)
        irq = evtchn_to_irq[evtchn];
        if (irq == -1) {
-                irq = find_unbound_irq();
+                irq = xen_allocate_irq_dynamic();
                set_irq_chip_and_handler_name(irq, &xen_dynamic_chip,
                                              handle_fasteoi_irq, "event");
@@ -839,7 +769,7 @@ static int bind_ipi_to_irq(unsigned int ipi, unsigned int cpu)
        irq = per_cpu(ipi_to_irq, cpu)[ipi];
        if (irq == -1) {
-                irq = find_unbound_irq();
+                irq = xen_allocate_irq_dynamic();
                if (irq < 0)
                        goto out;
@@ -875,7 +805,7 @@ int bind_virq_to_irq(unsigned int virq, unsigned int cpu)
        irq = per_cpu(virq_to_irq, cpu)[virq];
        if (irq == -1) {
-                irq = find_unbound_irq();
+                irq = xen_allocate_irq_dynamic();
                set_irq_chip_and_handler_name(irq, &xen_percpu_chip,
                                              handle_percpu_irq, "virq");
@@ -934,7 +864,7 @@ static void unbind_from_irq(unsigned int irq)
        if (irq_info[irq].type != IRQT_UNBOUND) {
                irq_info[irq] = mk_unbound_info();
-                irq_free_desc(irq);
+                xen_free_irq(irq);
        }
        spin_unlock(&irq_mapping_update_lock);
@@ -990,7 +920,7 @@ int bind_ipi_to_irqhandler(enum ipi_vector ipi,
        if (irq < 0)
                return irq;
-        irqflags |= IRQF_NO_SUSPEND;
+        irqflags |= IRQF_NO_SUSPEND | IRQF_FORCE_RESUME;
        retval = request_irq(irq, handler, irqflags, devname, dev_id);
        if (retval != 0) {
                unbind_from_irq(irq);
@@ -1234,11 +1164,12 @@ static int rebind_irq_to_cpu(unsigned irq, unsigned tcpu)
        return 0;
 }
-static int set_affinity_irq(unsigned irq, const struct cpumask *dest)
+static int set_affinity_irq(struct irq_data *data, const struct cpumask *dest,
+                            bool force)
 {
        unsigned tcpu = cpumask_first(dest);
-        return rebind_irq_to_cpu(irq, tcpu);
+        return rebind_irq_to_cpu(data->irq, tcpu);
 }
 int resend_irq_on_evtchn(unsigned int irq)
@@ -1257,35 +1188,35 @@ int resend_irq_on_evtchn(unsigned int irq)
        return 1;
 }
-static void enable_dynirq(unsigned int irq)
+static void enable_dynirq(struct irq_data *data)
 {
-        int evtchn = evtchn_from_irq(irq);
+        int evtchn = evtchn_from_irq(data->irq);
        if (VALID_EVTCHN(evtchn))
                unmask_evtchn(evtchn);
 }
-static void disable_dynirq(unsigned int irq)
+static void disable_dynirq(struct irq_data *data)
 {
-        int evtchn = evtchn_from_irq(irq);
+        int evtchn = evtchn_from_irq(data->irq);
        if (VALID_EVTCHN(evtchn))
                mask_evtchn(evtchn);
 }
-static void ack_dynirq(unsigned int irq)
+static void ack_dynirq(struct irq_data *data)
 {
-        int evtchn = evtchn_from_irq(irq);
+        int evtchn = evtchn_from_irq(data->irq);
-        move_masked_irq(irq);
+        move_masked_irq(data->irq);
        if (VALID_EVTCHN(evtchn))
                unmask_evtchn(evtchn);
 }
-static int retrigger_dynirq(unsigned int irq)
+static int retrigger_dynirq(struct irq_data *data)
 {
-        int evtchn = evtchn_from_irq(irq);
+        int evtchn = evtchn_from_irq(data->irq);
        struct shared_info *sh = HYPERVISOR_shared_info;
        int ret = 0;
@@ -1334,7 +1265,7 @@ static void restore_cpu_pirqs(void)
                printk(KERN_DEBUG "xen: --> irq=%d, pirq=%d\n", irq, map_irq.pirq);
-                startup_pirq(irq);
+                __startup_pirq(irq);
        }
 }
@@ -1445,7 +1376,6 @@ void xen_poll_irq(int irq)
 void xen_irq_resume(void)
 {
        unsigned int cpu, irq, evtchn;
-        struct irq_desc *desc;
        init_evtchn_cpu_bindings();
@@ -1465,66 +1395,48 @@ void xen_irq_resume(void)
                restore_cpu_ipis(cpu);
        }
-        /*
-         * Unmask any IRQF_NO_SUSPEND IRQs which are enabled. These
-         * are not handled by the IRQ core.
-         */
-        for_each_irq_desc(irq, desc) {
-                if (!desc->action || !(desc->action->flags & IRQF_NO_SUSPEND))
-                        continue;
-                if (desc->status & IRQ_DISABLED)
-                        continue;
-                evtchn = evtchn_from_irq(irq);
-                if (evtchn == -1)
-                        continue;
-                unmask_evtchn(evtchn);
-        }
        restore_cpu_pirqs();
 }
 static struct irq_chip xen_dynamic_chip __read_mostly = {
-        .name           = "xen-dyn",
+        .name                   = "xen-dyn",
-        .disable        = disable_dynirq,
+        .irq_disable            = disable_dynirq,
-        .mask           = disable_dynirq,
+        .irq_mask               = disable_dynirq,
-        .unmask         = enable_dynirq,
+        .irq_unmask             = enable_dynirq,
-        .eoi            = ack_dynirq,
+        .irq_eoi                = ack_dynirq,
-        .set_affinity   = set_affinity_irq,
+        .irq_set_affinity       = set_affinity_irq,
-        .retrigger      = retrigger_dynirq,
+        .irq_retrigger          = retrigger_dynirq,
 };
 static struct irq_chip xen_pirq_chip __read_mostly = {
-        .name           = "xen-pirq",
+        .name                   = "xen-pirq",
-        .startup        = startup_pirq,
+        .irq_startup            = startup_pirq,
-        .shutdown       = shutdown_pirq,
+        .irq_shutdown           = shutdown_pirq,
-        .enable         = enable_pirq,
+        .irq_enable             = enable_pirq,
-        .unmask         = enable_pirq,
+        .irq_unmask             = enable_pirq,
-        .disable        = disable_pirq,
+        .irq_disable            = disable_pirq,
-        .mask           = disable_pirq,
+        .irq_mask               = disable_pirq,
-        .ack            = ack_pirq,
+        .irq_ack                = ack_pirq,
-        .end            = end_pirq,
-        .set_affinity   = set_affinity_irq,
+        .irq_set_affinity       = set_affinity_irq,
-        .retrigger      = retrigger_dynirq,
+        .irq_retrigger          = retrigger_dynirq,
 };
 static struct irq_chip xen_percpu_chip __read_mostly = {
-        .name           = "xen-percpu",
+        .name                   = "xen-percpu",
-        .disable        = disable_dynirq,
+        .irq_disable            = disable_dynirq,
-        .mask           = disable_dynirq,
+        .irq_mask               = disable_dynirq,
-        .unmask         = enable_dynirq,
+        .irq_unmask             = enable_dynirq,
-        .ack            = ack_dynirq,
+        .irq_ack                = ack_dynirq,
 };
 int xen_set_callback_via(uint64_t via)