211 files changed, 1963 insertions, 934 deletions
diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index b811f2173f6f..88681aca88c5 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -105,7 +105,7 @@ config ACPI_EC_DEBUGFS
          Be aware that using this interface can confuse your Embedded
          Controller in a way that a normal reboot is not enough. You then
-          have to power of your system, and remove the laptop battery for
+          have to power off your system, and remove the laptop battery for
          some seconds.
          An Embedded Controller typically is available on laptops and reads
          sensor values like battery state and temperature.
diff --git a/drivers/acpi/acpi_pad.c b/drivers/acpi/acpi_pad.c
index b76848c80be3..6b115f6c4313 100644
--- a/drivers/acpi/acpi_pad.c
+++ b/drivers/acpi/acpi_pad.c
@@ -382,31 +382,32 @@ static void acpi_pad_remove_sysfs(struct acpi_device *device)
        device_remove_file(&device->dev, &dev_attr_rrtime);
 }
-/* Query firmware how many CPUs should be idle */
+/*
-static int acpi_pad_pur(acpi_handle handle, int *num_cpus)
+ * Query firmware how many CPUs should be idle
+ * return -1 on failure
+ */
+static int acpi_pad_pur(acpi_handle handle)
 {
        struct acpi_buffer buffer = {ACPI_ALLOCATE_BUFFER, NULL};
        union acpi_object *package;
-        int rev, num, ret = -EINVAL;
+        int num = -1;
        if (ACPI_FAILURE(acpi_evaluate_object(handle, "_PUR", NULL, &buffer)))
-                return -EINVAL;
+                return num;
        if (!buffer.length || !buffer.pointer)
-                return -EINVAL;
+                return num;
        package = buffer.pointer;
-        if (package->type != ACPI_TYPE_PACKAGE || package->package.count != 2)
-                goto out;
+        if (package->type == ACPI_TYPE_PACKAGE &&
-        rev = package->package.elements[0].integer.value;
+                package->package.count == 2 &&
-        num = package->package.elements[1].integer.value;
+                package->package.elements[0].integer.value == 1) /* rev 1 */
-        if (rev != 1 || num < 0)
-                goto out;
+                num = package->package.elements[1].integer.value;
-        *num_cpus = num;
-        ret = 0;
-out:
        kfree(buffer.pointer);
-        return ret;
+        return num;
 }
 /* Notify firmware how many CPUs are idle */
@@ -433,7 +434,8 @@ static void acpi_pad_handle_notify(acpi_handle handle)
        uint32_t idle_cpus;
        mutex_lock(&isolated_cpus_lock);
-        if (acpi_pad_pur(handle, &num_cpus)) {
+        num_cpus = acpi_pad_pur(handle);
+        if (num_cpus < 0) {
                mutex_unlock(&isolated_cpus_lock);
                return;
        }
diff --git a/drivers/acpi/acpica/aclocal.h b/drivers/acpi/acpica/aclocal.h
index df85b53a674f..7dad9160f209 100644
--- a/drivers/acpi/acpica/aclocal.h
+++ b/drivers/acpi/acpica/aclocal.h
@@ -854,6 +854,7 @@ struct acpi_bit_register_info {
        ACPI_BITMASK_POWER_BUTTON_STATUS   | \
        ACPI_BITMASK_SLEEP_BUTTON_STATUS   | \
        ACPI_BITMASK_RT_CLOCK_STATUS       | \
+        ACPI_BITMASK_PCIEXP_WAKE_DISABLE   | \
        ACPI_BITMASK_WAKE_STATUS)
 #define ACPI_BITMASK_TIMER_ENABLE               0x0001
diff --git a/drivers/acpi/acpica/exutils.c b/drivers/acpi/acpica/exutils.c
index 74c24d517f81..4093522eed45 100644
--- a/drivers/acpi/acpica/exutils.c
+++ b/drivers/acpi/acpica/exutils.c
@@ -109,7 +109,7 @@ void acpi_ex_enter_interpreter(void)
 *
 * DESCRIPTION: Reacquire the interpreter execution region from within the
 *              interpreter code. Failure to enter the interpreter region is a
- *              fatal system error. Used in  conjuction with
+ *              fatal system error. Used in  conjunction with
 *              relinquish_interpreter
 *
 ******************************************************************************/
diff --git a/drivers/acpi/acpica/rsutils.c b/drivers/acpi/acpica/rsutils.c
index 22cfcfbd9fff..491191e6cf69 100644
--- a/drivers/acpi/acpica/rsutils.c
+++ b/drivers/acpi/acpica/rsutils.c
@@ -149,7 +149,7 @@ acpi_rs_move_data(void *destination, void *source, u16 item_count, u8 move_type)
                        /*
                         * 16-, 32-, and 64-bit cases must use the move macros that perform
-                         * endian conversion and/or accomodate hardware that cannot perform
+                         * endian conversion and/or accommodate hardware that cannot perform
                         * misaligned memory transfers
                         */
                case ACPI_RSC_MOVE16:
diff --git a/drivers/acpi/apei/Kconfig b/drivers/acpi/apei/Kconfig
index 907e350f1c7d..fca34ccfd294 100644
--- a/drivers/acpi/apei/Kconfig
+++ b/drivers/acpi/apei/Kconfig
@@ -34,6 +34,6 @@ config ACPI_APEI_ERST_DEBUG
        depends on ACPI_APEI
        help
          ERST is a way provided by APEI to save and retrieve hardware
-          error infomation to and from a persistent store. Enable this
+          error information to and from a persistent store. Enable this
          if you want to debugging and testing the ERST kernel support
          and firmware implementation.
diff --git a/drivers/acpi/apei/apei-base.c b/drivers/acpi/apei/apei-base.c
index 73fd0c7487c1..4a904a4bf05f 100644
--- a/drivers/acpi/apei/apei-base.c
+++ b/drivers/acpi/apei/apei-base.c
@@ -445,11 +445,15 @@ EXPORT_SYMBOL_GPL(apei_resources_sub);
 int apei_resources_request(struct apei_resources *resources,
                           const char *desc)
 {
-        struct apei_res *res, *res_bak;
+        struct apei_res *res, *res_bak = NULL;
        struct resource *r;
+        int rc;
-        apei_resources_sub(resources, &apei_resources_all);
+        rc = apei_resources_sub(resources, &apei_resources_all);
+        if (rc)
+                return rc;
+        rc = -EINVAL;
        list_for_each_entry(res, &resources->iomem, list) {
                r = request_mem_region(res->start, res->end - res->start,
                                       desc);
@@ -475,7 +479,11 @@ int apei_resources_request(struct apei_resources *resources,
                }
        }
-        apei_resources_merge(&apei_resources_all, resources);
+        rc = apei_resources_merge(&apei_resources_all, resources);
+        if (rc) {
+                pr_err(APEI_PFX "Fail to merge resources!\n");
+                goto err_unmap_ioport;
+        }
        return 0;
 err_unmap_ioport:
@@ -491,12 +499,13 @@ err_unmap_iomem:
                        break;
                release_mem_region(res->start, res->end - res->start);
        }
-        return -EINVAL;
+        return rc;
 }
 EXPORT_SYMBOL_GPL(apei_resources_request);
 void apei_resources_release(struct apei_resources *resources)
 {
+        int rc;
        struct apei_res *res;
        list_for_each_entry(res, &resources->iomem, list)
@@ -504,7 +513,9 @@ void apei_resources_release(struct apei_resources *resources)
        list_for_each_entry(res, &resources->ioport, list)
                release_region(res->start, res->end - res->start);
-        apei_resources_sub(&apei_resources_all, resources);
+        rc = apei_resources_sub(&apei_resources_all, resources);
+        if (rc)
+                pr_err(APEI_PFX "Fail to sub resources!\n");
 }
 EXPORT_SYMBOL_GPL(apei_resources_release);
diff --git a/drivers/acpi/apei/einj.c b/drivers/acpi/apei/einj.c
index 465c885938ee..cf29df69380b 100644
--- a/drivers/acpi/apei/einj.c
+++ b/drivers/acpi/apei/einj.c
@@ -426,7 +426,9 @@ DEFINE_SIMPLE_ATTRIBUTE(error_inject_fops, NULL,
 static int einj_check_table(struct acpi_table_einj *einj_tab)
 {
-        if (einj_tab->header_length != sizeof(struct acpi_table_einj))
+        if ((einj_tab->header_length !=
+             (sizeof(struct acpi_table_einj) - sizeof(einj_tab->header)))
+            && (einj_tab->header_length != sizeof(struct acpi_table_einj)))
                return -EINVAL;
        if (einj_tab->header.length < sizeof(struct acpi_table_einj))
                return -EINVAL;
diff --git a/drivers/acpi/apei/erst-dbg.c b/drivers/acpi/apei/erst-dbg.c
index 5281ddda2777..da1228a9a544 100644
--- a/drivers/acpi/apei/erst-dbg.c
+++ b/drivers/acpi/apei/erst-dbg.c
@@ -2,7 +2,7 @@
 * APEI Error Record Serialization Table debug support
 *
 * ERST is a way provided by APEI to save and retrieve hardware error
- * infomation to and from a persistent store. This file provide the
+ * information to and from a persistent store. This file provide the
 * debugging/testing support for ERST kernel support and firmware
 * implementation.
 *
@@ -111,11 +111,13 @@ retry:
                goto out;
        }
        if (len > erst_dbg_buf_len) {
-                kfree(erst_dbg_buf);
+                void *p;
                rc = -ENOMEM;
-                erst_dbg_buf = kmalloc(len, GFP_KERNEL);
+                p = kmalloc(len, GFP_KERNEL);
-                if (!erst_dbg_buf)
+                if (!p)
                        goto out;
+                kfree(erst_dbg_buf);
+                erst_dbg_buf = p;
                erst_dbg_buf_len = len;
                goto retry;
        }
@@ -150,11 +152,13 @@ static ssize_t erst_dbg_write(struct file *filp, const char __user *ubuf,
        if (mutex_lock_interruptible(&erst_dbg_mutex))
                return -EINTR;
        if (usize > erst_dbg_buf_len) {
-                kfree(erst_dbg_buf);
+                void *p;
                rc = -ENOMEM;
-                erst_dbg_buf = kmalloc(usize, GFP_KERNEL);
+                p = kmalloc(usize, GFP_KERNEL);
-                if (!erst_dbg_buf)
+                if (!p)
                        goto out;
+                kfree(erst_dbg_buf);
+                erst_dbg_buf = p;
                erst_dbg_buf_len = usize;
        }
        rc = copy_from_user(erst_dbg_buf, ubuf, usize);
diff --git a/drivers/acpi/apei/erst.c b/drivers/acpi/apei/erst.c
index 18645f4e83cd..1211c03149e8 100644
--- a/drivers/acpi/apei/erst.c
+++ b/drivers/acpi/apei/erst.c
@@ -2,7 +2,7 @@
 * APEI Error Record Serialization Table support
 *
 * ERST is a way provided by APEI to save and retrieve hardware error
- * infomation to and from a persistent store.
+ * information to and from a persistent store.
 *
 * For more information about ERST, please refer to ACPI Specification
 * version 4.0, section 17.4.
@@ -266,13 +266,30 @@ static int erst_exec_move_data(struct apei_exec_context *ctx,
 {
        int rc;
        u64 offset;
+        void *src, *dst;
+        /* ioremap does not work in interrupt context */
+        if (in_interrupt()) {
+                pr_warning(ERST_PFX
+                           "MOVE_DATA can not be used in interrupt context");
+                return -EBUSY;
+        }
        rc = __apei_exec_read_register(entry, &offset);
        if (rc)
                return rc;
-        memmove((void *)ctx->dst_base + offset,
-                (void *)ctx->src_base + offset,
+        src = ioremap(ctx->src_base + offset, ctx->var2);
-                ctx->var2);
+        if (!src)
+                return -ENOMEM;
+        dst = ioremap(ctx->dst_base + offset, ctx->var2);
+        if (!dst)
+                return -ENOMEM;
+        memmove(dst, src, ctx->var2);
+        iounmap(src);
+        iounmap(dst);
        return 0;
 }
@@ -750,7 +767,9 @@ __setup("erst_disable", setup_erst_disable);
 static int erst_check_table(struct acpi_table_erst *erst_tab)
 {
-        if (erst_tab->header_length != sizeof(struct acpi_table_erst))
+        if ((erst_tab->header_length !=
+             (sizeof(struct acpi_table_erst) - sizeof(erst_tab->header)))
+            && (erst_tab->header_length != sizeof(struct acpi_table_einj)))
                return -EINVAL;
        if (erst_tab->header.length < sizeof(struct acpi_table_erst))
                return -EINVAL;
diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
index 385a6059714a..0d505e59214d 100644
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -302,7 +302,7 @@ static int __devinit ghes_probe(struct platform_device *ghes_dev)
        struct ghes *ghes = NULL;
        int rc = -EINVAL;
-        generic = ghes_dev->dev.platform_data;
+        generic = *(struct acpi_hest_generic **)ghes_dev->dev.platform_data;
        if (!generic->enabled)
                return -ENODEV;
diff --git a/drivers/acpi/apei/hest.c b/drivers/acpi/apei/hest.c
index 343168d18266..1a3508a7fe03 100644
--- a/drivers/acpi/apei/hest.c
+++ b/drivers/acpi/apei/hest.c
@@ -137,20 +137,23 @@ static int hest_parse_ghes_count(struct acpi_hest_header *hest_hdr, void *data)
 static int hest_parse_ghes(struct acpi_hest_header *hest_hdr, void *data)
 {
-        struct acpi_hest_generic *generic;
        struct platform_device *ghes_dev;
        struct ghes_arr *ghes_arr = data;
        int rc;
        if (hest_hdr->type != ACPI_HEST_TYPE_GENERIC_ERROR)
                return 0;
-        generic = (struct acpi_hest_generic *)hest_hdr;
-        if (!generic->enabled)
+        if (!((struct acpi_hest_generic *)hest_hdr)->enabled)
                return 0;
        ghes_dev = platform_device_alloc("GHES", hest_hdr->source_id);
        if (!ghes_dev)
                return -ENOMEM;
-        ghes_dev->dev.platform_data = generic;
+        rc = platform_device_add_data(ghes_dev, &hest_hdr, sizeof(void *));
+        if (rc)
+                goto err;
        rc = platform_device_add(ghes_dev);
        if (rc)
                goto err;
diff --git a/drivers/acpi/atomicio.c b/drivers/acpi/atomicio.c
index 8f8bd736d4ff..542e53903891 100644
--- a/drivers/acpi/atomicio.c
+++ b/drivers/acpi/atomicio.c
@@ -142,7 +142,7 @@ static void __iomem *acpi_pre_map(phys_addr_t paddr,
        list_add_tail_rcu(&map->list, &acpi_iomaps);
        spin_unlock_irqrestore(&acpi_iomaps_lock, flags);
-        return vaddr + (paddr - pg_off);
+        return map->vaddr + (paddr - map->paddr);
 err_unmap:
        iounmap(vaddr);
        return NULL;
diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index dc58402b0a17..98417201e9ce 100644
--- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -273,7 +273,6 @@ static enum power_supply_property energy_battery_props[] = {
        POWER_SUPPLY_PROP_CYCLE_COUNT,
        POWER_SUPPLY_PROP_VOLTAGE_MIN_DESIGN,
        POWER_SUPPLY_PROP_VOLTAGE_NOW,
-        POWER_SUPPLY_PROP_CURRENT_NOW,
        POWER_SUPPLY_PROP_POWER_NOW,
        POWER_SUPPLY_PROP_ENERGY_FULL_DESIGN,
        POWER_SUPPLY_PROP_ENERGY_FULL,
diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
index 2bb28b9d91c4..af308d03f492 100644
--- a/drivers/acpi/blacklist.c
+++ b/drivers/acpi/blacklist.c
@@ -183,6 +183,8 @@ static int __init dmi_disable_osi_vista(const struct dmi_system_id *d)
 {
        printk(KERN_NOTICE PREFIX "DMI detected: %s\n", d->ident);
        acpi_osi_setup("!Windows 2006");
+        acpi_osi_setup("!Windows 2006 SP1");
+        acpi_osi_setup("!Windows 2006 SP2");
        return 0;
 }
 static int __init dmi_disable_osi_win7(const struct dmi_system_id *d)
@@ -202,6 +204,23 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
                },
        },
        {
+        /*
+         * There have a NVIF method in MSI GX723 DSDT need call by Nvidia
+         * driver (e.g. nouveau) when user press brightness hotkey.
+         * Currently, nouveau driver didn't do the job and it causes there
+         * have a infinite while loop in DSDT when user press hotkey.
+         * We add MSI GX723's dmi information to this table for workaround
+         * this issue.
+         * Will remove MSI GX723 from the table after nouveau grows support.
+         */
+        .callback = dmi_disable_osi_vista,
+        .ident = "MSI GX723",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "Micro-Star International"),
+                     DMI_MATCH(DMI_PRODUCT_NAME, "GX723"),
+                },
+        },
+        {
        .callback = dmi_disable_osi_vista,
        .ident = "Sony VGN-NS10J_S",
        .matches = {
@@ -226,6 +245,14 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
                },
        },
        {
+        .callback = dmi_disable_osi_vista,
+        .ident = "Toshiba Satellite L355",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                     DMI_MATCH(DMI_PRODUCT_VERSION, "Satellite L355"),
+                },
+        },
+        {
        .callback = dmi_disable_osi_win7,
        .ident = "ASUS K50IJ",
        .matches = {
@@ -233,6 +260,14 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
                     DMI_MATCH(DMI_PRODUCT_NAME, "K50IJ"),
                },
        },
+        {
+        .callback = dmi_disable_osi_vista,
+        .ident = "Toshiba P305D",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                     DMI_MATCH(DMI_PRODUCT_NAME, "Satellite P305D"),
+                },
+        },
        /*
         * BIOS invocation of _OSI(Linux) is almost always a BIOS bug.
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index 5c221ab535d5..310e3b9749cb 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -55,7 +55,7 @@ EXPORT_SYMBOL(acpi_root_dir);
 static int set_power_nocheck(const struct dmi_system_id *id)
 {
        printk(KERN_NOTICE PREFIX "%s detected - "
-                "disable power check in power transistion\n", id->ident);
+                "disable power check in power transition\n", id->ident);
        acpi_power_nocheck = 1;
        return 0;
 }
@@ -80,23 +80,15 @@ static int set_copy_dsdt(const struct dmi_system_id *id)
 static struct dmi_system_id dsdt_dmi_table[] __initdata = {
        /*
-         * Insyde BIOS on some TOSHIBA machines corrupt the DSDT.
+         * Invoke DSDT corruption work-around on all Toshiba Satellite.
         * https://bugzilla.kernel.org/show_bug.cgi?id=14679
         */
        {
         .callback = set_copy_dsdt,
-         .ident = "TOSHIBA Satellite A505",
+         .ident = "TOSHIBA Satellite",
         .matches = {
                DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
-                DMI_MATCH(DMI_PRODUCT_NAME, "Satellite A505"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "Satellite"),
-                },
-        },
-        {
-         .callback = set_copy_dsdt,
-         .ident = "TOSHIBA Satellite L505D",
-         .matches = {
-                DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
-                DMI_MATCH(DMI_PRODUCT_NAME, "Satellite L505D"),
                },
        },
        {}
@@ -1027,7 +1019,7 @@ static int __init acpi_init(void)
        /*
         * If the laptop falls into the DMI check table, the power state check
-         * will be disabled in the course of device power transistion.
+         * will be disabled in the course of device power transition.
         */
        dmi_check_system(power_nocheck_dmi_table);
diff --git a/drivers/acpi/fan.c b/drivers/acpi/fan.c
index 8a3b840c0bb2..d94d2953c974 100644
--- a/drivers/acpi/fan.c
+++ b/drivers/acpi/fan.c
@@ -369,7 +369,9 @@ static void __exit acpi_fan_exit(void)
        acpi_bus_unregister_driver(&acpi_fan_driver);
+#ifdef CONFIG_ACPI_PROCFS
        remove_proc_entry(ACPI_FAN_CLASS, acpi_root_dir);
+#endif
        return;
 }
diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
index e9699aaed109..bec561c14beb 100644
--- a/drivers/acpi/processor_core.c
+++ b/drivers/acpi/processor_core.c
@@ -29,12 +29,6 @@ static int set_no_mwait(const struct dmi_system_id *id)
 static struct dmi_system_id __cpuinitdata processor_idle_dmi_table[] = {
        {
-        set_no_mwait, "IFL91 board", {
-        DMI_MATCH(DMI_BIOS_VENDOR, "COMPAL"),
-        DMI_MATCH(DMI_SYS_VENDOR, "ZEPTO"),
-        DMI_MATCH(DMI_PRODUCT_VERSION, "3215W"),
-        DMI_MATCH(DMI_BOARD_NAME, "IFL91") }, NULL},
-        {
        set_no_mwait, "Extensa 5220", {
        DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies LTD"),
        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
@@ -352,4 +346,5 @@ void __init acpi_early_processor_set_pdc(void)
        acpi_walk_namespace(ACPI_TYPE_PROCESSOR, ACPI_ROOT_OBJECT,
                            ACPI_UINT32_MAX,
                            early_init_pdc, NULL, NULL, NULL);
+        acpi_get_devices("ACPI0007", early_init_pdc, NULL, NULL);
 }
diff --git a/drivers/acpi/processor_driver.c b/drivers/acpi/processor_driver.c
index 156021892389..347eb21b2353 100644
--- a/drivers/acpi/processor_driver.c
+++ b/drivers/acpi/processor_driver.c
@@ -850,7 +850,7 @@ static int __init acpi_processor_init(void)
                printk(KERN_DEBUG "ACPI: %s registered with cpuidle\n",
                        acpi_idle_driver.name);
        } else {
-                printk(KERN_DEBUG "ACPI: acpi_idle yielding to %s",
+                printk(KERN_DEBUG "ACPI: acpi_idle yielding to %s\n",
                        cpuidle_get_driver()->name);
        }
diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
index ba1bd263d903..3a73a93596e8 100644
--- a/drivers/acpi/processor_perflib.c
+++ b/drivers/acpi/processor_perflib.c
@@ -447,8 +447,8 @@ int acpi_processor_notify_smm(struct module *calling_module)
        if (!try_module_get(calling_module))
                return -EINVAL;
-        /* is_done is set to negative if an error occured,
+        /* is_done is set to negative if an error occurred,
-         * and to postitive if _no_ error occured, but SMM
+         * and to postitive if _no_ error occurred, but SMM
         * was already notified. This avoids double notification
         * which might lead to unexpected results...
         */
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index cf82989ae756..4754ff6e70e6 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -363,6 +363,12 @@ static int __init init_old_suspend_ordering(const struct dmi_system_id *d)
        return 0;
 }
+static int __init init_nvs_nosave(const struct dmi_system_id *d)
+{
+        acpi_nvs_nosave();
+        return 0;
+}
 static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
        {
        .callback = init_old_suspend_ordering,
@@ -397,6 +403,22 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
                DMI_MATCH(DMI_BOARD_NAME, "CF51-2L"),
                },
        },
+        {
+        .callback = init_nvs_nosave,
+        .ident = "Sony Vaio VGN-SR11M",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"),
+                DMI_MATCH(DMI_PRODUCT_NAME, "VGN-SR11M"),
+                },
+        },
+        {
+        .callback = init_nvs_nosave,
+        .ident = "Everex StepNote Series",
+        .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "Everex Systems, Inc."),
+                DMI_MATCH(DMI_PRODUCT_NAME, "Everex StepNote Series"),
+                },
+        },
        {},
 };
 #endif /* CONFIG_SUSPEND */
diff --git a/drivers/acpi/sysfs.c b/drivers/acpi/sysfs.c
index 68e2e4582fa2..f8588f81048a 100644
--- a/drivers/acpi/sysfs.c
+++ b/drivers/acpi/sysfs.c
@@ -100,7 +100,7 @@ static const struct acpi_dlevel acpi_debug_levels[] = {
        ACPI_DEBUG_INIT(ACPI_LV_EVENTS),
 };
-static int param_get_debug_layer(char *buffer, struct kernel_param *kp)
+static int param_get_debug_layer(char *buffer, const struct kernel_param *kp)
 {
        int result = 0;
        int i;
@@ -128,7 +128,7 @@ static int param_get_debug_layer(char *buffer, struct kernel_param *kp)
        return result;
 }
-static int param_get_debug_level(char *buffer, struct kernel_param *kp)
+static int param_get_debug_level(char *buffer, const struct kernel_param *kp)
 {
        int result = 0;
        int i;
@@ -149,10 +149,18 @@ static int param_get_debug_level(char *buffer, struct kernel_param *kp)
        return result;
 }
-module_param_call(debug_layer, param_set_uint, param_get_debug_layer,
+static struct kernel_param_ops param_ops_debug_layer = {
-                  &acpi_dbg_layer, 0644);
+        .set = param_set_uint,
-module_param_call(debug_level, param_set_uint, param_get_debug_level,
+        .get = param_get_debug_layer,
-                  &acpi_dbg_level, 0644);
+};
+static struct kernel_param_ops param_ops_debug_level = {
+        .set = param_set_uint,
+        .get = param_get_debug_level,
+};
+module_param_cb(debug_layer, &param_ops_debug_layer, &acpi_dbg_layer, 0644);
+module_param_cb(debug_level, &param_ops_debug_level, &acpi_dbg_level, 0644);
 static char trace_method_name[6];
 module_param_string(trace_method_name, trace_method_name, 6, 0644);
diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
index c5fef01b3c95..b83676126598 100644
--- a/drivers/acpi/video_detect.c
+++ b/drivers/acpi/video_detect.c
@@ -59,8 +59,8 @@ acpi_backlight_cap_match(acpi_handle handle, u32 level, void *context,
                                  "support\n"));
                *cap |= ACPI_VIDEO_BACKLIGHT;
                if (ACPI_FAILURE(acpi_get_handle(handle, "_BQC", &h_dummy)))
-                        printk(KERN_WARNING FW_BUG PREFIX "ACPI brightness "
+                        printk(KERN_WARNING FW_BUG PREFIX "No _BQC method, "
-                                        "control misses _BQC function\n");
+                                "cannot determine initial brightness\n");
                /* We have backlight support, no need to scan further */
                return AE_CTRL_TERMINATE;
        }
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index ff1c945fba98..99d0e5a51148 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -90,6 +90,10 @@ static int ahci_pci_device_suspend(struct pci_dev *pdev, pm_message_t mesg);
 static int ahci_pci_device_resume(struct pci_dev *pdev);
 #endif
+static struct scsi_host_template ahci_sht = {
+        AHCI_SHT("ahci"),
+};
 static struct ata_port_operations ahci_vt8251_ops = {
        .inherits               = &ahci_ops,
        .hardreset              = ahci_vt8251_hardreset,
diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h
index 474427b6f99f..e5fdeebf9ef0 100644
--- a/drivers/ata/ahci.h
+++ b/drivers/ata/ahci.h
@@ -298,7 +298,17 @@ struct ahci_host_priv {
 extern int ahci_ignore_sss;
-extern struct scsi_host_template ahci_sht;
+extern struct device_attribute *ahci_shost_attrs[];
+extern struct device_attribute *ahci_sdev_attrs[];
+#define AHCI_SHT(drv_name)                                              \
+        ATA_NCQ_SHT(drv_name),                                          \
+        .can_queue              = AHCI_MAX_CMDS - 1,                    \
+        .sg_tablesize           = AHCI_MAX_SG,                          \
+        .dma_boundary           = AHCI_DMA_BOUNDARY,                    \
+        .shost_attrs            = ahci_shost_attrs,                     \
+        .sdev_attrs             = ahci_sdev_attrs
 extern struct ata_port_operations ahci_ops;
 void ahci_save_initial_config(struct device *dev,
diff --git a/drivers/ata/ahci_platform.c b/drivers/ata/ahci_platform.c
index 4e97f33cca44..84b643270e7a 100644
--- a/drivers/ata/ahci_platform.c
+++ b/drivers/ata/ahci_platform.c
@@ -23,6 +23,10 @@
 #include <linux/ahci_platform.h>
 #include "ahci.h"
+static struct scsi_host_template ahci_platform_sht = {
+        AHCI_SHT("ahci_platform"),
+};
 static int __init ahci_probe(struct platform_device *pdev)
 {
        struct device *dev = &pdev->dev;
@@ -145,7 +149,7 @@ static int __init ahci_probe(struct platform_device *pdev)
        ahci_print_info(host, "platform");
        rc = ata_host_activate(host, irq, ahci_interrupt, IRQF_SHARED,
-                               &ahci_sht);
+                               &ahci_platform_sht);
        if (rc)
                goto err0;
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 68dc6785472f..8eea309ea212 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -121,7 +121,7 @@ static DEVICE_ATTR(ahci_port_cmd, S_IRUGO, ahci_show_port_cmd, NULL);
 static DEVICE_ATTR(em_buffer, S_IWUSR | S_IRUGO,
                   ahci_read_em_buffer, ahci_store_em_buffer);
-static struct device_attribute *ahci_shost_attrs[] = {
+struct device_attribute *ahci_shost_attrs[] = {
        &dev_attr_link_power_management_policy,
        &dev_attr_em_message_type,
        &dev_attr_em_message,
@@ -132,22 +132,14 @@ static struct device_attribute *ahci_shost_attrs[] = {
        &dev_attr_em_buffer,
        NULL
 };
+EXPORT_SYMBOL_GPL(ahci_shost_attrs);
-static struct device_attribute *ahci_sdev_attrs[] = {
+struct device_attribute *ahci_sdev_attrs[] = {
        &dev_attr_sw_activity,
        &dev_attr_unload_heads,
        NULL
 };
+EXPORT_SYMBOL_GPL(ahci_sdev_attrs);
-struct scsi_host_template ahci_sht = {
-        ATA_NCQ_SHT("ahci"),
-        .can_queue              = AHCI_MAX_CMDS - 1,
-        .sg_tablesize           = AHCI_MAX_SG,
-        .dma_boundary           = AHCI_DMA_BOUNDARY,
-        .shost_attrs            = ahci_shost_attrs,
-        .sdev_attrs             = ahci_sdev_attrs,
-};
-EXPORT_SYMBOL_GPL(ahci_sht);
 struct ata_port_operations ahci_ops = {
        .inherits               = &sata_pmp_port_ops,
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index 6124c2fd2d33..5e4fadcdece9 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -4792,7 +4792,7 @@ static int __devinit cciss_init_one(struct pci_dev *pdev,
 clean4:
        kfree(h->cmd_pool_bits);
        /* Free up sg elements */
-        for (k = 0; k < h->nr_cmds; k++)
+        for (k-- ; k >= 0; k--)
                kfree(h->scatter_list[k]);
        kfree(h->scatter_list);
        cciss_free_sg_chain_blocks(h->cmd_sg_list, h->nr_cmds);
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index b1cbeb59bb76..37a2bb595076 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -2369,7 +2369,7 @@ static void pkt_release_dev(struct pktcdvd_device *pd, int flush)
        pkt_shrink_pktlist(pd);
 }
-static struct pktcdvd_device *pkt_find_dev_from_minor(int dev_minor)
+static struct pktcdvd_device *pkt_find_dev_from_minor(unsigned int dev_minor)
 {
        if (dev_minor >= MAX_WRITERS)
                return NULL;
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 2aafafca2b13..1101e251a629 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -202,6 +202,7 @@ static int virtblk_get_id(struct gendisk *disk, char *id_str)
        struct virtio_blk *vblk = disk->private_data;
        struct request *req;
        struct bio *bio;
+        int err;
        bio = bio_map_kern(vblk->disk->queue, id_str, VIRTIO_BLK_ID_BYTES,
                           GFP_KERNEL);
@@ -215,7 +216,10 @@ static int virtblk_get_id(struct gendisk *disk, char *id_str)
        }
        req->cmd_type = REQ_TYPE_SPECIAL;
-        return blk_execute_rq(vblk->disk->queue, vblk->disk, req, false);
+        err = blk_execute_rq(vblk->disk->queue, vblk->disk, req, false);
+        blk_put_request(req);
+        return err;
 }
 static int virtblk_locked_ioctl(struct block_device *bdev, fmode_t mode,
diff --git a/drivers/char/agp/intel-agp.c b/drivers/char/agp/intel-agp.c
index eab58db5f91c..cd18493c9527 100644
--- a/drivers/char/agp/intel-agp.c
+++ b/drivers/char/agp/intel-agp.c
@@ -806,6 +806,8 @@ static const struct intel_driver_description {
            "G45/G43", NULL, &intel_i965_driver },
        { PCI_DEVICE_ID_INTEL_B43_HB, PCI_DEVICE_ID_INTEL_B43_IG,
            "B43", NULL, &intel_i965_driver },
+        { PCI_DEVICE_ID_INTEL_B43_1_HB, PCI_DEVICE_ID_INTEL_B43_1_IG,
+            "B43", NULL, &intel_i965_driver },
        { PCI_DEVICE_ID_INTEL_G41_HB, PCI_DEVICE_ID_INTEL_G41_IG,
            "G41", NULL, &intel_i965_driver },
        { PCI_DEVICE_ID_INTEL_IRONLAKE_D_HB, PCI_DEVICE_ID_INTEL_IRONLAKE_D_IG,
diff --git a/drivers/char/agp/intel-agp.h b/drivers/char/agp/intel-agp.h
index ee189c74d345..d09b1ab7e8ab 100644
--- a/drivers/char/agp/intel-agp.h
+++ b/drivers/char/agp/intel-agp.h
@@ -186,6 +186,8 @@
 #define PCI_DEVICE_ID_INTEL_Q33_IG          0x29D2
 #define PCI_DEVICE_ID_INTEL_B43_HB          0x2E40
 #define PCI_DEVICE_ID_INTEL_B43_IG          0x2E42
+#define PCI_DEVICE_ID_INTEL_B43_1_HB        0x2E90
+#define PCI_DEVICE_ID_INTEL_B43_1_IG        0x2E92
 #define PCI_DEVICE_ID_INTEL_GM45_HB         0x2A40
 #define PCI_DEVICE_ID_INTEL_GM45_IG         0x2A42
 #define PCI_DEVICE_ID_INTEL_EAGLELAKE_HB        0x2E00
diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
index 3822b4f49c84..7bd7c45b53ef 100644
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -305,6 +305,9 @@ static int num_force_kipmid;
 #ifdef CONFIG_PCI
 static int pci_registered;
 #endif
+#ifdef CONFIG_ACPI
+static int pnp_registered;
+#endif
 #ifdef CONFIG_PPC_OF
 static int of_registered;
 #endif
@@ -2126,7 +2129,7 @@ static int __devinit ipmi_pnp_probe(struct pnp_dev *dev,
 {
        struct acpi_device *acpi_dev;
        struct smi_info *info;
-        struct resource *res;
+        struct resource *res, *res_second;
        acpi_handle handle;
        acpi_status status;
        unsigned long long tmp;
@@ -2182,13 +2185,13 @@ static int __devinit ipmi_pnp_probe(struct pnp_dev *dev,
        info->io.addr_data = res->start;
        info->io.regspacing = DEFAULT_REGSPACING;
-        res = pnp_get_resource(dev,
+        res_second = pnp_get_resource(dev,
                               (info->io.addr_type == IPMI_IO_ADDR_SPACE) ?
                                        IORESOURCE_IO : IORESOURCE_MEM,
                               1);
-        if (res) {
+        if (res_second) {
-                if (res->start > info->io.addr_data)
+                if (res_second->start > info->io.addr_data)
-                        info->io.regspacing = res->start - info->io.addr_data;
+                        info->io.regspacing = res_second->start - info->io.addr_data;
        }
        info->io.regsize = DEFAULT_REGSPACING;
        info->io.regshift = 0;
@@ -3359,6 +3362,7 @@ static __devinit int init_ipmi_si(void)
 #ifdef CONFIG_ACPI
        pnp_register_driver(&ipmi_pnp_driver);
+        pnp_registered = 1;
 #endif
 #ifdef CONFIG_DMI
@@ -3526,7 +3530,8 @@ static __exit void cleanup_ipmi_si(void)
                pci_unregister_driver(&ipmi_pci_driver);
 #endif
 #ifdef CONFIG_ACPI
-        pnp_unregister_driver(&ipmi_pnp_driver);
+        if (pnp_registered)
+                pnp_unregister_driver(&ipmi_pnp_driver);
 #endif
 #ifdef CONFIG_PPC_OF
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index a398ecdbd758..1f528fad3516 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -788,10 +788,11 @@ static const struct file_operations zero_fops = {
 /*
 * capabilities for /dev/zero
 * - permits private mappings, "copies" are taken of the source of zeros
+ * - no writeback happens
 */
 static struct backing_dev_info zero_bdi = {
        .name           = "char/mem",
-        .capabilities   = BDI_CAP_MAP_COPY,
+        .capabilities   = BDI_CAP_MAP_COPY | BDI_CAP_NO_ACCT_AND_WRITEBACK,
 };
 static const struct file_operations full_fops = {
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 942a9826bd23..c810481a5bc2 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -596,6 +596,10 @@ static ssize_t port_fops_write(struct file *filp, const char __user *ubuf,
        ssize_t ret;
        bool nonblock;
+        /* Userspace could be out to fool us */
+        if (!count)
+                return 0;
        port = filp->private_data;
        nonblock = filp->f_flags & O_NONBLOCK;
@@ -642,7 +646,7 @@ static unsigned int port_fops_poll(struct file *filp, poll_table *wait)
        poll_wait(filp, &port->waitqueue, wait);
        ret = 0;
-        if (port->inbuf)
+        if (!will_read_block(port))
                ret |= POLLIN | POLLRDNORM;
        if (!will_write_block(port))
                ret |= POLLOUT;
diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c
index c2408bbe9c2e..f508690eb958 100644
--- a/drivers/cpuidle/governors/menu.c
+++ b/drivers/cpuidle/governors/menu.c
@@ -80,7 +80,7 @@
 * Limiting Performance Impact
 * ---------------------------
 * C states, especially those with large exit latencies, can have a real
- * noticable impact on workloads, which is not acceptable for most sysadmins,
+ * noticeable impact on workloads, which is not acceptable for most sysadmins,
 * and in addition, less performance has a power price of its own.
 *
 * As a general rule of thumb, menu assumes that the following heuristic
diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
index 3630308e7b81..6b21e25f7a84 100644
--- a/drivers/edac/edac_mc.c
+++ b/drivers/edac/edac_mc.c
@@ -339,6 +339,9 @@ static void edac_mc_workq_teardown(struct mem_ctl_info *mci)
 {
        int status;
+        if (mci->op_state != OP_RUNNING_POLL)
+                return;
        status = cancel_delayed_work(&mci->work);
        if (status == 0) {
                debugf0("%s() not canceled, flush the queue\n",
diff --git a/drivers/edac/i7core_edac.c b/drivers/edac/i7core_edac.c
index e0187d16dd7c..0fd5b85a0f75 100644
--- a/drivers/edac/i7core_edac.c
+++ b/drivers/edac/i7core_edac.c
@@ -1140,6 +1140,7 @@ static struct mcidev_sysfs_attribute i7core_udimm_counters_attrs[] = {
        ATTR_COUNTER(0),
        ATTR_COUNTER(1),
        ATTR_COUNTER(2),
+        { .attr = { .name = NULL } }
 };
 static struct mcidev_sysfs_group i7core_udimm_counters = {
diff --git a/drivers/gpu/drm/drm_buffer.c b/drivers/gpu/drm/drm_buffer.c
index 55d03ed05000..529a0dbe9fc6 100644
--- a/drivers/gpu/drm/drm_buffer.c
+++ b/drivers/gpu/drm/drm_buffer.c
@@ -98,8 +98,8 @@ EXPORT_SYMBOL(drm_buffer_alloc);
 *   user_data: A pointer the data that is copied to the buffer.
 *   size: The Number of bytes to copy.
 */
-extern int drm_buffer_copy_from_user(struct drm_buffer *buf,
+int drm_buffer_copy_from_user(struct drm_buffer *buf,
-                void __user *user_data, int size)
+                              void __user *user_data, int size)
 {
        int nr_pages = size / PAGE_SIZE + 1;
        int idx;
@@ -163,7 +163,7 @@ void *drm_buffer_read_object(struct drm_buffer *buf,
 {
        int idx = drm_buffer_index(buf);
        int page = drm_buffer_page(buf);
-        void *obj = 0;
+        void *obj = NULL;
        if (idx + objsize <= PAGE_SIZE) {
                obj = &buf->data[page][idx];
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index bf92d07510df..5663d2719063 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -148,7 +148,7 @@ int drm_gem_object_init(struct drm_device *dev,
                return -ENOMEM;
        kref_init(&obj->refcount);
-        kref_init(&obj->handlecount);
+        atomic_set(&obj->handle_count, 0);
        obj->size = size;
        atomic_inc(&dev->object_count);
@@ -462,28 +462,6 @@ drm_gem_object_free(struct kref *kref)
 }
 EXPORT_SYMBOL(drm_gem_object_free);
-/**
- * Called after the last reference to the object has been lost.
- * Must be called without holding struct_mutex
- *
- * Frees the object
- */
-void
-drm_gem_object_free_unlocked(struct kref *kref)
-{
-        struct drm_gem_object *obj = (struct drm_gem_object *) kref;
-        struct drm_device *dev = obj->dev;
-        if (dev->driver->gem_free_object_unlocked != NULL)
-                dev->driver->gem_free_object_unlocked(obj);
-        else if (dev->driver->gem_free_object != NULL) {
-                mutex_lock(&dev->struct_mutex);
-                dev->driver->gem_free_object(obj);
-                mutex_unlock(&dev->struct_mutex);
-        }
-}
-EXPORT_SYMBOL(drm_gem_object_free_unlocked);
 static void drm_gem_object_ref_bug(struct kref *list_kref)
 {
        BUG();
@@ -496,12 +474,8 @@ static void drm_gem_object_ref_bug(struct kref *list_kref)
 * called before drm_gem_object_free or we'll be touching
 * freed memory
 */
-void
+void drm_gem_object_handle_free(struct drm_gem_object *obj)
-drm_gem_object_handle_free(struct kref *kref)
 {
-        struct drm_gem_object *obj = container_of(kref,
-                                                  struct drm_gem_object,
-                                                  handlecount);
        struct drm_device *dev = obj->dev;
        /* Remove any name for this object */
@@ -528,6 +502,10 @@ void drm_gem_vm_open(struct vm_area_struct *vma)
        struct drm_gem_object *obj = vma->vm_private_data;
        drm_gem_object_reference(obj);
+        mutex_lock(&obj->dev->struct_mutex);
+        drm_vm_open_locked(vma);
+        mutex_unlock(&obj->dev->struct_mutex);
 }
 EXPORT_SYMBOL(drm_gem_vm_open);
@@ -535,7 +513,10 @@ void drm_gem_vm_close(struct vm_area_struct *vma)
 {
        struct drm_gem_object *obj = vma->vm_private_data;
-        drm_gem_object_unreference_unlocked(obj);
+        mutex_lock(&obj->dev->struct_mutex);
+        drm_vm_close_locked(vma);
+        drm_gem_object_unreference(obj);
+        mutex_unlock(&obj->dev->struct_mutex);
 }
 EXPORT_SYMBOL(drm_gem_vm_close);
diff --git a/drivers/gpu/drm/drm_info.c b/drivers/gpu/drm/drm_info.c
index 2ef2c7827243..974e970ce3f8 100644
--- a/drivers/gpu/drm/drm_info.c
+++ b/drivers/gpu/drm/drm_info.c
@@ -255,7 +255,7 @@ int drm_gem_one_name_info(int id, void *ptr, void *data)
        seq_printf(m, "%6d %8zd %7d %8d\n",
                   obj->name, obj->size,
-                   atomic_read(&obj->handlecount.refcount),
+                   atomic_read(&obj->handle_count),
                   atomic_read(&obj->refcount.refcount));
        return 0;
 }
diff --git a/drivers/gpu/drm/drm_vm.c b/drivers/gpu/drm/drm_vm.c
index fda67468e603..5df450683aab 100644
--- a/drivers/gpu/drm/drm_vm.c
+++ b/drivers/gpu/drm/drm_vm.c
@@ -433,15 +433,7 @@ static void drm_vm_open(struct vm_area_struct *vma)
        mutex_unlock(&dev->struct_mutex);
 }
-/**
+void drm_vm_close_locked(struct vm_area_struct *vma)
- * \c close method for all virtual memory types.
- *
- * \param vma virtual memory area.
- *
- * Search the \p vma private data entry in drm_device::vmalist, unlink it, and
- * free it.
- */
-static void drm_vm_close(struct vm_area_struct *vma)
 {
        struct drm_file *priv = vma->vm_file->private_data;
        struct drm_device *dev = priv->minor->dev;
@@ -451,7 +443,6 @@ static void drm_vm_close(struct vm_area_struct *vma)
                  vma->vm_start, vma->vm_end - vma->vm_start);
        atomic_dec(&dev->vma_count);
-        mutex_lock(&dev->struct_mutex);
        list_for_each_entry_safe(pt, temp, &dev->vmalist, head) {
                if (pt->vma == vma) {
                        list_del(&pt->head);
@@ -459,6 +450,23 @@ static void drm_vm_close(struct vm_area_struct *vma)
                        break;
                }
        }
+}
+/**
+ * \c close method for all virtual memory types.
+ *
+ * \param vma virtual memory area.
+ *
+ * Search the \p vma private data entry in drm_device::vmalist, unlink it, and
+ * free it.
+ */
+static void drm_vm_close(struct vm_area_struct *vma)
+{
+        struct drm_file *priv = vma->vm_file->private_data;
+        struct drm_device *dev = priv->minor->dev;
+        mutex_lock(&dev->struct_mutex);
+        drm_vm_close_locked(vma);
        mutex_unlock(&dev->struct_mutex);
 }
diff --git a/drivers/gpu/drm/i810/i810_dma.c b/drivers/gpu/drm/i810/i810_dma.c
index 61b4caf220fa..fb07e73581e8 100644
--- a/drivers/gpu/drm/i810/i810_dma.c
+++ b/drivers/gpu/drm/i810/i810_dma.c
@@ -116,7 +116,7 @@ static int i810_mmap_buffers(struct file *filp, struct vm_area_struct *vma)
 static const struct file_operations i810_buffer_fops = {
        .open = drm_open,
        .release = drm_release,
-        .unlocked_ioctl = drm_ioctl,
+        .unlocked_ioctl = i810_ioctl,
        .mmap = i810_mmap_buffers,
        .fasync = drm_fasync,
 };
diff --git a/drivers/gpu/drm/i830/i830_dma.c b/drivers/gpu/drm/i830/i830_dma.c
index 671aa18415ac..cc92c7e6236f 100644
--- a/drivers/gpu/drm/i830/i830_dma.c
+++ b/drivers/gpu/drm/i830/i830_dma.c
@@ -118,7 +118,7 @@ static int i830_mmap_buffers(struct file *filp, struct vm_area_struct *vma)
 static const struct file_operations i830_buffer_fops = {
        .open = drm_open,
        .release = drm_release,
-        .unlocked_ioctl = drm_ioctl,
+        .unlocked_ioctl = i830_ioctl,
        .mmap = i830_mmap_buffers,
        .fasync = drm_fasync,
 };
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 9d67b4853030..2dd2c93ebfa3 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1787,9 +1787,9 @@ unsigned long i915_chipset_val(struct drm_i915_private *dev_priv)
                }
        }
-        div_u64(diff, diff1);
+        diff = div_u64(diff, diff1);
        ret = ((m * diff) + c);
-        div_u64(ret, 10);
+        ret = div_u64(ret, 10);
        dev_priv->last_count1 = total_count;
        dev_priv->last_time1 = now;
@@ -1858,7 +1858,7 @@ void i915_update_gfx_val(struct drm_i915_private *dev_priv)
        /* More magic constants... */
        diff = diff * 1181;
-        div_u64(diff, diffms * 10);
+        diff = div_u64(diff, diffms * 10);
        dev_priv->gfx_power = diff;
 }
@@ -2231,6 +2231,9 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
        dev_priv->mchdev_lock = &mchdev_lock;
        spin_unlock(&mchdev_lock);
+        /* XXX Prevent module unload due to memory corruption bugs. */
+        __module_get(THIS_MODULE);
        return 0;
 out_workqueue_free:
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 216deb579785..6dbe14cc4f74 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -170,6 +170,7 @@ static const struct pci_device_id pciidlist[] = {		/* aka */
        INTEL_VGA_DEVICE(0x2e22, &intel_g45_info),              /* G45_G */
        INTEL_VGA_DEVICE(0x2e32, &intel_g45_info),              /* G41_G */
        INTEL_VGA_DEVICE(0x2e42, &intel_g45_info),              /* B43_G */
+        INTEL_VGA_DEVICE(0x2e92, &intel_g45_info),              /* B43_G.1 */
        INTEL_VGA_DEVICE(0xa001, &intel_pineview_info),
        INTEL_VGA_DEVICE(0xa011, &intel_pineview_info),
        INTEL_VGA_DEVICE(0x0042, &intel_ironlake_d_info),
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 16fca1d1799a..90b1d6753b9d 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -136,14 +136,12 @@ i915_gem_create_ioctl(struct drm_device *dev, void *data,
                return -ENOMEM;
        ret = drm_gem_handle_create(file_priv, obj, &handle);
+        /* drop reference from allocate - handle holds it now */
+        drm_gem_object_unreference_unlocked(obj);
        if (ret) {
-                drm_gem_object_unreference_unlocked(obj);
                return ret;
        }
-        /* Sink the floating reference from kref_init(handlecount) */
-        drm_gem_object_handle_unreference_unlocked(obj);
        args->handle = handle;
        return 0;
 }
@@ -471,14 +469,17 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,
                return -ENOENT;
        obj_priv = to_intel_bo(obj);
-        /* Bounds check source.
+        /* Bounds check source.  */
-         *
+        if (args->offset > obj->size || args->size > obj->size - args->offset) {
-         * XXX: This could use review for overflow issues...
+                ret = -EINVAL;
-         */
+                goto err;
-        if (args->offset > obj->size || args->size > obj->size ||
+        }
-            args->offset + args->size > obj->size) {
-                drm_gem_object_unreference_unlocked(obj);
+        if (!access_ok(VERIFY_WRITE,
-                return -EINVAL;
+                       (char __user *)(uintptr_t)args->data_ptr,
+                       args->size)) {
+                ret = -EFAULT;
+                goto err;
        }
        if (i915_gem_object_needs_bit17_swizzle(obj)) {
@@ -490,8 +491,8 @@ i915_gem_pread_ioctl(struct drm_device *dev, void *data,
                                                        file_priv);
        }
+err:
        drm_gem_object_unreference_unlocked(obj);
        return ret;
 }
@@ -580,8 +581,6 @@ i915_gem_gtt_pwrite_fast(struct drm_device *dev, struct drm_gem_object *obj,
        user_data = (char __user *) (uintptr_t) args->data_ptr;
        remain = args->size;
-        if (!access_ok(VERIFY_READ, user_data, remain))
-                return -EFAULT;
        mutex_lock(&dev->struct_mutex);
@@ -934,14 +933,17 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
                return -ENOENT;
        obj_priv = to_intel_bo(obj);
-        /* Bounds check destination.
+        /* Bounds check destination. */
-         *
+        if (args->offset > obj->size || args->size > obj->size - args->offset) {
-         * XXX: This could use review for overflow issues...
+                ret = -EINVAL;
-         */
+                goto err;
-        if (args->offset > obj->size || args->size > obj->size ||
+        }
-            args->offset + args->size > obj->size) {
-                drm_gem_object_unreference_unlocked(obj);
+        if (!access_ok(VERIFY_READ,
-                return -EINVAL;
+                       (char __user *)(uintptr_t)args->data_ptr,
+                       args->size)) {
+                ret = -EFAULT;
+                goto err;
        }
        /* We can only do the GTT pwrite on untiled buffers, as otherwise
@@ -975,8 +977,8 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data,
                DRM_INFO("pwrite failed %d\n", ret);
 #endif
+err:
        drm_gem_object_unreference_unlocked(obj);
        return ret;
 }
@@ -2351,14 +2353,21 @@ i915_gem_object_get_fence_reg(struct drm_gem_object *obj)
        reg->obj = obj;
-        if (IS_GEN6(dev))
+        switch (INTEL_INFO(dev)->gen) {
+        case 6:
                sandybridge_write_fence_reg(reg);
-        else if (IS_I965G(dev))
+                break;
+        case 5:
+        case 4:
                i965_write_fence_reg(reg);
-        else if (IS_I9XX(dev))
+                break;
+        case 3:
                i915_write_fence_reg(reg);
-        else
+                break;
+        case 2:
                i830_write_fence_reg(reg);
+                break;
+        }
        trace_i915_gem_object_get_fence(obj, obj_priv->fence_reg,
                        obj_priv->tiling_mode);
@@ -2381,22 +2390,26 @@ i915_gem_clear_fence_reg(struct drm_gem_object *obj)
        struct drm_i915_gem_object *obj_priv = to_intel_bo(obj);
        struct drm_i915_fence_reg *reg =
                &dev_priv->fence_regs[obj_priv->fence_reg];
+        uint32_t fence_reg;
-        if (IS_GEN6(dev)) {
+        switch (INTEL_INFO(dev)->gen) {
+        case 6:
                I915_WRITE64(FENCE_REG_SANDYBRIDGE_0 +
                             (obj_priv->fence_reg * 8), 0);
-        } else if (IS_I965G(dev)) {
+                break;
+        case 5:
+        case 4:
                I915_WRITE64(FENCE_REG_965_0 + (obj_priv->fence_reg * 8), 0);
-        } else {
+                break;
-                uint32_t fence_reg;
+        case 3:
+                if (obj_priv->fence_reg >= 8)
-                if (obj_priv->fence_reg < 8)
+                        fence_reg = FENCE_REG_945_8 + (obj_priv->fence_reg - 8) * 4;
-                        fence_reg = FENCE_REG_830_0 + obj_priv->fence_reg * 4;
                else
-                        fence_reg = FENCE_REG_945_8 + (obj_priv->fence_reg -
+        case 2:
-                                                       8) * 4;
+                        fence_reg = FENCE_REG_830_0 + obj_priv->fence_reg * 4;
                I915_WRITE(fence_reg, 0);
+                break;
        }
        reg->obj = NULL;
@@ -3247,6 +3260,8 @@ i915_gem_object_pin_and_relocate(struct drm_gem_object *obj,
                                  (int) reloc->offset,
                                  reloc->read_domains,
                                  reloc->write_domain);
+                        drm_gem_object_unreference(target_obj);
+                        i915_gem_object_unpin(obj);
                        return -EINVAL;
                }
                if (reloc->write_domain & I915_GEM_DOMAIN_CPU ||
diff --git a/drivers/gpu/drm/i915/i915_gem_evict.c b/drivers/gpu/drm/i915/i915_gem_evict.c
index 72cae3cccad8..5c428fa3e0b3 100644
--- a/drivers/gpu/drm/i915/i915_gem_evict.c
+++ b/drivers/gpu/drm/i915/i915_gem_evict.c
@@ -79,6 +79,7 @@ mark_free(struct drm_i915_gem_object *obj_priv,
           struct list_head *unwind)
 {
        list_add(&obj_priv->evict_list, unwind);
+        drm_gem_object_reference(&obj_priv->base);
        return drm_mm_scan_add_block(obj_priv->gtt_space);
 }
@@ -92,7 +93,7 @@ i915_gem_evict_something(struct drm_device *dev, int min_size, unsigned alignmen
 {
        drm_i915_private_t *dev_priv = dev->dev_private;
        struct list_head eviction_list, unwind_list;
-        struct drm_i915_gem_object *obj_priv, *tmp_obj_priv;
+        struct drm_i915_gem_object *obj_priv;
        struct list_head *render_iter, *bsd_iter;
        int ret = 0;
@@ -165,6 +166,7 @@ i915_gem_evict_something(struct drm_device *dev, int min_size, unsigned alignmen
        list_for_each_entry(obj_priv, &unwind_list, evict_list) {
                ret = drm_mm_scan_remove_block(obj_priv->gtt_space);
                BUG_ON(ret);
+                drm_gem_object_unreference(&obj_priv->base);
        }
        /* We expect the caller to unpin, evict all and try again, or give up.
@@ -173,36 +175,34 @@ i915_gem_evict_something(struct drm_device *dev, int min_size, unsigned alignmen
        return -ENOSPC;
 found:
+        /* drm_mm doesn't allow any other other operations while
+         * scanning, therefore store to be evicted objects on a
+         * temporary list. */
        INIT_LIST_HEAD(&eviction_list);
-        list_for_each_entry_safe(obj_priv, tmp_obj_priv,
+        while (!list_empty(&unwind_list)) {
-                                 &unwind_list, evict_list) {
+                obj_priv = list_first_entry(&unwind_list,
+                                            struct drm_i915_gem_object,
+                                            evict_list);
                if (drm_mm_scan_remove_block(obj_priv->gtt_space)) {
-                        /* drm_mm doesn't allow any other other operations while
-                         * scanning, therefore store to be evicted objects on a
-                         * temporary list. */
                        list_move(&obj_priv->evict_list, &eviction_list);
+                        continue;
                }
+                list_del(&obj_priv->evict_list);
+                drm_gem_object_unreference(&obj_priv->base);
        }
        /* Unbinding will emit any required flushes */
-        list_for_each_entry_safe(obj_priv, tmp_obj_priv,
+        while (!list_empty(&eviction_list)) {
-                                 &eviction_list, evict_list) {
+                obj_priv = list_first_entry(&eviction_list,
-#if WATCH_LRU
+                                            struct drm_i915_gem_object,
-                DRM_INFO("%s: evicting %p\n", __func__, obj);
+                                            evict_list);
-#endif
+                if (ret == 0)
-                ret = i915_gem_object_unbind(&obj_priv->base);
+                        ret = i915_gem_object_unbind(&obj_priv->base);
-                if (ret)
+                list_del(&obj_priv->evict_list);
-                        return ret;
+                drm_gem_object_unreference(&obj_priv->base);
        }
-        /* The just created free hole should be on the top of the free stack
+        return ret;
-         * maintained by drm_mm, so this BUG_ON actually executes in O(1).
-         * Furthermore all accessed data has just recently been used, so it
-         * should be really fast, too. */
-        BUG_ON(!drm_mm_search_free(&dev_priv->mm.gtt_space, min_size,
-                                   alignment, 0));
-        return 0;
 }
 int
diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
index 2c6b98f2440e..31f08581e93a 100644
--- a/drivers/gpu/drm/i915/i915_suspend.c
+++ b/drivers/gpu/drm/i915/i915_suspend.c
@@ -789,16 +789,25 @@ int i915_save_state(struct drm_device *dev)
                dev_priv->saveSWF2[i] = I915_READ(SWF30 + (i << 2));
        /* Fences */
-        if (IS_I965G(dev)) {
+        switch (INTEL_INFO(dev)->gen) {
+        case 6:
+                for (i = 0; i < 16; i++)
+                        dev_priv->saveFENCE[i] = I915_READ64(FENCE_REG_SANDYBRIDGE_0 + (i * 8));
+                break;
+        case 5:
+        case 4:
                for (i = 0; i < 16; i++)
                        dev_priv->saveFENCE[i] = I915_READ64(FENCE_REG_965_0 + (i * 8));
-        } else {
+                break;
-                for (i = 0; i < 8; i++)
+        case 3:
-                        dev_priv->saveFENCE[i] = I915_READ(FENCE_REG_830_0 + (i * 4));
                if (IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev))
                        for (i = 0; i < 8; i++)
                                dev_priv->saveFENCE[i+8] = I915_READ(FENCE_REG_945_8 + (i * 4));
+        case 2:
+                for (i = 0; i < 8; i++)
+                        dev_priv->saveFENCE[i] = I915_READ(FENCE_REG_830_0 + (i * 4));
+                break;
        }
        return 0;
@@ -815,15 +824,24 @@ int i915_restore_state(struct drm_device *dev)
        I915_WRITE(HWS_PGA, dev_priv->saveHWS);
        /* Fences */
-        if (IS_I965G(dev)) {
+        switch (INTEL_INFO(dev)->gen) {
+        case 6:
+                for (i = 0; i < 16; i++)
+                        I915_WRITE64(FENCE_REG_SANDYBRIDGE_0 + (i * 8), dev_priv->saveFENCE[i]);
+                break;
+        case 5:
+        case 4:
                for (i = 0; i < 16; i++)
                        I915_WRITE64(FENCE_REG_965_0 + (i * 8), dev_priv->saveFENCE[i]);
-        } else {
+                break;
-                for (i = 0; i < 8; i++)
+        case 3:
-                        I915_WRITE(FENCE_REG_830_0 + (i * 4), dev_priv->saveFENCE[i]);
+        case 2:
                if (IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev))
                        for (i = 0; i < 8; i++)
                                I915_WRITE(FENCE_REG_945_8 + (i * 4), dev_priv->saveFENCE[i+8]);
+                for (i = 0; i < 8; i++)
+                        I915_WRITE(FENCE_REG_830_0 + (i * 4), dev_priv->saveFENCE[i]);
+                break;
        }
        i915_restore_display(dev);
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index a02a8df73727..197d4f32585a 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -188,7 +188,7 @@ static bool intel_ironlake_crt_detect_hotplug(struct drm_connector *connector)
        if (wait_for((I915_READ(PCH_ADPA) & ADPA_CRT_HOTPLUG_FORCE_TRIGGER) == 0,
                     1000, 1))
-                DRM_ERROR("timed out waiting for FORCE_TRIGGER");
+                DRM_DEBUG_KMS("timed out waiting for FORCE_TRIGGER");
        if (turn_off_dac) {
                I915_WRITE(PCH_ADPA, temp);
@@ -245,7 +245,7 @@ static bool intel_crt_detect_hotplug(struct drm_connector *connector)
                if (wait_for((I915_READ(PORT_HOTPLUG_EN) &
                              CRT_HOTPLUG_FORCE_DETECT) == 0,
                             1000, 1))
-                        DRM_ERROR("timed out waiting for FORCE_DETECT to go off");
+                        DRM_DEBUG_KMS("timed out waiting for FORCE_DETECT to go off");
        }
        stat = I915_READ(PORT_HOTPLUG_STAT);
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 19daead5b525..979228594599 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -1013,8 +1013,8 @@ void intel_wait_for_vblank(struct drm_device *dev, int pipe)
                DRM_DEBUG_KMS("vblank wait timed out\n");
 }
-/**
+/*
- * intel_wait_for_vblank_off - wait for vblank after disabling a pipe
+ * intel_wait_for_pipe_off - wait for pipe to turn off
 * @dev: drm device
 * @pipe: pipe to wait for
 *
@@ -1022,25 +1022,39 @@ void intel_wait_for_vblank(struct drm_device *dev, int pipe)
 * spinning on the vblank interrupt status bit, since we won't actually
 * see an interrupt when the pipe is disabled.
 *
- * So this function waits for the display line value to settle (it
+ * On Gen4 and above:
- * usually ends up stopping at the start of the next frame).
+ *   wait for the pipe register state bit to turn off
+ *
+ * Otherwise:
+ *   wait for the display line value to settle (it usually
+ *   ends up stopping at the start of the next frame).
+ *  
 */
-void intel_wait_for_vblank_off(struct drm_device *dev, int pipe)
+static void intel_wait_for_pipe_off(struct drm_device *dev, int pipe)
 {
        struct drm_i915_private *dev_priv = dev->dev_private;
-        int pipedsl_reg = (pipe == 0 ? PIPEADSL : PIPEBDSL);
-        unsigned long timeout = jiffies + msecs_to_jiffies(100);
+        if (INTEL_INFO(dev)->gen >= 4) {
-        u32 last_line;
+                int pipeconf_reg = (pipe == 0 ? PIPEACONF : PIPEBCONF);
-        /* Wait for the display line to settle */
+                /* Wait for the Pipe State to go off */
-        do {
+                if (wait_for((I915_READ(pipeconf_reg) & I965_PIPECONF_ACTIVE) == 0,
-                last_line = I915_READ(pipedsl_reg) & DSL_LINEMASK;
+                             100, 0))
-                mdelay(5);
+                        DRM_DEBUG_KMS("pipe_off wait timed out\n");
-        } while (((I915_READ(pipedsl_reg) & DSL_LINEMASK) != last_line) &&
+        } else {
-                 time_after(timeout, jiffies));
+                u32 last_line;
+                int pipedsl_reg = (pipe == 0 ? PIPEADSL : PIPEBDSL);
-        if (time_after(jiffies, timeout))
+                unsigned long timeout = jiffies + msecs_to_jiffies(100);
-                DRM_DEBUG_KMS("vblank wait timed out\n");
+                /* Wait for the display line to settle */
+                do {
+                        last_line = I915_READ(pipedsl_reg) & DSL_LINEMASK;
+                        mdelay(5);
+                } while (((I915_READ(pipedsl_reg) & DSL_LINEMASK) != last_line) &&
+                         time_after(timeout, jiffies));
+                if (time_after(jiffies, timeout))
+                        DRM_DEBUG_KMS("pipe_off wait timed out\n");
+        }
 }
 /* Parameters have changed, update FBC info */
@@ -2328,13 +2342,13 @@ static void i9xx_crtc_dpms(struct drm_crtc *crtc, int mode)
                        I915_READ(dspbase_reg);
                }
-                /* Wait for vblank for the disable to take effect */
-                intel_wait_for_vblank_off(dev, pipe);
                /* Don't disable pipe A or pipe A PLLs if needed */
                if (pipeconf_reg == PIPEACONF &&
-                    (dev_priv->quirks & QUIRK_PIPEA_FORCE))
+                    (dev_priv->quirks & QUIRK_PIPEA_FORCE)) {
+                        /* Wait for vblank for the disable to take effect */
+                        intel_wait_for_vblank(dev, pipe);
                        goto skip_pipe_off;
+                }
                /* Next, disable display pipes */
                temp = I915_READ(pipeconf_reg);
@@ -2343,8 +2357,8 @@ static void i9xx_crtc_dpms(struct drm_crtc *crtc, int mode)
                        I915_READ(pipeconf_reg);
                }
-                /* Wait for vblank for the disable to take effect. */
+                /* Wait for the pipe to turn off */
-                intel_wait_for_vblank_off(dev, pipe);
+                intel_wait_for_pipe_off(dev, pipe);
                temp = I915_READ(dpll_reg);
                if ((temp & DPLL_VCO_ENABLE) != 0) {
@@ -2463,11 +2477,19 @@ static bool intel_crtc_mode_fixup(struct drm_crtc *crtc,
                                  struct drm_display_mode *adjusted_mode)
 {
        struct drm_device *dev = crtc->dev;
        if (HAS_PCH_SPLIT(dev)) {
                /* FDI link clock is fixed at 2.7G */
                if (mode->clock * 3 > IRONLAKE_FDI_FREQ * 4)
                        return false;
        }
+        /* XXX some encoders set the crtcinfo, others don't.
+         * Obviously we need some form of conflict resolution here...
+         */
+        if (adjusted_mode->crtc_htotal == 0)
+                drm_mode_set_crtcinfo(adjusted_mode, 0);
        return true;
 }
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 1a51ee07de3e..9ab8708ac6ba 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -1138,18 +1138,14 @@ static bool
 intel_dp_set_link_train(struct intel_dp *intel_dp,
                        uint32_t dp_reg_value,
                        uint8_t dp_train_pat,
-                        uint8_t train_set[4],
+                        uint8_t train_set[4])
-                        bool first)
 {
        struct drm_device *dev = intel_dp->base.enc.dev;
        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct intel_crtc *intel_crtc = to_intel_crtc(intel_dp->base.enc.crtc);
        int ret;
        I915_WRITE(intel_dp->output_reg, dp_reg_value);
        POSTING_READ(intel_dp->output_reg);
-        if (first)
-                intel_wait_for_vblank(dev, intel_crtc->pipe);
        intel_dp_aux_native_write_1(intel_dp,
                                    DP_TRAINING_PATTERN_SET,
@@ -1174,10 +1170,15 @@ intel_dp_link_train(struct intel_dp *intel_dp)
        uint8_t voltage;
        bool clock_recovery = false;
        bool channel_eq = false;
-        bool first = true;
        int tries;
        u32 reg;
        uint32_t DP = intel_dp->DP;
+        struct intel_crtc *intel_crtc = to_intel_crtc(intel_dp->base.enc.crtc);
+        /* Enable output, wait for it to become active */
+        I915_WRITE(intel_dp->output_reg, intel_dp->DP);
+        POSTING_READ(intel_dp->output_reg);
+        intel_wait_for_vblank(dev, intel_crtc->pipe);
        /* Write the link configuration data */
        intel_dp_aux_native_write(intel_dp, DP_LINK_BW_SET,
@@ -1210,9 +1211,8 @@ intel_dp_link_train(struct intel_dp *intel_dp)
                        reg = DP | DP_LINK_TRAIN_PAT_1;
                if (!intel_dp_set_link_train(intel_dp, reg,
-                                             DP_TRAINING_PATTERN_1, train_set, first))
+                                             DP_TRAINING_PATTERN_1, train_set))
                        break;
-                first = false;
                /* Set training pattern 1 */
                udelay(100);
@@ -1266,8 +1266,7 @@ intel_dp_link_train(struct intel_dp *intel_dp)
                /* channel eq pattern */
                if (!intel_dp_set_link_train(intel_dp, reg,
-                                             DP_TRAINING_PATTERN_2, train_set,
+                                             DP_TRAINING_PATTERN_2, train_set))
-                                             false))
                        break;
                udelay(400);
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index ad312ca6b3e5..8828b3ac6414 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -229,7 +229,6 @@ extern struct drm_display_mode *intel_crtc_mode_get(struct drm_device *dev,
                                                    struct drm_crtc *crtc);
 int intel_get_pipe_from_crtc_id(struct drm_device *dev, void *data,
                                struct drm_file *file_priv);
-extern void intel_wait_for_vblank_off(struct drm_device *dev, int pipe);
 extern void intel_wait_for_vblank(struct drm_device *dev, int pipe);
 extern struct drm_crtc *intel_get_crtc_from_pipe(struct drm_device *dev, int pipe);
 extern struct drm_crtc *intel_get_load_detect_pipe(struct intel_encoder *intel_encoder,
diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
index 7bdc96256bf5..b61966c126d3 100644
--- a/drivers/gpu/drm/i915/intel_fb.c
+++ b/drivers/gpu/drm/i915/intel_fb.c
@@ -237,8 +237,10 @@ int intel_fbdev_destroy(struct drm_device *dev,
        drm_fb_helper_fini(&ifbdev->helper);
        drm_framebuffer_cleanup(&ifb->base);
-        if (ifb->obj)
+        if (ifb->obj) {
                drm_gem_object_unreference(ifb->obj);
+                ifb->obj = NULL;
+        }
        return 0;
 }
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index e8e902d614ed..ee73e428a84a 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -2170,8 +2170,7 @@ intel_sdvo_tv_init(struct intel_sdvo *intel_sdvo, int type)
        return true;
 err:
-        intel_sdvo_destroy_enhance_property(connector);
+        intel_sdvo_destroy(connector);
-        kfree(intel_sdvo_connector);
        return false;
 }
@@ -2243,8 +2242,7 @@ intel_sdvo_lvds_init(struct intel_sdvo *intel_sdvo, int device)
        return true;
 err:
-        intel_sdvo_destroy_enhance_property(connector);
+        intel_sdvo_destroy(connector);
-        kfree(intel_sdvo_connector);
        return false;
 }
@@ -2522,11 +2520,10 @@ static bool intel_sdvo_create_enhance_property(struct intel_sdvo *intel_sdvo,
                uint16_t response;
        } enhancements;
-        if (!intel_sdvo_get_value(intel_sdvo,
+        enhancements.response = 0;
-                                  SDVO_CMD_GET_SUPPORTED_ENHANCEMENTS,
+        intel_sdvo_get_value(intel_sdvo,
-                                  &enhancements, sizeof(enhancements)))
+                             SDVO_CMD_GET_SUPPORTED_ENHANCEMENTS,
-                return false;
+                             &enhancements, sizeof(enhancements));
        if (enhancements.response == 0) {
                DRM_DEBUG_KMS("No enhancement is supported\n");
                return true;
diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
index 87186a4bbf03..fc737037f751 100644
--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
@@ -558,8 +558,10 @@ nouveau_connector_get_modes(struct drm_connector *connector)
        if (nv_encoder->dcb->type == OUTPUT_LVDS &&
            (nv_encoder->dcb->lvdsconf.use_straps_for_mode ||
             dev_priv->vbios.fp_no_ddc) && nouveau_bios_fp_mode(dev, NULL)) {
-                nv_connector->native_mode = drm_mode_create(dev);
+                struct drm_display_mode mode;
-                nouveau_bios_fp_mode(dev, nv_connector->native_mode);
+                nouveau_bios_fp_mode(dev, &mode);
+                nv_connector->native_mode = drm_mode_duplicate(dev, &mode);
        }
        /* Find the native mode if this is a digital panel, if we didn't
diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
index ead7b8fc53fc..19620a6709f5 100644
--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
@@ -167,11 +167,9 @@ nouveau_gem_ioctl_new(struct drm_device *dev, void *data,
                goto out;
        ret = drm_gem_handle_create(file_priv, nvbo->gem, &req->info.handle);
+        /* drop reference from allocate - handle holds it now */
+        drm_gem_object_unreference_unlocked(nvbo->gem);
 out:
-        drm_gem_object_handle_unreference_unlocked(nvbo->gem);
-        if (ret)
-                drm_gem_object_unreference_unlocked(nvbo->gem);
        return ret;
 }
diff --git a/drivers/gpu/drm/radeon/atombios.h b/drivers/gpu/drm/radeon/atombios.h
index 1bc72c3190a9..fe359a239df3 100644
--- a/drivers/gpu/drm/radeon/atombios.h
+++ b/drivers/gpu/drm/radeon/atombios.h
@@ -4999,7 +4999,7 @@ typedef struct _SW_I2C_IO_DATA_PARAMETERS
 #define SW_I2C_CNTL_WRITE1BIT 6
 //==============================VESA definition Portion===============================
-#define VESA_OEM_PRODUCT_REV                                '01.00'
+#define VESA_OEM_PRODUCT_REV                                "01.00"
 #define VESA_MODE_ATTRIBUTE_MODE_SUPPORT             0xBB       //refer to VBE spec p.32, no TTY support
 #define VESA_MODE_WIN_ATTRIBUTE                                              7
 #define VESA_WIN_SIZE                                                                                        64
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 79082d4398ae..2f93d46ae69a 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -1137,7 +1137,7 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
                WREG32(RCU_IND_INDEX, 0x203);
                efuse_straps_3 = RREG32(RCU_IND_DATA);
-                efuse_box_bit_127_124 = (u8)(efuse_straps_3 & 0xF0000000) >> 28;
+                efuse_box_bit_127_124 = (u8)((efuse_straps_3 & 0xF0000000) >> 28);
                switch(efuse_box_bit_127_124) {
                case 0x0:
@@ -1407,6 +1407,7 @@ int evergreen_mc_init(struct radeon_device *rdev)
        rdev->mc.mc_vram_size = RREG32(CONFIG_MEMSIZE) * 1024 * 1024;
        rdev->mc.real_vram_size = RREG32(CONFIG_MEMSIZE) * 1024 * 1024;
        rdev->mc.visible_vram_size = rdev->mc.aper_size;
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
        r600_vram_gtt_location(rdev, &rdev->mc);
        radeon_update_bandwidth_info(rdev);
@@ -1520,7 +1521,7 @@ void evergreen_disable_interrupt_state(struct radeon_device *rdev)
 {
        u32 tmp;
-        WREG32(CP_INT_CNTL, 0);
+        WREG32(CP_INT_CNTL, CNTX_BUSY_INT_ENABLE | CNTX_EMPTY_INT_ENABLE);
        WREG32(GRBM_INT_CNTL, 0);
        WREG32(INT_MASK + EVERGREEN_CRTC0_REGISTER_OFFSET, 0);
        WREG32(INT_MASK + EVERGREEN_CRTC1_REGISTER_OFFSET, 0);
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index e151f16a8f86..e59422320bb6 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -1030,6 +1030,7 @@ int r100_cp_init(struct radeon_device *rdev, unsigned ring_size)
                return r;
        }
        rdev->cp.ready = true;
+        rdev->mc.active_vram_size = rdev->mc.real_vram_size;
        return 0;
 }
@@ -1047,6 +1048,7 @@ void r100_cp_fini(struct radeon_device *rdev)
 void r100_cp_disable(struct radeon_device *rdev)
 {
        /* Disable ring */
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
        rdev->cp.ready = false;
        WREG32(RADEON_CP_CSQ_MODE, 0);
        WREG32(RADEON_CP_CSQ_CNTL, 0);
@@ -2295,6 +2297,7 @@ void r100_vram_init_sizes(struct radeon_device *rdev)
        /* FIXME we don't use the second aperture yet when we could use it */
        if (rdev->mc.visible_vram_size > rdev->mc.aper_size)
                rdev->mc.visible_vram_size = rdev->mc.aper_size;
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
        config_aper_size = RREG32(RADEON_CONFIG_APER_SIZE);
        if (rdev->flags & RADEON_IS_IGP) {
                uint32_t tom;
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index afc18d87fdca..7b65e4efe8af 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -1248,6 +1248,7 @@ int r600_mc_init(struct radeon_device *rdev)
        rdev->mc.mc_vram_size = RREG32(CONFIG_MEMSIZE);
        rdev->mc.real_vram_size = RREG32(CONFIG_MEMSIZE);
        rdev->mc.visible_vram_size = rdev->mc.aper_size;
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
        r600_vram_gtt_location(rdev, &rdev->mc);
        if (rdev->flags & RADEON_IS_IGP) {
@@ -1917,6 +1918,7 @@ void r600_pciep_wreg(struct radeon_device *rdev, u32 reg, u32 v)
 */
 void r600_cp_stop(struct radeon_device *rdev)
 {
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
        WREG32(R_0086D8_CP_ME_CNTL, S_0086D8_CP_ME_HALT(1));
 }
@@ -2729,7 +2731,7 @@ int r600_ib_test(struct radeon_device *rdev)
        if (i < rdev->usec_timeout) {
                DRM_INFO("ib test succeeded in %u usecs\n", i);
        } else {
-                DRM_ERROR("radeon: ib test failed (sracth(0x%04X)=0x%08X)\n",
+                DRM_ERROR("radeon: ib test failed (scratch(0x%04X)=0x%08X)\n",
                          scratch, tmp);
                r = -EINVAL;
        }
@@ -2910,7 +2912,7 @@ static void r600_disable_interrupt_state(struct radeon_device *rdev)
 {
        u32 tmp;
-        WREG32(CP_INT_CNTL, 0);
+        WREG32(CP_INT_CNTL, CNTX_BUSY_INT_ENABLE | CNTX_EMPTY_INT_ENABLE);
        WREG32(GRBM_INT_CNTL, 0);
        WREG32(DxMODE_INT_MASK, 0);
        if (ASIC_IS_DCE3(rdev)) {
@@ -3528,7 +3530,8 @@ void r600_ioctl_wait_idle(struct radeon_device *rdev, struct radeon_bo *bo)
        /* r7xx hw bug.  write to HDP_DEBUG1 followed by fb read
         * rather than write to HDP_REG_COHERENCY_FLUSH_CNTL
         */
-        if ((rdev->family >= CHIP_RV770) && (rdev->family <= CHIP_RV740)) {
+        if ((rdev->family >= CHIP_RV770) && (rdev->family <= CHIP_RV740) &&
+            rdev->vram_scratch.ptr) {
                void __iomem *ptr = (void *)rdev->vram_scratch.ptr;
                u32 tmp;
diff --git a/drivers/gpu/drm/radeon/r600_blit_kms.c b/drivers/gpu/drm/radeon/r600_blit_kms.c
index 9ceb2a1ce799..3473c00781ff 100644
--- a/drivers/gpu/drm/radeon/r600_blit_kms.c
+++ b/drivers/gpu/drm/radeon/r600_blit_kms.c
@@ -532,6 +532,7 @@ int r600_blit_init(struct radeon_device *rdev)
        memcpy(ptr + rdev->r600_blit.ps_offset, r6xx_ps, r6xx_ps_size * 4);
        radeon_bo_kunmap(rdev->r600_blit.shader_obj);
        radeon_bo_unreserve(rdev->r600_blit.shader_obj);
+        rdev->mc.active_vram_size = rdev->mc.real_vram_size;
        return 0;
 }
@@ -539,6 +540,7 @@ void r600_blit_fini(struct radeon_device *rdev)
 {
        int r;
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
        if (rdev->r600_blit.shader_obj == NULL)
                return;
        /* If we can't reserve the bo, unref should be enough to destroy
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index a168d644bf9e..9ff38c99a6ea 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -344,6 +344,7 @@ struct radeon_mc {
         * about vram size near mc fb location */
        u64                     mc_vram_size;
        u64                     visible_vram_size;
+        u64                     active_vram_size;
        u64                     gtt_size;
        u64                     gtt_start;
        u64                     gtt_end;
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index ebae14c4b768..8e43ddae70cc 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -317,6 +317,15 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
                        *connector_type = DRM_MODE_CONNECTOR_DVID;
        }
+        /* MSI K9A2GM V2/V3 board has no HDMI or DVI */
+        if ((dev->pdev->device == 0x796e) &&
+            (dev->pdev->subsystem_vendor == 0x1462) &&
+            (dev->pdev->subsystem_device == 0x7302)) {
+                if ((supported_device == ATOM_DEVICE_DFP2_SUPPORT) ||
+                    (supported_device == ATOM_DEVICE_DFP3_SUPPORT))
+                        return false;
+        }
        /* a-bit f-i90hd - ciaranm on #radeonhd - this board has no DVI */
        if ((dev->pdev->device == 0x7941) &&
            (dev->pdev->subsystem_vendor == 0x147b) &&
@@ -1549,39 +1558,39 @@ radeon_atombios_get_tv_info(struct radeon_device *rdev)
                switch (tv_info->ucTV_BootUpDefaultStandard) {
                case ATOM_TV_NTSC:
                        tv_std = TV_STD_NTSC;
-                        DRM_INFO("Default TV standard: NTSC\n");
+                        DRM_DEBUG_KMS("Default TV standard: NTSC\n");
                        break;
                case ATOM_TV_NTSCJ:
                        tv_std = TV_STD_NTSC_J;
-                        DRM_INFO("Default TV standard: NTSC-J\n");
+                        DRM_DEBUG_KMS("Default TV standard: NTSC-J\n");
                        break;
                case ATOM_TV_PAL:
                        tv_std = TV_STD_PAL;
-                        DRM_INFO("Default TV standard: PAL\n");
+                        DRM_DEBUG_KMS("Default TV standard: PAL\n");
                        break;
                case ATOM_TV_PALM:
                        tv_std = TV_STD_PAL_M;
-                        DRM_INFO("Default TV standard: PAL-M\n");
+                        DRM_DEBUG_KMS("Default TV standard: PAL-M\n");
                        break;
                case ATOM_TV_PALN:
                        tv_std = TV_STD_PAL_N;
-                        DRM_INFO("Default TV standard: PAL-N\n");
+                        DRM_DEBUG_KMS("Default TV standard: PAL-N\n");
                        break;
                case ATOM_TV_PALCN:
                        tv_std = TV_STD_PAL_CN;
-                        DRM_INFO("Default TV standard: PAL-CN\n");
+                        DRM_DEBUG_KMS("Default TV standard: PAL-CN\n");
                        break;
                case ATOM_TV_PAL60:
                        tv_std = TV_STD_PAL_60;
-                        DRM_INFO("Default TV standard: PAL-60\n");
+                        DRM_DEBUG_KMS("Default TV standard: PAL-60\n");
                        break;
                case ATOM_TV_SECAM:
                        tv_std = TV_STD_SECAM;
-                        DRM_INFO("Default TV standard: SECAM\n");
+                        DRM_DEBUG_KMS("Default TV standard: SECAM\n");
                        break;
                default:
                        tv_std = TV_STD_NTSC;
-                        DRM_INFO("Unknown TV standard; defaulting to NTSC\n");
+                        DRM_DEBUG_KMS("Unknown TV standard; defaulting to NTSC\n");
                        break;
                }
        }
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index a04b7a6ad95f..7b7ea269549c 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -913,47 +913,47 @@ radeon_combios_get_tv_info(struct radeon_device *rdev)
                        switch (RBIOS8(tv_info + 7) & 0xf) {
                        case 1:
                                tv_std = TV_STD_NTSC;
-                                DRM_INFO("Default TV standard: NTSC\n");
+                                DRM_DEBUG_KMS("Default TV standard: NTSC\n");
                                break;
                        case 2:
                                tv_std = TV_STD_PAL;
-                                DRM_INFO("Default TV standard: PAL\n");
+                                DRM_DEBUG_KMS("Default TV standard: PAL\n");
                                break;
                        case 3:
                                tv_std = TV_STD_PAL_M;
-                                DRM_INFO("Default TV standard: PAL-M\n");
+                                DRM_DEBUG_KMS("Default TV standard: PAL-M\n");
                                break;
                        case 4:
                                tv_std = TV_STD_PAL_60;
-                                DRM_INFO("Default TV standard: PAL-60\n");
+                                DRM_DEBUG_KMS("Default TV standard: PAL-60\n");
                                break;
                        case 5:
                                tv_std = TV_STD_NTSC_J;
-                                DRM_INFO("Default TV standard: NTSC-J\n");
+                                DRM_DEBUG_KMS("Default TV standard: NTSC-J\n");
                                break;
                        case 6:
                                tv_std = TV_STD_SCART_PAL;
-                                DRM_INFO("Default TV standard: SCART-PAL\n");
+                                DRM_DEBUG_KMS("Default TV standard: SCART-PAL\n");
                                break;
                        default:
                                tv_std = TV_STD_NTSC;
-                                DRM_INFO
+                                DRM_DEBUG_KMS
                                    ("Unknown TV standard; defaulting to NTSC\n");
                                break;
                        }
                        switch ((RBIOS8(tv_info + 9) >> 2) & 0x3) {
                        case 0:
-                                DRM_INFO("29.498928713 MHz TV ref clk\n");
+                                DRM_DEBUG_KMS("29.498928713 MHz TV ref clk\n");
                                break;
                        case 1:
-                                DRM_INFO("28.636360000 MHz TV ref clk\n");
+                                DRM_DEBUG_KMS("28.636360000 MHz TV ref clk\n");
                                break;
                        case 2:
-                                DRM_INFO("14.318180000 MHz TV ref clk\n");
+                                DRM_DEBUG_KMS("14.318180000 MHz TV ref clk\n");
                                break;
                        case 3:
-                                DRM_INFO("27.000000000 MHz TV ref clk\n");
+                                DRM_DEBUG_KMS("27.000000000 MHz TV ref clk\n");
                                break;
                        default:
                                break;
@@ -1324,7 +1324,7 @@ bool radeon_legacy_get_tmds_info_from_combios(struct radeon_encoder *encoder,
        if (tmds_info) {
                ver = RBIOS8(tmds_info);
-                DRM_INFO("DFP table revision: %d\n", ver);
+                DRM_DEBUG_KMS("DFP table revision: %d\n", ver);
                if (ver == 3) {
                        n = RBIOS8(tmds_info + 5) + 1;
                        if (n > 4)
@@ -1408,7 +1408,7 @@ bool radeon_legacy_get_ext_tmds_info_from_combios(struct radeon_encoder *encoder
                offset = combios_get_table_offset(dev, COMBIOS_EXT_TMDS_INFO_TABLE);
                if (offset) {
                        ver = RBIOS8(offset);
-                        DRM_INFO("External TMDS Table revision: %d\n", ver);
+                        DRM_DEBUG_KMS("External TMDS Table revision: %d\n", ver);
                        tmds->slave_addr = RBIOS8(offset + 4 + 2);
                        tmds->slave_addr >>= 1; /* 7 bit addressing */
                        gpio = RBIOS8(offset + 4 + 3);
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index 127a395f70fb..b92d2f2fcbed 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -349,6 +349,8 @@ static void radeon_print_display_setup(struct drm_device *dev)
                                        DRM_INFO("    DFP4: %s\n", encoder_names[radeon_encoder->encoder_id]);
                                if (devices & ATOM_DEVICE_DFP5_SUPPORT)
                                        DRM_INFO("    DFP5: %s\n", encoder_names[radeon_encoder->encoder_id]);
+                                if (devices & ATOM_DEVICE_DFP6_SUPPORT)
+                                        DRM_INFO("    DFP6: %s\n", encoder_names[radeon_encoder->encoder_id]);
                                if (devices & ATOM_DEVICE_TV1_SUPPORT)
                                        DRM_INFO("    TV1: %s\n", encoder_names[radeon_encoder->encoder_id]);
                                if (devices & ATOM_DEVICE_CV_SUPPORT)
@@ -841,8 +843,9 @@ static void radeon_user_framebuffer_destroy(struct drm_framebuffer *fb)
 {
        struct radeon_framebuffer *radeon_fb = to_radeon_framebuffer(fb);
-        if (radeon_fb->obj)
+        if (radeon_fb->obj) {
                drm_gem_object_unreference_unlocked(radeon_fb->obj);
+        }
        drm_framebuffer_cleanup(fb);
        kfree(radeon_fb);
 }
diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c
index c74a8b20d941..40b0c087b592 100644
--- a/drivers/gpu/drm/radeon/radeon_fb.c
+++ b/drivers/gpu/drm/radeon/radeon_fb.c
@@ -94,6 +94,7 @@ static void radeonfb_destroy_pinned_object(struct drm_gem_object *gobj)
        ret = radeon_bo_reserve(rbo, false);
        if (likely(ret == 0)) {
                radeon_bo_kunmap(rbo);
+                radeon_bo_unpin(rbo);
                radeon_bo_unreserve(rbo);
        }
        drm_gem_object_unreference_unlocked(gobj);
@@ -325,8 +326,6 @@ static int radeon_fbdev_destroy(struct drm_device *dev, struct radeon_fbdev *rfb
 {
        struct fb_info *info;
        struct radeon_framebuffer *rfb = &rfbdev->rfb;
-        struct radeon_bo *rbo;
-        int r;
        if (rfbdev->helper.fbdev) {
                info = rfbdev->helper.fbdev;
@@ -338,14 +337,8 @@ static int radeon_fbdev_destroy(struct drm_device *dev, struct radeon_fbdev *rfb
        }
        if (rfb->obj) {
-                rbo = rfb->obj->driver_private;
+                radeonfb_destroy_pinned_object(rfb->obj);
-                r = radeon_bo_reserve(rbo, false);
+                rfb->obj = NULL;
-                if (likely(r == 0)) {
-                        radeon_bo_kunmap(rbo);
-                        radeon_bo_unpin(rbo);
-                        radeon_bo_unreserve(rbo);
-                }
-                drm_gem_object_unreference_unlocked(rfb->obj);
        }
        drm_fb_helper_fini(&rfbdev->helper);
        drm_framebuffer_cleanup(&rfb->base);
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
index c578f265b24c..d1e595d91723 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -201,11 +201,11 @@ int radeon_gem_create_ioctl(struct drm_device *dev, void *data,
                return r;
        }
        r = drm_gem_handle_create(filp, gobj, &handle);
+        /* drop reference from allocate - handle holds it now */
+        drm_gem_object_unreference_unlocked(gobj);
        if (r) {
-                drm_gem_object_unreference_unlocked(gobj);
                return r;
        }
-        drm_gem_object_handle_unreference_unlocked(gobj);
        args->handle = handle;
        return 0;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index 5eee3c41d124..8fbbe1c6ebbd 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -203,6 +203,10 @@ int radeon_info_ioctl(struct drm_device *dev, void *data, struct drm_file *filp)
 */
 int radeon_driver_firstopen_kms(struct drm_device *dev)
 {
+        struct radeon_device *rdev = dev->dev_private;
+        if (rdev->powered_down)
+                return -EINVAL;
        return 0;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index 0afd1e62347d..b3b5306bb578 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -69,7 +69,7 @@ void radeon_ttm_placement_from_domain(struct radeon_bo *rbo, u32 domain)
        u32 c = 0;
        rbo->placement.fpfn = 0;
-        rbo->placement.lpfn = 0;
+        rbo->placement.lpfn = rbo->rdev->mc.active_vram_size >> PAGE_SHIFT;
        rbo->placement.placement = rbo->placements;
        rbo->placement.busy_placement = rbo->placements;
        if (domain & RADEON_GEM_DOMAIN_VRAM)
diff --git a/drivers/gpu/drm/radeon/radeon_object.h b/drivers/gpu/drm/radeon/radeon_object.h
index 353998dc2c03..3481bc7f6f58 100644
--- a/drivers/gpu/drm/radeon/radeon_object.h
+++ b/drivers/gpu/drm/radeon/radeon_object.h
@@ -124,11 +124,8 @@ static inline int radeon_bo_wait(struct radeon_bo *bo, u32 *mem_type,
        int r;
        r = ttm_bo_reserve(&bo->tbo, true, no_wait, false, 0);
-        if (unlikely(r != 0)) {
+        if (unlikely(r != 0))
-                if (r != -ERESTARTSYS)
-                        dev_err(bo->rdev->dev, "%p reserve failed for wait\n", bo);
                return r;
-        }
        spin_lock(&bo->tbo.lock);
        if (mem_type)
                *mem_type = bo->tbo.mem.mem_type;
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index cc05b230d7ef..51d5f7b5ab21 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -693,6 +693,7 @@ void rs600_mc_init(struct radeon_device *rdev)
        rdev->mc.real_vram_size = RREG32(RADEON_CONFIG_MEMSIZE);
        rdev->mc.mc_vram_size = rdev->mc.real_vram_size;
        rdev->mc.visible_vram_size = rdev->mc.aper_size;
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
        rdev->mc.igp_sideport_enabled = radeon_atombios_sideport_present(rdev);
        base = RREG32_MC(R_000004_MC_FB_LOCATION);
        base = G_000004_MC_FB_START(base) << 16;
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index 3e3f75718be3..4dc2a87ea680 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -157,6 +157,7 @@ void rs690_mc_init(struct radeon_device *rdev)
        rdev->mc.aper_base = pci_resource_start(rdev->pdev, 0);
        rdev->mc.aper_size = pci_resource_len(rdev->pdev, 0);
        rdev->mc.visible_vram_size = rdev->mc.aper_size;
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
        base = RREG32_MC(R_000100_MCCFG_FB_LOCATION);
        base = G_000100_MC_FB_START(base) << 16;
        rdev->mc.igp_sideport_enabled = radeon_atombios_sideport_present(rdev);
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index bfa59db374d2..9490da700749 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -267,6 +267,7 @@ static void rv770_mc_program(struct radeon_device *rdev)
 */
 void r700_cp_stop(struct radeon_device *rdev)
 {
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
        WREG32(CP_ME_CNTL, (CP_ME_HALT | CP_PFP_HALT));
 }
@@ -992,6 +993,7 @@ int rv770_mc_init(struct radeon_device *rdev)
        rdev->mc.mc_vram_size = RREG32(CONFIG_MEMSIZE);
        rdev->mc.real_vram_size = RREG32(CONFIG_MEMSIZE);
        rdev->mc.visible_vram_size = rdev->mc.aper_size;
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
        r600_vram_gtt_location(rdev, &rdev->mc);
        radeon_update_bandwidth_info(rdev);
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index cb4cf7ef4d1e..db809e034cc4 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -442,6 +442,43 @@ out_err:
 }
 /**
+ * Call bo::reserved and with the lru lock held.
+ * Will release GPU memory type usage on destruction.
+ * This is the place to put in driver specific hooks.
+ * Will release the bo::reserved lock and the
+ * lru lock on exit.
+ */
+static void ttm_bo_cleanup_memtype_use(struct ttm_buffer_object *bo)
+{
+        struct ttm_bo_global *glob = bo->glob;
+        if (bo->ttm) {
+                /**
+                 * Release the lru_lock, since we don't want to have
+                 * an atomic requirement on ttm_tt[unbind|destroy].
+                 */
+                spin_unlock(&glob->lru_lock);
+                ttm_tt_unbind(bo->ttm);
+                ttm_tt_destroy(bo->ttm);
+                bo->ttm = NULL;
+                spin_lock(&glob->lru_lock);
+        }
+        if (bo->mem.mm_node) {
+                drm_mm_put_block(bo->mem.mm_node);
+                bo->mem.mm_node = NULL;
+        }
+        atomic_set(&bo->reserved, 0);
+        wake_up_all(&bo->event_queue);
+        spin_unlock(&glob->lru_lock);
+}
+/**
 * If bo idle, remove from delayed- and lru lists, and unref.
 * If not idle, and already on delayed list, do nothing.
 * If not idle, and not on delayed list, put on delayed list,
@@ -456,6 +493,7 @@ static int ttm_bo_cleanup_refs(struct ttm_buffer_object *bo, bool remove_all)
        int ret;
        spin_lock(&bo->lock);
+retry:
        (void) ttm_bo_wait(bo, false, false, !remove_all);
        if (!bo->sync_obj) {
@@ -464,31 +502,52 @@ static int ttm_bo_cleanup_refs(struct ttm_buffer_object *bo, bool remove_all)
                spin_unlock(&bo->lock);
                spin_lock(&glob->lru_lock);
-                put_count = ttm_bo_del_from_lru(bo);
+                ret = ttm_bo_reserve_locked(bo, false, !remove_all, false, 0);
+                /**
+                 * Someone else has the object reserved. Bail and retry.
+                 */
-                ret = ttm_bo_reserve_locked(bo, false, false, false, 0);
+                if (unlikely(ret == -EBUSY)) {
-                BUG_ON(ret);
+                        spin_unlock(&glob->lru_lock);
-                if (bo->ttm)
+                        spin_lock(&bo->lock);
-                        ttm_tt_unbind(bo->ttm);
+                        goto requeue;
+                }
+                /**
+                 * We can re-check for sync object without taking
+                 * the bo::lock since setting the sync object requires
+                 * also bo::reserved. A busy object at this point may
+                 * be caused by another thread starting an accelerated
+                 * eviction.
+                 */
+                if (unlikely(bo->sync_obj)) {
+                        atomic_set(&bo->reserved, 0);
+                        wake_up_all(&bo->event_queue);
+                        spin_unlock(&glob->lru_lock);
+                        spin_lock(&bo->lock);
+                        if (remove_all)
+                                goto retry;
+                        else
+                                goto requeue;
+                }
+                put_count = ttm_bo_del_from_lru(bo);
                if (!list_empty(&bo->ddestroy)) {
                        list_del_init(&bo->ddestroy);
                        ++put_count;
                }
-                if (bo->mem.mm_node) {
-                        drm_mm_put_block(bo->mem.mm_node);
-                        bo->mem.mm_node = NULL;
-                }
-                spin_unlock(&glob->lru_lock);
-                atomic_set(&bo->reserved, 0);
+                ttm_bo_cleanup_memtype_use(bo);
                while (put_count--)
                        kref_put(&bo->list_kref, ttm_bo_ref_bug);
                return 0;
        }
+requeue:
        spin_lock(&glob->lru_lock);
        if (list_empty(&bo->ddestroy)) {
                void *sync_obj = bo->sync_obj;
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index 7cffb3e04232..3451a82adba7 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -351,6 +351,7 @@ static int ttm_buffer_object_transfer(struct ttm_buffer_object *bo,
        INIT_LIST_HEAD(&fbo->lru);
        INIT_LIST_HEAD(&fbo->swap);
        fbo->vm_node = NULL;
+        atomic_set(&fbo->cpu_writers, 0);
        fbo->sync_obj = driver->sync_obj_ref(bo->sync_obj);
        kref_init(&fbo->list_kref);
diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c
index ca904799f018..b1e02fffd3cc 100644
--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c
+++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c
@@ -69,7 +69,7 @@ struct ttm_page_pool {
        spinlock_t              lock;
        bool                    fill_lock;
        struct list_head        list;
-        int                     gfp_flags;
+        gfp_t                   gfp_flags;
        unsigned                npages;
        char                    *name;
        unsigned long           nfrees;
@@ -475,7 +475,7 @@ static void ttm_handle_caching_state_failure(struct list_head *pages,
 * This function is reentrant if caller updates count depending on number of
 * pages returned in pages array.
 */
-static int ttm_alloc_new_pages(struct list_head *pages, int gfp_flags,
+static int ttm_alloc_new_pages(struct list_head *pages, gfp_t gfp_flags,
                int ttm_flags, enum ttm_caching_state cstate, unsigned count)
 {
        struct page **caching_array;
@@ -666,7 +666,7 @@ int ttm_get_pages(struct list_head *pages, int flags,
 {
        struct ttm_page_pool *pool = ttm_get_pool(flags, cstate);
        struct page *p = NULL;
-        int gfp_flags = GFP_USER;
+        gfp_t gfp_flags = GFP_USER;
        int r;
        /* set zero flag for page allocation if required */
@@ -818,7 +818,7 @@ int ttm_page_alloc_init(struct ttm_mem_global *glob, unsigned max_pages)
        return 0;
 }
-void ttm_page_alloc_fini()
+void ttm_page_alloc_fini(void)
 {
        int i;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 72ec2e2b6e97..a96ed6d9d010 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -148,13 +148,16 @@ static struct pci_device_id vmw_pci_id_list[] = {
        {0, 0, 0}
 };
-static char *vmw_devname = "vmwgfx";
+static int enable_fbdev;
 static int vmw_probe(struct pci_dev *, const struct pci_device_id *);
 static void vmw_master_init(struct vmw_master *);
 static int vmwgfx_pm_notifier(struct notifier_block *nb, unsigned long val,
                              void *ptr);
+MODULE_PARM_DESC(enable_fbdev, "Enable vmwgfx fbdev");
+module_param_named(enable_fbdev, enable_fbdev, int, 0600);
 static void vmw_print_capabilities(uint32_t capabilities)
 {
        DRM_INFO("Capabilities:\n");
@@ -192,8 +195,6 @@ static int vmw_request_device(struct vmw_private *dev_priv)
 {
        int ret;
-        vmw_kms_save_vga(dev_priv);
        ret = vmw_fifo_init(dev_priv, &dev_priv->fifo);
        if (unlikely(ret != 0)) {
                DRM_ERROR("Unable to initialize FIFO.\n");
@@ -206,9 +207,35 @@ static int vmw_request_device(struct vmw_private *dev_priv)
 static void vmw_release_device(struct vmw_private *dev_priv)
 {
        vmw_fifo_release(dev_priv, &dev_priv->fifo);
-        vmw_kms_restore_vga(dev_priv);
 }
+int vmw_3d_resource_inc(struct vmw_private *dev_priv)
+{
+        int ret = 0;
+        mutex_lock(&dev_priv->release_mutex);
+        if (unlikely(dev_priv->num_3d_resources++ == 0)) {
+                ret = vmw_request_device(dev_priv);
+                if (unlikely(ret != 0))
+                        --dev_priv->num_3d_resources;
+        }
+        mutex_unlock(&dev_priv->release_mutex);
+        return ret;
+}
+void vmw_3d_resource_dec(struct vmw_private *dev_priv)
+{
+        int32_t n3d;
+        mutex_lock(&dev_priv->release_mutex);
+        if (unlikely(--dev_priv->num_3d_resources == 0))
+                vmw_release_device(dev_priv);
+        n3d = (int32_t) dev_priv->num_3d_resources;
+        mutex_unlock(&dev_priv->release_mutex);
+        BUG_ON(n3d < 0);
+}
 static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
 {
@@ -228,6 +255,7 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
        dev_priv->last_read_sequence = (uint32_t) -100;
        mutex_init(&dev_priv->hw_mutex);
        mutex_init(&dev_priv->cmdbuf_mutex);
+        mutex_init(&dev_priv->release_mutex);
        rwlock_init(&dev_priv->resource_lock);
        idr_init(&dev_priv->context_idr);
        idr_init(&dev_priv->surface_idr);
@@ -244,6 +272,8 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
        dev_priv->vram_start = pci_resource_start(dev->pdev, 1);
        dev_priv->mmio_start = pci_resource_start(dev->pdev, 2);
+        dev_priv->enable_fb = enable_fbdev;
        mutex_lock(&dev_priv->hw_mutex);
        vmw_write(dev_priv, SVGA_REG_ID, SVGA_ID_2);
@@ -343,17 +373,6 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
        dev->dev_private = dev_priv;
-        if (!dev->devname)
-                dev->devname = vmw_devname;
-        if (dev_priv->capabilities & SVGA_CAP_IRQMASK) {
-                ret = drm_irq_install(dev);
-                if (unlikely(ret != 0)) {
-                        DRM_ERROR("Failed installing irq: %d\n", ret);
-                        goto out_no_irq;
-                }
-        }
        ret = pci_request_regions(dev->pdev, "vmwgfx probe");
        dev_priv->stealth = (ret != 0);
        if (dev_priv->stealth) {
@@ -369,26 +388,52 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
                        goto out_no_device;
                }
        }
-        ret = vmw_request_device(dev_priv);
+        ret = vmw_kms_init(dev_priv);
        if (unlikely(ret != 0))
-                goto out_no_device;
+                goto out_no_kms;
-        vmw_kms_init(dev_priv);
        vmw_overlay_init(dev_priv);
-        vmw_fb_init(dev_priv);
+        if (dev_priv->enable_fb) {
+                ret = vmw_3d_resource_inc(dev_priv);
+                if (unlikely(ret != 0))
+                        goto out_no_fifo;
+                vmw_kms_save_vga(dev_priv);
+                vmw_fb_init(dev_priv);
+                DRM_INFO("%s", vmw_fifo_have_3d(dev_priv) ?
+                         "Detected device 3D availability.\n" :
+                         "Detected no device 3D availability.\n");
+        } else {
+                DRM_INFO("Delayed 3D detection since we're not "
+                         "running the device in SVGA mode yet.\n");
+        }
+        if (dev_priv->capabilities & SVGA_CAP_IRQMASK) {
+                ret = drm_irq_install(dev);
+                if (unlikely(ret != 0)) {
+                        DRM_ERROR("Failed installing irq: %d\n", ret);
+                        goto out_no_irq;
+                }
+        }
        dev_priv->pm_nb.notifier_call = vmwgfx_pm_notifier;
        register_pm_notifier(&dev_priv->pm_nb);
-        DRM_INFO("%s", vmw_fifo_have_3d(dev_priv) ? "Have 3D\n" : "No 3D\n");
        return 0;
-out_no_device:
-        if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
-                drm_irq_uninstall(dev_priv->dev);
-        if (dev->devname == vmw_devname)
-                dev->devname = NULL;
 out_no_irq:
+        if (dev_priv->enable_fb) {
+                vmw_fb_close(dev_priv);
+                vmw_kms_restore_vga(dev_priv);
+                vmw_3d_resource_dec(dev_priv);
+        }
+out_no_fifo:
+        vmw_overlay_close(dev_priv);
+        vmw_kms_close(dev_priv);
+out_no_kms:
+        if (dev_priv->stealth)
+                pci_release_region(dev->pdev, 2);
+        else
+                pci_release_regions(dev->pdev);
+out_no_device:
        ttm_object_device_release(&dev_priv->tdev);
 out_err4:
        iounmap(dev_priv->mmio_virt);
@@ -415,19 +460,20 @@ static int vmw_driver_unload(struct drm_device *dev)
        unregister_pm_notifier(&dev_priv->pm_nb);
-        vmw_fb_close(dev_priv);
+        if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
+                drm_irq_uninstall(dev_priv->dev);
+        if (dev_priv->enable_fb) {
+                vmw_fb_close(dev_priv);
+                vmw_kms_restore_vga(dev_priv);
+                vmw_3d_resource_dec(dev_priv);
+        }
        vmw_kms_close(dev_priv);
        vmw_overlay_close(dev_priv);
-        vmw_release_device(dev_priv);
        if (dev_priv->stealth)
                pci_release_region(dev->pdev, 2);
        else
                pci_release_regions(dev->pdev);
-        if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
-                drm_irq_uninstall(dev_priv->dev);
-        if (dev->devname == vmw_devname)
-                dev->devname = NULL;
        ttm_object_device_release(&dev_priv->tdev);
        iounmap(dev_priv->mmio_virt);
        drm_mtrr_del(dev_priv->mmio_mtrr, dev_priv->mmio_start,
@@ -500,7 +546,7 @@ static long vmw_unlocked_ioctl(struct file *filp, unsigned int cmd,
                struct drm_ioctl_desc *ioctl =
                    &vmw_ioctls[nr - DRM_COMMAND_BASE];
-                if (unlikely(ioctl->cmd != cmd)) {
+                if (unlikely(ioctl->cmd_drv != cmd)) {
                        DRM_ERROR("Invalid command format, ioctl %d\n",
                                  nr - DRM_COMMAND_BASE);
                        return -EINVAL;
@@ -589,6 +635,16 @@ static int vmw_master_set(struct drm_device *dev,
        struct vmw_master *vmaster = vmw_master(file_priv->master);
        int ret = 0;
+        if (!dev_priv->enable_fb) {
+                ret = vmw_3d_resource_inc(dev_priv);
+                if (unlikely(ret != 0))
+                        return ret;
+                vmw_kms_save_vga(dev_priv);
+                mutex_lock(&dev_priv->hw_mutex);
+                vmw_write(dev_priv, SVGA_REG_TRACES, 0);
+                mutex_unlock(&dev_priv->hw_mutex);
+        }
        if (active) {
                BUG_ON(active != &dev_priv->fbdev_master);
                ret = ttm_vt_lock(&active->lock, false, vmw_fp->tfile);
@@ -617,7 +673,13 @@ static int vmw_master_set(struct drm_device *dev,
        return 0;
 out_no_active_lock:
-        vmw_release_device(dev_priv);
+        if (!dev_priv->enable_fb) {
+                mutex_lock(&dev_priv->hw_mutex);
+                vmw_write(dev_priv, SVGA_REG_TRACES, 1);
+                mutex_unlock(&dev_priv->hw_mutex);
+                vmw_kms_restore_vga(dev_priv);
+                vmw_3d_resource_dec(dev_priv);
+        }
        return ret;
 }
@@ -645,11 +707,23 @@ static void vmw_master_drop(struct drm_device *dev,
        ttm_lock_set_kill(&vmaster->lock, true, SIGTERM);
+        if (!dev_priv->enable_fb) {
+                ret = ttm_bo_evict_mm(&dev_priv->bdev, TTM_PL_VRAM);
+                if (unlikely(ret != 0))
+                        DRM_ERROR("Unable to clean VRAM on master drop.\n");
+                mutex_lock(&dev_priv->hw_mutex);
+                vmw_write(dev_priv, SVGA_REG_TRACES, 1);
+                mutex_unlock(&dev_priv->hw_mutex);
+                vmw_kms_restore_vga(dev_priv);
+                vmw_3d_resource_dec(dev_priv);
+        }
        dev_priv->active_master = &dev_priv->fbdev_master;
        ttm_lock_set_kill(&dev_priv->fbdev_master.lock, false, SIGTERM);
        ttm_vt_unlock(&dev_priv->fbdev_master.lock);
-        vmw_fb_on(dev_priv);
+        if (dev_priv->enable_fb)
+                vmw_fb_on(dev_priv);
 }
@@ -722,6 +796,7 @@ static struct drm_driver driver = {
        .irq_postinstall = vmw_irq_postinstall,
        .irq_uninstall = vmw_irq_uninstall,
        .irq_handler = vmw_irq_handler,
+        .get_vblank_counter = vmw_get_vblank_counter,
        .reclaim_buffers_locked = NULL,
        .get_map_ofs = drm_core_get_map_ofs,
        .get_reg_ofs = drm_core_get_reg_ofs,
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index 429f917b60bf..58de6393f611 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -277,6 +277,7 @@ struct vmw_private {
        bool stealth;
        bool is_opened;
+        bool enable_fb;
        /**
         * Master management.
@@ -285,6 +286,9 @@ struct vmw_private {
        struct vmw_master *active_master;
        struct vmw_master fbdev_master;
        struct notifier_block pm_nb;
+        struct mutex release_mutex;
+        uint32_t num_3d_resources;
 };
 static inline struct vmw_private *vmw_priv(struct drm_device *dev)
@@ -319,6 +323,9 @@ static inline uint32_t vmw_read(struct vmw_private *dev_priv,
        return val;
 }
+int vmw_3d_resource_inc(struct vmw_private *dev_priv);
+void vmw_3d_resource_dec(struct vmw_private *dev_priv);
 /**
 * GMR utilities - vmwgfx_gmr.c
 */
@@ -511,6 +518,7 @@ void vmw_kms_write_svga(struct vmw_private *vmw_priv,
                        unsigned bbp, unsigned depth);
 int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data,
                                struct drm_file *file_priv);
+u32 vmw_get_vblank_counter(struct drm_device *dev, int crtc);
 /**
 * Overlay control - vmwgfx_overlay.c
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
index 870967a97c15..409e172f4abf 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
@@ -615,6 +615,11 @@ int vmw_dmabuf_to_start_of_vram(struct vmw_private *vmw_priv,
        if (unlikely(ret != 0))
                goto err_unlock;
+        if (bo->mem.mem_type == TTM_PL_VRAM &&
+            bo->mem.mm_node->start < bo->num_pages)
+                (void) ttm_bo_validate(bo, &vmw_sys_placement, false,
+                                       false, false);
        ret = ttm_bo_validate(bo, &ne_placement, false, false, false);
        /* Could probably bug on */
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
index e6a1eb7ea954..0fe31766e4cf 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
@@ -106,6 +106,7 @@ int vmw_fifo_init(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
        mutex_lock(&dev_priv->hw_mutex);
        dev_priv->enable_state = vmw_read(dev_priv, SVGA_REG_ENABLE);
        dev_priv->config_done_state = vmw_read(dev_priv, SVGA_REG_CONFIG_DONE);
+        dev_priv->traces_state = vmw_read(dev_priv, SVGA_REG_TRACES);
        vmw_write(dev_priv, SVGA_REG_ENABLE, 1);
        min = 4;
@@ -175,6 +176,8 @@ void vmw_fifo_release(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
                  dev_priv->config_done_state);
        vmw_write(dev_priv, SVGA_REG_ENABLE,
                  dev_priv->enable_state);
+        vmw_write(dev_priv, SVGA_REG_TRACES,
+                  dev_priv->traces_state);
        mutex_unlock(&dev_priv->hw_mutex);
        vmw_fence_queue_takedown(&fifo->fence_queue);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index 64d7f47df868..e882ba099f0c 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -898,7 +898,19 @@ int vmw_kms_save_vga(struct vmw_private *vmw_priv)
                save->width = vmw_read(vmw_priv, SVGA_REG_DISPLAY_WIDTH);
                save->height = vmw_read(vmw_priv, SVGA_REG_DISPLAY_HEIGHT);
                vmw_write(vmw_priv, SVGA_REG_DISPLAY_ID, SVGA_ID_INVALID);
+                if (i == 0 && vmw_priv->num_displays == 1 &&
+                    save->width == 0 && save->height == 0) {
+                        /*
+                         * It should be fairly safe to assume that these
+                         * values are uninitialized.
+                         */
+                        save->width = vmw_priv->vga_width - save->pos_x;
+                        save->height = vmw_priv->vga_height - save->pos_y;
+                }
        }
        return 0;
 }
@@ -984,3 +996,8 @@ out_unlock:
        ttm_read_unlock(&vmaster->lock);
        return ret;
 }
+u32 vmw_get_vblank_counter(struct drm_device *dev, int crtc)
+{
+        return 0;
+}
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
index 7083b1a24df3..11cb39e3accb 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c
@@ -27,6 +27,8 @@
 #include "vmwgfx_kms.h"
+#define VMWGFX_LDU_NUM_DU 8
 #define vmw_crtc_to_ldu(x) \
        container_of(x, struct vmw_legacy_display_unit, base.crtc)
 #define vmw_encoder_to_ldu(x) \
@@ -536,6 +538,10 @@ static int vmw_ldu_init(struct vmw_private *dev_priv, unsigned unit)
 int vmw_kms_init_legacy_display_system(struct vmw_private *dev_priv)
 {
+        struct drm_device *dev = dev_priv->dev;
+        int i;
+        int ret;
        if (dev_priv->ldu_priv) {
                DRM_INFO("ldu system already on\n");
                return -EINVAL;
@@ -553,23 +559,24 @@ int vmw_kms_init_legacy_display_system(struct vmw_private *dev_priv)
        drm_mode_create_dirty_info_property(dev_priv->dev);
-        vmw_ldu_init(dev_priv, 0);
-        /* for old hardware without multimon only enable one display */
        if (dev_priv->capabilities & SVGA_CAP_MULTIMON) {
-                vmw_ldu_init(dev_priv, 1);
+                for (i = 0; i < VMWGFX_LDU_NUM_DU; ++i)
-                vmw_ldu_init(dev_priv, 2);
+                        vmw_ldu_init(dev_priv, i);
-                vmw_ldu_init(dev_priv, 3);
+                ret = drm_vblank_init(dev, VMWGFX_LDU_NUM_DU);
-                vmw_ldu_init(dev_priv, 4);
+        } else {
-                vmw_ldu_init(dev_priv, 5);
+                /* for old hardware without multimon only enable one display */
-                vmw_ldu_init(dev_priv, 6);
+                vmw_ldu_init(dev_priv, 0);
-                vmw_ldu_init(dev_priv, 7);
+                ret = drm_vblank_init(dev, 1);
        }
-        return 0;
+        return ret;
 }
 int vmw_kms_close_legacy_display_system(struct vmw_private *dev_priv)
 {
+        struct drm_device *dev = dev_priv->dev;
+        drm_vblank_cleanup(dev);
        if (!dev_priv->ldu_priv)
                return -ENOSYS;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
index 5f2d5df01e5c..c8c40e9979db 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -211,6 +211,7 @@ static void vmw_hw_context_destroy(struct vmw_resource *res)
        cmd->body.cid = cpu_to_le32(res->id);
        vmw_fifo_commit(dev_priv, sizeof(*cmd));
+        vmw_3d_resource_dec(dev_priv);
 }
 static int vmw_context_init(struct vmw_private *dev_priv,
@@ -247,6 +248,7 @@ static int vmw_context_init(struct vmw_private *dev_priv,
        cmd->body.cid = cpu_to_le32(res->id);
        vmw_fifo_commit(dev_priv, sizeof(*cmd));
+        (void) vmw_3d_resource_inc(dev_priv);
        vmw_resource_activate(res, vmw_hw_context_destroy);
        return 0;
 }
@@ -406,6 +408,7 @@ static void vmw_hw_surface_destroy(struct vmw_resource *res)
        cmd->body.sid = cpu_to_le32(res->id);
        vmw_fifo_commit(dev_priv, sizeof(*cmd));
+        vmw_3d_resource_dec(dev_priv);
 }
 void vmw_surface_res_free(struct vmw_resource *res)
@@ -473,6 +476,7 @@ int vmw_surface_init(struct vmw_private *dev_priv,
        }
        vmw_fifo_commit(dev_priv, submit_size);
+        (void) vmw_3d_resource_inc(dev_priv);
        vmw_resource_activate(res, vmw_hw_surface_destroy);
        return 0;
 }
diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c
index b87569e96b16..f366f968155a 100644
--- a/drivers/gpu/vga/vgaarb.c
+++ b/drivers/gpu/vga/vgaarb.c
@@ -598,7 +598,7 @@ static inline void vga_update_device_decodes(struct vga_device *vgadev,
        pr_debug("vgaarb: decoding count now is: %d\n", vga_decode_count);
 }
-void __vga_set_legacy_decoding(struct pci_dev *pdev, unsigned int decodes, bool userspace)
+static void __vga_set_legacy_decoding(struct pci_dev *pdev, unsigned int decodes, bool userspace)
 {
        struct vga_device *vgadev;
        unsigned long flags;
diff --git a/drivers/hwmon/Kconfig b/drivers/hwmon/Kconfig
index 4d4d09bdec0a..97499d00615a 100644
--- a/drivers/hwmon/Kconfig
+++ b/drivers/hwmon/Kconfig
@@ -409,7 +409,7 @@ config SENSORS_CORETEMP
 config SENSORS_PKGTEMP
        tristate "Intel processor package temperature sensor"
-        depends on X86 && PCI && EXPERIMENTAL
+        depends on X86 && EXPERIMENTAL
        help
          If you say yes here you get support for the package level temperature
          sensor inside your CPU. Check documentation/driver for details.
diff --git a/drivers/hwmon/coretemp.c b/drivers/hwmon/coretemp.c
index de8111114f46..a23b17a78ace 100644
--- a/drivers/hwmon/coretemp.c
+++ b/drivers/hwmon/coretemp.c
@@ -36,6 +36,7 @@
 #include <linux/pci.h>
 #include <asm/msr.h>
 #include <asm/processor.h>
+#include <asm/smp.h>
 #define DRVNAME "coretemp"
@@ -423,9 +424,18 @@ static int __cpuinit coretemp_device_add(unsigned int cpu)
        int err;
        struct platform_device *pdev;
        struct pdev_entry *pdev_entry;
-#ifdef CONFIG_SMP
        struct cpuinfo_x86 *c = &cpu_data(cpu);
-#endif
+        /*
+         * CPUID.06H.EAX[0] indicates whether the CPU has thermal
+         * sensors. We check this bit only, all the early CPUs
+         * without thermal sensors will be filtered out.
+         */
+        if (!cpu_has(c, X86_FEATURE_DTS)) {
+                printk(KERN_INFO DRVNAME ": CPU (model=0x%x)"
+                       " has no thermal sensor.\n", c->x86_model);
+                return 0;
+        }
        mutex_lock(&pdev_list_mutex);
@@ -482,14 +492,22 @@ exit:
 static void coretemp_device_remove(unsigned int cpu)
 {
-        struct pdev_entry *p, *n;
+        struct pdev_entry *p;
+        unsigned int i;
        mutex_lock(&pdev_list_mutex);
-        list_for_each_entry_safe(p, n, &pdev_list, list) {
+        list_for_each_entry(p, &pdev_list, list) {
-                if (p->cpu == cpu) {
+                if (p->cpu != cpu)
-                        platform_device_unregister(p->pdev);
+                        continue;
-                        list_del(&p->list);
-                        kfree(p);
+                platform_device_unregister(p->pdev);
-                }
+                list_del(&p->list);
+                mutex_unlock(&pdev_list_mutex);
+                kfree(p);
+                for_each_cpu(i, cpu_sibling_mask(cpu))
+                        if (i != cpu && !coretemp_device_add(i))
+                                break;
+                return;
        }
        mutex_unlock(&pdev_list_mutex);
 }
@@ -527,30 +545,21 @@ static int __init coretemp_init(void)
        if (err)
                goto exit;
-        for_each_online_cpu(i) {
+        for_each_online_cpu(i)
-                struct cpuinfo_x86 *c = &cpu_data(i);
+                coretemp_device_add(i);
-                /*
-                 * CPUID.06H.EAX[0] indicates whether the CPU has thermal
+#ifndef CONFIG_HOTPLUG_CPU
-                 * sensors. We check this bit only, all the early CPUs
-                 * without thermal sensors will be filtered out.
-                 */
-                if (c->cpuid_level >= 6 && (cpuid_eax(0x06) & 0x01))
-                        coretemp_device_add(i);
-                else {
-                        printk(KERN_INFO DRVNAME ": CPU (model=0x%x)"
-                                " has no thermal sensor.\n", c->x86_model);
-                }
-        }
        if (list_empty(&pdev_list)) {
                err = -ENODEV;
                goto exit_driver_unreg;
        }
+#endif
        register_hotcpu_notifier(&coretemp_cpu_notifier);
        return 0;
-exit_driver_unreg:
 #ifndef CONFIG_HOTPLUG_CPU
+exit_driver_unreg:
        platform_driver_unregister(&coretemp_driver);
 #endif
 exit:
diff --git a/drivers/hwmon/f71882fg.c b/drivers/hwmon/f71882fg.c
index 537841ef44b9..75afb3b0e076 100644
--- a/drivers/hwmon/f71882fg.c
+++ b/drivers/hwmon/f71882fg.c
@@ -111,7 +111,7 @@ static struct platform_device *f71882fg_pdev;
 /* Super-I/O Function prototypes */
 static inline int superio_inb(int base, int reg);
 static inline int superio_inw(int base, int reg);
-static inline void superio_enter(int base);
+static inline int superio_enter(int base);
 static inline void superio_select(int base, int ld);
 static inline void superio_exit(int base);
@@ -861,11 +861,20 @@ static int superio_inw(int base, int reg)
        return val;
 }
-static inline void superio_enter(int base)
+static inline int superio_enter(int base)
 {
+        /* Don't step on other drivers' I/O space by accident */
+        if (!request_muxed_region(base, 2, DRVNAME)) {
+                printk(KERN_ERR DRVNAME ": I/O address 0x%04x already in use\n",
+                                base);
+                return -EBUSY;
+        }
        /* according to the datasheet the key must be send twice! */
        outb(SIO_UNLOCK_KEY, base);
        outb(SIO_UNLOCK_KEY, base);
+        return 0;
 }
 static inline void superio_select(int base, int ld)
@@ -877,6 +886,7 @@ static inline void superio_select(int base, int ld)
 static inline void superio_exit(int base)
 {
        outb(SIO_LOCK_KEY, base);
+        release_region(base, 2);
 }
 static inline int fan_from_reg(u16 reg)
@@ -2175,21 +2185,15 @@ static int f71882fg_remove(struct platform_device *pdev)
 static int __init f71882fg_find(int sioaddr, unsigned short *address,
        struct f71882fg_sio_data *sio_data)
 {
-        int err = -ENODEV;
        u16 devid;
+        int err = superio_enter(sioaddr);
-        /* Don't step on other drivers' I/O space by accident */
+        if (err)
-        if (!request_region(sioaddr, 2, DRVNAME)) {
+                return err;
-                printk(KERN_ERR DRVNAME ": I/O address 0x%04x already in use\n",
-                                (int)sioaddr);
-                return -EBUSY;
-        }
-        superio_enter(sioaddr);
        devid = superio_inw(sioaddr, SIO_REG_MANID);
        if (devid != SIO_FINTEK_ID) {
                pr_debug(DRVNAME ": Not a Fintek device\n");
+                err = -ENODEV;
                goto exit;
        }
@@ -2213,6 +2217,7 @@ static int __init f71882fg_find(int sioaddr, unsigned short *address,
        default:
                printk(KERN_INFO DRVNAME ": Unsupported Fintek device: %04x\n",
                       (unsigned int)devid);
+                err = -ENODEV;
                goto exit;
        }
@@ -2223,12 +2228,14 @@ static int __init f71882fg_find(int sioaddr, unsigned short *address,
        if (!(superio_inb(sioaddr, SIO_REG_ENABLE) & 0x01)) {
                printk(KERN_WARNING DRVNAME ": Device not activated\n");
+                err = -ENODEV;
                goto exit;
        }
        *address = superio_inw(sioaddr, SIO_REG_ADDR);
        if (*address == 0) {
                printk(KERN_WARNING DRVNAME ": Base address not set\n");
+                err = -ENODEV;
                goto exit;
        }
        *address &= ~(REGION_LENGTH - 1);       /* Ignore 3 LSB */
@@ -2239,7 +2246,6 @@ static int __init f71882fg_find(int sioaddr, unsigned short *address,
                (int)superio_inb(sioaddr, SIO_REG_DEVREV));
 exit:
        superio_exit(sioaddr);
-        release_region(sioaddr, 2);
        return err;
 }
diff --git a/drivers/hwmon/lis3lv02d.c b/drivers/hwmon/lis3lv02d.c
index 6138f036b159..fc591ae53107 100644
--- a/drivers/hwmon/lis3lv02d.c
+++ b/drivers/hwmon/lis3lv02d.c
@@ -277,7 +277,7 @@ static irqreturn_t lis302dl_interrupt(int irq, void *dummy)
        wake_up_interruptible(&lis3_dev.misc_wait);
        kill_fasync(&lis3_dev.async_queue, SIGIO, POLL_IN);
 out:
-        if (lis3_dev.whoami == WAI_8B && lis3_dev.idev &&
+        if (lis3_dev.pdata && lis3_dev.whoami == WAI_8B && lis3_dev.idev &&
            lis3_dev.idev->input->users)
                return IRQ_WAKE_THREAD;
        return IRQ_HANDLED;
@@ -718,7 +718,7 @@ int lis3lv02d_init_device(struct lis3lv02d *dev)
         * io-apic is not configurable (and generates a warning) but I keep it
         * in case of support for other hardware.
         */
-        if (dev->whoami == WAI_8B)
+        if (dev->pdata && dev->whoami == WAI_8B)
                thread_fn = lis302dl_interrupt_thread1_8b;
        else
                thread_fn = NULL;
diff --git a/drivers/hwmon/pkgtemp.c b/drivers/hwmon/pkgtemp.c
index 74157fcda6ed..f11903936c8b 100644
--- a/drivers/hwmon/pkgtemp.c
+++ b/drivers/hwmon/pkgtemp.c
@@ -33,7 +33,6 @@
 #include <linux/list.h>
 #include <linux/platform_device.h>
 #include <linux/cpu.h>
-#include <linux/pci.h>
 #include <asm/msr.h>
 #include <asm/processor.h>
@@ -224,7 +223,7 @@ static int __devinit pkgtemp_probe(struct platform_device *pdev)
        err = sysfs_create_group(&pdev->dev.kobj, &pkgtemp_group);
        if (err)
-                goto exit_free;
+                goto exit_dev;
        data->hwmon_dev = hwmon_device_register(&pdev->dev);
        if (IS_ERR(data->hwmon_dev)) {
@@ -238,6 +237,8 @@ static int __devinit pkgtemp_probe(struct platform_device *pdev)
 exit_class:
        sysfs_remove_group(&pdev->dev.kobj, &pkgtemp_group);
+exit_dev:
+        device_remove_file(&pdev->dev, &sensor_dev_attr_temp1_max.dev_attr);
 exit_free:
        kfree(data);
 exit:
@@ -250,6 +251,7 @@ static int __devexit pkgtemp_remove(struct platform_device *pdev)
        hwmon_device_unregister(data->hwmon_dev);
        sysfs_remove_group(&pdev->dev.kobj, &pkgtemp_group);
+        device_remove_file(&pdev->dev, &sensor_dev_attr_temp1_max.dev_attr);
        platform_set_drvdata(pdev, NULL);
        kfree(data);
        return 0;
@@ -281,9 +283,10 @@ static int __cpuinit pkgtemp_device_add(unsigned int cpu)
        int err;
        struct platform_device *pdev;
        struct pdev_entry *pdev_entry;
-#ifdef CONFIG_SMP
        struct cpuinfo_x86 *c = &cpu_data(cpu);
-#endif
+        if (!cpu_has(c, X86_FEATURE_PTS))
+                return 0;
        mutex_lock(&pdev_list_mutex);
@@ -339,17 +342,18 @@ exit:
 #ifdef CONFIG_HOTPLUG_CPU
 static void pkgtemp_device_remove(unsigned int cpu)
 {
-        struct pdev_entry *p, *n;
+        struct pdev_entry *p;
        unsigned int i;
        int err;
        mutex_lock(&pdev_list_mutex);
-        list_for_each_entry_safe(p, n, &pdev_list, list) {
+        list_for_each_entry(p, &pdev_list, list) {
                if (p->cpu != cpu)
                        continue;
                platform_device_unregister(p->pdev);
                list_del(&p->list);
+                mutex_unlock(&pdev_list_mutex);
                kfree(p);
                for_each_cpu(i, cpu_core_mask(cpu)) {
                        if (i != cpu) {
@@ -358,7 +362,7 @@ static void pkgtemp_device_remove(unsigned int cpu)
                                        break;
                        }
                }
-                break;
+                return;
        }
        mutex_unlock(&pdev_list_mutex);
 }
@@ -399,11 +403,6 @@ static int __init pkgtemp_init(void)
                goto exit;
        for_each_online_cpu(i) {
-                struct cpuinfo_x86 *c = &cpu_data(i);
-                if (!cpu_has(c, X86_FEATURE_PTS))
-                        continue;
                err = pkgtemp_device_add(i);
                if (err)
                        goto exit_devices_unreg;
diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c
index f7bd2613cecc..f2de3be35df3 100644
--- a/drivers/i2c/busses/i2c-cpm.c
+++ b/drivers/i2c/busses/i2c-cpm.c
@@ -677,6 +677,11 @@ static int __devinit cpm_i2c_probe(struct platform_device *ofdev,
        dev_dbg(&ofdev->dev, "hw routines for %s registered.\n",
                cpm->adap.name);
+        /*
+         * register OF I2C devices
+         */
+        of_i2c_register_devices(&cpm->adap);
        return 0;
 out_shut:
        cpm_i2c_shutdown(cpm);
diff --git a/drivers/i2c/busses/i2c-davinci.c b/drivers/i2c/busses/i2c-davinci.c
index 2222c87876b9..b8feac5f2ef4 100644
--- a/drivers/i2c/busses/i2c-davinci.c
+++ b/drivers/i2c/busses/i2c-davinci.c
@@ -357,9 +357,6 @@ i2c_davinci_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg, int stop)
        dev->terminate = 0;
-        /* write the data into mode register */
-        davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, flag);
        /*
         * First byte should be set here, not after interrupt,
         * because transmit-data-ready interrupt can come before
@@ -371,6 +368,9 @@ i2c_davinci_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg, int stop)
                dev->buf_len--;
        }
+        /* write the data into mode register; start transmitting */
+        davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, flag);
        r = wait_for_completion_interruptible_timeout(&dev->cmd_complete,
                                                      dev->adapter.timeout);
        if (r == 0) {
diff --git a/drivers/i2c/busses/i2c-ibm_iic.c b/drivers/i2c/busses/i2c-ibm_iic.c
index 43ca32fddde2..89eedf45d30e 100644
--- a/drivers/i2c/busses/i2c-ibm_iic.c
+++ b/drivers/i2c/busses/i2c-ibm_iic.c
@@ -761,6 +761,9 @@ static int __devinit iic_probe(struct platform_device *ofdev,
        dev_info(&ofdev->dev, "using %s mode\n",
                 dev->fast_mode ? "fast (400 kHz)" : "standard (100 kHz)");
+        /* Now register all the child nodes */
+        of_i2c_register_devices(adap);
        return 0;
 error_cleanup:
diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c
index a1c419a716af..b74e6dc6886c 100644
--- a/drivers/i2c/busses/i2c-mpc.c
+++ b/drivers/i2c/busses/i2c-mpc.c
@@ -632,6 +632,7 @@ static int __devinit fsl_i2c_probe(struct platform_device *op,
                dev_err(i2c->dev, "failed to add adapter\n");
                goto fail_add;
        }
+        of_i2c_register_devices(&i2c->adap);
        return result;
diff --git a/drivers/i2c/busses/i2c-octeon.c b/drivers/i2c/busses/i2c-octeon.c
index 0e9f85d0a835..56dbe54e8811 100644
--- a/drivers/i2c/busses/i2c-octeon.c
+++ b/drivers/i2c/busses/i2c-octeon.c
@@ -218,7 +218,7 @@ static int octeon_i2c_wait(struct octeon_i2c *i2c)
                return result;
        } else if (result == 0) {
                dev_dbg(i2c->dev, "%s: timeout\n", __func__);
-                result = -ETIMEDOUT;
+                return -ETIMEDOUT;
        }
        return 0;
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index 7674efb55378..b33c78586bfc 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -680,6 +680,8 @@ omap_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msgs[], int num)
        if (r == 0)
                r = num;
+        omap_i2c_wait_for_bb(dev);
 out:
        omap_i2c_idle(dev);
        return r;
diff --git a/drivers/i2c/busses/i2c-pca-isa.c b/drivers/i2c/busses/i2c-pca-isa.c
index bbd77603a417..29933f87d8fa 100644
--- a/drivers/i2c/busses/i2c-pca-isa.c
+++ b/drivers/i2c/busses/i2c-pca-isa.c
@@ -71,8 +71,8 @@ static int pca_isa_readbyte(void *pd, int reg)
 static int pca_isa_waitforcompletion(void *pd)
 {
-        long ret = ~0;
        unsigned long timeout;
+        long ret;
        if (irq > -1) {
                ret = wait_event_timeout(pca_wait,
@@ -81,11 +81,15 @@ static int pca_isa_waitforcompletion(void *pd)
        } else {
                /* Do polling */
                timeout = jiffies + pca_isa_ops.timeout;
-                while (((pca_isa_readbyte(pd, I2C_PCA_CON)
+                do {
-                                & I2C_PCA_CON_SI) == 0)
+                        ret = time_before(jiffies, timeout);
-                                && (ret = time_before(jiffies, timeout)))
+                        if (pca_isa_readbyte(pd, I2C_PCA_CON)
+                                        & I2C_PCA_CON_SI)
+                                break;
                        udelay(100);
+                } while (ret);
        }
        return ret > 0;
 }
diff --git a/drivers/i2c/busses/i2c-pca-platform.c b/drivers/i2c/busses/i2c-pca-platform.c
index ef5c78487eb7..5f6d7f89e225 100644
--- a/drivers/i2c/busses/i2c-pca-platform.c
+++ b/drivers/i2c/busses/i2c-pca-platform.c
@@ -80,8 +80,8 @@ static void i2c_pca_pf_writebyte32(void *pd, int reg, int val)
 static int i2c_pca_pf_waitforcompletion(void *pd)
 {
        struct i2c_pca_pf_data *i2c = pd;
-        long ret = ~0;
        unsigned long timeout;
+        long ret;
        if (i2c->irq) {
                ret = wait_event_timeout(i2c->wait,
@@ -90,10 +90,13 @@ static int i2c_pca_pf_waitforcompletion(void *pd)
        } else {
                /* Do polling */
                timeout = jiffies + i2c->adap.timeout;
-                while (((i2c->algo_data.read_byte(i2c, I2C_PCA_CON)
+                do {
-                                & I2C_PCA_CON_SI) == 0)
+                        ret = time_before(jiffies, timeout);
-                                && (ret = time_before(jiffies, timeout)))
+                        if (i2c->algo_data.read_byte(i2c, I2C_PCA_CON)
+                                        & I2C_PCA_CON_SI)
+                                break;
                        udelay(100);
+                } while (ret);
        }
        return ret > 0;
diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
index 72902e0bbfa7..bf831bf81587 100644
--- a/drivers/i2c/busses/i2c-s3c2410.c
+++ b/drivers/i2c/busses/i2c-s3c2410.c
@@ -662,8 +662,8 @@ static int s3c24xx_i2c_clockrate(struct s3c24xx_i2c *i2c, unsigned int *got)
                unsigned long sda_delay;
                if (pdata->sda_delay) {
-                        sda_delay = (freq / 1000) * pdata->sda_delay;
+                        sda_delay = clkin * pdata->sda_delay;
-                        sda_delay /= 1000000;
+                        sda_delay = DIV_ROUND_UP(sda_delay, 1000000);
                        sda_delay = DIV_ROUND_UP(sda_delay, 5);
                        if (sda_delay > 3)
                                sda_delay = 3;
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 6649176de940..bea4c5021d26 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -32,7 +32,6 @@
 #include <linux/init.h>
 #include <linux/idr.h>
 #include <linux/mutex.h>
-#include <linux/of_i2c.h>
 #include <linux/of_device.h>
 #include <linux/completion.h>
 #include <linux/hardirq.h>
@@ -197,11 +196,12 @@ static int i2c_device_pm_suspend(struct device *dev)
 {
        const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
-        if (pm_runtime_suspended(dev))
+        if (pm) {
-                return 0;
+                if (pm_runtime_suspended(dev))
+                        return 0;
-        if (pm)
+                else
-                return pm->suspend ? pm->suspend(dev) : 0;
+                        return pm->suspend ? pm->suspend(dev) : 0;
+        }
        return i2c_legacy_suspend(dev, PMSG_SUSPEND);
 }
@@ -216,12 +216,6 @@ static int i2c_device_pm_resume(struct device *dev)
        else
                ret = i2c_legacy_resume(dev);
-        if (!ret) {
-                pm_runtime_disable(dev);
-                pm_runtime_set_active(dev);
-                pm_runtime_enable(dev);
-        }
        return ret;
 }
@@ -229,11 +223,12 @@ static int i2c_device_pm_freeze(struct device *dev)
 {
        const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
-        if (pm_runtime_suspended(dev))
+        if (pm) {
-                return 0;
+                if (pm_runtime_suspended(dev))
+                        return 0;
-        if (pm)
+                else
-                return pm->freeze ? pm->freeze(dev) : 0;
+                        return pm->freeze ? pm->freeze(dev) : 0;
+        }
        return i2c_legacy_suspend(dev, PMSG_FREEZE);
 }
@@ -242,11 +237,12 @@ static int i2c_device_pm_thaw(struct device *dev)
 {
        const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
-        if (pm_runtime_suspended(dev))
+        if (pm) {
-                return 0;
+                if (pm_runtime_suspended(dev))
+                        return 0;
-        if (pm)
+                else
-                return pm->thaw ? pm->thaw(dev) : 0;
+                        return pm->thaw ? pm->thaw(dev) : 0;
+        }
        return i2c_legacy_resume(dev);
 }
@@ -255,11 +251,12 @@ static int i2c_device_pm_poweroff(struct device *dev)
 {
        const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
-        if (pm_runtime_suspended(dev))
+        if (pm) {
-                return 0;
+                if (pm_runtime_suspended(dev))
+                        return 0;
-        if (pm)
+                else
-                return pm->poweroff ? pm->poweroff(dev) : 0;
+                        return pm->poweroff ? pm->poweroff(dev) : 0;
+        }
        return i2c_legacy_suspend(dev, PMSG_HIBERNATE);
 }
@@ -876,9 +873,6 @@ static int i2c_register_adapter(struct i2c_adapter *adap)
        if (adap->nr < __i2c_first_dynamic_bus_num)
                i2c_scan_static_board_info(adap);
-        /* Register devices from the device tree */
-        of_i2c_register_devices(adap);
        /* Notify drivers */
        mutex_lock(&core_lock);
        bus_for_each_drv(&i2c_bus_type, NULL, adap, __process_new_adapter);
diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
index a10152bb1427..c37ef64d1465 100755..100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -83,7 +83,7 @@ static unsigned int mwait_substates;
 /* Reliable LAPIC Timer States, bit 1 for C1 etc.  */
 static unsigned int lapic_timer_reliable_states;
-static struct cpuidle_device *intel_idle_cpuidle_devices;
+static struct cpuidle_device __percpu *intel_idle_cpuidle_devices;
 static int intel_idle(struct cpuidle_device *dev, struct cpuidle_state *state);
 static struct cpuidle_state *cpuidle_state_table;
@@ -108,7 +108,7 @@ static struct cpuidle_state nehalem_cstates[MWAIT_MAX_NUM_CSTATES] = {
                .name = "NHM-C3",
                .desc = "MWAIT 0x10",
                .driver_data = (void *) 0x10,
-                .flags = CPUIDLE_FLAG_TIME_VALID,
+                .flags = CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_TLB_FLUSHED,
                .exit_latency = 20,
                .power_usage = 500,
                .target_residency = 80,
@@ -117,7 +117,7 @@ static struct cpuidle_state nehalem_cstates[MWAIT_MAX_NUM_CSTATES] = {
                .name = "NHM-C6",
                .desc = "MWAIT 0x20",
                .driver_data = (void *) 0x20,
-                .flags = CPUIDLE_FLAG_TIME_VALID,
+                .flags = CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_TLB_FLUSHED,
                .exit_latency = 200,
                .power_usage = 350,
                .target_residency = 800,
@@ -149,7 +149,7 @@ static struct cpuidle_state atom_cstates[MWAIT_MAX_NUM_CSTATES] = {
                .name = "ATM-C4",
                .desc = "MWAIT 0x30",
                .driver_data = (void *) 0x30,
-                .flags = CPUIDLE_FLAG_TIME_VALID,
+                .flags = CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_TLB_FLUSHED,
                .exit_latency = 100,
                .power_usage = 250,
                .target_residency = 400,
@@ -157,13 +157,13 @@ static struct cpuidle_state atom_cstates[MWAIT_MAX_NUM_CSTATES] = {
        { /* MWAIT C5 */ },
        { /* MWAIT C6 */
                .name = "ATM-C6",
-                .desc = "MWAIT 0x40",
+                .desc = "MWAIT 0x52",
-                .driver_data = (void *) 0x40,
+                .driver_data = (void *) 0x52,
-                .flags = CPUIDLE_FLAG_TIME_VALID,
+                .flags = CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_TLB_FLUSHED,
-                .exit_latency = 200,
+                .exit_latency = 140,
                .power_usage = 150,
-                .target_residency = 800,
+                .target_residency = 560,
-                .enter = NULL },        /* disabled */
+                .enter = &intel_idle },
 };
 /**
@@ -185,6 +185,16 @@ static int intel_idle(struct cpuidle_device *dev, struct cpuidle_state *state)
        local_irq_disable();
+        /*
+         * If the state flag indicates that the TLB will be flushed or if this
+         * is the deepest c-state supported, do a voluntary leave mm to avoid
+         * costly and mostly unnecessary wakeups for flushing the user TLB's
+         * associated with the active mm.
+         */
+        if (state->flags & CPUIDLE_FLAG_TLB_FLUSHED ||
+            (&dev->states[dev->state_count - 1] == state))
+                leave_mm(cpu);
        if (!(lapic_timer_reliable_states & (1 << (cstate))))
                clockevents_notify(CLOCK_EVT_NOTIFY_BROADCAST_ENTER, &cpu);
diff --git a/drivers/infiniband/hw/cxgb3/iwch_cm.c b/drivers/infiniband/hw/cxgb3/iwch_cm.c
index d88077a21994..13c88871dc3b 100644
--- a/drivers/infiniband/hw/cxgb3/iwch_cm.c
+++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c
@@ -463,7 +463,8 @@ static int send_connect(struct iwch_ep *ep)
            V_MSS_IDX(mtu_idx) |
            V_L2T_IDX(ep->l2t->idx) | V_TX_CHANNEL(ep->l2t->smt_idx);
        opt0l = V_TOS((ep->tos >> 2) & M_TOS) | V_RCV_BUFSIZ(rcv_win>>10);
-        opt2 = V_FLAVORS_VALID(1) | V_CONG_CONTROL_FLAVOR(cong_flavor);
+        opt2 = F_RX_COALESCE_VALID | V_RX_COALESCE(0) | V_FLAVORS_VALID(1) |
+               V_CONG_CONTROL_FLAVOR(cong_flavor);
        skb->priority = CPL_PRIORITY_SETUP;
        set_arp_failure_handler(skb, act_open_req_arp_failure);
@@ -1280,7 +1281,8 @@ static void accept_cr(struct iwch_ep *ep, __be32 peer_ip, struct sk_buff *skb)
            V_MSS_IDX(mtu_idx) |
            V_L2T_IDX(ep->l2t->idx) | V_TX_CHANNEL(ep->l2t->smt_idx);
        opt0l = V_TOS((ep->tos >> 2) & M_TOS) | V_RCV_BUFSIZ(rcv_win>>10);
-        opt2 = V_FLAVORS_VALID(1) | V_CONG_CONTROL_FLAVOR(cong_flavor);
+        opt2 = F_RX_COALESCE_VALID | V_RX_COALESCE(0) | V_FLAVORS_VALID(1) |
+               V_CONG_CONTROL_FLAVOR(cong_flavor);
        rpl = cplhdr(skb);
        rpl->wr.wr_hi = htonl(V_WR_OP(FW_WROPCODE_FORWARD));
diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
index d85bd8a7967d..22239e988498 100644
--- a/drivers/input/joydev.c
+++ b/drivers/input/joydev.c
@@ -483,6 +483,9 @@ static int joydev_handle_JSIOCSAXMAP(struct joydev *joydev,
        memcpy(joydev->abspam, abspam, len);
+        for (i = 0; i < joydev->nabs; i++)
+                joydev->absmap[joydev->abspam[i]] = i;
 out:
        kfree(abspam);
        return retval;
diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
index 0d4266a533a5..360698553eb5 100644
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -404,6 +404,13 @@ static int uinput_setup_device(struct uinput_device *udev, const char __user *bu
                retval = uinput_validate_absbits(dev);
                if (retval < 0)
                        goto exit;
+                if (test_bit(ABS_MT_SLOT, dev->absbit)) {
+                        int nslot = input_abs_get_max(dev, ABS_MT_SLOT) + 1;
+                        input_mt_create_slots(dev, nslot);
+                        input_set_events_per_packet(dev, 6 * nslot);
+                } else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) {
+                        input_set_events_per_packet(dev, 60);
+                }
        }
        udev->state = UIST_SETUP_COMPLETE;
diff --git a/drivers/input/tablet/wacom_sys.c b/drivers/input/tablet/wacom_sys.c
index 42ba3691d908..b35876ee6908 100644
--- a/drivers/input/tablet/wacom_sys.c
+++ b/drivers/input/tablet/wacom_sys.c
@@ -103,27 +103,26 @@ static void wacom_sys_irq(struct urb *urb)
 static int wacom_open(struct input_dev *dev)
 {
        struct wacom *wacom = input_get_drvdata(dev);
+        int retval = 0;
-        mutex_lock(&wacom->lock);
+        if (usb_autopm_get_interface(wacom->intf) < 0)
-        wacom->irq->dev = wacom->usbdev;
-        if (usb_autopm_get_interface(wacom->intf) < 0) {
-                mutex_unlock(&wacom->lock);
                return -EIO;
-        }
+        mutex_lock(&wacom->lock);
        if (usb_submit_urb(wacom->irq, GFP_KERNEL)) {
-                usb_autopm_put_interface(wacom->intf);
+                retval = -EIO;
-                mutex_unlock(&wacom->lock);
+                goto out;
-                return -EIO;
        }
        wacom->open = true;
        wacom->intf->needs_remote_wakeup = 1;
+out:
        mutex_unlock(&wacom->lock);
-        return 0;
+        if (retval)
+                usb_autopm_put_interface(wacom->intf);
+        return retval;
 }
 static void wacom_close(struct input_dev *dev)
@@ -135,6 +134,8 @@ static void wacom_close(struct input_dev *dev)
        wacom->open = false;
        wacom->intf->needs_remote_wakeup = 0;
        mutex_unlock(&wacom->lock);
+        usb_autopm_put_interface(wacom->intf);
 }
 static int wacom_parse_hid(struct usb_interface *intf, struct hid_descriptor *hid_desc,
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index 6e29badb969e..47fd7a041c52 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -442,8 +442,10 @@ static void wacom_intuos_general(struct wacom_wac *wacom)
        /* general pen packet */
        if ((data[1] & 0xb8) == 0xa0) {
                t = (data[6] << 2) | ((data[7] >> 6) & 3);
-                if (features->type >= INTUOS4S && features->type <= INTUOS4L)
+                if ((features->type >= INTUOS4S && features->type <= INTUOS4L) ||
+                    features->type == WACOM_21UX2) {
                        t = (t << 1) | (data[1] & 1);
+                }
                input_report_abs(input, ABS_PRESSURE, t);
                input_report_abs(input, ABS_TILT_X,
                                ((data[7] << 1) & 0x7e) | (data[8] >> 7));
diff --git a/drivers/isdn/sc/interrupt.c b/drivers/isdn/sc/interrupt.c
index 485be8b1e1b3..f0225bc0f267 100644
--- a/drivers/isdn/sc/interrupt.c
+++ b/drivers/isdn/sc/interrupt.c
@@ -112,11 +112,19 @@ irqreturn_t interrupt_handler(int dummy, void *card_inst)
                        }
                        else if(callid>=0x0000 && callid<=0x7FFF)
                        {
+                                int len;
                                pr_debug("%s: Got Incoming Call\n",
                                                sc_adapter[card]->devicename);
-                                strcpy(setup.phone,&(rcvmsg.msg_data.byte_array[4]));
+                                len = strlcpy(setup.phone, &(rcvmsg.msg_data.byte_array[4]),
-                                strcpy(setup.eazmsn,
+                                                sizeof(setup.phone));
-                                        sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn);
+                                if (len >= sizeof(setup.phone))
+                                        continue;
+                                len = strlcpy(setup.eazmsn,
+                                                sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn,
+                                                sizeof(setup.eazmsn));
+                                if (len >= sizeof(setup.eazmsn))
+                                        continue;
                                setup.si1 = 7;
                                setup.si2 = 0;
                                setup.plan = 0;
@@ -176,7 +184,9 @@ irqreturn_t interrupt_handler(int dummy, void *card_inst)
                 * Handle a GetMyNumber Rsp
                 */
                if (IS_CE_MESSAGE(rcvmsg,Call,0,GetMyNumber)){
-                        strcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn,rcvmsg.msg_data.byte_array);
+                        strlcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn,
+                                rcvmsg.msg_data.byte_array,
+                                sizeof(rcvmsg.msg_data.byte_array));
                        continue;
                }
                        
diff --git a/drivers/leds/leds-ns2.c b/drivers/leds/leds-ns2.c
index 74dce4ba0262..350eb34f049c 100644
--- a/drivers/leds/leds-ns2.c
+++ b/drivers/leds/leds-ns2.c
@@ -81,7 +81,7 @@ static int ns2_led_get_mode(struct ns2_led_data *led_dat,
        int cmd_level;
        int slow_level;
-        read_lock(&led_dat->rw_lock);
+        read_lock_irq(&led_dat->rw_lock);
        cmd_level = gpio_get_value(led_dat->cmd);
        slow_level = gpio_get_value(led_dat->slow);
@@ -95,7 +95,7 @@ static int ns2_led_get_mode(struct ns2_led_data *led_dat,
                }
        }
-        read_unlock(&led_dat->rw_lock);
+        read_unlock_irq(&led_dat->rw_lock);
        return ret;
 }
@@ -104,8 +104,9 @@ static void ns2_led_set_mode(struct ns2_led_data *led_dat,
                             enum ns2_led_modes mode)
 {
        int i;
+        unsigned long flags;
-        write_lock(&led_dat->rw_lock);
+        write_lock_irqsave(&led_dat->rw_lock, flags);
        for (i = 0; i < ARRAY_SIZE(ns2_led_modval); i++) {
                if (mode == ns2_led_modval[i].mode) {
@@ -116,7 +117,7 @@ static void ns2_led_set_mode(struct ns2_led_data *led_dat,
                }
        }
-        write_unlock(&led_dat->rw_lock);
+        write_unlock_irqrestore(&led_dat->rw_lock, flags);
 }
 static void ns2_led_set(struct led_classdev *led_cdev,
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index ed4900ade93a..e4fb58db5454 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -1000,10 +1000,11 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, sector_t start)
                                page = bitmap->sb_page;
                                offset = sizeof(bitmap_super_t);
                                if (!file)
-                                        read_sb_page(bitmap->mddev,
+                                        page = read_sb_page(
-                                                     bitmap->mddev->bitmap_info.offset,
+                                                bitmap->mddev,
-                                                     page,
+                                                bitmap->mddev->bitmap_info.offset,
-                                                     index, count);
+                                                page,
+                                                index, count);
                        } else if (file) {
                                page = read_page(file, index, bitmap, count);
                                offset = 0;
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index ad83a4dcadc3..0b830bbe1d8b 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1839,7 +1839,9 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
                /* take from bio_init */
                bio->bi_next = NULL;
+                bio->bi_flags &= ~(BIO_POOL_MASK-1);
                bio->bi_flags |= 1 << BIO_UPTODATE;
+                bio->bi_comp_cpu = -1;
                bio->bi_rw = READ;
                bio->bi_vcnt = 0;
                bio->bi_idx = 0;
@@ -1912,7 +1914,7 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
                            !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery))
                                break;
                        BUG_ON(sync_blocks < (PAGE_SIZE>>9));
-                        if (len > (sync_blocks<<9))
+                        if ((len >> 9) > sync_blocks)
                                len = sync_blocks<<9;
                }
diff --git a/drivers/media/IR/ir-keytable.c b/drivers/media/IR/ir-keytable.c
index 7e82a9df726b..7961d59f5cac 100644
--- a/drivers/media/IR/ir-keytable.c
+++ b/drivers/media/IR/ir-keytable.c
@@ -319,7 +319,7 @@ static void ir_timer_keyup(unsigned long cookie)
         * a keyup event might follow immediately after the keydown.
         */
        spin_lock_irqsave(&ir->keylock, flags);
-        if (time_is_after_eq_jiffies(ir->keyup_jiffies))
+        if (time_is_before_eq_jiffies(ir->keyup_jiffies))
                ir_keyup(ir);
        spin_unlock_irqrestore(&ir->keylock, flags);
 }
@@ -510,6 +510,13 @@ int __ir_input_register(struct input_dev *input_dev,
                   (ir_dev->props && ir_dev->props->driver_type == RC_DRIVER_IR_RAW) ?
                        " in raw mode" : "");
+        /*
+         * Default delay of 250ms is too short for some protocols, expecially
+         * since the timeout is currently set to 250ms. Increase it to 500ms,
+         * to avoid wrong repetition of the keycodes.
+         */
+        input_dev->rep[REP_DELAY] = 500;
        return 0;
 out_event:
diff --git a/drivers/media/IR/ir-lirc-codec.c b/drivers/media/IR/ir-lirc-codec.c
index 77b5946413c0..e63f757d5d72 100644
--- a/drivers/media/IR/ir-lirc-codec.c
+++ b/drivers/media/IR/ir-lirc-codec.c
@@ -267,7 +267,7 @@ static int ir_lirc_register(struct input_dev *input_dev)
                        features |= LIRC_CAN_SET_SEND_CARRIER;
                if (ir_dev->props->s_tx_duty_cycle)
-                        features |= LIRC_CAN_SET_REC_DUTY_CYCLE;
+                        features |= LIRC_CAN_SET_SEND_DUTY_CYCLE;
        }
        if (ir_dev->props->s_rx_carrier_range)
diff --git a/drivers/media/IR/ir-raw-event.c b/drivers/media/IR/ir-raw-event.c
index 43094e7eccfa..8e0e1b1f8c87 100644
--- a/drivers/media/IR/ir-raw-event.c
+++ b/drivers/media/IR/ir-raw-event.c
@@ -279,9 +279,11 @@ int ir_raw_event_register(struct input_dev *input_dev)
                        "rc%u",  (unsigned int)ir->devno);
        if (IS_ERR(ir->raw->thread)) {
+                int ret = PTR_ERR(ir->raw->thread);
                kfree(ir->raw);
                ir->raw = NULL;
-                return PTR_ERR(ir->raw->thread);
+                return ret;
        }
        mutex_lock(&ir_raw_handler_lock);
diff --git a/drivers/media/IR/ir-sysfs.c b/drivers/media/IR/ir-sysfs.c
index 96dafc425c8e..46d42467f9b4 100644
--- a/drivers/media/IR/ir-sysfs.c
+++ b/drivers/media/IR/ir-sysfs.c
@@ -67,13 +67,14 @@ static ssize_t show_protocols(struct device *d,
        char *tmp = buf;
        int i;
-        if (ir_dev->props->driver_type == RC_DRIVER_SCANCODE) {
+        if (ir_dev->props && ir_dev->props->driver_type == RC_DRIVER_SCANCODE) {
                enabled = ir_dev->rc_tab.ir_type;
                allowed = ir_dev->props->allowed_protos;
-        } else {
+        } else if (ir_dev->raw) {
                enabled = ir_dev->raw->enabled_protocols;
                allowed = ir_raw_get_allowed_protocols();
-        }
+        } else
+                return sprintf(tmp, "[builtin]\n");
        IR_dprintk(1, "allowed - 0x%llx, enabled - 0x%llx\n",
                   (long long)allowed,
@@ -121,10 +122,14 @@ static ssize_t store_protocols(struct device *d,
        int rc, i, count = 0;
        unsigned long flags;
-        if (ir_dev->props->driver_type == RC_DRIVER_SCANCODE)
+        if (ir_dev->props && ir_dev->props->driver_type == RC_DRIVER_SCANCODE)
                type = ir_dev->rc_tab.ir_type;
-        else
+        else if (ir_dev->raw)
                type = ir_dev->raw->enabled_protocols;
+        else {
+                IR_dprintk(1, "Protocol switching not supported\n");
+                return -EINVAL;
+        }
        while ((tmp = strsep((char **) &data, " \n")) != NULL) {
                if (!*tmp)
@@ -185,7 +190,7 @@ static ssize_t store_protocols(struct device *d,
                }
        }
-        if (ir_dev->props->driver_type == RC_DRIVER_SCANCODE) {
+        if (ir_dev->props && ir_dev->props->driver_type == RC_DRIVER_SCANCODE) {
                spin_lock_irqsave(&ir_dev->rc_tab.lock, flags);
                ir_dev->rc_tab.ir_type = type;
                spin_unlock_irqrestore(&ir_dev->rc_tab.lock, flags);
diff --git a/drivers/media/IR/keymaps/rc-rc6-mce.c b/drivers/media/IR/keymaps/rc-rc6-mce.c
index 64264f7f838f..39557ad401b6 100644
--- a/drivers/media/IR/keymaps/rc-rc6-mce.c
+++ b/drivers/media/IR/keymaps/rc-rc6-mce.c
@@ -19,6 +19,7 @@ static struct ir_scancode rc6_mce[] = {
        { 0x800f0416, KEY_PLAY },
        { 0x800f0418, KEY_PAUSE },
+        { 0x800f046e, KEY_PLAYPAUSE },
        { 0x800f0419, KEY_STOP },
        { 0x800f0417, KEY_RECORD },
@@ -37,6 +38,8 @@ static struct ir_scancode rc6_mce[] = {
        { 0x800f0411, KEY_VOLUMEDOWN },
        { 0x800f0412, KEY_CHANNELUP },
        { 0x800f0413, KEY_CHANNELDOWN },
+        { 0x800f043a, KEY_BRIGHTNESSUP },
+        { 0x800f0480, KEY_BRIGHTNESSDOWN },
        { 0x800f0401, KEY_NUMERIC_1 },
        { 0x800f0402, KEY_NUMERIC_2 },
diff --git a/drivers/media/IR/mceusb.c b/drivers/media/IR/mceusb.c
index ac6bb2c01a48..bc620e10ef77 100644
--- a/drivers/media/IR/mceusb.c
+++ b/drivers/media/IR/mceusb.c
@@ -120,6 +120,10 @@ static struct usb_device_id mceusb_dev_table[] = {
        { USB_DEVICE(VENDOR_PHILIPS, 0x0613) },
        /* Philips eHome Infrared Transceiver */
        { USB_DEVICE(VENDOR_PHILIPS, 0x0815) },
+        /* Philips/Spinel plus IR transceiver for ASUS */
+        { USB_DEVICE(VENDOR_PHILIPS, 0x206c) },
+        /* Philips/Spinel plus IR transceiver for ASUS */
+        { USB_DEVICE(VENDOR_PHILIPS, 0x2088) },
        /* Realtek MCE IR Receiver */
        { USB_DEVICE(VENDOR_REALTEK, 0x0161) },
        /* SMK/Toshiba G83C0004D410 */
diff --git a/drivers/media/dvb/dvb-usb/dib0700_core.c b/drivers/media/dvb/dvb-usb/dib0700_core.c
index fe818348b8a3..48397f103d32 100644
--- a/drivers/media/dvb/dvb-usb/dib0700_core.c
+++ b/drivers/media/dvb/dvb-usb/dib0700_core.c
@@ -673,9 +673,6 @@ static int dib0700_probe(struct usb_interface *intf,
                        else
                                dev->props.rc.core.bulk_mode = false;
-                        /* Need a higher delay, to avoid wrong repeat */
-                        dev->rc_input_dev->rep[REP_DELAY] = 500;
                        dib0700_rc_setup(dev);
                        return 0;
diff --git a/drivers/media/dvb/dvb-usb/dib0700_devices.c b/drivers/media/dvb/dvb-usb/dib0700_devices.c
index f634d2e784b2..e06acd1fecb6 100644
--- a/drivers/media/dvb/dvb-usb/dib0700_devices.c
+++ b/drivers/media/dvb/dvb-usb/dib0700_devices.c
@@ -940,6 +940,58 @@ static int stk7070p_frontend_attach(struct dvb_usb_adapter *adap)
        return adap->fe == NULL ? -ENODEV : 0;
 }
+/* STK7770P */
+static struct dib7000p_config dib7770p_dib7000p_config = {
+        .output_mpeg2_in_188_bytes = 1,
+        .agc_config_count = 1,
+        .agc = &dib7070_agc_config,
+        .bw  = &dib7070_bw_config_12_mhz,
+        .tuner_is_baseband = 1,
+        .spur_protect = 1,
+        .gpio_dir = DIB7000P_GPIO_DEFAULT_DIRECTIONS,
+        .gpio_val = DIB7000P_GPIO_DEFAULT_VALUES,
+        .gpio_pwm_pos = DIB7000P_GPIO_DEFAULT_PWM_POS,
+        .hostbus_diversity = 1,
+        .enable_current_mirror = 1,
+        .disable_sample_and_hold = 0,
+};
+static int stk7770p_frontend_attach(struct dvb_usb_adapter *adap)
+{
+        struct usb_device_descriptor *p = &adap->dev->udev->descriptor;
+        if (p->idVendor  == cpu_to_le16(USB_VID_PINNACLE) &&
+            p->idProduct == cpu_to_le16(USB_PID_PINNACLE_PCTV72E))
+                dib0700_set_gpio(adap->dev, GPIO6, GPIO_OUT, 0);
+        else
+                dib0700_set_gpio(adap->dev, GPIO6, GPIO_OUT, 1);
+        msleep(10);
+        dib0700_set_gpio(adap->dev, GPIO9, GPIO_OUT, 1);
+        dib0700_set_gpio(adap->dev, GPIO4, GPIO_OUT, 1);
+        dib0700_set_gpio(adap->dev, GPIO7, GPIO_OUT, 1);
+        dib0700_set_gpio(adap->dev, GPIO10, GPIO_OUT, 0);
+        dib0700_ctrl_clock(adap->dev, 72, 1);
+        msleep(10);
+        dib0700_set_gpio(adap->dev, GPIO10, GPIO_OUT, 1);
+        msleep(10);
+        dib0700_set_gpio(adap->dev, GPIO0, GPIO_OUT, 1);
+        if (dib7000p_i2c_enumeration(&adap->dev->i2c_adap, 1, 18,
+                                     &dib7770p_dib7000p_config) != 0) {
+                err("%s: dib7000p_i2c_enumeration failed.  Cannot continue\n",
+                    __func__);
+                return -ENODEV;
+        }
+        adap->fe = dvb_attach(dib7000p_attach, &adap->dev->i2c_adap, 0x80,
+                &dib7770p_dib7000p_config);
+        return adap->fe == NULL ? -ENODEV : 0;
+}
 /* DIB807x generic */
 static struct dibx000_agc_config dib807x_agc_config[2] = {
        {
@@ -1781,7 +1833,7 @@ struct usb_device_id dib0700_usb_id_table[] = {
 /* 60 */{ USB_DEVICE(USB_VID_TERRATEC,  USB_PID_TERRATEC_CINERGY_T_XXS_2) },
        { USB_DEVICE(USB_VID_DIBCOM,    USB_PID_DIBCOM_STK807XPVR) },
        { USB_DEVICE(USB_VID_DIBCOM,    USB_PID_DIBCOM_STK807XP) },
-        { USB_DEVICE(USB_VID_PIXELVIEW, USB_PID_PIXELVIEW_SBTVD) },
+        { USB_DEVICE_VER(USB_VID_PIXELVIEW, USB_PID_PIXELVIEW_SBTVD, 0x000, 0x3f00) },
        { USB_DEVICE(USB_VID_EVOLUTEPC, USB_PID_TVWAY_PLUS) },
 /* 65 */{ USB_DEVICE(USB_VID_PINNACLE,  USB_PID_PINNACLE_PCTV73ESE) },
        { USB_DEVICE(USB_VID_PINNACLE,  USB_PID_PINNACLE_PCTV282E) },
@@ -2406,7 +2458,7 @@ struct dvb_usb_device_properties dib0700_devices[] = {
                                .pid_filter_count = 32,
                                .pid_filter       = stk70x0p_pid_filter,
                                .pid_filter_ctrl  = stk70x0p_pid_filter_ctrl,
-                                .frontend_attach  = stk7070p_frontend_attach,
+                                .frontend_attach  = stk7770p_frontend_attach,
                                .tuner_attach     = dib7770p_tuner_attach,
                                DIB0700_DEFAULT_STREAMING_CONFIG(0x02),
diff --git a/drivers/media/dvb/dvb-usb/opera1.c b/drivers/media/dvb/dvb-usb/opera1.c
index 6b22ec64ab0c..f896337b4535 100644
--- a/drivers/media/dvb/dvb-usb/opera1.c
+++ b/drivers/media/dvb/dvb-usb/opera1.c
@@ -483,9 +483,7 @@ static int opera1_xilinx_load_firmware(struct usb_device *dev,
                }
        }
        kfree(p);
-        if (fw) {
+        release_firmware(fw);
-                release_firmware(fw);
-        }
        return ret;
 }
diff --git a/drivers/media/dvb/frontends/dib7000p.c b/drivers/media/dvb/frontends/dib7000p.c
index 2e28b973dfd3..3aed0d433921 100644
--- a/drivers/media/dvb/frontends/dib7000p.c
+++ b/drivers/media/dvb/frontends/dib7000p.c
@@ -260,6 +260,9 @@ static void dib7000p_set_adc_state(struct dib7000p_state *state, enum dibx000_ad
 //      dprintk( "908: %x, 909: %x\n", reg_908, reg_909);
+        reg_909 |= (state->cfg.disable_sample_and_hold & 1) << 4;
+        reg_908 |= (state->cfg.enable_current_mirror & 1) << 7;
        dib7000p_write_word(state, 908, reg_908);
        dib7000p_write_word(state, 909, reg_909);
 }
@@ -778,7 +781,10 @@ static void dib7000p_set_channel(struct dib7000p_state *state, struct dvb_fronte
                default:
                case GUARD_INTERVAL_1_32: value *= 1; break;
        }
-        state->div_sync_wait = (value * 3) / 2 + 32; // add 50% SFN margin + compensate for one DVSY-fifo TODO
+        if (state->cfg.diversity_delay == 0)
+                state->div_sync_wait = (value * 3) / 2 + 48; // add 50% SFN margin + compensate for one DVSY-fifo
+        else
+                state->div_sync_wait = (value * 3) / 2 + state->cfg.diversity_delay; // add 50% SFN margin + compensate for one DVSY-fifo
        /* deactive the possibility of diversity reception if extended interleaver */
        state->div_force_off = !1 && ch->u.ofdm.transmission_mode != TRANSMISSION_MODE_8K;
diff --git a/drivers/media/dvb/frontends/dib7000p.h b/drivers/media/dvb/frontends/dib7000p.h
index 805dd13a97ee..da17345bf5bd 100644
--- a/drivers/media/dvb/frontends/dib7000p.h
+++ b/drivers/media/dvb/frontends/dib7000p.h
@@ -33,6 +33,11 @@ struct dib7000p_config {
        int (*agc_control) (struct dvb_frontend *, u8 before);
        u8 output_mode;
+        u8 disable_sample_and_hold : 1;
+        u8 enable_current_mirror : 1;
+        u8 diversity_delay;
 };
 #define DEFAULT_DIB7000P_I2C_ADDRESS 18
diff --git a/drivers/media/dvb/siano/smscoreapi.c b/drivers/media/dvb/siano/smscoreapi.c
index d93468cd3a85..ff3b0fa901b3 100644
--- a/drivers/media/dvb/siano/smscoreapi.c
+++ b/drivers/media/dvb/siano/smscoreapi.c
@@ -1098,33 +1098,26 @@ EXPORT_SYMBOL_GPL(smscore_onresponse);
 *
 * @return pointer to descriptor on success, NULL on error.
 */
-struct smscore_buffer_t *smscore_getbuffer(struct smscore_device_t *coredev)
+struct smscore_buffer_t *get_entry(struct smscore_device_t *coredev)
 {
        struct smscore_buffer_t *cb = NULL;
        unsigned long flags;
-        DEFINE_WAIT(wait);
        spin_lock_irqsave(&coredev->bufferslock, flags);
+        if (!list_empty(&coredev->buffers)) {
-        /* This function must return a valid buffer, since the buffer list is
+                cb = (struct smscore_buffer_t *) coredev->buffers.next;
-         * finite, we check that there is an available buffer, if not, we wait
+                list_del(&cb->entry);
-         * until such buffer become available.
-         */
-        prepare_to_wait(&coredev->buffer_mng_waitq, &wait, TASK_INTERRUPTIBLE);
-        if (list_empty(&coredev->buffers)) {
-                spin_unlock_irqrestore(&coredev->bufferslock, flags);
-                schedule();
-                spin_lock_irqsave(&coredev->bufferslock, flags);
        }
+        spin_unlock_irqrestore(&coredev->bufferslock, flags);
+        return cb;
+}
-        finish_wait(&coredev->buffer_mng_waitq, &wait);
+struct smscore_buffer_t *smscore_getbuffer(struct smscore_device_t *coredev)
+{
-        cb = (struct smscore_buffer_t *) coredev->buffers.next;
+        struct smscore_buffer_t *cb = NULL;
-        list_del(&cb->entry);
-        spin_unlock_irqrestore(&coredev->bufferslock, flags);
+        wait_event(coredev->buffer_mng_waitq, (cb = get_entry(coredev)));
        return cb;
 }
diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c
index 67a4ec8768a6..4ce541a5eb47 100644
--- a/drivers/media/radio/si470x/radio-si470x-i2c.c
+++ b/drivers/media/radio/si470x/radio-si470x-i2c.c
@@ -395,7 +395,7 @@ static int __devinit si470x_i2c_probe(struct i2c_client *client,
        radio->registers[POWERCFG] = POWERCFG_ENABLE;
        if (si470x_set_register(radio, POWERCFG) < 0) {
                retval = -EIO;
-                goto err_all;
+                goto err_video;
        }
        msleep(110);
diff --git a/drivers/media/video/cx231xx/Makefile b/drivers/media/video/cx231xx/Makefile
index 755dd0ce65ff..6f2b57384488 100644
--- a/drivers/media/video/cx231xx/Makefile
+++ b/drivers/media/video/cx231xx/Makefile
@@ -11,4 +11,5 @@ EXTRA_CFLAGS += -Idrivers/media/video
 EXTRA_CFLAGS += -Idrivers/media/common/tuners
 EXTRA_CFLAGS += -Idrivers/media/dvb/dvb-core
 EXTRA_CFLAGS += -Idrivers/media/dvb/frontends
+EXTRA_CFLAGS += -Idrivers/media/dvb/dvb-usb
diff --git a/drivers/media/video/cx231xx/cx231xx-cards.c b/drivers/media/video/cx231xx/cx231xx-cards.c
index 6bdc0ef18119..f2a4900014bc 100644
--- a/drivers/media/video/cx231xx/cx231xx-cards.c
+++ b/drivers/media/video/cx231xx/cx231xx-cards.c
@@ -32,6 +32,7 @@
 #include <media/v4l2-chip-ident.h>
 #include <media/cx25840.h>
+#include "dvb-usb-ids.h"
 #include "xc5000.h"
 #include "cx231xx.h"
@@ -175,6 +176,8 @@ struct usb_device_id cx231xx_id_table[] = {
         .driver_info = CX231XX_BOARD_CNXT_RDE_250},
        {USB_DEVICE(0x0572, 0x58A1),
         .driver_info = CX231XX_BOARD_CNXT_RDU_250},
+        {USB_DEVICE_VER(USB_VID_PIXELVIEW, USB_PID_PIXELVIEW_SBTVD, 0x4000,0x4fff),
+         .driver_info = CX231XX_BOARD_UNKNOWN},
        {},
 };
@@ -226,14 +229,16 @@ void cx231xx_pre_card_setup(struct cx231xx *dev)
                     dev->board.name, dev->model);
        /* set the direction for GPIO pins */
-        cx231xx_set_gpio_direction(dev, dev->board.tuner_gpio->bit, 1);
+        if (dev->board.tuner_gpio) {
-        cx231xx_set_gpio_value(dev, dev->board.tuner_gpio->bit, 1);
+                cx231xx_set_gpio_direction(dev, dev->board.tuner_gpio->bit, 1);
-        cx231xx_set_gpio_direction(dev, dev->board.tuner_sif_gpio, 1);
+                cx231xx_set_gpio_value(dev, dev->board.tuner_gpio->bit, 1);
+                cx231xx_set_gpio_direction(dev, dev->board.tuner_sif_gpio, 1);
-        /* request some modules if any required */
+                /* request some modules if any required */
-        /* reset the Tuner */
+                /* reset the Tuner */
-        cx231xx_gpio_set(dev, dev->board.tuner_gpio);
+                cx231xx_gpio_set(dev, dev->board.tuner_gpio);
+        }
        /* set the mode to Analog mode initially */
        cx231xx_set_mode(dev, CX231XX_ANALOG_MODE);
diff --git a/drivers/media/video/cx25840/cx25840-core.c b/drivers/media/video/cx25840/cx25840-core.c
index 86ca8c2359dd..f5a3e74c3c7c 100644
--- a/drivers/media/video/cx25840/cx25840-core.c
+++ b/drivers/media/video/cx25840/cx25840-core.c
@@ -1996,7 +1996,7 @@ static int cx25840_probe(struct i2c_client *client,
                state->volume = v4l2_ctrl_new_std(&state->hdl,
                        &cx25840_audio_ctrl_ops, V4L2_CID_AUDIO_VOLUME,
-                        0, 65335, 65535 / 100, default_volume);
+                        0, 65535, 65535 / 100, default_volume);
                state->mute = v4l2_ctrl_new_std(&state->hdl,
                        &cx25840_audio_ctrl_ops, V4L2_CID_AUDIO_MUTE,
                        0, 1, 1, 0);
diff --git a/drivers/media/video/cx88/Kconfig b/drivers/media/video/cx88/Kconfig
index 99dbae117591..0fa85cbefbb1 100644
--- a/drivers/media/video/cx88/Kconfig
+++ b/drivers/media/video/cx88/Kconfig
@@ -17,7 +17,7 @@ config VIDEO_CX88
 config VIDEO_CX88_ALSA
        tristate "Conexant 2388x DMA audio support"
-        depends on VIDEO_CX88 && SND && EXPERIMENTAL
+        depends on VIDEO_CX88 && SND
        select SND_PCM
        ---help---
          This is a video4linux driver for direct (DMA) audio on
diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c
index b9846106913e..78abc1c1f9d5 100644
--- a/drivers/media/video/gspca/gspca.c
+++ b/drivers/media/video/gspca/gspca.c
@@ -223,6 +223,7 @@ static int alloc_and_submit_int_urb(struct gspca_dev *gspca_dev,
                usb_rcvintpipe(dev, ep->bEndpointAddress),
                buffer, buffer_len,
                int_irq, (void *)gspca_dev, interval);
+        urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
        gspca_dev->int_urb = urb;
        ret = usb_submit_urb(urb, GFP_KERNEL);
        if (ret < 0) {
diff --git a/drivers/media/video/gspca/sn9c20x.c b/drivers/media/video/gspca/sn9c20x.c
index 83a718f0f3f9..9052d5702556 100644
--- a/drivers/media/video/gspca/sn9c20x.c
+++ b/drivers/media/video/gspca/sn9c20x.c
@@ -2357,8 +2357,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
                            (data[33] << 10);
                avg_lum >>= 9;
                atomic_set(&sd->avg_lum, avg_lum);
-                gspca_frame_add(gspca_dev, LAST_PACKET,
+                gspca_frame_add(gspca_dev, LAST_PACKET, NULL, 0);
-                                data, len);
                return;
        }
        if (gspca_dev->last_packet_type == LAST_PACKET) {
diff --git a/drivers/media/video/ivtv/ivtvfb.c b/drivers/media/video/ivtv/ivtvfb.c
index be03a712731c..f0316d02f09f 100644
--- a/drivers/media/video/ivtv/ivtvfb.c
+++ b/drivers/media/video/ivtv/ivtvfb.c
@@ -466,6 +466,8 @@ static int ivtvfb_ioctl(struct fb_info *info, unsigned int cmd, unsigned long ar
                        struct fb_vblank vblank;
                        u32 trace;
+                        memset(&vblank, 0, sizeof(struct fb_vblank));
                        vblank.flags = FB_VBLANK_HAVE_COUNT |FB_VBLANK_HAVE_VCOUNT |
                                        FB_VBLANK_HAVE_VSYNC;
                        trace = read_reg(IVTV_REG_DEC_LINE_FIELD) >> 16;
diff --git a/drivers/media/video/mem2mem_testdev.c b/drivers/media/video/mem2mem_testdev.c
index 4525335f9bd4..a7210d981388 100644
--- a/drivers/media/video/mem2mem_testdev.c
+++ b/drivers/media/video/mem2mem_testdev.c
@@ -239,7 +239,7 @@ static int device_process(struct m2mtest_ctx *ctx,
                return -EFAULT;
        }
-        if (in_buf->vb.size < out_buf->vb.size) {
+        if (in_buf->vb.size > out_buf->vb.size) {
                v4l2_err(&dev->v4l2_dev, "Output buffer is too small\n");
                return -EINVAL;
        }
@@ -1014,6 +1014,7 @@ static int m2mtest_remove(struct platform_device *pdev)
        v4l2_m2m_release(dev->m2m_dev);
        del_timer_sync(&dev->timer);
        video_unregister_device(dev->vfd);
+        video_device_release(dev->vfd);
        v4l2_device_unregister(&dev->v4l2_dev);
        kfree(dev);
diff --git a/drivers/media/video/mt9m111.c b/drivers/media/video/mt9m111.c
index 758a4db27d65..c71af4e0e517 100644
--- a/drivers/media/video/mt9m111.c
+++ b/drivers/media/video/mt9m111.c
@@ -447,6 +447,9 @@ static int mt9m111_s_crop(struct v4l2_subdev *sd, struct v4l2_crop *a)
        dev_dbg(&client->dev, "%s left=%d, top=%d, width=%d, height=%d\n",
                __func__, rect.left, rect.top, rect.width, rect.height);
+        if (a->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                return -EINVAL;
        ret = mt9m111_make_rect(client, &rect);
        if (!ret)
                mt9m111->rect = rect;
@@ -466,12 +469,14 @@ static int mt9m111_g_crop(struct v4l2_subdev *sd, struct v4l2_crop *a)
 static int mt9m111_cropcap(struct v4l2_subdev *sd, struct v4l2_cropcap *a)
 {
+        if (a->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                return -EINVAL;
        a->bounds.left                  = MT9M111_MIN_DARK_COLS;
        a->bounds.top                   = MT9M111_MIN_DARK_ROWS;
        a->bounds.width                 = MT9M111_MAX_WIDTH;
        a->bounds.height                = MT9M111_MAX_HEIGHT;
        a->defrect                      = a->bounds;
-        a->type                         = V4L2_BUF_TYPE_VIDEO_CAPTURE;
        a->pixelaspect.numerator        = 1;
        a->pixelaspect.denominator      = 1;
@@ -487,6 +492,7 @@ static int mt9m111_g_fmt(struct v4l2_subdev *sd,
        mf->width       = mt9m111->rect.width;
        mf->height      = mt9m111->rect.height;
        mf->code        = mt9m111->fmt->code;
+        mf->colorspace  = mt9m111->fmt->colorspace;
        mf->field       = V4L2_FIELD_NONE;
        return 0;
diff --git a/drivers/media/video/mt9v022.c b/drivers/media/video/mt9v022.c
index e7cd23cd6394..b48473c7896b 100644
--- a/drivers/media/video/mt9v022.c
+++ b/drivers/media/video/mt9v022.c
@@ -402,9 +402,6 @@ static int mt9v022_s_fmt(struct v4l2_subdev *sd,
                if (mt9v022->model != V4L2_IDENT_MT9V022IX7ATC)
                        return -EINVAL;
                break;
-        case 0:
-                /* No format change, only geometry */
-                break;
        default:
                return -EINVAL;
        }
diff --git a/drivers/media/video/mx2_camera.c b/drivers/media/video/mx2_camera.c
index 66ff174151b5..b6ea67221d1d 100644
--- a/drivers/media/video/mx2_camera.c
+++ b/drivers/media/video/mx2_camera.c
@@ -378,6 +378,9 @@ static void mx25_camera_frame_done(struct mx2_camera_dev *pcdev, int fb,
        spin_lock_irqsave(&pcdev->lock, flags);
+        if (*fb_active == NULL)
+                goto out;
        vb = &(*fb_active)->vb;
        dev_dbg(pcdev->dev, "%s (vb=0x%p) 0x%08lx %d\n", __func__,
                vb, vb->baddr, vb->bsize);
@@ -402,6 +405,7 @@ static void mx25_camera_frame_done(struct mx2_camera_dev *pcdev, int fb,
        *fb_active = buf;
+out:
        spin_unlock_irqrestore(&pcdev->lock, flags);
 }
diff --git a/drivers/media/video/pvrusb2/pvrusb2-ctrl.c b/drivers/media/video/pvrusb2/pvrusb2-ctrl.c
index 1b992b847198..55ea914c7fcd 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-ctrl.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-ctrl.c
@@ -513,7 +513,7 @@ int pvr2_ctrl_sym_to_value(struct pvr2_ctrl *cptr,
                        if (ret >= 0) {
                                ret = pvr2_ctrl_range_check(cptr,*valptr);
                        }
-                        if (maskptr) *maskptr = ~0;
+                        *maskptr = ~0;
                } else if (cptr->info->type == pvr2_ctl_bool) {
                        ret = parse_token(ptr,len,valptr,boolNames,
                                          ARRAY_SIZE(boolNames));
@@ -522,7 +522,7 @@ int pvr2_ctrl_sym_to_value(struct pvr2_ctrl *cptr,
                        } else if (ret == 0) {
                                *valptr = (*valptr & 1) ? !0 : 0;
                        }
-                        if (maskptr) *maskptr = 1;
+                        *maskptr = 1;
                } else if (cptr->info->type == pvr2_ctl_enum) {
                        ret = parse_token(
                                ptr,len,valptr,
@@ -531,7 +531,7 @@ int pvr2_ctrl_sym_to_value(struct pvr2_ctrl *cptr,
                        if (ret >= 0) {
                                ret = pvr2_ctrl_range_check(cptr,*valptr);
                        }
-                        if (maskptr) *maskptr = ~0;
+                        *maskptr = ~0;
                } else if (cptr->info->type == pvr2_ctl_bitmask) {
                        ret = parse_tlist(
                                ptr,len,maskptr,valptr,
diff --git a/drivers/media/video/s5p-fimc/fimc-core.c b/drivers/media/video/s5p-fimc/fimc-core.c
index b151c7be8a50..6961c55baf9b 100644
--- a/drivers/media/video/s5p-fimc/fimc-core.c
+++ b/drivers/media/video/s5p-fimc/fimc-core.c
@@ -393,6 +393,37 @@ static void fimc_set_yuv_order(struct fimc_ctx *ctx)
        dbg("ctx->out_order_1p= %d", ctx->out_order_1p);
 }
+static void fimc_prepare_dma_offset(struct fimc_ctx *ctx, struct fimc_frame *f)
+{
+        struct samsung_fimc_variant *variant = ctx->fimc_dev->variant;
+        f->dma_offset.y_h = f->offs_h;
+        if (!variant->pix_hoff)
+                f->dma_offset.y_h *= (f->fmt->depth >> 3);
+        f->dma_offset.y_v = f->offs_v;
+        f->dma_offset.cb_h = f->offs_h;
+        f->dma_offset.cb_v = f->offs_v;
+        f->dma_offset.cr_h = f->offs_h;
+        f->dma_offset.cr_v = f->offs_v;
+        if (!variant->pix_hoff) {
+                if (f->fmt->planes_cnt == 3) {
+                        f->dma_offset.cb_h >>= 1;
+                        f->dma_offset.cr_h >>= 1;
+                }
+                if (f->fmt->color == S5P_FIMC_YCBCR420) {
+                        f->dma_offset.cb_v >>= 1;
+                        f->dma_offset.cr_v >>= 1;
+                }
+        }
+        dbg("in_offset: color= %d, y_h= %d, y_v= %d",
+            f->fmt->color, f->dma_offset.y_h, f->dma_offset.y_v);
+}
 /**
 * fimc_prepare_config - check dimensions, operation and color mode
 *                       and pre-calculate offset and the scaling coefficients.
@@ -406,7 +437,6 @@ static int fimc_prepare_config(struct fimc_ctx *ctx, u32 flags)
 {
        struct fimc_frame *s_frame, *d_frame;
        struct fimc_vid_buffer *buf = NULL;
-        struct samsung_fimc_variant *variant = ctx->fimc_dev->variant;
        int ret = 0;
        s_frame = &ctx->s_frame;
@@ -419,61 +449,16 @@ static int fimc_prepare_config(struct fimc_ctx *ctx, u32 flags)
                        swap(d_frame->width, d_frame->height);
                }
-                /* Prepare the output offset ratios for scaler. */
+                /* Prepare the DMA offset ratios for scaler. */
-                d_frame->dma_offset.y_h = d_frame->offs_h;
+                fimc_prepare_dma_offset(ctx, &ctx->s_frame);
-                if (!variant->pix_hoff)
+                fimc_prepare_dma_offset(ctx, &ctx->d_frame);
-                        d_frame->dma_offset.y_h *= (d_frame->fmt->depth >> 3);
-                d_frame->dma_offset.y_v = d_frame->offs_v;
-                d_frame->dma_offset.cb_h = d_frame->offs_h;
-                d_frame->dma_offset.cb_v = d_frame->offs_v;
-                d_frame->dma_offset.cr_h = d_frame->offs_h;
-                d_frame->dma_offset.cr_v = d_frame->offs_v;
-                if (!variant->pix_hoff && d_frame->fmt->planes_cnt == 3) {
-                        d_frame->dma_offset.cb_h >>= 1;
-                        d_frame->dma_offset.cb_v >>= 1;
-                        d_frame->dma_offset.cr_h >>= 1;
-                        d_frame->dma_offset.cr_v >>= 1;
-                }
-                dbg("out offset: color= %d, y_h= %d, y_v= %d",
-                        d_frame->fmt->color,
-                        d_frame->dma_offset.y_h, d_frame->dma_offset.y_v);
-                /* Prepare the input offset ratios for scaler. */
-                s_frame->dma_offset.y_h = s_frame->offs_h;
-                if (!variant->pix_hoff)
-                        s_frame->dma_offset.y_h *= (s_frame->fmt->depth >> 3);
-                s_frame->dma_offset.y_v = s_frame->offs_v;
-                s_frame->dma_offset.cb_h = s_frame->offs_h;
-                s_frame->dma_offset.cb_v = s_frame->offs_v;
-                s_frame->dma_offset.cr_h = s_frame->offs_h;
-                s_frame->dma_offset.cr_v = s_frame->offs_v;
-                if (!variant->pix_hoff && s_frame->fmt->planes_cnt == 3) {
-                        s_frame->dma_offset.cb_h >>= 1;
-                        s_frame->dma_offset.cb_v >>= 1;
-                        s_frame->dma_offset.cr_h >>= 1;
-                        s_frame->dma_offset.cr_v >>= 1;
-                }
-                dbg("in offset: color= %d, y_h= %d, y_v= %d",
-                        s_frame->fmt->color, s_frame->dma_offset.y_h,
-                        s_frame->dma_offset.y_v);
-                fimc_set_yuv_order(ctx);
-                /* Check against the scaler ratio. */
                if (s_frame->height > (SCALER_MAX_VRATIO * d_frame->height) ||
                    s_frame->width > (SCALER_MAX_HRATIO * d_frame->width)) {
                        err("out of scaler range");
                        return -EINVAL;
                }
+                fimc_set_yuv_order(ctx);
        }
        /* Input DMA mode is not allowed when the scaler is disabled. */
@@ -822,7 +807,8 @@ static int fimc_m2m_s_fmt(struct file *file, void *priv, struct v4l2_format *f)
        } else {
                v4l2_err(&ctx->fimc_dev->m2m.v4l2_dev,
                         "Wrong buffer/video queue type (%d)\n", f->type);
-                return -EINVAL;
+                ret = -EINVAL;
+                goto s_fmt_out;
        }
        pix = &f->fmt.pix;
@@ -1414,8 +1400,10 @@ static int fimc_probe(struct platform_device *pdev)
        }
        fimc->work_queue = create_workqueue(dev_name(&fimc->pdev->dev));
-        if (!fimc->work_queue)
+        if (!fimc->work_queue) {
+                ret = -ENOMEM;
                goto err_irq;
+        }
        ret = fimc_register_m2m_device(fimc);
        if (ret)
@@ -1492,6 +1480,7 @@ static struct samsung_fimc_variant fimc2_variant_s5p = {
 };
 static struct samsung_fimc_variant fimc01_variant_s5pv210 = {
+        .pix_hoff       = 1,
        .has_inp_rot    = 1,
        .has_out_rot    = 1,
        .min_inp_pixsize = 16,
@@ -1506,6 +1495,7 @@ static struct samsung_fimc_variant fimc01_variant_s5pv210 = {
 };
 static struct samsung_fimc_variant fimc2_variant_s5pv210 = {
+        .pix_hoff        = 1,
        .min_inp_pixsize = 16,
        .min_out_pixsize = 32,
diff --git a/drivers/media/video/saa7134/saa7134-cards.c b/drivers/media/video/saa7134/saa7134-cards.c
index ec697fcd406e..bb8d83d8ddaf 100644
--- a/drivers/media/video/saa7134/saa7134-cards.c
+++ b/drivers/media/video/saa7134/saa7134-cards.c
@@ -4323,13 +4323,13 @@ struct saa7134_board saa7134_boards[] = {
        },
        [SAA7134_BOARD_BEHOLD_COLUMBUS_TVFM] = {
                /*       Beholder Intl. Ltd. 2008      */
-                /*Dmitry Belimov <d.belimov@gmail.com> */
+                /* Dmitry Belimov <d.belimov@gmail.com> */
-                .name           = "Beholder BeholdTV Columbus TVFM",
+                .name           = "Beholder BeholdTV Columbus TV/FM",
                .audio_clock    = 0x00187de7,
                .tuner_type     = TUNER_ALPS_TSBE5_PAL,
-                .radio_type     = UNSET,
+                .radio_type     = TUNER_TEA5767,
-                .tuner_addr     = ADDR_UNSET,
+                .tuner_addr     = 0xc2 >> 1,
-                .radio_addr     = ADDR_UNSET,
+                .radio_addr     = 0xc0 >> 1,
                .tda9887_conf   = TDA9887_PRESENT,
                .gpiomask       = 0x000A8004,
                .inputs         = {{
diff --git a/drivers/media/video/saa7164/saa7164-buffer.c b/drivers/media/video/saa7164/saa7164-buffer.c
index 5713f3a4b76c..ddd25d32723d 100644
--- a/drivers/media/video/saa7164/saa7164-buffer.c
+++ b/drivers/media/video/saa7164/saa7164-buffer.c
@@ -136,10 +136,11 @@ ret:
 int saa7164_buffer_dealloc(struct saa7164_tsport *port,
        struct saa7164_buffer *buf)
 {
-        struct saa7164_dev *dev = port->dev;
+        struct saa7164_dev *dev;
-        if ((buf == 0) || (port == 0))
+        if (!buf || !port)
                return SAA_ERR_BAD_PARAMETER;
+        dev = port->dev;
        dprintk(DBGLVL_BUF, "%s() deallocating buffer @ 0x%p\n", __func__, buf);
diff --git a/drivers/media/video/uvc/uvc_driver.c b/drivers/media/video/uvc/uvc_driver.c
index 8bdd940f32e6..2ac85d8984f0 100644
--- a/drivers/media/video/uvc/uvc_driver.c
+++ b/drivers/media/video/uvc/uvc_driver.c
@@ -486,6 +486,12 @@ static int uvc_parse_format(struct uvc_device *dev,
                            max(frame->dwFrameInterval[0],
                                frame->dwDefaultFrameInterval));
+                if (dev->quirks & UVC_QUIRK_RESTRICT_FRAME_RATE) {
+                        frame->bFrameIntervalType = 1;
+                        frame->dwFrameInterval[0] =
+                                frame->dwDefaultFrameInterval;
+                }
                uvc_trace(UVC_TRACE_DESCR, "- %ux%u (%u.%u fps)\n",
                        frame->wWidth, frame->wHeight,
                        10000000/frame->dwDefaultFrameInterval,
@@ -2026,6 +2032,15 @@ static struct usb_device_id uvc_ids[] = {
          .bInterfaceClass      = USB_CLASS_VENDOR_SPEC,
          .bInterfaceSubClass   = 1,
          .bInterfaceProtocol   = 0 },
+        /* Chicony CNF7129 (Asus EEE 100HE) */
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+                                | USB_DEVICE_ID_MATCH_INT_INFO,
+          .idVendor             = 0x04f2,
+          .idProduct            = 0xb071,
+          .bInterfaceClass      = USB_CLASS_VIDEO,
+          .bInterfaceSubClass   = 1,
+          .bInterfaceProtocol   = 0,
+          .driver_info          = UVC_QUIRK_RESTRICT_FRAME_RATE },
        /* Alcor Micro AU3820 (Future Boy PC USB Webcam) */
        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
                                | USB_DEVICE_ID_MATCH_INT_INFO,
@@ -2091,6 +2106,15 @@ static struct usb_device_id uvc_ids[] = {
          .bInterfaceProtocol   = 0,
          .driver_info          = UVC_QUIRK_PROBE_MINMAX
                                | UVC_QUIRK_PROBE_DEF },
+        /* IMC Networks (Medion Akoya) */
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+                                | USB_DEVICE_ID_MATCH_INT_INFO,
+          .idVendor             = 0x13d3,
+          .idProduct            = 0x5103,
+          .bInterfaceClass      = USB_CLASS_VIDEO,
+          .bInterfaceSubClass   = 1,
+          .bInterfaceProtocol   = 0,
+          .driver_info          = UVC_QUIRK_STREAM_NO_FID },
        /* Syntek (HP Spartan) */
        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
                                | USB_DEVICE_ID_MATCH_INT_INFO,
diff --git a/drivers/media/video/uvc/uvcvideo.h b/drivers/media/video/uvc/uvcvideo.h
index bdacf3beabf5..892e0e51916c 100644
--- a/drivers/media/video/uvc/uvcvideo.h
+++ b/drivers/media/video/uvc/uvcvideo.h
@@ -182,6 +182,7 @@ struct uvc_xu_control {
 #define UVC_QUIRK_IGNORE_SELECTOR_UNIT  0x00000020
 #define UVC_QUIRK_FIX_BANDWIDTH         0x00000080
 #define UVC_QUIRK_PROBE_DEF             0x00000100
+#define UVC_QUIRK_RESTRICT_FRAME_RATE   0x00000200
 /* Format flags */
 #define UVC_FMT_FLAG_COMPRESSED         0x00000001
diff --git a/drivers/media/video/videobuf-dma-contig.c b/drivers/media/video/videobuf-dma-contig.c
index 372b87efcd05..6ff9e4bac3ea 100644
--- a/drivers/media/video/videobuf-dma-contig.c
+++ b/drivers/media/video/videobuf-dma-contig.c
@@ -393,8 +393,10 @@ void videobuf_dma_contig_free(struct videobuf_queue *q,
        }
        /* read() method */
-        dma_free_coherent(q->dev, mem->size, mem->vaddr, mem->dma_handle);
+        if (mem->vaddr) {
-        mem->vaddr = NULL;
+                dma_free_coherent(q->dev, mem->size, mem->vaddr, mem->dma_handle);
+                mem->vaddr = NULL;
+        }
 }
 EXPORT_SYMBOL_GPL(videobuf_dma_contig_free);
diff --git a/drivers/media/video/videobuf-dma-sg.c b/drivers/media/video/videobuf-dma-sg.c
index 06f9a9c2a39a..2ad0bc252b0e 100644
--- a/drivers/media/video/videobuf-dma-sg.c
+++ b/drivers/media/video/videobuf-dma-sg.c
@@ -94,7 +94,7 @@ err:
 * must free the memory.
 */
 static struct scatterlist *videobuf_pages_to_sg(struct page **pages,
-                                                int nr_pages, int offset)
+                                        int nr_pages, int offset, size_t size)
 {
        struct scatterlist *sglist;
        int i;
@@ -110,12 +110,14 @@ static struct scatterlist *videobuf_pages_to_sg(struct page **pages,
                /* DMA to highmem pages might not work */
                goto highmem;
        sg_set_page(&sglist[0], pages[0], PAGE_SIZE - offset, offset);
+        size -= PAGE_SIZE - offset;
        for (i = 1; i < nr_pages; i++) {
                if (NULL == pages[i])
                        goto nopage;
                if (PageHighMem(pages[i]))
                        goto highmem;
-                sg_set_page(&sglist[i], pages[i], PAGE_SIZE, 0);
+                sg_set_page(&sglist[i], pages[i], min(PAGE_SIZE, size), 0);
+                size -= min(PAGE_SIZE, size);
        }
        return sglist;
@@ -170,7 +172,8 @@ static int videobuf_dma_init_user_locked(struct videobuf_dmabuf *dma,
        first = (data          & PAGE_MASK) >> PAGE_SHIFT;
        last  = ((data+size-1) & PAGE_MASK) >> PAGE_SHIFT;
-        dma->offset   = data & ~PAGE_MASK;
+        dma->offset = data & ~PAGE_MASK;
+        dma->size = size;
        dma->nr_pages = last-first+1;
        dma->pages = kmalloc(dma->nr_pages * sizeof(struct page *), GFP_KERNEL);
        if (NULL == dma->pages)
@@ -252,7 +255,7 @@ int videobuf_dma_map(struct device *dev, struct videobuf_dmabuf *dma)
        if (dma->pages) {
                dma->sglist = videobuf_pages_to_sg(dma->pages, dma->nr_pages,
-                                                   dma->offset);
+                                                   dma->offset, dma->size);
        }
        if (dma->vaddr) {
                dma->sglist = videobuf_vmalloc_to_sg(dma->vaddr,
diff --git a/drivers/mfd/max8925-core.c b/drivers/mfd/max8925-core.c
index 04028a9ee082..428377a5a6f5 100644
--- a/drivers/mfd/max8925-core.c
+++ b/drivers/mfd/max8925-core.c
@@ -429,24 +429,25 @@ static void max8925_irq_sync_unlock(unsigned int irq)
        irq_tsc = cache_tsc;
        for (i = 0; i < ARRAY_SIZE(max8925_irqs); i++) {
                irq_data = &max8925_irqs[i];
+                /* 1 -- disable, 0 -- enable */
                switch (irq_data->mask_reg) {
                case MAX8925_CHG_IRQ1_MASK:
-                        irq_chg[0] &= irq_data->enable;
+                        irq_chg[0] &= ~irq_data->enable;
                        break;
                case MAX8925_CHG_IRQ2_MASK:
-                        irq_chg[1] &= irq_data->enable;
+                        irq_chg[1] &= ~irq_data->enable;
                        break;
                case MAX8925_ON_OFF_IRQ1_MASK:
-                        irq_on[0] &= irq_data->enable;
+                        irq_on[0] &= ~irq_data->enable;
                        break;
                case MAX8925_ON_OFF_IRQ2_MASK:
-                        irq_on[1] &= irq_data->enable;
+                        irq_on[1] &= ~irq_data->enable;
                        break;
                case MAX8925_RTC_IRQ_MASK:
-                        irq_rtc &= irq_data->enable;
+                        irq_rtc &= ~irq_data->enable;
                        break;
                case MAX8925_TSC_IRQ_MASK:
-                        irq_tsc &= irq_data->enable;
+                        irq_tsc &= ~irq_data->enable;
                        break;
                default:
                        dev_err(chip->dev, "wrong IRQ\n");
diff --git a/drivers/mfd/wm831x-irq.c b/drivers/mfd/wm831x-irq.c
index 7dabe4dbd373..294183b6260b 100644
--- a/drivers/mfd/wm831x-irq.c
+++ b/drivers/mfd/wm831x-irq.c
@@ -394,8 +394,13 @@ static int wm831x_irq_set_type(unsigned int irq, unsigned int type)
        irq = irq - wm831x->irq_base;
-        if (irq < WM831X_IRQ_GPIO_1 || irq > WM831X_IRQ_GPIO_11)
+        if (irq < WM831X_IRQ_GPIO_1 || irq > WM831X_IRQ_GPIO_11) {
-                return -EINVAL;
+                /* Ignore internal-only IRQs */
+                if (irq >= 0 && irq < WM831X_NUM_IRQS)
+                        return 0;
+                else
+                        return -EINVAL;
+        }
        switch (type) {
        case IRQ_TYPE_EDGE_BOTH:
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 0b591b658243..b74331260744 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -368,7 +368,7 @@ config VMWARE_BALLOON
          If unsure, say N.
          To compile this driver as a module, choose M here: the
-          module will be called vmware_balloon.
+          module will be called vmw_balloon.
 config ARM_CHARLCD
        bool "ARM Ltd. Character LCD Driver"
diff --git a/drivers/misc/Makefile b/drivers/misc/Makefile
index 255a80dc9d73..42eab95cde2a 100644
--- a/drivers/misc/Makefile
+++ b/drivers/misc/Makefile
@@ -33,5 +33,5 @@ obj-$(CONFIG_IWMC3200TOP)      += iwmc3200top/
 obj-$(CONFIG_HMC6352)           += hmc6352.o
 obj-y                           += eeprom/
 obj-y                           += cb710/
-obj-$(CONFIG_VMWARE_BALLOON)    += vmware_balloon.o
+obj-$(CONFIG_VMWARE_BALLOON)    += vmw_balloon.o
 obj-$(CONFIG_ARM_CHARLCD)       += arm-charlcd.o
diff --git a/drivers/misc/bh1780gli.c b/drivers/misc/bh1780gli.c
index 714c6b487313..d5f3a3fd2319 100644
--- a/drivers/misc/bh1780gli.c
+++ b/drivers/misc/bh1780gli.c
@@ -190,7 +190,6 @@ static int __devexit bh1780_remove(struct i2c_client *client)
        ddata = i2c_get_clientdata(client);
        sysfs_remove_group(&client->dev.kobj, &bh1780_attr_group);
-        i2c_set_clientdata(client, NULL);
        kfree(ddata);
        return 0;
diff --git a/drivers/misc/vmware_balloon.c b/drivers/misc/vmw_balloon.c
index 2a1e804a71aa..2a1e804a71aa 100644
--- a/drivers/misc/vmware_balloon.c
+++ b/drivers/misc/vmw_balloon.c
diff --git a/drivers/mmc/host/sdhci-s3c.c b/drivers/mmc/host/sdhci-s3c.c
index 71ad4163b95e..aacb862ecc8a 100644
--- a/drivers/mmc/host/sdhci-s3c.c
+++ b/drivers/mmc/host/sdhci-s3c.c
@@ -241,8 +241,10 @@ static struct sdhci_ops sdhci_s3c_ops = {
 static void sdhci_s3c_notify_change(struct platform_device *dev, int state)
 {
        struct sdhci_host *host = platform_get_drvdata(dev);
+        unsigned long flags;
        if (host) {
-                spin_lock(&host->lock);
+                spin_lock_irqsave(&host->lock, flags);
                if (state) {
                        dev_dbg(&dev->dev, "card inserted.\n");
                        host->flags &= ~SDHCI_DEVICE_DEAD;
@@ -253,7 +255,7 @@ static void sdhci_s3c_notify_change(struct platform_device *dev, int state)
                        host->quirks &= ~SDHCI_QUIRK_BROKEN_CARD_DETECTION;
                }
                tasklet_schedule(&host->card_tasklet);
-                spin_unlock(&host->lock);
+                spin_unlock_irqrestore(&host->lock, flags);
        }
 }
@@ -481,8 +483,10 @@ static int __devexit sdhci_s3c_remove(struct platform_device *pdev)
        sdhci_remove_host(host, 1);
        for (ptr = 0; ptr < 3; ptr++) {
-                clk_disable(sc->clk_bus[ptr]);
+                if (sc->clk_bus[ptr]) {
-                clk_put(sc->clk_bus[ptr]);
+                        clk_disable(sc->clk_bus[ptr]);
+                        clk_put(sc->clk_bus[ptr]);
+                }
        }
        clk_disable(sc->clk_io);
        clk_put(sc->clk_io);
diff --git a/drivers/mtd/nand/omap2.c b/drivers/mtd/nand/omap2.c
index 133d51528f8d..513e0a76a4a7 100644
--- a/drivers/mtd/nand/omap2.c
+++ b/drivers/mtd/nand/omap2.c
@@ -413,7 +413,7 @@ static inline int omap_nand_dma_transfer(struct mtd_info *mtd, void *addr,
                prefetch_status = gpmc_read_status(GPMC_PREFETCH_COUNT);
        } while (prefetch_status);
        /* disable and stop the PFPW engine */
-        gpmc_prefetch_reset();
+        gpmc_prefetch_reset(info->gpmc_cs);
        dma_unmap_single(&info->pdev->dev, dma_addr, len, dir);
        return 0;
diff --git a/drivers/net/3c59x.c b/drivers/net/3c59x.c
index fa42103b2874..179871d9e71f 100644
--- a/drivers/net/3c59x.c
+++ b/drivers/net/3c59x.c
@@ -2942,6 +2942,9 @@ static void vortex_get_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
 {
        struct vortex_private *vp = netdev_priv(dev);
+        if (!VORTEX_PCI(vp))
+                return;
        wol->supported = WAKE_MAGIC;
        wol->wolopts = 0;
@@ -2952,6 +2955,10 @@ static void vortex_get_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
 static int vortex_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
 {
        struct vortex_private *vp = netdev_priv(dev);
+        if (!VORTEX_PCI(vp))
+                return -EOPNOTSUPP;
        if (wol->wolopts & ~WAKE_MAGIC)
                return -EINVAL;
@@ -3201,6 +3208,9 @@ static void acpi_set_WOL(struct net_device *dev)
                        return;
                }
+                if (VORTEX_PCI(vp)->current_state < PCI_D3hot)
+                        return;
                /* Change the power state to D3; RxEnable doesn't take effect. */
                pci_set_power_state(VORTEX_PCI(vp), PCI_D3hot);
        }
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 2cc81a54cbf3..5db667c0b371 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -2428,7 +2428,7 @@ config UGETH_TX_ON_DEMAND
 config MV643XX_ETH
        tristate "Marvell Discovery (643XX) and Orion ethernet support"
-        depends on MV64X60 || PPC32 || PLAT_ORION
+        depends on (MV64X60 || PPC32 || PLAT_ORION) && INET
        select INET_LRO
        select PHYLIB
        help
@@ -2803,7 +2803,7 @@ config NIU
 config PASEMI_MAC
        tristate "PA Semi 1/10Gbit MAC"
-        depends on PPC_PASEMI && PCI
+        depends on PPC_PASEMI && PCI && INET
        select PHYLIB
        select INET_LRO
        help
diff --git a/drivers/net/atlx/atl1.c b/drivers/net/atlx/atl1.c
index 63b9ba0cc67e..c73be2848319 100644
--- a/drivers/net/atlx/atl1.c
+++ b/drivers/net/atlx/atl1.c
@@ -1251,6 +1251,12 @@ static void atl1_free_ring_resources(struct atl1_adapter *adapter)
        rrd_ring->desc = NULL;
        rrd_ring->dma = 0;
+        adapter->cmb.dma = 0;
+        adapter->cmb.cmb = NULL;
+        adapter->smb.dma = 0;
+        adapter->smb.smb = NULL;
 }
 static void atl1_setup_mac_ctrl(struct atl1_adapter *adapter)
@@ -2847,10 +2853,11 @@ static int atl1_resume(struct pci_dev *pdev)
        pci_enable_wake(pdev, PCI_D3cold, 0);
        atl1_reset_hw(&adapter->hw);
-        adapter->cmb.cmb->int_stats = 0;
-        if (netif_running(netdev))
+        if (netif_running(netdev)) {
+                adapter->cmb.cmb->int_stats = 0;
                atl1_up(adapter);
+        }
        netif_device_attach(netdev);
        return 0;
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 3b16f62d5606..e953c6ad6e6d 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -5164,6 +5164,15 @@ int bond_create(struct net *net, const char *name)
                res = dev_alloc_name(bond_dev, "bond%d");
                if (res < 0)
                        goto out;
+        } else {
+                /*
+                 * If we're given a name to register
+                 * we need to ensure that its not already
+                 * registered
+                 */
+                res = -EEXIST;
+                if (__dev_get_by_name(net, name) != NULL)
+                        goto out;
        }
        res = register_netdevice(bond_dev);
diff --git a/drivers/net/e1000e/hw.h b/drivers/net/e1000e/hw.h
index 66ed08f726fb..ba302a5c2c30 100644
--- a/drivers/net/e1000e/hw.h
+++ b/drivers/net/e1000e/hw.h
@@ -57,6 +57,7 @@ enum e1e_registers {
        E1000_SCTL     = 0x00024, /* SerDes Control - RW */
        E1000_FCAL     = 0x00028, /* Flow Control Address Low - RW */
        E1000_FCAH     = 0x0002C, /* Flow Control Address High -RW */
+        E1000_FEXTNVM4 = 0x00024, /* Future Extended NVM 4 - RW */
        E1000_FEXTNVM  = 0x00028, /* Future Extended NVM - RW */
        E1000_FCT      = 0x00030, /* Flow Control Type - RW */
        E1000_VET      = 0x00038, /* VLAN Ether Type - RW */
diff --git a/drivers/net/e1000e/ich8lan.c b/drivers/net/e1000e/ich8lan.c
index 63930d12711c..57b5435599ab 100644
--- a/drivers/net/e1000e/ich8lan.c
+++ b/drivers/net/e1000e/ich8lan.c
@@ -105,6 +105,10 @@
 #define E1000_FEXTNVM_SW_CONFIG         1
 #define E1000_FEXTNVM_SW_CONFIG_ICH8M (1 << 27) /* Bit redefined for ICH8M :/ */
+#define E1000_FEXTNVM4_BEACON_DURATION_MASK    0x7
+#define E1000_FEXTNVM4_BEACON_DURATION_8USEC   0x7
+#define E1000_FEXTNVM4_BEACON_DURATION_16USEC  0x3
 #define PCIE_ICH8_SNOOP_ALL             PCIE_NO_SNOOP_ALL
 #define E1000_ICH_RAR_ENTRIES           7
@@ -125,6 +129,7 @@
 /* SMBus Address Phy Register */
 #define HV_SMB_ADDR            PHY_REG(768, 26)
+#define HV_SMB_ADDR_MASK       0x007F
 #define HV_SMB_ADDR_PEC_EN     0x0200
 #define HV_SMB_ADDR_VALID      0x0080
@@ -237,6 +242,8 @@ static s32  e1000_k1_gig_workaround_hv(struct e1000_hw *hw, bool link);
 static s32 e1000_set_mdio_slow_mode_hv(struct e1000_hw *hw);
 static bool e1000_check_mng_mode_ich8lan(struct e1000_hw *hw);
 static bool e1000_check_mng_mode_pchlan(struct e1000_hw *hw);
+static s32 e1000_k1_workaround_lv(struct e1000_hw *hw);
+static void e1000_gate_hw_phy_config_ich8lan(struct e1000_hw *hw, bool gate);
 static inline u16 __er16flash(struct e1000_hw *hw, unsigned long reg)
 {
@@ -272,7 +279,7 @@ static inline void __ew32flash(struct e1000_hw *hw, unsigned long reg, u32 val)
 static s32 e1000_init_phy_params_pchlan(struct e1000_hw *hw)
 {
        struct e1000_phy_info *phy = &hw->phy;
-        u32 ctrl;
+        u32 ctrl, fwsm;
        s32 ret_val = 0;
        phy->addr                     = 1;
@@ -294,7 +301,8 @@ static s32 e1000_init_phy_params_pchlan(struct e1000_hw *hw)
         * disabled, then toggle the LANPHYPC Value bit to force
         * the interconnect to PCIe mode.
         */
-        if (!(er32(FWSM) & E1000_ICH_FWSM_FW_VALID)) {
+        fwsm = er32(FWSM);
+        if (!(fwsm & E1000_ICH_FWSM_FW_VALID)) {
                ctrl = er32(CTRL);
                ctrl |=  E1000_CTRL_LANPHYPC_OVERRIDE;
                ctrl &= ~E1000_CTRL_LANPHYPC_VALUE;
@@ -303,6 +311,13 @@ static s32 e1000_init_phy_params_pchlan(struct e1000_hw *hw)
                ctrl &= ~E1000_CTRL_LANPHYPC_OVERRIDE;
                ew32(CTRL, ctrl);
                msleep(50);
+                /*
+                 * Gate automatic PHY configuration by hardware on
+                 * non-managed 82579
+                 */
+                if (hw->mac.type == e1000_pch2lan)
+                        e1000_gate_hw_phy_config_ich8lan(hw, true);
        }
        /*
@@ -315,6 +330,13 @@ static s32 e1000_init_phy_params_pchlan(struct e1000_hw *hw)
        if (ret_val)
                goto out;
+        /* Ungate automatic PHY configuration on non-managed 82579 */
+        if ((hw->mac.type == e1000_pch2lan)  &&
+            !(fwsm & E1000_ICH_FWSM_FW_VALID)) {
+                msleep(10);
+                e1000_gate_hw_phy_config_ich8lan(hw, false);
+        }
        phy->id = e1000_phy_unknown;
        ret_val = e1000e_get_phy_id(hw);
        if (ret_val)
@@ -561,13 +583,10 @@ static s32 e1000_init_mac_params_ich8lan(struct e1000_adapter *adapter)
        if (mac->type == e1000_ich8lan)
                e1000e_set_kmrn_lock_loss_workaround_ich8lan(hw, true);
-        /* Disable PHY configuration by hardware, config by software */
+        /* Gate automatic PHY configuration by hardware on managed 82579 */
-        if (mac->type == e1000_pch2lan) {
+        if ((mac->type == e1000_pch2lan) &&
-                u32 extcnf_ctrl = er32(EXTCNF_CTRL);
+            (er32(FWSM) & E1000_ICH_FWSM_FW_VALID))
+                e1000_gate_hw_phy_config_ich8lan(hw, true);
-                extcnf_ctrl |= E1000_EXTCNF_CTRL_GATE_PHY_CFG;
-                ew32(EXTCNF_CTRL, extcnf_ctrl);
-        }
        return 0;
 }
@@ -652,6 +671,12 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw)
                        goto out;
        }
+        if (hw->mac.type == e1000_pch2lan) {
+                ret_val = e1000_k1_workaround_lv(hw);
+                if (ret_val)
+                        goto out;
+        }
        /*
         * Check if there was DownShift, must be checked
         * immediately after link-up
@@ -895,6 +920,34 @@ static s32 e1000_check_reset_block_ich8lan(struct e1000_hw *hw)
 }
 /**
+ *  e1000_write_smbus_addr - Write SMBus address to PHY needed during Sx states
+ *  @hw: pointer to the HW structure
+ *
+ *  Assumes semaphore already acquired.
+ *
+ **/
+static s32 e1000_write_smbus_addr(struct e1000_hw *hw)
+{
+        u16 phy_data;
+        u32 strap = er32(STRAP);
+        s32 ret_val = 0;
+        strap &= E1000_STRAP_SMBUS_ADDRESS_MASK;
+        ret_val = e1000_read_phy_reg_hv_locked(hw, HV_SMB_ADDR, &phy_data);
+        if (ret_val)
+                goto out;
+        phy_data &= ~HV_SMB_ADDR_MASK;
+        phy_data |= (strap >> E1000_STRAP_SMBUS_ADDRESS_SHIFT);
+        phy_data |= HV_SMB_ADDR_PEC_EN | HV_SMB_ADDR_VALID;
+        ret_val = e1000_write_phy_reg_hv_locked(hw, HV_SMB_ADDR, phy_data);
+out:
+        return ret_val;
+}
+/**
 *  e1000_sw_lcd_config_ich8lan - SW-based LCD Configuration
 *  @hw:   pointer to the HW structure
 *
@@ -903,7 +956,6 @@ static s32 e1000_check_reset_block_ich8lan(struct e1000_hw *hw)
 **/
 static s32 e1000_sw_lcd_config_ich8lan(struct e1000_hw *hw)
 {
-        struct e1000_adapter *adapter = hw->adapter;
        struct e1000_phy_info *phy = &hw->phy;
        u32 i, data, cnf_size, cnf_base_addr, sw_cfg_mask;
        s32 ret_val = 0;
@@ -921,7 +973,8 @@ static s32 e1000_sw_lcd_config_ich8lan(struct e1000_hw *hw)
                if (phy->type != e1000_phy_igp_3)
                        return ret_val;
-                if (adapter->pdev->device == E1000_DEV_ID_ICH8_IGP_AMT) {
+                if ((hw->adapter->pdev->device == E1000_DEV_ID_ICH8_IGP_AMT) ||
+                    (hw->adapter->pdev->device == E1000_DEV_ID_ICH8_IGP_C)) {
                        sw_cfg_mask = E1000_FEXTNVM_SW_CONFIG;
                        break;
                }
@@ -961,21 +1014,16 @@ static s32 e1000_sw_lcd_config_ich8lan(struct e1000_hw *hw)
        cnf_base_addr = data & E1000_EXTCNF_CTRL_EXT_CNF_POINTER_MASK;
        cnf_base_addr >>= E1000_EXTCNF_CTRL_EXT_CNF_POINTER_SHIFT;
-        if (!(data & E1000_EXTCNF_CTRL_OEM_WRITE_ENABLE) &&
+        if ((!(data & E1000_EXTCNF_CTRL_OEM_WRITE_ENABLE) &&
-            ((hw->mac.type == e1000_pchlan) ||
+            (hw->mac.type == e1000_pchlan)) ||
-             (hw->mac.type == e1000_pch2lan))) {
+             (hw->mac.type == e1000_pch2lan)) {
                /*
                 * HW configures the SMBus address and LEDs when the
                 * OEM and LCD Write Enable bits are set in the NVM.
                 * When both NVM bits are cleared, SW will configure
                 * them instead.
                 */
-                data = er32(STRAP);
+                ret_val = e1000_write_smbus_addr(hw);
-                data &= E1000_STRAP_SMBUS_ADDRESS_MASK;
-                reg_data = data >> E1000_STRAP_SMBUS_ADDRESS_SHIFT;
-                reg_data |= HV_SMB_ADDR_PEC_EN | HV_SMB_ADDR_VALID;
-                ret_val = e1000_write_phy_reg_hv_locked(hw, HV_SMB_ADDR,
-                                                        reg_data);
                if (ret_val)
                        goto out;
@@ -1440,10 +1488,6 @@ s32 e1000_lv_jumbo_workaround_ich8lan(struct e1000_hw *hw, bool enable)
                        goto out;
                /* Enable jumbo frame workaround in the PHY */
-                e1e_rphy(hw, PHY_REG(769, 20), &data);
-                ret_val = e1e_wphy(hw, PHY_REG(769, 20), data & ~(1 << 14));
-                if (ret_val)
-                        goto out;
                e1e_rphy(hw, PHY_REG(769, 23), &data);
                data &= ~(0x7F << 5);
                data |= (0x37 << 5);
@@ -1452,7 +1496,6 @@ s32 e1000_lv_jumbo_workaround_ich8lan(struct e1000_hw *hw, bool enable)
                        goto out;
                e1e_rphy(hw, PHY_REG(769, 16), &data);
                data &= ~(1 << 13);
-                data |= (1 << 12);
                ret_val = e1e_wphy(hw, PHY_REG(769, 16), data);
                if (ret_val)
                        goto out;
@@ -1477,7 +1520,7 @@ s32 e1000_lv_jumbo_workaround_ich8lan(struct e1000_hw *hw, bool enable)
                mac_reg = er32(RCTL);
                mac_reg &= ~E1000_RCTL_SECRC;
-                ew32(FFLT_DBG, mac_reg);
+                ew32(RCTL, mac_reg);
                ret_val = e1000e_read_kmrn_reg(hw,
                                                E1000_KMRNCTRLSTA_CTRL_OFFSET,
@@ -1503,17 +1546,12 @@ s32 e1000_lv_jumbo_workaround_ich8lan(struct e1000_hw *hw, bool enable)
                        goto out;
                /* Write PHY register values back to h/w defaults */
-                e1e_rphy(hw, PHY_REG(769, 20), &data);
-                ret_val = e1e_wphy(hw, PHY_REG(769, 20), data & ~(1 << 14));
-                if (ret_val)
-                        goto out;
                e1e_rphy(hw, PHY_REG(769, 23), &data);
                data &= ~(0x7F << 5);
                ret_val = e1e_wphy(hw, PHY_REG(769, 23), data);
                if (ret_val)
                        goto out;
                e1e_rphy(hw, PHY_REG(769, 16), &data);
-                data &= ~(1 << 12);
                data |= (1 << 13);
                ret_val = e1e_wphy(hw, PHY_REG(769, 16), data);
                if (ret_val)
@@ -1559,6 +1597,69 @@ out:
 }
 /**
+ *  e1000_k1_gig_workaround_lv - K1 Si workaround
+ *  @hw:   pointer to the HW structure
+ *
+ *  Workaround to set the K1 beacon duration for 82579 parts
+ **/
+static s32 e1000_k1_workaround_lv(struct e1000_hw *hw)
+{
+        s32 ret_val = 0;
+        u16 status_reg = 0;
+        u32 mac_reg;
+        if (hw->mac.type != e1000_pch2lan)
+                goto out;
+        /* Set K1 beacon duration based on 1Gbps speed or otherwise */
+        ret_val = e1e_rphy(hw, HV_M_STATUS, &status_reg);
+        if (ret_val)
+                goto out;
+        if ((status_reg & (HV_M_STATUS_LINK_UP | HV_M_STATUS_AUTONEG_COMPLETE))
+            == (HV_M_STATUS_LINK_UP | HV_M_STATUS_AUTONEG_COMPLETE)) {
+                mac_reg = er32(FEXTNVM4);
+                mac_reg &= ~E1000_FEXTNVM4_BEACON_DURATION_MASK;
+                if (status_reg & HV_M_STATUS_SPEED_1000)
+                        mac_reg |= E1000_FEXTNVM4_BEACON_DURATION_8USEC;
+                else
+                        mac_reg |= E1000_FEXTNVM4_BEACON_DURATION_16USEC;
+                ew32(FEXTNVM4, mac_reg);
+        }
+out:
+        return ret_val;
+}
+/**
+ *  e1000_gate_hw_phy_config_ich8lan - disable PHY config via hardware
+ *  @hw:   pointer to the HW structure
+ *  @gate: boolean set to true to gate, false to ungate
+ *
+ *  Gate/ungate the automatic PHY configuration via hardware; perform
+ *  the configuration via software instead.
+ **/
+static void e1000_gate_hw_phy_config_ich8lan(struct e1000_hw *hw, bool gate)
+{
+        u32 extcnf_ctrl;
+        if (hw->mac.type != e1000_pch2lan)
+                return;
+        extcnf_ctrl = er32(EXTCNF_CTRL);
+        if (gate)
+                extcnf_ctrl |= E1000_EXTCNF_CTRL_GATE_PHY_CFG;
+        else
+                extcnf_ctrl &= ~E1000_EXTCNF_CTRL_GATE_PHY_CFG;
+        ew32(EXTCNF_CTRL, extcnf_ctrl);
+        return;
+}
+/**
 *  e1000_lan_init_done_ich8lan - Check for PHY config completion
 *  @hw: pointer to the HW structure
 *
@@ -1602,6 +1703,9 @@ static s32 e1000_post_phy_reset_ich8lan(struct e1000_hw *hw)
        if (e1000_check_reset_block(hw))
                goto out;
+        /* Allow time for h/w to get to quiescent state after reset */
+        msleep(10);
        /* Perform any necessary post-reset workarounds */
        switch (hw->mac.type) {
        case e1000_pchlan:
@@ -1630,6 +1734,13 @@ static s32 e1000_post_phy_reset_ich8lan(struct e1000_hw *hw)
        /* Configure the LCD with the OEM bits in NVM */
        ret_val = e1000_oem_bits_config_ich8lan(hw, true);
+        /* Ungate automatic PHY configuration on non-managed 82579 */
+        if ((hw->mac.type == e1000_pch2lan) &&
+            !(er32(FWSM) & E1000_ICH_FWSM_FW_VALID)) {
+                msleep(10);
+                e1000_gate_hw_phy_config_ich8lan(hw, false);
+        }
 out:
        return ret_val;
 }
@@ -1646,6 +1757,11 @@ static s32 e1000_phy_hw_reset_ich8lan(struct e1000_hw *hw)
 {
        s32 ret_val = 0;
+        /* Gate automatic PHY configuration by hardware on non-managed 82579 */
+        if ((hw->mac.type == e1000_pch2lan) &&
+            !(er32(FWSM) & E1000_ICH_FWSM_FW_VALID))
+                e1000_gate_hw_phy_config_ich8lan(hw, true);
        ret_val = e1000e_phy_hw_reset_generic(hw);
        if (ret_val)
                goto out;
@@ -2910,6 +3026,14 @@ static s32 e1000_reset_hw_ich8lan(struct e1000_hw *hw)
                 * external PHY is reset.
                 */
                ctrl |= E1000_CTRL_PHY_RST;
+                /*
+                 * Gate automatic PHY configuration by hardware on
+                 * non-managed 82579
+                 */
+                if ((hw->mac.type == e1000_pch2lan) &&
+                    !(er32(FWSM) & E1000_ICH_FWSM_FW_VALID))
+                        e1000_gate_hw_phy_config_ich8lan(hw, true);
        }
        ret_val = e1000_acquire_swflag_ich8lan(hw);
        e_dbg("Issuing a global reset to ich8lan\n");
@@ -3460,13 +3584,20 @@ void e1000e_gig_downshift_workaround_ich8lan(struct e1000_hw *hw)
 void e1000e_disable_gig_wol_ich8lan(struct e1000_hw *hw)
 {
        u32 phy_ctrl;
+        s32 ret_val;
        phy_ctrl = er32(PHY_CTRL);
        phy_ctrl |= E1000_PHY_CTRL_D0A_LPLU | E1000_PHY_CTRL_GBE_DISABLE;
        ew32(PHY_CTRL, phy_ctrl);
-        if (hw->mac.type >= e1000_pchlan)
+        if (hw->mac.type >= e1000_pchlan) {
-                e1000_phy_hw_reset_ich8lan(hw);
+                e1000_oem_bits_config_ich8lan(hw, true);
+                ret_val = hw->phy.ops.acquire(hw);
+                if (ret_val)
+                        return;
+                e1000_write_smbus_addr(hw);
+                hw->phy.ops.release(hw);
+        }
 }
 /**
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 2b8ef44bd2b1..e561d15c3eb1 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -2704,6 +2704,16 @@ static void e1000_setup_rctl(struct e1000_adapter *adapter)
        u32 psrctl = 0;
        u32 pages = 0;
+        /* Workaround Si errata on 82579 - configure jumbo frame flow */
+        if (hw->mac.type == e1000_pch2lan) {
+                s32 ret_val;
+                if (adapter->netdev->mtu > ETH_DATA_LEN)
+                        ret_val = e1000_lv_jumbo_workaround_ich8lan(hw, true);
+                else
+                        ret_val = e1000_lv_jumbo_workaround_ich8lan(hw, false);
+        }
        /* Program MC offset vector base */
        rctl = er32(RCTL);
        rctl &= ~(3 << E1000_RCTL_MO_SHIFT);
@@ -2744,16 +2754,6 @@ static void e1000_setup_rctl(struct e1000_adapter *adapter)
                e1e_wphy(hw, 22, phy_data);
        }
-        /* Workaround Si errata on 82579 - configure jumbo frame flow */
-        if (hw->mac.type == e1000_pch2lan) {
-                s32 ret_val;
-                if (rctl & E1000_RCTL_LPE)
-                        ret_val = e1000_lv_jumbo_workaround_ich8lan(hw, true);
-                else
-                        ret_val = e1000_lv_jumbo_workaround_ich8lan(hw, false);
-        }
        /* Setup buffer sizes */
        rctl &= ~E1000_RCTL_SZ_4096;
        rctl |= E1000_RCTL_BSEX;
@@ -4833,6 +4833,15 @@ static int e1000_change_mtu(struct net_device *netdev, int new_mtu)
                return -EINVAL;
        }
+        /* Jumbo frame workaround on 82579 requires CRC be stripped */
+        if ((adapter->hw.mac.type == e1000_pch2lan) &&
+            !(adapter->flags2 & FLAG2_CRC_STRIPPING) &&
+            (new_mtu > ETH_DATA_LEN)) {
+                e_err("Jumbo Frames not supported on 82579 when CRC "
+                      "stripping is disabled.\n");
+                return -EINVAL;
+        }
        /* 82573 Errata 17 */
        if (((adapter->hw.mac.type == e1000_82573) ||
             (adapter->hw.mac.type == e1000_82574)) &&
diff --git a/drivers/net/ibm_newemac/core.c b/drivers/net/ibm_newemac/core.c
index 3506fd6ad726..519e19e23955 100644
--- a/drivers/net/ibm_newemac/core.c
+++ b/drivers/net/ibm_newemac/core.c
@@ -2928,7 +2928,7 @@ static int __devinit emac_probe(struct platform_device *ofdev,
        if (dev->emac_irq != NO_IRQ)
                irq_dispose_mapping(dev->emac_irq);
 err_free:
-        kfree(ndev);
+        free_netdev(ndev);
 err_gone:
        /* if we were on the bootlist, remove us as we won't show up and
         * wake up all waiters to notify them in case they were waiting
@@ -2971,7 +2971,7 @@ static int __devexit emac_remove(struct platform_device *ofdev)
        if (dev->emac_irq != NO_IRQ)
                irq_dispose_mapping(dev->emac_irq);
-        kfree(dev->ndev);
+        free_netdev(dev->ndev);
        return 0;
 }
diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index cabae7bb1fc6..b075a35b85d4 100644
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -1540,7 +1540,6 @@ netxen_process_rcv(struct netxen_adapter *adapter,
        if (pkt_offset)
                skb_pull(skb, pkt_offset);
-        skb->truesize = skb->len + sizeof(struct sk_buff);
        skb->protocol = eth_type_trans(skb, netdev);
        napi_gro_receive(&sds_ring->napi, skb);
@@ -1602,8 +1601,6 @@ netxen_process_lro(struct netxen_adapter *adapter,
        skb_put(skb, lro_length + data_offset);
-        skb->truesize = skb->len + sizeof(struct sk_buff) + skb_headroom(skb);
        skb_pull(skb, l2_hdr_offset);
        skb->protocol = eth_type_trans(skb, netdev);
diff --git a/drivers/net/qlcnic/qlcnic_init.c b/drivers/net/qlcnic/qlcnic_init.c
index 75ba744b173c..2c7cf0b64811 100644
--- a/drivers/net/qlcnic/qlcnic_init.c
+++ b/drivers/net/qlcnic/qlcnic_init.c
@@ -1316,7 +1316,7 @@ qlcnic_alloc_rx_skb(struct qlcnic_adapter *adapter,
                return -ENOMEM;
        }
-        skb_reserve(skb, 2);
+        skb_reserve(skb, NET_IP_ALIGN);
        dma = pci_map_single(pdev, skb->data,
                        rds_ring->dma_size, PCI_DMA_FROMDEVICE);
@@ -1404,7 +1404,6 @@ qlcnic_process_rcv(struct qlcnic_adapter *adapter,
        if (pkt_offset)
                skb_pull(skb, pkt_offset);
-        skb->truesize = skb->len + sizeof(struct sk_buff);
        skb->protocol = eth_type_trans(skb, netdev);
        napi_gro_receive(&sds_ring->napi, skb);
@@ -1466,8 +1465,6 @@ qlcnic_process_lro(struct qlcnic_adapter *adapter,
        skb_put(skb, lro_length + data_offset);
-        skb->truesize = skb->len + sizeof(struct sk_buff) + skb_headroom(skb);
        skb_pull(skb, l2_hdr_offset);
        skb->protocol = eth_type_trans(skb, netdev);
@@ -1700,8 +1697,6 @@ qlcnic_process_rcv_diag(struct qlcnic_adapter *adapter,
        if (pkt_offset)
                skb_pull(skb, pkt_offset);
-        skb->truesize = skb->len + sizeof(struct sk_buff);
        if (!qlcnic_check_loopback_buff(skb->data))
                adapter->diag_cnt++;
diff --git a/drivers/net/rionet.c b/drivers/net/rionet.c
index 07eb884ff982..44150f2f7bfd 100644
--- a/drivers/net/rionet.c
+++ b/drivers/net/rionet.c
@@ -384,7 +384,7 @@ static void rionet_remove(struct rio_dev *rdev)
        free_pages((unsigned long)rionet_active, rdev->net->hport->sys_size ?
                                        __ilog2(sizeof(void *)) + 4 : 0);
        unregister_netdev(ndev);
-        kfree(ndev);
+        free_netdev(ndev);
        list_for_each_entry_safe(peer, tmp, &rionet_peers, node) {
                list_del(&peer->node);
diff --git a/drivers/net/sgiseeq.c b/drivers/net/sgiseeq.c
index cc4bd8c65f8b..9265315baa0b 100644
--- a/drivers/net/sgiseeq.c
+++ b/drivers/net/sgiseeq.c
@@ -804,7 +804,7 @@ static int __devinit sgiseeq_probe(struct platform_device *pdev)
 err_out_free_page:
        free_page((unsigned long) sp->srings);
 err_out_free_dev:
-        kfree(dev);
+        free_netdev(dev);
 err_out:
        return err;
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index 40e5c46e7571..465ae7e84507 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -43,6 +43,7 @@
 #include <linux/seq_file.h>
 #include <linux/mii.h>
 #include <linux/slab.h>
+#include <linux/dmi.h>
 #include <asm/irq.h>
 #include "skge.h"
@@ -3868,6 +3869,8 @@ static void __devinit skge_show_addr(struct net_device *dev)
        netif_info(skge, probe, skge->netdev, "addr %pM\n", dev->dev_addr);
 }
+static int only_32bit_dma;
 static int __devinit skge_probe(struct pci_dev *pdev,
                                const struct pci_device_id *ent)
 {
@@ -3889,7 +3892,7 @@ static int __devinit skge_probe(struct pci_dev *pdev,
        pci_set_master(pdev);
-        if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(64))) {
+        if (!only_32bit_dma && !pci_set_dma_mask(pdev, DMA_BIT_MASK(64))) {
                using_dac = 1;
                err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64));
        } else if (!(err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32)))) {
@@ -4147,8 +4150,21 @@ static struct pci_driver skge_driver = {
        .shutdown =     skge_shutdown,
 };
+static struct dmi_system_id skge_32bit_dma_boards[] = {
+        {
+                .ident = "Gigabyte nForce boards",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "Gigabyte Technology Co"),
+                        DMI_MATCH(DMI_BOARD_NAME, "nForce"),
+                },
+        },
+        {}
+};
 static int __init skge_init_module(void)
 {
+        if (dmi_check_system(skge_32bit_dma_boards))
+                only_32bit_dma = 1;
        skge_debug_init();
        return pci_register_driver(&skge_driver);
 }
diff --git a/drivers/net/smsc911x.c b/drivers/net/smsc911x.c
index 0909ae934ad0..8150ba154116 100644
--- a/drivers/net/smsc911x.c
+++ b/drivers/net/smsc911x.c
@@ -58,6 +58,7 @@
 MODULE_LICENSE("GPL");
 MODULE_VERSION(SMSC_DRV_VERSION);
+MODULE_ALIAS("platform:smsc911x");
 #if USE_DEBUG > 0
 static int debug = 16;
diff --git a/drivers/net/tulip/de2104x.c b/drivers/net/tulip/de2104x.c
index 5efa57757a2c..6888e3d41462 100644
--- a/drivers/net/tulip/de2104x.c
+++ b/drivers/net/tulip/de2104x.c
@@ -243,6 +243,7 @@ enum {
        NWayState               = (1 << 14) | (1 << 13) | (1 << 12),
        NWayRestart             = (1 << 12),
        NonselPortActive        = (1 << 9),
+        SelPortActive           = (1 << 8),
        LinkFailStatus          = (1 << 2),
        NetCxnErr               = (1 << 1),
 };
@@ -363,7 +364,9 @@ static u16 t21040_csr15[] = { 0, 0, 0x0006, 0x0000, 0x0000, };
 /* 21041 transceiver register settings: TP AUTO, BNC, AUI, TP, TP FD*/
 static u16 t21041_csr13[] = { 0xEF01, 0xEF09, 0xEF09, 0xEF01, 0xEF09, };
-static u16 t21041_csr14[] = { 0xFFFF, 0xF7FD, 0xF7FD, 0x6F3F, 0x6F3D, };
+static u16 t21041_csr14[] = { 0xFFFF, 0xF7FD, 0xF7FD, 0x7F3F, 0x7F3D, };
+/* If on-chip autonegotiation is broken, use half-duplex (FF3F) instead */
+static u16 t21041_csr14_brk[] = { 0xFF3F, 0xF7FD, 0xF7FD, 0x7F3F, 0x7F3D, };
 static u16 t21041_csr15[] = { 0x0008, 0x0006, 0x000E, 0x0008, 0x0008, };
@@ -1064,6 +1067,9 @@ static void de21041_media_timer (unsigned long data)
        unsigned int carrier;
        unsigned long flags;
+        /* clear port active bits */
+        dw32(SIAStatus, NonselPortActive | SelPortActive);
        carrier = (status & NetCxnErr) ? 0 : 1;
        if (carrier) {
@@ -1158,14 +1164,29 @@ no_link_yet:
 static void de_media_interrupt (struct de_private *de, u32 status)
 {
        if (status & LinkPass) {
+                /* Ignore if current media is AUI or BNC and we can't use TP */
+                if ((de->media_type == DE_MEDIA_AUI ||
+                     de->media_type == DE_MEDIA_BNC) &&
+                    (de->media_lock ||
+                     !de_ok_to_advertise(de, DE_MEDIA_TP_AUTO)))
+                        return;
+                /* If current media is not TP, change it to TP */
+                if ((de->media_type == DE_MEDIA_AUI ||
+                     de->media_type == DE_MEDIA_BNC)) {
+                        de->media_type = DE_MEDIA_TP_AUTO;
+                        de_stop_rxtx(de);
+                        de_set_media(de);
+                        de_start_rxtx(de);
+                }
                de_link_up(de);
                mod_timer(&de->media_timer, jiffies + DE_TIMER_LINK);
                return;
        }
        BUG_ON(!(status & LinkFail));
+        /* Mark the link as down only if current media is TP */
-        if (netif_carrier_ok(de->dev)) {
+        if (netif_carrier_ok(de->dev) && de->media_type != DE_MEDIA_AUI &&
+            de->media_type != DE_MEDIA_BNC) {
                de_link_down(de);
                mod_timer(&de->media_timer, jiffies + DE_TIMER_NO_LINK);
        }
@@ -1229,6 +1250,7 @@ static void de_adapter_sleep (struct de_private *de)
        if (de->de21040)
                return;
+        dw32(CSR13, 0); /* Reset phy */
        pci_read_config_dword(de->pdev, PCIPM, &pmctl);
        pmctl |= PM_Sleep;
        pci_write_config_dword(de->pdev, PCIPM, pmctl);
@@ -1574,12 +1596,15 @@ static int __de_set_settings(struct de_private *de, struct ethtool_cmd *ecmd)
                return 0; /* nothing to change */
        de_link_down(de);
+        mod_timer(&de->media_timer, jiffies + DE_TIMER_NO_LINK);
        de_stop_rxtx(de);
        de->media_type = new_media;
        de->media_lock = media_lock;
        de->media_advertise = ecmd->advertising;
        de_set_media(de);
+        if (netif_running(de->dev))
+                de_start_rxtx(de);
        return 0;
 }
@@ -1911,8 +1936,14 @@ fill_defaults:
        for (i = 0; i < DE_MAX_MEDIA; i++) {
                if (de->media[i].csr13 == 0xffff)
                        de->media[i].csr13 = t21041_csr13[i];
-                if (de->media[i].csr14 == 0xffff)
+                if (de->media[i].csr14 == 0xffff) {
-                        de->media[i].csr14 = t21041_csr14[i];
+                        /* autonegotiation is broken at least on some chip
+                           revisions - rev. 0x21 works, 0x11 does not */
+                        if (de->pdev->revision < 0x20)
+                                de->media[i].csr14 = t21041_csr14_brk[i];
+                        else
+                                de->media[i].csr14 = t21041_csr14[i];
+                }
                if (de->media[i].csr15 == 0xffff)
                        de->media[i].csr15 = t21041_csr15[i];
        }
@@ -2158,6 +2189,8 @@ static int de_resume (struct pci_dev *pdev)
                dev_err(&dev->dev, "pci_enable_device failed in resume\n");
                goto out;
        }
+        pci_set_master(pdev);
+        de_init_rings(de);
        de_init_hw(de);
 out_attach:
        netif_device_attach(dev);
diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index cc648b6ae31c..a3d95cca8f0c 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -543,7 +543,7 @@ static u8 ath9k_hw_chan_2_clockrate_mhz(struct ath_hw *ah)
        if (conf_is_ht40(conf))
                return clockrate * 2;
-        return clockrate * 2;
+        return clockrate;
 }
 static int32_t ath9k_hw_ani_get_listen_time(struct ath_hw *ah)
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
index 9dd9e64c2b0b..8fd00a6e5120 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-lib.c
@@ -1411,7 +1411,7 @@ void iwlagn_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
        clear_bit(STATUS_SCAN_HW, &priv->status);
        clear_bit(STATUS_SCANNING, &priv->status);
        /* inform mac80211 scan aborted */
-        queue_work(priv->workqueue, &priv->scan_completed);
+        queue_work(priv->workqueue, &priv->abort_scan);
 }
 int iwlagn_manage_ibss_station(struct iwl_priv *priv,
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 07dbc2796448..e23c4060a0f0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -2613,6 +2613,11 @@ int iwl_force_reset(struct iwl_priv *priv, int mode, bool external)
        if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                return -EINVAL;
+        if (test_bit(STATUS_SCANNING, &priv->status)) {
+                IWL_DEBUG_INFO(priv, "scan in progress.\n");
+                return -EINVAL;
+        }
        if (mode >= IWL_MAX_FORCE_RESET) {
                IWL_DEBUG_INFO(priv, "invalid reset request.\n");
                return -EINVAL;
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 59a308b02f95..d31661c1ce77 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -3018,7 +3018,7 @@ void iwl3945_request_scan(struct iwl_priv *priv, struct ieee80211_vif *vif)
        clear_bit(STATUS_SCANNING, &priv->status);
        /* inform mac80211 scan aborted */
-        queue_work(priv->workqueue, &priv->scan_completed);
+        queue_work(priv->workqueue, &priv->abort_scan);
 }
 static void iwl3945_bg_restart(struct work_struct *data)
diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
index c3ceebb5be84..4789f8e8bf7a 100644
--- a/drivers/pci/intel-iommu.c
+++ b/drivers/pci/intel-iommu.c
@@ -71,6 +71,49 @@
 #define DMA_32BIT_PFN           IOVA_PFN(DMA_BIT_MASK(32))
 #define DMA_64BIT_PFN           IOVA_PFN(DMA_BIT_MASK(64))
+/* page table handling */
+#define LEVEL_STRIDE            (9)
+#define LEVEL_MASK              (((u64)1 << LEVEL_STRIDE) - 1)
+static inline int agaw_to_level(int agaw)
+{
+        return agaw + 2;
+}
+static inline int agaw_to_width(int agaw)
+{
+        return 30 + agaw * LEVEL_STRIDE;
+}
+static inline int width_to_agaw(int width)
+{
+        return (width - 30) / LEVEL_STRIDE;
+}
+static inline unsigned int level_to_offset_bits(int level)
+{
+        return (level - 1) * LEVEL_STRIDE;
+}
+static inline int pfn_level_offset(unsigned long pfn, int level)
+{
+        return (pfn >> level_to_offset_bits(level)) & LEVEL_MASK;
+}
+static inline unsigned long level_mask(int level)
+{
+        return -1UL << level_to_offset_bits(level);
+}
+static inline unsigned long level_size(int level)
+{
+        return 1UL << level_to_offset_bits(level);
+}
+static inline unsigned long align_to_level(unsigned long pfn, int level)
+{
+        return (pfn + level_size(level) - 1) & level_mask(level);
+}
 /* VT-d pages must always be _smaller_ than MM pages. Otherwise things
   are never going to work. */
@@ -434,8 +477,6 @@ void free_iova_mem(struct iova *iova)
 }
-static inline int width_to_agaw(int width);
 static int __iommu_calculate_agaw(struct intel_iommu *iommu, int max_gaw)
 {
        unsigned long sagaw;
@@ -646,51 +687,6 @@ out:
        spin_unlock_irqrestore(&iommu->lock, flags);
 }
-/* page table handling */
-#define LEVEL_STRIDE            (9)
-#define LEVEL_MASK              (((u64)1 << LEVEL_STRIDE) - 1)
-static inline int agaw_to_level(int agaw)
-{
-        return agaw + 2;
-}
-static inline int agaw_to_width(int agaw)
-{
-        return 30 + agaw * LEVEL_STRIDE;
-}
-static inline int width_to_agaw(int width)
-{
-        return (width - 30) / LEVEL_STRIDE;
-}
-static inline unsigned int level_to_offset_bits(int level)
-{
-        return (level - 1) * LEVEL_STRIDE;
-}
-static inline int pfn_level_offset(unsigned long pfn, int level)
-{
-        return (pfn >> level_to_offset_bits(level)) & LEVEL_MASK;
-}
-static inline unsigned long level_mask(int level)
-{
-        return -1UL << level_to_offset_bits(level);
-}
-static inline unsigned long level_size(int level)
-{
-        return 1UL << level_to_offset_bits(level);
-}
-static inline unsigned long align_to_level(unsigned long pfn, int level)
-{
-        return (pfn + level_size(level) - 1) & level_mask(level);
-}
 static struct dma_pte *pfn_to_dma_pte(struct dmar_domain *domain,
                                      unsigned long pfn)
 {
@@ -3761,6 +3757,33 @@ static void __devinit quirk_iommu_rwbf(struct pci_dev *dev)
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_rwbf);
+#define GGC 0x52
+#define GGC_MEMORY_SIZE_MASK    (0xf << 8)
+#define GGC_MEMORY_SIZE_NONE    (0x0 << 8)
+#define GGC_MEMORY_SIZE_1M      (0x1 << 8)
+#define GGC_MEMORY_SIZE_2M      (0x3 << 8)
+#define GGC_MEMORY_VT_ENABLED   (0x8 << 8)
+#define GGC_MEMORY_SIZE_2M_VT   (0x9 << 8)
+#define GGC_MEMORY_SIZE_3M_VT   (0xa << 8)
+#define GGC_MEMORY_SIZE_4M_VT   (0xb << 8)
+static void __devinit quirk_calpella_no_shadow_gtt(struct pci_dev *dev)
+{
+        unsigned short ggc;
+        if (pci_read_config_word(dev, GGC, &ggc))
+                return;
+        if (!(ggc & GGC_MEMORY_VT_ENABLED)) {
+                printk(KERN_INFO "DMAR: BIOS has allocated no shadow GTT; disabling IOMMU for graphics\n");
+                dmar_map_gfx = 0;
+        }
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x0040, quirk_calpella_no_shadow_gtt);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x0044, quirk_calpella_no_shadow_gtt);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x0062, quirk_calpella_no_shadow_gtt);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x006a, quirk_calpella_no_shadow_gtt);
 /* On Tylersburg chipsets, some BIOSes have been known to enable the
   ISOCH DMAR unit for the Azalia sound device, but not give it any
   TLB entries, which causes it to deadlock. Check for that.  We do
diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c
index ce6a3666b3d9..553d8ee55c1c 100644
--- a/drivers/pci/iov.c
+++ b/drivers/pci/iov.c
@@ -608,7 +608,7 @@ int pci_iov_resource_bar(struct pci_dev *dev, int resno,
 * the VF BAR size multiplied by the number of VFs.  The alignment
 * is just the VF BAR size.
 */
-int pci_sriov_resource_alignment(struct pci_dev *dev, int resno)
+resource_size_t pci_sriov_resource_alignment(struct pci_dev *dev, int resno)
 {
        struct resource tmp;
        enum pci_bar_type type;
diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h
index 7754a678ab15..6beb11b617a9 100644
--- a/drivers/pci/pci.h
+++ b/drivers/pci/pci.h
@@ -264,7 +264,8 @@ extern int pci_iov_init(struct pci_dev *dev);
 extern void pci_iov_release(struct pci_dev *dev);
 extern int pci_iov_resource_bar(struct pci_dev *dev, int resno,
                                enum pci_bar_type *type);
-extern int pci_sriov_resource_alignment(struct pci_dev *dev, int resno);
+extern resource_size_t pci_sriov_resource_alignment(struct pci_dev *dev,
+                                                    int resno);
 extern void pci_restore_iov_state(struct pci_dev *dev);
 extern int pci_iov_bus_range(struct pci_bus *bus);
@@ -320,7 +321,7 @@ static inline int pci_ats_enabled(struct pci_dev *dev)
 }
 #endif /* CONFIG_PCI_IOV */
-static inline int pci_resource_alignment(struct pci_dev *dev,
+static inline resource_size_t pci_resource_alignment(struct pci_dev *dev,
                                         struct resource *res)
 {
 #ifdef CONFIG_PCI_IOV
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 89ed181cd90c..857ae01734a6 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -163,6 +163,26 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NEC,	PCI_DEVICE_ID_NEC_CBUS_2,	quirk_isa_d
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_NEC,      PCI_DEVICE_ID_NEC_CBUS_3,       quirk_isa_dma_hangs);
 /*
+ * Intel NM10 "TigerPoint" LPC PM1a_STS.BM_STS must be clear
+ * for some HT machines to use C4 w/o hanging.
+ */
+static void __devinit quirk_tigerpoint_bm_sts(struct pci_dev *dev)
+{
+        u32 pmbase;
+        u16 pm1a;
+        pci_read_config_dword(dev, 0x40, &pmbase);
+        pmbase = pmbase & 0xff80;
+        pm1a = inw(pmbase);
+        if (pm1a & 0x10) {
+                dev_info(&dev->dev, FW_BUG "TigerPoint LPC.BM_STS cleared\n");
+                outw(0x10, pmbase);
+        }
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_TGP_LPC, quirk_tigerpoint_bm_sts);
+/*
 *      Chipsets where PCI->PCI transfers vanish or hang
 */
 static void __devinit quirk_nopcipci(struct pci_dev *dev)
diff --git a/drivers/pcmcia/pcmcia_resource.c b/drivers/pcmcia/pcmcia_resource.c
index a5c176598d95..9ba4dade69a4 100644
--- a/drivers/pcmcia/pcmcia_resource.c
+++ b/drivers/pcmcia/pcmcia_resource.c
@@ -595,7 +595,13 @@ int pcmcia_request_io(struct pcmcia_device *p_dev)
        if (c->io[1].end) {
                ret = alloc_io_space(s, &c->io[1], p_dev->io_lines);
                if (ret) {
+                        struct resource tmp = c->io[0];
+                        /* release the previously allocated resource */
                        release_io_space(s, &c->io[0]);
+                        /* but preserve the settings, for they worked... */
+                        c->io[0].end = resource_size(&tmp);
+                        c->io[0].start = tmp.start;
+                        c->io[0].flags = tmp.flags;
                        goto out;
                }
        } else
diff --git a/drivers/pcmcia/pd6729.c b/drivers/pcmcia/pd6729.c
index b8a869af0f44..deef6656ab7b 100644
--- a/drivers/pcmcia/pd6729.c
+++ b/drivers/pcmcia/pd6729.c
@@ -646,7 +646,7 @@ static int __devinit pd6729_pci_probe(struct pci_dev *dev,
        if (!pci_resource_start(dev, 0)) {
                dev_warn(&dev->dev, "refusing to load the driver as the "
                        "io_base is NULL.\n");
-                goto err_out_free_mem;
+                goto err_out_disable;
        }
        dev_info(&dev->dev, "Cirrus PD6729 PCI to PCMCIA Bridge at 0x%llx "
diff --git a/drivers/platform/x86/intel_ips.c b/drivers/platform/x86/intel_ips.c
index 9024480a8228..c44a5e8b8b82 100644
--- a/drivers/platform/x86/intel_ips.c
+++ b/drivers/platform/x86/intel_ips.c
@@ -51,7 +51,6 @@
 * TODO:
 *   - handle CPU hotplug
 *   - provide turbo enable/disable api
- *   - make sure we can write turbo enable/disable reg based on MISC_EN
 *
 * Related documents:
 *   - CDI 403777, 403778 - Auburndale EDS vol 1 & 2
@@ -230,7 +229,7 @@
 #define THM_TC2         0xac
 #define THM_DTV         0xb0
 #define THM_ITV         0xd8
-#define   ITV_ME_SEQNO_MASK 0x000f0000 /* ME should update every ~200ms */
+#define   ITV_ME_SEQNO_MASK 0x00ff0000 /* ME should update every ~200ms */
 #define   ITV_ME_SEQNO_SHIFT (16)
 #define   ITV_MCH_TEMP_MASK 0x0000ff00
 #define   ITV_MCH_TEMP_SHIFT (8)
@@ -325,6 +324,7 @@ struct ips_driver {
        bool gpu_preferred;
        bool poll_turbo_status;
        bool second_cpu;
+        bool turbo_toggle_allowed;
        struct ips_mcp_limits *limits;
        /* Optional MCH interfaces for if i915 is in use */
@@ -415,7 +415,7 @@ static void ips_cpu_lower(struct ips_driver *ips)
        new_limit = cur_limit - 8; /* 1W decrease */
        /* Clamp to SKU TDP limit */
-        if (((new_limit * 10) / 8) < (ips->orig_turbo_limit & TURBO_TDP_MASK))
+        if (new_limit  < (ips->orig_turbo_limit & TURBO_TDP_MASK))
                new_limit = ips->orig_turbo_limit & TURBO_TDP_MASK;
        thm_writew(THM_MPCPC, (new_limit * 10) / 8);
@@ -461,7 +461,8 @@ static void ips_enable_cpu_turbo(struct ips_driver *ips)
        if (ips->__cpu_turbo_on)
                return;
-        on_each_cpu(do_enable_cpu_turbo, ips, 1);
+        if (ips->turbo_toggle_allowed)
+                on_each_cpu(do_enable_cpu_turbo, ips, 1);
        ips->__cpu_turbo_on = true;
 }
@@ -498,7 +499,8 @@ static void ips_disable_cpu_turbo(struct ips_driver *ips)
        if (!ips->__cpu_turbo_on)
                return;
-        on_each_cpu(do_disable_cpu_turbo, ips, 1);
+        if (ips->turbo_toggle_allowed)
+                on_each_cpu(do_disable_cpu_turbo, ips, 1);
        ips->__cpu_turbo_on = false;
 }
@@ -598,17 +600,29 @@ static bool mcp_exceeded(struct ips_driver *ips)
 {
        unsigned long flags;
        bool ret = false;
+        u32 temp_limit;
+        u32 avg_power;
+        const char *msg = "MCP limit exceeded: ";
        spin_lock_irqsave(&ips->turbo_status_lock, flags);
-        if (ips->mcp_avg_temp > (ips->mcp_temp_limit * 100))
-                ret = true;
+        temp_limit = ips->mcp_temp_limit * 100;
-        if (ips->cpu_avg_power + ips->mch_avg_power > ips->mcp_power_limit)
+        if (ips->mcp_avg_temp > temp_limit) {
+                dev_info(&ips->dev->dev,
+                        "%sAvg temp %u, limit %u\n", msg, ips->mcp_avg_temp,
+                        temp_limit);
                ret = true;
-        spin_unlock_irqrestore(&ips->turbo_status_lock, flags);
+        }
-        if (ret)
+        avg_power = ips->cpu_avg_power + ips->mch_avg_power;
+        if (avg_power > ips->mcp_power_limit) {
                dev_info(&ips->dev->dev,
-                         "MCP power or thermal limit exceeded\n");
+                        "%sAvg power %u, limit %u\n", msg, avg_power,
+                        ips->mcp_power_limit);
+                ret = true;
+        }
+        spin_unlock_irqrestore(&ips->turbo_status_lock, flags);
        return ret;
 }
@@ -663,6 +677,27 @@ static bool mch_exceeded(struct ips_driver *ips)
 }
 /**
+ * verify_limits - verify BIOS provided limits
+ * @ips: IPS structure
+ *
+ * BIOS can optionally provide non-default limits for power and temp.  Check
+ * them here and use the defaults if the BIOS values are not provided or
+ * are otherwise unusable.
+ */
+static void verify_limits(struct ips_driver *ips)
+{
+        if (ips->mcp_power_limit < ips->limits->mcp_power_limit ||
+            ips->mcp_power_limit > 35000)
+                ips->mcp_power_limit = ips->limits->mcp_power_limit;
+        if (ips->mcp_temp_limit < ips->limits->core_temp_limit ||
+            ips->mcp_temp_limit < ips->limits->mch_temp_limit ||
+            ips->mcp_temp_limit > 150)
+                ips->mcp_temp_limit = min(ips->limits->core_temp_limit,
+                                          ips->limits->mch_temp_limit);
+}
+/**
 * update_turbo_limits - get various limits & settings from regs
 * @ips: IPS driver struct
 *
@@ -680,12 +715,21 @@ static void update_turbo_limits(struct ips_driver *ips)
        u32 hts = thm_readl(THM_HTS);
        ips->cpu_turbo_enabled = !(hts & HTS_PCTD_DIS);
-        ips->gpu_turbo_enabled = !(hts & HTS_GTD_DIS);
+        /* 
+         * Disable turbo for now, until we can figure out why the power figures
+         * are wrong
+         */
+        ips->cpu_turbo_enabled = false;
+        if (ips->gpu_busy)
+                ips->gpu_turbo_enabled = !(hts & HTS_GTD_DIS);
        ips->core_power_limit = thm_readw(THM_MPCPC);
        ips->mch_power_limit = thm_readw(THM_MMGPC);
        ips->mcp_temp_limit = thm_readw(THM_PTL);
        ips->mcp_power_limit = thm_readw(THM_MPPC);
+        verify_limits(ips);
        /* Ignore BIOS CPU vs GPU pref */
 }
@@ -858,7 +902,7 @@ static u32 get_cpu_power(struct ips_driver *ips, u32 *last, int period)
        ret = (ret * 1000) / 65535;
        *last = val;
-        return ret;
+        return 0;
 }
 static const u16 temp_decay_factor = 2;
@@ -940,7 +984,6 @@ static int ips_monitor(void *data)
                kfree(mch_samples);
                kfree(cpu_samples);
                kfree(mchp_samples);
-                kthread_stop(ips->adjust);
                return -ENOMEM;
        }
@@ -948,7 +991,7 @@ static int ips_monitor(void *data)
                ITV_ME_SEQNO_SHIFT;
        seqno_timestamp = get_jiffies_64();
-        old_cpu_power = thm_readl(THM_CEC) / 65535;
+        old_cpu_power = thm_readl(THM_CEC);
        schedule_timeout_interruptible(msecs_to_jiffies(IPS_SAMPLE_PERIOD));
        /* Collect an initial average */
@@ -1150,11 +1193,18 @@ static irqreturn_t ips_irq_handler(int irq, void *arg)
                                STS_GPL_SHIFT;
                        /* ignore EC CPU vs GPU pref */
                        ips->cpu_turbo_enabled = !(sts & STS_PCTD_DIS);
-                        ips->gpu_turbo_enabled = !(sts & STS_GTD_DIS);
+                        /* 
+                         * Disable turbo for now, until we can figure
+                         * out why the power figures are wrong
+                         */
+                        ips->cpu_turbo_enabled = false;
+                        if (ips->gpu_busy)
+                                ips->gpu_turbo_enabled = !(sts & STS_GTD_DIS);
                        ips->mcp_temp_limit = (sts & STS_PTL_MASK) >>
                                STS_PTL_SHIFT;
                        ips->mcp_power_limit = (tc1 & STS_PPL_MASK) >>
                                STS_PPL_SHIFT;
+                        verify_limits(ips);
                        spin_unlock(&ips->turbo_status_lock);
                        thm_writeb(THM_SEC, SEC_ACK);
@@ -1333,8 +1383,10 @@ static struct ips_mcp_limits *ips_detect_cpu(struct ips_driver *ips)
         * turbo manually or we'll get an illegal MSR access, even though
         * turbo will still be available.
         */
-        if (!(misc_en & IA32_MISC_TURBO_EN))
+        if (misc_en & IA32_MISC_TURBO_EN)
-                ; /* add turbo MSR write allowed flag if necessary */
+                ips->turbo_toggle_allowed = true;
+        else
+                ips->turbo_toggle_allowed = false;
        if (strstr(boot_cpu_data.x86_model_id, "CPU       M"))
                limits = &ips_sv_limits;
@@ -1351,9 +1403,10 @@ static struct ips_mcp_limits *ips_detect_cpu(struct ips_driver *ips)
        tdp = turbo_power & TURBO_TDP_MASK;
        /* Sanity check TDP against CPU */
-        if (limits->mcp_power_limit != (tdp / 8) * 1000) {
+        if (limits->core_power_limit != (tdp / 8) * 1000) {
-                dev_warn(&ips->dev->dev, "Warning: CPU TDP doesn't match expected value (found %d, expected %d)\n",
+                dev_info(&ips->dev->dev, "CPU TDP doesn't match expected value (found %d, expected %d)\n",
-                         tdp / 8, limits->mcp_power_limit / 1000);
+                         tdp / 8, limits->core_power_limit / 1000);
+                limits->core_power_limit = (tdp / 8) * 1000;
        }
 out:
@@ -1390,7 +1443,7 @@ static bool ips_get_i915_syms(struct ips_driver *ips)
        return true;
 out_put_busy:
-        symbol_put(i915_gpu_turbo_disable);
+        symbol_put(i915_gpu_busy);
 out_put_lower:
        symbol_put(i915_gpu_lower);
 out_put_raise:
@@ -1532,22 +1585,27 @@ static int ips_probe(struct pci_dev *dev, const struct pci_device_id *id)
        /* Save turbo limits & ratios */
        rdmsrl(TURBO_POWER_CURRENT_LIMIT, ips->orig_turbo_limit);
-        ips_enable_cpu_turbo(ips);
+        ips_disable_cpu_turbo(ips);
-        ips->cpu_turbo_enabled = true;
+        ips->cpu_turbo_enabled = false;
-        /* Set up the work queue and monitor/adjust threads */
+        /* Create thermal adjust thread */
-        ips->monitor = kthread_run(ips_monitor, ips, "ips-monitor");
+        ips->adjust = kthread_create(ips_adjust, ips, "ips-adjust");
-        if (IS_ERR(ips->monitor)) {
+        if (IS_ERR(ips->adjust)) {
                dev_err(&dev->dev,
-                        "failed to create thermal monitor thread, aborting\n");
+                        "failed to create thermal adjust thread, aborting\n");
                ret = -ENOMEM;
                goto error_free_irq;
        }
-        ips->adjust = kthread_create(ips_adjust, ips, "ips-adjust");
+        /*
-        if (IS_ERR(ips->adjust)) {
+         * Set up the work queue and monitor thread. The monitor thread
+         * will wake up ips_adjust thread.
+         */
+        ips->monitor = kthread_run(ips_monitor, ips, "ips-monitor");
+        if (IS_ERR(ips->monitor)) {
                dev_err(&dev->dev,
-                        "failed to create thermal adjust thread, aborting\n");
+                        "failed to create thermal monitor thread, aborting\n");
                ret = -ENOMEM;
                goto error_thread_cleanup;
        }
@@ -1566,7 +1624,7 @@ static int ips_probe(struct pci_dev *dev, const struct pci_device_id *id)
        return ret;
 error_thread_cleanup:
-        kthread_stop(ips->monitor);
+        kthread_stop(ips->adjust);
 error_free_irq:
        free_irq(ips->dev->irq, ips);
 error_unmap:
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index e35ed128bdef..2d61186ad5a2 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -3093,7 +3093,8 @@ static const struct tpacpi_quirk tpacpi_hotkey_qtable[] __initconst = {
        TPACPI_Q_IBM('1', 'D', TPACPI_HK_Q_INIMASK), /* X22, X23, X24 */
 };
-typedef u16 tpacpi_keymap_t[TPACPI_HOTKEY_MAP_LEN];
+typedef u16 tpacpi_keymap_entry_t;
+typedef tpacpi_keymap_entry_t tpacpi_keymap_t[TPACPI_HOTKEY_MAP_LEN];
 static int __init hotkey_init(struct ibm_init_struct *iibm)
 {
@@ -3230,7 +3231,7 @@ static int __init hotkey_init(struct ibm_init_struct *iibm)
        };
 #define TPACPI_HOTKEY_MAP_SIZE          sizeof(tpacpi_keymap_t)
-#define TPACPI_HOTKEY_MAP_TYPESIZE      sizeof(tpacpi_keymap_t[0])
+#define TPACPI_HOTKEY_MAP_TYPESIZE      sizeof(tpacpi_keymap_entry_t)
        int res, i;
        int status;
diff --git a/drivers/regulator/ad5398.c b/drivers/regulator/ad5398.c
index df1fb53c09d2..a4be41614eeb 100644
--- a/drivers/regulator/ad5398.c
+++ b/drivers/regulator/ad5398.c
@@ -256,7 +256,6 @@ static int __devexit ad5398_remove(struct i2c_client *client)
        regulator_unregister(chip->rdev);
        kfree(chip);
-        i2c_set_clientdata(client, NULL);
        return 0;
 }
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 422a709d271d..cc8b337b9119 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -700,7 +700,7 @@ static void print_constraints(struct regulator_dev *rdev)
            constraints->min_uA != constraints->max_uA) {
                ret = _regulator_get_current_limit(rdev);
                if (ret > 0)
-                        count += sprintf(buf + count, "at %d uA ", ret / 1000);
+                        count += sprintf(buf + count, "at %d mA ", ret / 1000);
        }
        if (constraints->valid_modes_mask & REGULATOR_MODE_FAST)
@@ -2302,8 +2302,10 @@ struct regulator_dev *regulator_register(struct regulator_desc *regulator_desc,
        dev_set_name(&rdev->dev, "regulator.%d",
                     atomic_inc_return(&regulator_no) - 1);
        ret = device_register(&rdev->dev);
-        if (ret != 0)
+        if (ret != 0) {
+                put_device(&rdev->dev);
                goto clean;
+        }
        dev_set_drvdata(&rdev->dev, rdev);
diff --git a/drivers/regulator/isl6271a-regulator.c b/drivers/regulator/isl6271a-regulator.c
index d61ecb885a8c..b8cc6389a541 100644
--- a/drivers/regulator/isl6271a-regulator.c
+++ b/drivers/regulator/isl6271a-regulator.c
@@ -191,8 +191,6 @@ static int __devexit isl6271a_remove(struct i2c_client *i2c)
        struct isl_pmic *pmic = i2c_get_clientdata(i2c);
        int i;
-        i2c_set_clientdata(i2c, NULL);
        for (i = 0; i < 3; i++)
                regulator_unregister(pmic->rdev[i]);
diff --git a/drivers/regulator/max8649.c b/drivers/regulator/max8649.c
index 4520ace3f7e7..6b60a9c0366b 100644
--- a/drivers/regulator/max8649.c
+++ b/drivers/regulator/max8649.c
@@ -330,7 +330,7 @@ static int __devinit max8649_regulator_probe(struct i2c_client *client,
                /* set external clock frequency */
                info->extclk_freq = pdata->extclk_freq;
                max8649_set_bits(info->i2c, MAX8649_SYNC, MAX8649_EXT_MASK,
-                                 info->extclk_freq);
+                                 info->extclk_freq << 6);
        }
        if (pdata->ramp_timing) {
diff --git a/drivers/rtc/rtc-ab3100.c b/drivers/rtc/rtc-ab3100.c
index d26780ea254b..261a07e0fb24 100644
--- a/drivers/rtc/rtc-ab3100.c
+++ b/drivers/rtc/rtc-ab3100.c
@@ -235,6 +235,7 @@ static int __init ab3100_rtc_probe(struct platform_device *pdev)
                err = PTR_ERR(rtc);
                return err;
        }
+        platform_set_drvdata(pdev, rtc);
        return 0;
 }
@@ -244,6 +245,7 @@ static int __exit ab3100_rtc_remove(struct platform_device *pdev)
        struct rtc_device *rtc = platform_get_drvdata(pdev);
        rtc_device_unregister(rtc);
+        platform_set_drvdata(pdev, NULL);
        return 0;
 }
diff --git a/drivers/rtc/rtc-ds3232.c b/drivers/rtc/rtc-ds3232.c
index 9daed8db83d3..9de8516e3531 100644
--- a/drivers/rtc/rtc-ds3232.c
+++ b/drivers/rtc/rtc-ds3232.c
@@ -268,7 +268,6 @@ out_irq:
                free_irq(client->irq, client);
 out_free:
-        i2c_set_clientdata(client, NULL);
        kfree(ds3232);
        return ret;
 }
@@ -287,7 +286,6 @@ static int __devexit ds3232_remove(struct i2c_client *client)
        }
        rtc_device_unregister(ds3232->rtc);
-        i2c_set_clientdata(client, NULL);
        kfree(ds3232);
        return 0;
 }
diff --git a/drivers/rtc/rtc-s3c.c b/drivers/rtc/rtc-s3c.c
index a0d3ec89d412..f57a87f4ae96 100644
--- a/drivers/rtc/rtc-s3c.c
+++ b/drivers/rtc/rtc-s3c.c
@@ -310,11 +310,6 @@ static int s3c_rtc_setalarm(struct device *dev, struct rtc_wkalrm *alrm)
        s3c_rtc_setaie(alrm->enabled);
-        if (alrm->enabled)
-                enable_irq_wake(s3c_rtc_alarmno);
-        else
-                disable_irq_wake(s3c_rtc_alarmno);
        return 0;
 }
@@ -587,6 +582,10 @@ static int s3c_rtc_suspend(struct platform_device *pdev, pm_message_t state)
                ticnt_en_save &= S3C64XX_RTCCON_TICEN;
        }
        s3c_rtc_enable(pdev, 0);
+        if (device_may_wakeup(&pdev->dev))
+                enable_irq_wake(s3c_rtc_alarmno);
        return 0;
 }
@@ -600,6 +599,10 @@ static int s3c_rtc_resume(struct platform_device *pdev)
                tmp = readb(s3c_rtc_base + S3C2410_RTCCON);
                writeb(tmp | ticnt_en_save, s3c_rtc_base + S3C2410_RTCCON);
        }
+        if (device_may_wakeup(&pdev->dev))
+                disable_irq_wake(s3c_rtc_alarmno);
        return 0;
 }
 #else
diff --git a/drivers/s390/net/ctcm_main.c b/drivers/s390/net/ctcm_main.c
index 6edf20b62de5..2c7d2d9be4d0 100644
--- a/drivers/s390/net/ctcm_main.c
+++ b/drivers/s390/net/ctcm_main.c
@@ -1154,7 +1154,7 @@ static struct net_device *ctcm_init_netdevice(struct ctcm_priv *priv)
                                dev_fsm, dev_fsm_len, GFP_KERNEL);
        if (priv->fsm == NULL) {
                CTCMY_DBF_DEV(SETUP, dev, "init_fsm error");
-                kfree(dev);
+                free_netdev(dev);
                return NULL;
        }
        fsm_newstate(priv->fsm, DEV_STATE_STOPPED);
@@ -1165,7 +1165,7 @@ static struct net_device *ctcm_init_netdevice(struct ctcm_priv *priv)
                grp = ctcmpc_init_mpc_group(priv);
                if (grp == NULL) {
                        MPC_DBF_DEV(SETUP, dev, "init_mpc_group error");
-                        kfree(dev);
+                        free_netdev(dev);
                        return NULL;
                }
                tasklet_init(&grp->mpc_tasklet2,
diff --git a/drivers/serial/mfd.c b/drivers/serial/mfd.c
index 324c385a653d..5dff45c76d32 100644
--- a/drivers/serial/mfd.c
+++ b/drivers/serial/mfd.c
@@ -27,6 +27,7 @@
 #include <linux/init.h>
 #include <linux/console.h>
 #include <linux/sysrq.h>
+#include <linux/slab.h>
 #include <linux/serial_reg.h>
 #include <linux/circ_buf.h>
 #include <linux/delay.h>
diff --git a/drivers/serial/mrst_max3110.c b/drivers/serial/mrst_max3110.c
index f6ad1ecbff79..51c15f58e01e 100644
--- a/drivers/serial/mrst_max3110.c
+++ b/drivers/serial/mrst_max3110.c
@@ -29,6 +29,7 @@
 #include <linux/module.h>
 #include <linux/ioport.h>
+#include <linux/irq.h>
 #include <linux/init.h>
 #include <linux/console.h>
 #include <linux/sysrq.h>
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 0bcf4c1601a2..b5a78a1f4421 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -23,6 +23,7 @@
 #include <linux/init.h>
 #include <linux/cache.h>
 #include <linux/mutex.h>
+#include <linux/of_device.h>
 #include <linux/slab.h>
 #include <linux/mod_devicetable.h>
 #include <linux/spi/spi.h>
@@ -86,6 +87,10 @@ static int spi_match_device(struct device *dev, struct device_driver *drv)
        const struct spi_device *spi = to_spi_device(dev);
        const struct spi_driver *sdrv = to_spi_driver(drv);
+        /* Attempt an OF style match */
+        if (of_driver_match_device(dev, drv))
+                return 1;
        if (sdrv->id_table)
                return !!spi_match_id(sdrv->id_table, spi);
diff --git a/drivers/spi/spi_gpio.c b/drivers/spi/spi_gpio.c
index e24a63498acb..63e51b011d50 100644
--- a/drivers/spi/spi_gpio.c
+++ b/drivers/spi/spi_gpio.c
@@ -350,7 +350,7 @@ static int __init spi_gpio_probe(struct platform_device *pdev)
        spi_gpio->bitbang.master = spi_master_get(master);
        spi_gpio->bitbang.chipselect = spi_gpio_chipselect;
-        if ((master_flags & (SPI_MASTER_NO_RX | SPI_MASTER_NO_RX)) == 0) {
+        if ((master_flags & (SPI_MASTER_NO_TX | SPI_MASTER_NO_RX)) == 0) {
                spi_gpio->bitbang.txrx_word[SPI_MODE_0] = spi_gpio_txrx_word_mode0;
                spi_gpio->bitbang.txrx_word[SPI_MODE_1] = spi_gpio_txrx_word_mode1;
                spi_gpio->bitbang.txrx_word[SPI_MODE_2] = spi_gpio_txrx_word_mode2;
diff --git a/drivers/spi/spi_mpc8xxx.c b/drivers/spi/spi_mpc8xxx.c
index d31b57f7baaf..1dd86b835cd8 100644
--- a/drivers/spi/spi_mpc8xxx.c
+++ b/drivers/spi/spi_mpc8xxx.c
@@ -408,11 +408,17 @@ static void mpc8xxx_spi_cpm_bufs_start(struct mpc8xxx_spi *mspi)
        xfer_ofs = mspi->xfer_in_progress->len - mspi->count;
-        out_be32(&rx_bd->cbd_bufaddr, mspi->rx_dma + xfer_ofs);
+        if (mspi->rx_dma == mspi->dma_dummy_rx)
+                out_be32(&rx_bd->cbd_bufaddr, mspi->rx_dma);
+        else
+                out_be32(&rx_bd->cbd_bufaddr, mspi->rx_dma + xfer_ofs);
        out_be16(&rx_bd->cbd_datlen, 0);
        out_be16(&rx_bd->cbd_sc, BD_SC_EMPTY | BD_SC_INTRPT | BD_SC_WRAP);
-        out_be32(&tx_bd->cbd_bufaddr, mspi->tx_dma + xfer_ofs);
+        if (mspi->tx_dma == mspi->dma_dummy_tx)
+                out_be32(&tx_bd->cbd_bufaddr, mspi->tx_dma);
+        else
+                out_be32(&tx_bd->cbd_bufaddr, mspi->tx_dma + xfer_ofs);
        out_be16(&tx_bd->cbd_datlen, xfer_len);
        out_be16(&tx_bd->cbd_sc, BD_SC_READY | BD_SC_INTRPT | BD_SC_WRAP |
                                 BD_SC_LAST);
diff --git a/drivers/staging/ti-st/st.h b/drivers/staging/ti-st/st.h
index 9952579425b9..1b3060eb2921 100644
--- a/drivers/staging/ti-st/st.h
+++ b/drivers/staging/ti-st/st.h
@@ -80,5 +80,4 @@ struct st_proto_s {
 extern long st_register(struct st_proto_s *);
 extern long st_unregister(enum proto_type);
-extern struct platform_device *st_get_plat_device(void);
 #endif /* ST_H */
diff --git a/drivers/staging/ti-st/st_core.c b/drivers/staging/ti-st/st_core.c
index 063c9b1db1ab..b85d8bfdf600 100644
--- a/drivers/staging/ti-st/st_core.c
+++ b/drivers/staging/ti-st/st_core.c
@@ -38,7 +38,6 @@
 #include "st_ll.h"
 #include "st.h"
-#define VERBOSE
 /* strings to be used for rfkill entries and by
 * ST Core to be used for sysfs debug entry
 */
@@ -581,7 +580,7 @@ long st_register(struct st_proto_s *new_proto)
        long err = 0;
        unsigned long flags = 0;
-        st_kim_ref(&st_gdata);
+        st_kim_ref(&st_gdata, 0);
        pr_info("%s(%d) ", __func__, new_proto->type);
        if (st_gdata == NULL || new_proto == NULL || new_proto->recv == NULL
            || new_proto->reg_complete_cb == NULL) {
@@ -713,7 +712,7 @@ long st_unregister(enum proto_type type)
        pr_debug("%s: %d ", __func__, type);
-        st_kim_ref(&st_gdata);
+        st_kim_ref(&st_gdata, 0);
        if (type < ST_BT || type >= ST_MAX) {
                pr_err(" protocol %d not supported", type);
                return -EPROTONOSUPPORT;
@@ -767,7 +766,7 @@ long st_write(struct sk_buff *skb)
 #endif
        long len;
-        st_kim_ref(&st_gdata);
+        st_kim_ref(&st_gdata, 0);
        if (unlikely(skb == NULL || st_gdata == NULL
                || st_gdata->tty == NULL)) {
                pr_err("data/tty unavailable to perform write");
@@ -818,7 +817,7 @@ static int st_tty_open(struct tty_struct *tty)
        struct st_data_s *st_gdata;
        pr_info("%s ", __func__);
-        st_kim_ref(&st_gdata);
+        st_kim_ref(&st_gdata, 0);
        st_gdata->tty = tty;
        tty->disc_data = st_gdata;
diff --git a/drivers/staging/ti-st/st_core.h b/drivers/staging/ti-st/st_core.h
index e0c32d149f5f..8601320a679e 100644
--- a/drivers/staging/ti-st/st_core.h
+++ b/drivers/staging/ti-st/st_core.h
@@ -117,7 +117,7 @@ int st_core_init(struct st_data_s **);
 void st_core_exit(struct st_data_s *);
 /* ask for reference from KIM */
-void st_kim_ref(struct st_data_s **);
+void st_kim_ref(struct st_data_s **, int);
 #define GPS_STUB_TEST
 #ifdef GPS_STUB_TEST
diff --git a/drivers/staging/ti-st/st_kim.c b/drivers/staging/ti-st/st_kim.c
index b4a6c7fdc4e6..9e99463f76e8 100644
--- a/drivers/staging/ti-st/st_kim.c
+++ b/drivers/staging/ti-st/st_kim.c
@@ -72,11 +72,26 @@ const unsigned char *protocol_names[] = {
        PROTO_ENTRY(ST_GPS, "GPS"),
 };
+#define MAX_ST_DEVICES  3       /* Imagine 1 on each UART for now */
+struct platform_device *st_kim_devices[MAX_ST_DEVICES];
 /**********************************************************************/
 /* internal functions */
 /**
+ * st_get_plat_device -
+ *      function which returns the reference to the platform device
+ *      requested by id. As of now only 1 such device exists (id=0)
+ *      the context requesting for reference can get the id to be
+ *      requested by a. The protocol driver which is registering or
+ *      b. the tty device which is opened.
+ */
+static struct platform_device *st_get_plat_device(int id)
+{
+        return st_kim_devices[id];
+}
+/**
 * validate_firmware_response -
 *      function to return whether the firmware response was proper
 *      in case of error don't complete so that waiting for proper
@@ -353,7 +368,7 @@ void st_kim_chip_toggle(enum proto_type type, enum kim_gpio_state state)
        struct kim_data_s       *kim_gdata;
        pr_info(" %s ", __func__);
-        kim_pdev = st_get_plat_device();
+        kim_pdev = st_get_plat_device(0);
        kim_gdata = dev_get_drvdata(&kim_pdev->dev);
        if (kim_gdata->gpios[type] == -1) {
@@ -574,12 +589,12 @@ static int kim_toggle_radio(void *data, bool blocked)
 *      This would enable multiple such platform devices to exist
 *      on a given platform
 */
-void st_kim_ref(struct st_data_s **core_data)
+void st_kim_ref(struct st_data_s **core_data, int id)
 {
        struct platform_device  *pdev;
        struct kim_data_s       *kim_gdata;
        /* get kim_gdata reference from platform device */
-        pdev = st_get_plat_device();
+        pdev = st_get_plat_device(id);
        kim_gdata = dev_get_drvdata(&pdev->dev);
        *core_data = kim_gdata->core_data;
 }
@@ -623,6 +638,7 @@ static int kim_probe(struct platform_device *pdev)
        long *gpios = pdev->dev.platform_data;
        struct kim_data_s       *kim_gdata;
+        st_kim_devices[pdev->id] = pdev;
        kim_gdata = kzalloc(sizeof(struct kim_data_s), GFP_ATOMIC);
        if (!kim_gdata) {
                pr_err("no mem to allocate");
diff --git a/drivers/staging/tm6000/Kconfig b/drivers/staging/tm6000/Kconfig
index c725356cc346..de7ebb99d8f6 100644
--- a/drivers/staging/tm6000/Kconfig
+++ b/drivers/staging/tm6000/Kconfig
@@ -1,6 +1,6 @@
 config VIDEO_TM6000
        tristate "TV Master TM5600/6000/6010 driver"
-        depends on VIDEO_DEV && I2C && INPUT && USB && EXPERIMENTAL
+        depends on VIDEO_DEV && I2C && INPUT && IR_CORE && USB && EXPERIMENTAL
        select VIDEO_TUNER
        select MEDIA_TUNER_XC2028
        select MEDIA_TUNER_XC5000
diff --git a/drivers/staging/tm6000/tm6000-input.c b/drivers/staging/tm6000/tm6000-input.c
index 32f7a0af6938..54f7667cc706 100644
--- a/drivers/staging/tm6000/tm6000-input.c
+++ b/drivers/staging/tm6000/tm6000-input.c
@@ -46,7 +46,7 @@ MODULE_PARM_DESC(enable_ir, "enable ir (default is enable");
        }
 struct tm6000_ir_poll_result {
-        u8 rc_data[4];
+        u16 rc_data;
 };
 struct tm6000_IR {
@@ -60,9 +60,9 @@ struct tm6000_IR {
        int                     polling;
        struct delayed_work     work;
        u8                      wait:1;
+        u8                      key:1;
        struct urb              *int_urb;
        u8                      *urb_data;
-        u8                      key:1;
        int (*get_key) (struct tm6000_IR *, struct tm6000_ir_poll_result *);
@@ -122,13 +122,14 @@ static void tm6000_ir_urb_received(struct urb *urb)
        if (urb->status != 0)
                printk(KERN_INFO "not ready\n");
-        else if (urb->actual_length > 0)
+        else if (urb->actual_length > 0) {
                memcpy(ir->urb_data, urb->transfer_buffer, urb->actual_length);
-        dprintk("data %02x %02x %02x %02x\n", ir->urb_data[0],
+                dprintk("data %02x %02x %02x %02x\n", ir->urb_data[0],
-        ir->urb_data[1], ir->urb_data[2], ir->urb_data[3]);
+                        ir->urb_data[1], ir->urb_data[2], ir->urb_data[3]);
-        ir->key = 1;
+                ir->key = 1;
+        }
        rc = usb_submit_urb(urb, GFP_ATOMIC);
 }
@@ -140,30 +141,47 @@ static int default_polling_getkey(struct tm6000_IR *ir,
        int rc;
        u8 buf[2];
-        if (ir->wait && !&dev->int_in) {
+        if (ir->wait && !&dev->int_in)
-                poll_result->rc_data[0] = 0xff;
                return 0;
-        }
        if (&dev->int_in) {
-                poll_result->rc_data[0] = ir->urb_data[0];
+                if (ir->ir.ir_type == IR_TYPE_RC5)
-                poll_result->rc_data[1] = ir->urb_data[1];
+                        poll_result->rc_data = ir->urb_data[0];
+                else
+                        poll_result->rc_data = ir->urb_data[0] | ir->urb_data[1] << 8;
        } else {
                tm6000_set_reg(dev, REQ_04_EN_DISABLE_MCU_INT, 2, 0);
                msleep(10);
                tm6000_set_reg(dev, REQ_04_EN_DISABLE_MCU_INT, 2, 1);
                msleep(10);
-                rc = tm6000_read_write_usb(dev, USB_DIR_IN | USB_TYPE_VENDOR |
+                if (ir->ir.ir_type == IR_TYPE_RC5) {
-                 USB_RECIP_DEVICE, REQ_02_GET_IR_CODE, 0, 0, buf, 1);
+                        rc = tm6000_read_write_usb(dev, USB_DIR_IN |
+                                USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+                                REQ_02_GET_IR_CODE, 0, 0, buf, 1);
-                msleep(10);
+                        msleep(10);
-                dprintk("read data=%02x\n", buf[0]);
+                        dprintk("read data=%02x\n", buf[0]);
-                if (rc < 0)
+                        if (rc < 0)
-                        return rc;
+                                return rc;
-                poll_result->rc_data[0] = buf[0];
+                        poll_result->rc_data = buf[0];
+                } else {
+                        rc = tm6000_read_write_usb(dev, USB_DIR_IN |
+                                USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+                                REQ_02_GET_IR_CODE, 0, 0, buf, 2);
+                        msleep(10);
+                        dprintk("read data=%04x\n", buf[0] | buf[1] << 8);
+                        if (rc < 0)
+                                return rc;
+                        poll_result->rc_data = buf[0] | buf[1] << 8;
+                }
+                if ((poll_result->rc_data & 0x00ff) != 0xff)
+                        ir->key = 1;
        }
        return 0;
 }
@@ -180,12 +198,11 @@ static void tm6000_ir_handle_key(struct tm6000_IR *ir)
                return;
        }
-        dprintk("ir->get_key result data=%02x %02x\n",
+        dprintk("ir->get_key result data=%04x\n", poll_result.rc_data);
-                poll_result.rc_data[0], poll_result.rc_data[1]);
-        if (poll_result.rc_data[0] != 0xff && ir->key == 1) {
+        if (ir->key) {
                ir_input_keydown(ir->input->input_dev, &ir->ir,
-                        poll_result.rc_data[0] | poll_result.rc_data[1] << 8);
+                                (u32)poll_result.rc_data);
                ir_input_nokey(ir->input->input_dev, &ir->ir);
                ir->key = 0;
diff --git a/drivers/usb/core/Kconfig b/drivers/usb/core/Kconfig
index 7e594449600e..9eed5b52d9de 100644
--- a/drivers/usb/core/Kconfig
+++ b/drivers/usb/core/Kconfig
@@ -91,12 +91,12 @@ config USB_DYNAMIC_MINORS
          If you are unsure about this, say N here.
 config USB_SUSPEND
-        bool "USB runtime power management (suspend/resume and wakeup)"
+        bool "USB runtime power management (autosuspend) and wakeup"
        depends on USB && PM_RUNTIME
        help
          If you say Y here, you can use driver calls or the sysfs
-          "power/level" file to suspend or resume individual USB
+          "power/control" file to enable or disable autosuspend for
-          peripherals and to enable or disable autosuspend (see
+          individual USB peripherals (see
          Documentation/usb/power-management.txt for more details).
          Also, USB "remote wakeup" signaling is supported, whereby some
diff --git a/drivers/usb/core/file.c b/drivers/usb/core/file.c
index f06f5dbc8cdc..1e6ccef2cf0c 100644
--- a/drivers/usb/core/file.c
+++ b/drivers/usb/core/file.c
@@ -159,9 +159,9 @@ void usb_major_cleanup(void)
 int usb_register_dev(struct usb_interface *intf,
                     struct usb_class_driver *class_driver)
 {
-        int retval = -EINVAL;
+        int retval;
        int minor_base = class_driver->minor_base;
-        int minor = 0;
+        int minor;
        char name[20];
        char *temp;
@@ -173,12 +173,17 @@ int usb_register_dev(struct usb_interface *intf,
         */
        minor_base = 0;
 #endif
-        intf->minor = -1;
-        dbg ("looking for a minor, starting at %d", minor_base);
        if (class_driver->fops == NULL)
-                goto exit;
+                return -EINVAL;
+        if (intf->minor >= 0)
+                return -EADDRINUSE;
+        retval = init_usb_class();
+        if (retval)
+                return retval;
+        dev_dbg(&intf->dev, "looking for a minor, starting at %d", minor_base);
        down_write(&minor_rwsem);
        for (minor = minor_base; minor < MAX_USB_MINORS; ++minor) {
@@ -186,20 +191,12 @@ int usb_register_dev(struct usb_interface *intf,
                        continue;
                usb_minors[minor] = class_driver->fops;
+                intf->minor = minor;
-                retval = 0;
                break;
        }
        up_write(&minor_rwsem);
+        if (intf->minor < 0)
-        if (retval)
+                return -EXFULL;
-                goto exit;
-        retval = init_usb_class();
-        if (retval)
-                goto exit;
-        intf->minor = minor;
        /* create a usb class device for this usb interface */
        snprintf(name, sizeof(name), class_driver->name, minor - minor_base);
@@ -213,11 +210,11 @@ int usb_register_dev(struct usb_interface *intf,
                                      "%s", temp);
        if (IS_ERR(intf->usb_dev)) {
                down_write(&minor_rwsem);
-                usb_minors[intf->minor] = NULL;
+                usb_minors[minor] = NULL;
+                intf->minor = -1;
                up_write(&minor_rwsem);
                retval = PTR_ERR(intf->usb_dev);
        }
-exit:
        return retval;
 }
 EXPORT_SYMBOL_GPL(usb_register_dev);
diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c
index 844683e50383..9f0ce7de0e36 100644
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -1802,6 +1802,7 @@ free_interfaces:
                intf->dev.groups = usb_interface_groups;
                intf->dev.dma_mask = dev->dev.dma_mask;
                INIT_WORK(&intf->reset_ws, __usb_queue_reset_device);
+                intf->minor = -1;
                device_initialize(&intf->dev);
                dev_set_name(&intf->dev, "%d-%s:%d.%d",
                        dev->bus->busnum, dev->devpath,
diff --git a/drivers/usb/musb/cppi_dma.c b/drivers/usb/musb/cppi_dma.c
index 59dc3d351b60..5ab5bb89bae3 100644
--- a/drivers/usb/musb/cppi_dma.c
+++ b/drivers/usb/musb/cppi_dma.c
@@ -322,6 +322,7 @@ cppi_channel_allocate(struct dma_controller *c,
                                index, transmit ? 'T' : 'R', cppi_ch);
        cppi_ch->hw_ep = ep;
        cppi_ch->channel.status = MUSB_DMA_STATUS_FREE;
+        cppi_ch->channel.max_len = 0x7fffffff;
        DBG(4, "Allocate CPPI%d %cX\n", index, transmit ? 'T' : 'R');
        return &cppi_ch->channel;
diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
index 6fca870e957e..d065e23f123e 100644
--- a/drivers/usb/musb/musb_gadget.c
+++ b/drivers/usb/musb/musb_gadget.c
@@ -300,6 +300,11 @@ static void txstate(struct musb *musb, struct musb_request *req)
 #ifndef CONFIG_MUSB_PIO_ONLY
        if (is_dma_capable() && musb_ep->dma) {
                struct dma_controller   *c = musb->dma_controller;
+                size_t request_size;
+                /* setup DMA, then program endpoint CSR */
+                request_size = min_t(size_t, request->length - request->actual,
+                                        musb_ep->dma->max_len);
                use_dma = (request->dma != DMA_ADDR_INVALID);
@@ -307,11 +312,6 @@ static void txstate(struct musb *musb, struct musb_request *req)
 #ifdef CONFIG_USB_INVENTRA_DMA
                {
-                        size_t request_size;
-                        /* setup DMA, then program endpoint CSR */
-                        request_size = min_t(size_t, request->length,
-                                                musb_ep->dma->max_len);
                        if (request_size < musb_ep->packet_sz)
                                musb_ep->dma->desired_mode = 0;
                        else
@@ -373,8 +373,8 @@ static void txstate(struct musb *musb, struct musb_request *req)
                use_dma = use_dma && c->channel_program(
                                musb_ep->dma, musb_ep->packet_sz,
                                0,
-                                request->dma,
+                                request->dma + request->actual,
-                                request->length);
+                                request_size);
                if (!use_dma) {
                        c->channel_release(musb_ep->dma);
                        musb_ep->dma = NULL;
@@ -386,8 +386,8 @@ static void txstate(struct musb *musb, struct musb_request *req)
                use_dma = use_dma && c->channel_program(
                                musb_ep->dma, musb_ep->packet_sz,
                                request->zero,
-                                request->dma,
+                                request->dma + request->actual,
-                                request->length);
+                                request_size);
 #endif
        }
 #endif
@@ -501,26 +501,14 @@ void musb_g_tx(struct musb *musb, u8 epnum)
                                request->zero = 0;
                        }
-                        /* ... or if not, then complete it. */
+                        if (request->actual == request->length) {
-                        musb_g_giveback(musb_ep, request, 0);
+                                musb_g_giveback(musb_ep, request, 0);
+                                request = musb_ep->desc ? next_request(musb_ep) : NULL;
-                        /*
+                                if (!request) {
-                         * Kickstart next transfer if appropriate;
+                                        DBG(4, "%s idle now\n",
-                         * the packet that just completed might not
+                                                musb_ep->end_point.name);
-                         * be transmitted for hours or days.
+                                        return;
-                         * REVISIT for double buffering...
+                                }
-                         * FIXME revisit for stalls too...
-                         */
-                        musb_ep_select(mbase, epnum);
-                        csr = musb_readw(epio, MUSB_TXCSR);
-                        if (csr & MUSB_TXCSR_FIFONOTEMPTY)
-                                return;
-                        request = musb_ep->desc ? next_request(musb_ep) : NULL;
-                        if (!request) {
-                                DBG(4, "%s idle now\n",
-                                        musb_ep->end_point.name);
-                                return;
                        }
                }
@@ -568,11 +556,19 @@ static void rxstate(struct musb *musb, struct musb_request *req)
 {
        const u8                epnum = req->epnum;
        struct usb_request      *request = &req->request;
-        struct musb_ep          *musb_ep = &musb->endpoints[epnum].ep_out;
+        struct musb_ep          *musb_ep;
        void __iomem            *epio = musb->endpoints[epnum].regs;
        unsigned                fifo_count = 0;
-        u16                     len = musb_ep->packet_sz;
+        u16                     len;
        u16                     csr = musb_readw(epio, MUSB_RXCSR);
+        struct musb_hw_ep       *hw_ep = &musb->endpoints[epnum];
+        if (hw_ep->is_shared_fifo)
+                musb_ep = &hw_ep->ep_in;
+        else
+                musb_ep = &hw_ep->ep_out;
+        len = musb_ep->packet_sz;
        /* We shouldn't get here while DMA is active, but we do... */
        if (dma_channel_status(musb_ep->dma) == MUSB_DMA_STATUS_BUSY) {
@@ -647,8 +643,8 @@ static void rxstate(struct musb *musb, struct musb_request *req)
         */
                                csr |= MUSB_RXCSR_DMAENAB;
-#ifdef USE_MODE1
                                csr |= MUSB_RXCSR_AUTOCLEAR;
+#ifdef USE_MODE1
                                /* csr |= MUSB_RXCSR_DMAMODE; */
                                /* this special sequence (enabling and then
@@ -663,10 +659,11 @@ static void rxstate(struct musb *musb, struct musb_request *req)
                                if (request->actual < request->length) {
                                        int transfer_size = 0;
 #ifdef USE_MODE1
-                                        transfer_size = min(request->length,
+                                        transfer_size = min(request->length - request->actual,
                                                        channel->max_len);
 #else
-                                        transfer_size = len;
+                                        transfer_size = min(request->length - request->actual,
+                                                        (unsigned)len);
 #endif
                                        if (transfer_size <= musb_ep->packet_sz)
                                                musb_ep->dma->desired_mode = 0;
@@ -740,9 +737,15 @@ void musb_g_rx(struct musb *musb, u8 epnum)
        u16                     csr;
        struct usb_request      *request;
        void __iomem            *mbase = musb->mregs;
-        struct musb_ep          *musb_ep = &musb->endpoints[epnum].ep_out;
+        struct musb_ep          *musb_ep;
        void __iomem            *epio = musb->endpoints[epnum].regs;
        struct dma_channel      *dma;
+        struct musb_hw_ep       *hw_ep = &musb->endpoints[epnum];
+        if (hw_ep->is_shared_fifo)
+                musb_ep = &hw_ep->ep_in;
+        else
+                musb_ep = &hw_ep->ep_out;
        musb_ep_select(mbase, epnum);
@@ -1081,7 +1084,7 @@ struct free_record {
 /*
 * Context: controller locked, IRQs blocked.
 */
-static void musb_ep_restart(struct musb *musb, struct musb_request *req)
+void musb_ep_restart(struct musb *musb, struct musb_request *req)
 {
        DBG(3, "<== %s request %p len %u on hw_ep%d\n",
                req->tx ? "TX/IN" : "RX/OUT",
diff --git a/drivers/usb/musb/musb_gadget.h b/drivers/usb/musb/musb_gadget.h
index c8b140325d82..572b1da7f2dc 100644
--- a/drivers/usb/musb/musb_gadget.h
+++ b/drivers/usb/musb/musb_gadget.h
@@ -105,4 +105,6 @@ extern void musb_gadget_cleanup(struct musb *);
 extern void musb_g_giveback(struct musb_ep *, struct usb_request *, int);
+extern void musb_ep_restart(struct musb *, struct musb_request *);
 #endif          /* __MUSB_GADGET_H */
diff --git a/drivers/usb/musb/musb_gadget_ep0.c b/drivers/usb/musb/musb_gadget_ep0.c
index 59bef8f3a358..6dd03f4c5f49 100644
--- a/drivers/usb/musb/musb_gadget_ep0.c
+++ b/drivers/usb/musb/musb_gadget_ep0.c
@@ -261,6 +261,7 @@ __acquires(musb->lock)
                                        ctrlrequest->wIndex & 0x0f;
                                struct musb_ep          *musb_ep;
                                struct musb_hw_ep       *ep;
+                                struct musb_request     *request;
                                void __iomem            *regs;
                                int                     is_in;
                                u16                     csr;
@@ -302,6 +303,14 @@ __acquires(musb->lock)
                                        musb_writew(regs, MUSB_RXCSR, csr);
                                }
+                                /* Maybe start the first request in the queue */
+                                request = to_musb_request(
+                                                next_request(musb_ep));
+                                if (!musb_ep->busy && request) {
+                                        DBG(3, "restarting the request\n");
+                                        musb_ep_restart(musb, request);
+                                }
                                /* select ep0 again */
                                musb_ep_select(mbase, 0);
                                } break;
diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
index 877d20b1dff9..9e65c47cc98b 100644
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -660,6 +660,12 @@ static bool musb_tx_dma_program(struct dma_controller *dma,
        qh->segsize = length;
+        /*
+         * Ensure the data reaches to main memory before starting
+         * DMA transfer
+         */
+        wmb();
        if (!dma->channel_program(channel, pkt_size, mode,
                        urb->transfer_dma + offset, length)) {
                dma->channel_release(channel);
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 29e850a7a2f9..7c8008225ee3 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -243,7 +243,7 @@ static int get_rx_bufs(struct vhost_virtqueue *vq,
        int r, nlogs = 0;
        while (datalen > 0) {
-                if (unlikely(headcount >= VHOST_NET_MAX_SG)) {
+                if (unlikely(seg >= VHOST_NET_MAX_SG)) {
                        r = -ENOBUFS;
                        goto err;
                }
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index c579dcc9200c..dd3d6f7406f8 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -858,11 +858,12 @@ int vhost_log_write(struct vhost_virtqueue *vq, struct vhost_log *log,
                if (r < 0)
                        return r;
                len -= l;
-                if (!len)
+                if (!len) {
+                        if (vq->log_ctx)
+                                eventfd_signal(vq->log_ctx, 1);
                        return 0;
+                }
        }
-        if (vq->log_ctx)
-                eventfd_signal(vq->log_ctx, 1);
        /* Length written exceeds what we have stored. This is a bug. */
        BUG();
        return 0;
diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
index 84f842331dfa..7ccc967831f0 100644
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -3508,7 +3508,7 @@ static void fbcon_exit(void)
        softback_buf = 0UL;
        for (i = 0; i < FB_MAX; i++) {
-                int pending;
+                int pending = 0;
                mapped = 0;
                info = registered_fb[i];
@@ -3516,7 +3516,8 @@ static void fbcon_exit(void)
                if (info == NULL)
                        continue;
-                pending = cancel_work_sync(&info->queue);
+                if (info->queue.func)
+                        pending = cancel_work_sync(&info->queue);
                DPRINTK("fbcon: %s pending work\n", (pending ? "canceled" :
                        "no"));
diff --git a/drivers/video/efifb.c b/drivers/video/efifb.c
index 815f84b07933..70477c2e4b61 100644
--- a/drivers/video/efifb.c
+++ b/drivers/video/efifb.c
@@ -13,7 +13,7 @@
 #include <linux/platform_device.h>
 #include <linux/screen_info.h>
 #include <linux/dmi.h>
+#include <linux/pci.h>
 #include <video/vga.h>
 static struct fb_var_screeninfo efifb_defined __devinitdata = {
@@ -39,17 +39,31 @@ enum {
        M_I20,          /* 20-Inch iMac */
        M_I20_SR,       /* 20-Inch iMac (Santa Rosa) */
        M_I24,          /* 24-Inch iMac */
+        M_I24_8_1,      /* 24-Inch iMac, 8,1th gen */
+        M_I24_10_1,     /* 24-Inch iMac, 10,1th gen */
+        M_I27_11_1,     /* 27-Inch iMac, 11,1th gen */
        M_MINI,         /* Mac Mini */
+        M_MINI_3_1,     /* Mac Mini, 3,1th gen */
+        M_MINI_4_1,     /* Mac Mini, 4,1th gen */
        M_MB,           /* MacBook */
        M_MB_2,         /* MacBook, 2nd rev. */
        M_MB_3,         /* MacBook, 3rd rev. */
+        M_MB_5_1,       /* MacBook, 5th rev. */
+        M_MB_6_1,       /* MacBook, 6th rev. */
+        M_MB_7_1,       /* MacBook, 7th rev. */
        M_MB_SR,        /* MacBook, 2nd gen, (Santa Rosa) */
        M_MBA,          /* MacBook Air */
        M_MBP,          /* MacBook Pro */
        M_MBP_2,        /* MacBook Pro 2nd gen */
+        M_MBP_2_2,      /* MacBook Pro 2,2nd gen */
        M_MBP_SR,       /* MacBook Pro (Santa Rosa) */
        M_MBP_4,        /* MacBook Pro, 4th gen */
        M_MBP_5_1,    /* MacBook Pro, 5,1th gen */
+        M_MBP_5_2,      /* MacBook Pro, 5,2th gen */
+        M_MBP_5_3,      /* MacBook Pro, 5,3rd gen */
+        M_MBP_6_1,      /* MacBook Pro, 6,1th gen */
+        M_MBP_6_2,      /* MacBook Pro, 6,2th gen */
+        M_MBP_7_1,      /* MacBook Pro, 7,1th gen */
        M_UNKNOWN       /* placeholder */
 };
@@ -64,14 +78,28 @@ static struct efifb_dmi_info {
        [M_I20] = { "i20", 0x80010000, 1728 * 4, 1680, 1050 }, /* guess */
        [M_I20_SR] = { "imac7", 0x40010000, 1728 * 4, 1680, 1050 },
        [M_I24] = { "i24", 0x80010000, 2048 * 4, 1920, 1200 }, /* guess */
+        [M_I24_8_1] = { "imac8", 0xc0060000, 2048 * 4, 1920, 1200 },
+        [M_I24_10_1] = { "imac10", 0xc0010000, 2048 * 4, 1920, 1080 },
+        [M_I27_11_1] = { "imac11", 0xc0010000, 2560 * 4, 2560, 1440 },
        [M_MINI]= { "mini", 0x80000000, 2048 * 4, 1024, 768 },
+        [M_MINI_3_1] = { "mini31", 0x40010000, 1024 * 4, 1024, 768 },
+        [M_MINI_4_1] = { "mini41", 0xc0010000, 2048 * 4, 1920, 1200 },
        [M_MB] = { "macbook", 0x80000000, 2048 * 4, 1280, 800 },
+        [M_MB_5_1] = { "macbook51", 0x80010000, 2048 * 4, 1280, 800 },
+        [M_MB_6_1] = { "macbook61", 0x80010000, 2048 * 4, 1280, 800 },
+        [M_MB_7_1] = { "macbook71", 0x80010000, 2048 * 4, 1280, 800 },
        [M_MBA] = { "mba", 0x80000000, 2048 * 4, 1280, 800 },
        [M_MBP] = { "mbp", 0x80010000, 1472 * 4, 1440, 900 },
        [M_MBP_2] = { "mbp2", 0, 0, 0, 0 }, /* placeholder */
+        [M_MBP_2_2] = { "mbp22", 0x80010000, 1472 * 4, 1440, 900 },
        [M_MBP_SR] = { "mbp3", 0x80030000, 2048 * 4, 1440, 900 },
        [M_MBP_4] = { "mbp4", 0xc0060000, 2048 * 4, 1920, 1200 },
        [M_MBP_5_1] = { "mbp51", 0xc0010000, 2048 * 4, 1440, 900 },
+        [M_MBP_5_2] = { "mbp52", 0xc0010000, 2048 * 4, 1920, 1200 },
+        [M_MBP_5_3] = { "mbp53", 0xd0010000, 2048 * 4, 1440, 900 },
+        [M_MBP_6_1] = { "mbp61", 0x90030000, 2048 * 4, 1920, 1200 },
+        [M_MBP_6_2] = { "mbp62", 0x90030000, 2048 * 4, 1680, 1050 },
+        [M_MBP_7_1] = { "mbp71", 0xc0010000, 2048 * 4, 1280, 800 },
        [M_UNKNOWN] = { NULL, 0, 0, 0, 0 }
 };
@@ -92,7 +120,12 @@ static const struct dmi_system_id dmi_system_table[] __initconst = {
        EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "iMac6,1", M_I24),
        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "iMac6,1", M_I24),
        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "iMac7,1", M_I20_SR),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "iMac8,1", M_I24_8_1),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "iMac10,1", M_I24_10_1),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "iMac11,1", M_I27_11_1),
        EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "Macmini1,1", M_MINI),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "Macmini3,1", M_MINI_3_1),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "Macmini4,1", M_MINI_4_1),
        EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "MacBook1,1", M_MB),
        /* At least one of these two will be right; maybe both? */
        EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "MacBook2,1", M_MB),
@@ -101,14 +134,23 @@ static const struct dmi_system_id dmi_system_table[] __initconst = {
        EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "MacBook3,1", M_MB),
        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBook3,1", M_MB),
        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBook4,1", M_MB),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBook5,1", M_MB_5_1),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBook6,1", M_MB_6_1),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBook7,1", M_MB_7_1),
        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookAir1,1", M_MBA),
        EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "MacBookPro1,1", M_MBP),
        EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "MacBookPro2,1", M_MBP_2),
+        EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "MacBookPro2,2", M_MBP_2_2),
        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro2,1", M_MBP_2),
        EFIFB_DMI_SYSTEM_ID("Apple Computer, Inc.", "MacBookPro3,1", M_MBP_SR),
        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro3,1", M_MBP_SR),
        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro4,1", M_MBP_4),
        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro5,1", M_MBP_5_1),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro5,2", M_MBP_5_2),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro5,3", M_MBP_5_3),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro6,1", M_MBP_6_1),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro6,2", M_MBP_6_2),
+        EFIFB_DMI_SYSTEM_ID("Apple Inc.", "MacBookPro7,1", M_MBP_7_1),
        {},
 };
@@ -116,7 +158,7 @@ static int set_system(const struct dmi_system_id *id)
 {
        struct efifb_dmi_info *info = id->driver_data;
        if (info->base == 0)
-                return -ENODEV;
+                return 0;
        printk(KERN_INFO "efifb: dmi detected %s - framebuffer at %p "
                         "(%dx%d, stride %d)\n", id->ident,
@@ -124,18 +166,55 @@ static int set_system(const struct dmi_system_id *id)
                         info->stride);
        /* Trust the bootloader over the DMI tables */
-        if (screen_info.lfb_base == 0)
+        if (screen_info.lfb_base == 0) {
+#if defined(CONFIG_PCI)
+                struct pci_dev *dev = NULL;
+                int found_bar = 0;
+#endif
                screen_info.lfb_base = info->base;
-        if (screen_info.lfb_linelength == 0)
-                screen_info.lfb_linelength = info->stride;
-        if (screen_info.lfb_width == 0)
-                screen_info.lfb_width = info->width;
-        if (screen_info.lfb_height == 0)
-                screen_info.lfb_height = info->height;
-        if (screen_info.orig_video_isVGA == 0)
-                screen_info.orig_video_isVGA = VIDEO_TYPE_EFI;
-        return 0;
+#if defined(CONFIG_PCI)
+                /* make sure that the address in the table is actually on a
+                 * VGA device's PCI BAR */
+                for_each_pci_dev(dev) {
+                        int i;
+                        if ((dev->class >> 8) != PCI_CLASS_DISPLAY_VGA)
+                                continue;
+                        for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
+                                resource_size_t start, end;
+                                start = pci_resource_start(dev, i);
+                                if (start == 0)
+                                        break;
+                                end = pci_resource_end(dev, i);
+                                if (screen_info.lfb_base >= start &&
+                                                screen_info.lfb_base < end) {
+                                        found_bar = 1;
+                                }
+                        }
+                }
+                if (!found_bar)
+                        screen_info.lfb_base = 0;
+#endif
+        }
+        if (screen_info.lfb_base) {
+                if (screen_info.lfb_linelength == 0)
+                        screen_info.lfb_linelength = info->stride;
+                if (screen_info.lfb_width == 0)
+                        screen_info.lfb_width = info->width;
+                if (screen_info.lfb_height == 0)
+                        screen_info.lfb_height = info->height;
+                if (screen_info.orig_video_isVGA == 0)
+                        screen_info.orig_video_isVGA = VIDEO_TYPE_EFI;
+        } else {
+                screen_info.lfb_linelength = 0;
+                screen_info.lfb_width = 0;
+                screen_info.lfb_height = 0;
+                screen_info.orig_video_isVGA = 0;
+                return 0;
+        }
+        return 1;
 }
 static int efifb_setcolreg(unsigned regno, unsigned red, unsigned green,
diff --git a/drivers/video/pxa168fb.c b/drivers/video/pxa168fb.c
index 5d786bd3e304..a31a77ff6f3d 100644
--- a/drivers/video/pxa168fb.c
+++ b/drivers/video/pxa168fb.c
@@ -298,8 +298,8 @@ static void set_dma_control0(struct pxa168fb_info *fbi)
         * Set bit to enable graphics DMA.
         */
        x = readl(fbi->reg_base + LCD_SPU_DMA_CTRL0);
-        x |= fbi->active ? 0x00000100 : 0;
+        x &= ~CFG_GRA_ENA_MASK;
-        fbi->active = 0;
+        x |= fbi->active ? CFG_GRA_ENA(1) : CFG_GRA_ENA(0);
        /*
         * If we are in a pseudo-color mode, we need to enable
diff --git a/drivers/video/sis/sis_main.c b/drivers/video/sis/sis_main.c
index 559bf1727a2b..b52f8e4ef1fd 100644
--- a/drivers/video/sis/sis_main.c
+++ b/drivers/video/sis/sis_main.c
@@ -1701,6 +1701,9 @@ static int	sisfb_ioctl(struct fb_info *info, unsigned int cmd,
                break;
           case FBIOGET_VBLANK:
+                memset(&sisvbblank, 0, sizeof(struct fb_vblank));
                sisvbblank.count = 0;
                sisvbblank.flags = sisfb_setupvbblankflags(ivideo, &sisvbblank.vcount, &sisvbblank.hcount);
diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c
index 29bac5118877..d409495876f1 100644
--- a/drivers/xen/xenbus/xenbus_probe.c
+++ b/drivers/xen/xenbus/xenbus_probe.c
@@ -755,7 +755,10 @@ int register_xenstore_notifier(struct notifier_block *nb)
 {
        int ret = 0;
-        blocking_notifier_chain_register(&xenstore_chain, nb);
+        if (xenstored_ready > 0)
+                ret = nb->notifier_call(nb, 0, NULL);
+        else
+                blocking_notifier_chain_register(&xenstore_chain, nb);
        return ret;
 }
@@ -769,7 +772,7 @@ EXPORT_SYMBOL_GPL(unregister_xenstore_notifier);
 void xenbus_probe(struct work_struct *unused)
 {
-        BUG_ON((xenstored_ready <= 0));
+        xenstored_ready = 1;
        /* Enumerate devices in xenstore and watch for changes. */
        xenbus_probe_devices(&xenbus_frontend);
@@ -835,8 +838,8 @@ static int __init xenbus_init(void)
                        xen_store_evtchn = xen_start_info->store_evtchn;
                        xen_store_mfn = xen_start_info->store_mfn;
                        xen_store_interface = mfn_to_virt(xen_store_mfn);
+                        xenstored_ready = 1;
                }
-                xenstored_ready = 1;
        }
        /* Initialize the interface to xenstore. */