105 files changed, 1720 insertions, 808 deletions
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index c7a527c08a09..65a0655e7fc8 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -226,8 +226,18 @@ static inline void addQ(struct hlist_head *list, CommandList_struct *c)
 static inline void removeQ(CommandList_struct *c)
 {
-        if (WARN_ON(hlist_unhashed(&c->list)))
+        /*
+         * After kexec/dump some commands might still
+         * be in flight, which the firmware will try
+         * to complete. Resetting the firmware doesn't work
+         * with old fw revisions, so we have to mark
+         * them off as 'stale' to prevent the driver from
+         * falling over.
+         */
+        if (WARN_ON(hlist_unhashed(&c->list))) {
+                c->cmd_type = CMD_MSG_STALE;
                return;
+        }
        hlist_del_init(&c->list);
 }
@@ -4246,7 +4256,8 @@ static void fail_all_cmds(unsigned long ctlr)
        while (!hlist_empty(&h->cmpQ)) {
                c = hlist_entry(h->cmpQ.first, CommandList_struct, list);
                removeQ(c);
-                c->err_info->CommandStatus = CMD_HARDWARE_ERR;
+                if (c->cmd_type != CMD_MSG_STALE)
+                        c->err_info->CommandStatus = CMD_HARDWARE_ERR;
                if (c->cmd_type == CMD_RWREQ) {
                        complete_command(h, c, 0);
                } else if (c->cmd_type == CMD_IOCTL_PEND)
diff --git a/drivers/block/cciss_cmd.h b/drivers/block/cciss_cmd.h
index cd665b00c7c5..dbaed1ea0da3 100644
--- a/drivers/block/cciss_cmd.h
+++ b/drivers/block/cciss_cmd.h
@@ -274,6 +274,7 @@ typedef struct _ErrorInfo_struct {
 #define CMD_SCSI        0x03
 #define CMD_MSG_DONE    0x04
 #define CMD_MSG_TIMEOUT 0x05
+#define CMD_MSG_STALE   0xff
 /* This structure needs to be divisible by 8 for new
 * indexing method.
diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
index 862b40c90181..91b753013780 100644
--- a/drivers/block/floppy.c
+++ b/drivers/block/floppy.c
@@ -3327,7 +3327,10 @@ static inline int set_geometry(unsigned int cmd, struct floppy_struct *g,
                if (!capable(CAP_SYS_ADMIN))
                        return -EPERM;
                mutex_lock(&open_lock);
-                LOCK_FDC(drive, 1);
+                if (lock_fdc(drive, 1)) {
+                        mutex_unlock(&open_lock);
+                        return -EINTR;
+                }
                floppy_type[type] = *g;
                floppy_type[type].name = "user format";
                for (cnt = type << 2; cnt < (type << 2) + 4; cnt++)
diff --git a/drivers/char/tty_ldisc.c b/drivers/char/tty_ldisc.c
index a19e935847b0..913aa8d3f1c5 100644
--- a/drivers/char/tty_ldisc.c
+++ b/drivers/char/tty_ldisc.c
@@ -867,15 +867,22 @@ void tty_ldisc_release(struct tty_struct *tty, struct tty_struct *o_tty)
        tty_ldisc_wait_idle(tty);
        /*
-         * Shutdown the current line discipline, and reset it to N_TTY.
+         * Now kill off the ldisc
-         *
-         * FIXME: this MUST get fixed for the new reflocking
         */
+        tty_ldisc_close(tty, tty->ldisc);
+        tty_ldisc_put(tty->ldisc);
+        /* Force an oops if we mess this up */
+        tty->ldisc = NULL;
+        /* Ensure the next open requests the N_TTY ldisc */
+        tty_set_termios_ldisc(tty, N_TTY);
-        tty_ldisc_reinit(tty);
        /* This will need doing differently if we need to lock */
        if (o_tty)
                tty_ldisc_release(o_tty, NULL);
+        /* And the memory resources remaining (buffers, termios) will be
+           disposed of when the kref hits zero */
 }
 /**
diff --git a/drivers/clocksource/sh_tmu.c b/drivers/clocksource/sh_tmu.c
index 9ffb05f4095d..93c2322feab7 100644
--- a/drivers/clocksource/sh_tmu.c
+++ b/drivers/clocksource/sh_tmu.c
@@ -161,7 +161,7 @@ static void sh_tmu_set_next(struct sh_tmu_priv *p, unsigned long delta,
        if (periodic)
                sh_tmu_write(p, TCOR, delta);
        else
-                sh_tmu_write(p, TCOR, 0);
+                sh_tmu_write(p, TCOR, 0xffffffff);
        sh_tmu_write(p, TCNT, delta);
diff --git a/drivers/edac/edac_core.h b/drivers/edac/edac_core.h
index 3493c6bdb820..871c13b4c148 100644
--- a/drivers/edac/edac_core.h
+++ b/drivers/edac/edac_core.h
@@ -150,6 +150,8 @@ enum mem_type {
        MEM_FB_DDR2,            /* fully buffered DDR2 */
        MEM_RDDR2,              /* Registered DDR2 RAM */
        MEM_XDR,                /* Rambus XDR */
+        MEM_DDR3,               /* DDR3 RAM */
+        MEM_RDDR3,              /* Registered DDR3 RAM */
 };
 #define MEM_FLAG_EMPTY          BIT(MEM_EMPTY)
@@ -167,6 +169,8 @@ enum mem_type {
 #define MEM_FLAG_FB_DDR2        BIT(MEM_FB_DDR2)
 #define MEM_FLAG_RDDR2          BIT(MEM_RDDR2)
 #define MEM_FLAG_XDR            BIT(MEM_XDR)
+#define MEM_FLAG_DDR3            BIT(MEM_DDR3)
+#define MEM_FLAG_RDDR3           BIT(MEM_RDDR3)
 /* chipset Error Detection and Correction capabilities and mode */
 enum edac_type {
diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
index ad218fe4942d..e1d4ce083481 100644
--- a/drivers/edac/edac_mc_sysfs.c
+++ b/drivers/edac/edac_mc_sysfs.c
@@ -94,7 +94,9 @@ static const char *mem_types[] = {
        [MEM_DDR2] = "Unbuffered-DDR2",
        [MEM_FB_DDR2] = "FullyBuffered-DDR2",
        [MEM_RDDR2] = "Registered-DDR2",
-        [MEM_XDR] = "XDR"
+        [MEM_XDR] = "XDR",
+        [MEM_DDR3] = "Unbuffered-DDR3",
+        [MEM_RDDR3] = "Registered-DDR3"
 };
 static const char *dev_types[] = {
diff --git a/drivers/edac/mpc85xx_edac.c b/drivers/edac/mpc85xx_edac.c
index 7c8c2d72916f..3f2ccfc6407c 100644
--- a/drivers/edac/mpc85xx_edac.c
+++ b/drivers/edac/mpc85xx_edac.c
@@ -757,6 +757,9 @@ static void __devinit mpc85xx_init_csrows(struct mem_ctl_info *mci)
                case DSC_SDTYPE_DDR2:
                        mtype = MEM_RDDR2;
                        break;
+                case DSC_SDTYPE_DDR3:
+                        mtype = MEM_RDDR3;
+                        break;
                default:
                        mtype = MEM_UNKNOWN;
                        break;
@@ -769,6 +772,9 @@ static void __devinit mpc85xx_init_csrows(struct mem_ctl_info *mci)
                case DSC_SDTYPE_DDR2:
                        mtype = MEM_DDR2;
                        break;
+                case DSC_SDTYPE_DDR3:
+                        mtype = MEM_DDR3;
+                        break;
                default:
                        mtype = MEM_UNKNOWN;
                        break;
diff --git a/drivers/edac/mpc85xx_edac.h b/drivers/edac/mpc85xx_edac.h
index 135b3539a030..52432ee7c4b9 100644
--- a/drivers/edac/mpc85xx_edac.h
+++ b/drivers/edac/mpc85xx_edac.h
@@ -53,6 +53,7 @@
 #define DSC_SDTYPE_DDR          0x02000000
 #define DSC_SDTYPE_DDR2         0x03000000
+#define DSC_SDTYPE_DDR3         0x07000000
 #define DSC_X32_EN      0x00000020
 /* Err_Int_En */
diff --git a/drivers/gpio/pl061.c b/drivers/gpio/pl061.c
index aa8e7cb020d9..4ee4c8367a3f 100644
--- a/drivers/gpio/pl061.c
+++ b/drivers/gpio/pl061.c
@@ -109,6 +109,16 @@ static void pl061_set_value(struct gpio_chip *gc, unsigned offset, int value)
        writeb(!!value << offset, chip->base + (1 << (offset + 2)));
 }
+static int pl061_to_irq(struct gpio_chip *gc, unsigned offset)
+{
+        struct pl061_gpio *chip = container_of(gc, struct pl061_gpio, gc);
+        if (chip->irq_base == (unsigned) -1)
+                return -EINVAL;
+        return chip->irq_base + offset;
+}
 /*
 * PL061 GPIO IRQ
 */
@@ -200,7 +210,7 @@ static void pl061_irq_handler(unsigned irq, struct irq_desc *desc)
        desc->chip->ack(irq);
        list_for_each(ptr, chip_list) {
                unsigned long pending;
-                int gpio;
+                int offset;
                chip = list_entry(ptr, struct pl061_gpio, list);
                pending = readb(chip->base + GPIOMIS);
@@ -209,8 +219,8 @@ static void pl061_irq_handler(unsigned irq, struct irq_desc *desc)
                if (pending == 0)
                        continue;
-                for_each_bit(gpio, &pending, PL061_GPIO_NR)
+                for_each_bit(offset, &pending, PL061_GPIO_NR)
-                        generic_handle_irq(gpio_to_irq(gpio));
+                        generic_handle_irq(pl061_to_irq(&chip->gc, offset));
        }
        desc->chip->unmask(irq);
 }
@@ -221,7 +231,7 @@ static int __init pl061_probe(struct amba_device *dev, struct amba_id *id)
        struct pl061_gpio *chip;
        struct list_head *chip_list;
        int ret, irq, i;
-        static unsigned long init_irq[BITS_TO_LONGS(NR_IRQS)];
+        static DECLARE_BITMAP(init_irq, NR_IRQS);
        pdata = dev->dev.platform_data;
        if (pdata == NULL)
@@ -251,6 +261,7 @@ static int __init pl061_probe(struct amba_device *dev, struct amba_id *id)
        chip->gc.direction_output = pl061_direction_output;
        chip->gc.get = pl061_get_value;
        chip->gc.set = pl061_set_value;
+        chip->gc.to_irq = pl061_to_irq;
        chip->gc.base = pdata->gpio_base;
        chip->gc.ngpio = PL061_GPIO_NR;
        chip->gc.label = dev_name(&dev->dev);
@@ -280,6 +291,7 @@ static int __init pl061_probe(struct amba_device *dev, struct amba_id *id)
        if (!test_and_set_bit(irq, init_irq)) { /* list initialized? */
                chip_list = kmalloc(sizeof(*chip_list), GFP_KERNEL);
                if (chip_list == NULL) {
+                        clear_bit(irq, init_irq);
                        ret = -ENOMEM;
                        goto iounmap;
                }
diff --git a/drivers/ide/ide-acpi.c b/drivers/ide/ide-acpi.c
index 77f79d26b264..c509c9916464 100644
--- a/drivers/ide/ide-acpi.c
+++ b/drivers/ide/ide-acpi.c
@@ -92,6 +92,11 @@ int ide_acpi_init(void)
        return 0;
 }
+bool ide_port_acpi(ide_hwif_t *hwif)
+{
+        return ide_noacpi == 0 && hwif->acpidata;
+}
 /**
 * ide_get_dev_handle - finds acpi_handle and PCI device.function
 * @dev: device to locate
@@ -352,9 +357,6 @@ int ide_acpi_exec_tfs(ide_drive_t *drive)
        unsigned long   gtf_address;
        unsigned long   obj_loc;
-        if (ide_noacpi)
-                return 0;
        DEBPRINT("call get_GTF, drive=%s port=%d\n", drive->name, drive->dn);
        ret = do_drive_get_GTF(drive, &gtf_length, &gtf_address, &obj_loc);
@@ -389,16 +391,6 @@ void ide_acpi_get_timing(ide_hwif_t *hwif)
        struct acpi_buffer      output;
        union acpi_object       *out_obj;
-        if (ide_noacpi)
-                return;
-        DEBPRINT("ENTER:\n");
-        if (!hwif->acpidata) {
-                DEBPRINT("no ACPI data for %s\n", hwif->name);
-                return;
-        }
        /* Setting up output buffer for _GTM */
        output.length = ACPI_ALLOCATE_BUFFER;
        output.pointer = NULL;  /* ACPI-CA sets this; save/free it later */
@@ -479,16 +471,6 @@ void ide_acpi_push_timing(ide_hwif_t *hwif)
        struct ide_acpi_drive_link      *master = &hwif->acpidata->master;
        struct ide_acpi_drive_link      *slave = &hwif->acpidata->slave;
-        if (ide_noacpi)
-                return;
-        DEBPRINT("ENTER:\n");
-        if (!hwif->acpidata) {
-                DEBPRINT("no ACPI data for %s\n", hwif->name);
-                return;
-        }
        /* Give the GTM buffer + drive Identify data to the channel via the
         * _STM method: */
        /* setup input parameters buffer for _STM */
@@ -527,16 +509,11 @@ void ide_acpi_set_state(ide_hwif_t *hwif, int on)
        ide_drive_t *drive;
        int i;
-        if (ide_noacpi || ide_noacpi_psx)
+        if (ide_noacpi_psx)
                return;
        DEBPRINT("ENTER:\n");
-        if (!hwif->acpidata) {
-                DEBPRINT("no ACPI data for %s\n", hwif->name);
-                return;
-        }
        /* channel first and then drives for power on and verse versa for power off */
        if (on)
                acpi_bus_set_power(hwif->acpidata->obj_handle, ACPI_STATE_D0);
@@ -616,7 +593,7 @@ void ide_acpi_port_init_devices(ide_hwif_t *hwif)
                                 drive->name, err);
        }
-        if (!ide_acpionboot) {
+        if (ide_noacpi || ide_acpionboot == 0) {
                DEBPRINT("ACPI methods disabled on boot\n");
                return;
        }
diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
index f0ede5953af8..6a9a769bffc1 100644
--- a/drivers/ide/ide-cd.c
+++ b/drivers/ide/ide-cd.c
@@ -592,9 +592,19 @@ static ide_startstop_t cdrom_newpc_intr(ide_drive_t *drive)
                        }
                } else if (!blk_pc_request(rq)) {
                        ide_cd_request_sense_fixup(drive, cmd);
-                        /* complain if we still have data left to transfer */
                        uptodate = cmd->nleft ? 0 : 1;
-                        if (uptodate == 0)
+                        /*
+                         * suck out the remaining bytes from the drive in an
+                         * attempt to complete the data xfer. (see BZ#13399)
+                         */
+                        if (!(stat & ATA_ERR) && !uptodate && thislen) {
+                                ide_pio_bytes(drive, cmd, write, thislen);
+                                uptodate = cmd->nleft ? 0 : 1;
+                        }
+                        if (!uptodate)
                                rq->cmd_flags |= REQ_FAILED;
                }
                goto out_end;
diff --git a/drivers/ide/ide-devsets.c b/drivers/ide/ide-devsets.c
index 5bf958e5b1d5..1099bf7cf968 100644
--- a/drivers/ide/ide-devsets.c
+++ b/drivers/ide/ide-devsets.c
@@ -183,6 +183,6 @@ ide_startstop_t ide_do_devset(ide_drive_t *drive, struct request *rq)
        err = setfunc(drive, *(int *)&rq->cmd[1]);
        if (err)
                rq->errors = err;
-        ide_complete_rq(drive, err, ide_rq_bytes(rq));
+        ide_complete_rq(drive, err, blk_rq_bytes(rq));
        return ide_stopped;
 }
diff --git a/drivers/ide/ide-eh.c b/drivers/ide/ide-eh.c
index 2b9141979613..e9abf2c3c335 100644
--- a/drivers/ide/ide-eh.c
+++ b/drivers/ide/ide-eh.c
@@ -149,7 +149,7 @@ static inline void ide_complete_drive_reset(ide_drive_t *drive, int err)
        if (rq && blk_special_request(rq) && rq->cmd[0] == REQ_DRIVE_RESET) {
                if (err <= 0 && rq->errors == 0)
                        rq->errors = -EIO;
-                ide_complete_rq(drive, err ? err : 0, ide_rq_bytes(rq));
+                ide_complete_rq(drive, err ? err : 0, blk_rq_bytes(rq));
        }
 }
diff --git a/drivers/ide/ide-floppy.c b/drivers/ide/ide-floppy.c
index 8b3f204f7d73..fefbdfc8db06 100644
--- a/drivers/ide/ide-floppy.c
+++ b/drivers/ide/ide-floppy.c
@@ -293,7 +293,7 @@ out_end:
        drive->failed_pc = NULL;
        if (blk_fs_request(rq) == 0 && rq->errors == 0)
                rq->errors = -EIO;
-        ide_complete_rq(drive, -EIO, ide_rq_bytes(rq));
+        ide_complete_rq(drive, -EIO, blk_rq_bytes(rq));
        return ide_stopped;
 }
diff --git a/drivers/ide/ide-io.c b/drivers/ide/ide-io.c
index 93b7886a2d6e..d5f3c77beadd 100644
--- a/drivers/ide/ide-io.c
+++ b/drivers/ide/ide-io.c
@@ -112,16 +112,6 @@ void ide_complete_cmd(ide_drive_t *drive, struct ide_cmd *cmd, u8 stat, u8 err)
        }
 }
-/* obsolete, blk_rq_bytes() should be used instead */
-unsigned int ide_rq_bytes(struct request *rq)
-{
-        if (blk_pc_request(rq))
-                return blk_rq_bytes(rq);
-        else
-                return blk_rq_cur_sectors(rq) << 9;
-}
-EXPORT_SYMBOL_GPL(ide_rq_bytes);
 int ide_complete_rq(ide_drive_t *drive, int error, unsigned int nr_bytes)
 {
        ide_hwif_t *hwif = drive->hwif;
@@ -152,14 +142,14 @@ void ide_kill_rq(ide_drive_t *drive, struct request *rq)
        if ((media == ide_floppy || media == ide_tape) && drv_req) {
                rq->errors = 0;
-                ide_complete_rq(drive, 0, blk_rq_bytes(rq));
        } else {
                if (media == ide_tape)
                        rq->errors = IDE_DRV_ERROR_GENERAL;
                else if (blk_fs_request(rq) == 0 && rq->errors == 0)
                        rq->errors = -EIO;
-                ide_complete_rq(drive, -EIO, ide_rq_bytes(rq));
        }
+        ide_complete_rq(drive, -EIO, blk_rq_bytes(rq));
 }
 static void ide_tf_set_specify_cmd(ide_drive_t *drive, struct ide_taskfile *tf)
diff --git a/drivers/ide/ide-ioctls.c b/drivers/ide/ide-ioctls.c
index 82f252c3ee6e..e246d3d3fbcc 100644
--- a/drivers/ide/ide-ioctls.c
+++ b/drivers/ide/ide-ioctls.c
@@ -64,7 +64,8 @@ static int ide_get_identity_ioctl(ide_drive_t *drive, unsigned int cmd,
                goto out;
        }
-        id = kmalloc(size, GFP_KERNEL);
+        /* ata_id_to_hd_driveid() relies on 'id' to be fully allocated. */
+        id = kmalloc(ATA_ID_WORDS * 2, GFP_KERNEL);
        if (id == NULL) {
                rc = -ENOMEM;
                goto out;
diff --git a/drivers/ide/ide-pm.c b/drivers/ide/ide-pm.c
index c14ca144cffe..ad7be2669dcb 100644
--- a/drivers/ide/ide-pm.c
+++ b/drivers/ide/ide-pm.c
@@ -10,9 +10,11 @@ int generic_ide_suspend(struct device *dev, pm_message_t mesg)
        struct request_pm_state rqpm;
        int ret;
-        /* call ACPI _GTM only once */
+        if (ide_port_acpi(hwif)) {
-        if ((drive->dn & 1) == 0 || pair == NULL)
+                /* call ACPI _GTM only once */
-                ide_acpi_get_timing(hwif);
+                if ((drive->dn & 1) == 0 || pair == NULL)
+                        ide_acpi_get_timing(hwif);
+        }
        memset(&rqpm, 0, sizeof(rqpm));
        rq = blk_get_request(drive->queue, READ, __GFP_WAIT);
@@ -26,9 +28,11 @@ int generic_ide_suspend(struct device *dev, pm_message_t mesg)
        ret = blk_execute_rq(drive->queue, NULL, rq, 0);
        blk_put_request(rq);
-        /* call ACPI _PS3 only after both devices are suspended */
+        if (ret == 0 && ide_port_acpi(hwif)) {
-        if (ret == 0 && ((drive->dn & 1) || pair == NULL))
+                /* call ACPI _PS3 only after both devices are suspended */
-                ide_acpi_set_state(hwif, 0);
+                if ((drive->dn & 1) || pair == NULL)
+                        ide_acpi_set_state(hwif, 0);
+        }
        return ret;
 }
@@ -42,13 +46,15 @@ int generic_ide_resume(struct device *dev)
        struct request_pm_state rqpm;
        int err;
-        /* call ACPI _PS0 / _STM only once */
+        if (ide_port_acpi(hwif)) {
-        if ((drive->dn & 1) == 0 || pair == NULL) {
+                /* call ACPI _PS0 / _STM only once */
-                ide_acpi_set_state(hwif, 1);
+                if ((drive->dn & 1) == 0 || pair == NULL) {
-                ide_acpi_push_timing(hwif);
+                        ide_acpi_set_state(hwif, 1);
-        }
+                        ide_acpi_push_timing(hwif);
+                }
-        ide_acpi_exec_tfs(drive);
+                ide_acpi_exec_tfs(drive);
+        }
        memset(&rqpm, 0, sizeof(rqpm));
        rq = blk_get_request(drive->queue, READ, __GFP_WAIT);
diff --git a/drivers/leds/Kconfig b/drivers/leds/Kconfig
index 9b60b6b684d9..7c8e7122aaa9 100644
--- a/drivers/leds/Kconfig
+++ b/drivers/leds/Kconfig
@@ -75,6 +75,7 @@ config LEDS_ALIX2
        depends on LEDS_CLASS && X86 && EXPERIMENTAL
        help
          This option enables support for the PCEngines ALIX.2 and ALIX.3 LEDs.
+          You have to set leds-alix2.force=1 for boards with Award BIOS.
 config LEDS_H1940
        tristate "LED Support for iPAQ H1940 device"
@@ -145,15 +146,16 @@ config LEDS_GPIO_OF
          of_platform devices.  For instance, LEDs which are listed in a "dts"
          file.
-config LEDS_LP5521
+config LEDS_LP3944
-        tristate "LED Support for the LP5521 LEDs"
+        tristate "LED Support for N.S. LP3944 (Fun Light) I2C chip"
        depends on LEDS_CLASS && I2C
        help
-          If you say 'Y' here you get support for the National Semiconductor
+    This option enables support for LEDs connected to the National
-          LP5521 LED driver used in n8x0 boards.
+    Semiconductor LP3944 Lighting Management Unit (LMU) also known as
+    Fun Light Chip.
-          This driver can be built as a module by choosing 'M'. The module
+          To compile this driver as a module, choose M here: the
-          will be called leds-lp5521.
+          module will be called leds-lp3944.
 config LEDS_CLEVO_MAIL
        tristate "Mail LED on Clevo notebook"
diff --git a/drivers/leds/Makefile b/drivers/leds/Makefile
index 2d41c4dcf92f..e8cdcf77a4c3 100644
--- a/drivers/leds/Makefile
+++ b/drivers/leds/Makefile
@@ -20,6 +20,7 @@ obj-$(CONFIG_LEDS_COBALT_RAQ)		+= leds-cobalt-raq.o
 obj-$(CONFIG_LEDS_SUNFIRE)              += leds-sunfire.o
 obj-$(CONFIG_LEDS_PCA9532)              += leds-pca9532.o
 obj-$(CONFIG_LEDS_GPIO)                 += leds-gpio.o
+obj-$(CONFIG_LEDS_LP3944)               += leds-lp3944.o
 obj-$(CONFIG_LEDS_CLEVO_MAIL)           += leds-clevo-mail.o
 obj-$(CONFIG_LEDS_HP6XX)                += leds-hp6xx.o
 obj-$(CONFIG_LEDS_FSG)                  += leds-fsg.o
diff --git a/drivers/leds/leds-alix2.c b/drivers/leds/leds-alix2.c
index ddbd7730dfc8..731d4eef3425 100644
--- a/drivers/leds/leds-alix2.c
+++ b/drivers/leds/leds-alix2.c
@@ -14,7 +14,7 @@
 static int force = 0;
 module_param(force, bool, 0444);
-MODULE_PARM_DESC(force, "Assume system has ALIX.2 style LEDs");
+MODULE_PARM_DESC(force, "Assume system has ALIX.2/ALIX.3 style LEDs");
 struct alix_led {
        struct led_classdev cdev;
@@ -155,6 +155,11 @@ static int __init alix_led_init(void)
                goto out;
        }
+        /* enable output on GPIO for LED 1,2,3 */
+        outl(1 << 6, 0x6104);
+        outl(1 << 9, 0x6184);
+        outl(1 << 11, 0x6184);
        pdev = platform_device_register_simple(KBUILD_MODNAME, -1, NULL, 0);
        if (!IS_ERR(pdev)) {
                ret = platform_driver_probe(&alix_led_driver, alix_led_probe);
diff --git a/drivers/leds/leds-bd2802.c b/drivers/leds/leds-bd2802.c
index 4149ecb3a9b2..779d7f262c04 100644
--- a/drivers/leds/leds-bd2802.c
+++ b/drivers/leds/leds-bd2802.c
@@ -97,6 +97,10 @@ struct bd2802_led {
        enum led_ids                    led_id;
        enum led_colors                 color;
        enum led_bits                   state;
+        /* General attributes of RGB LEDs */
+        int                             wave_pattern;
+        int                             rgb_current;
 };
@@ -254,7 +258,7 @@ static void bd2802_set_on(struct bd2802_led *led, enum led_ids id,
                bd2802_reset_cancel(led);
        reg = bd2802_get_reg_addr(id, color, BD2802_REG_CURRENT1SETUP);
-        bd2802_write_byte(led->client, reg, BD2802_CURRENT_032);
+        bd2802_write_byte(led->client, reg, led->rgb_current);
        reg = bd2802_get_reg_addr(id, color, BD2802_REG_CURRENT2SETUP);
        bd2802_write_byte(led->client, reg, BD2802_CURRENT_000);
        reg = bd2802_get_reg_addr(id, color, BD2802_REG_WAVEPATTERN);
@@ -275,9 +279,9 @@ static void bd2802_set_blink(struct bd2802_led *led, enum led_ids id,
        reg = bd2802_get_reg_addr(id, color, BD2802_REG_CURRENT1SETUP);
        bd2802_write_byte(led->client, reg, BD2802_CURRENT_000);
        reg = bd2802_get_reg_addr(id, color, BD2802_REG_CURRENT2SETUP);
-        bd2802_write_byte(led->client, reg, BD2802_CURRENT_032);
+        bd2802_write_byte(led->client, reg, led->rgb_current);
        reg = bd2802_get_reg_addr(id, color, BD2802_REG_WAVEPATTERN);
-        bd2802_write_byte(led->client, reg, BD2802_PATTERN_HALF);
+        bd2802_write_byte(led->client, reg, led->wave_pattern);
        bd2802_enable(led, id);
        bd2802_update_state(led, id, color, BD2802_BLINK);
@@ -406,7 +410,7 @@ static void bd2802_enable_adv_conf(struct bd2802_led *led)
                ret = device_create_file(&led->client->dev,
                                                bd2802_addr_attributes[i]);
                if (ret) {
-                        dev_err(&led->client->dev, "failed to sysfs file %s\n",
+                        dev_err(&led->client->dev, "failed: sysfs file %s\n",
                                        bd2802_addr_attributes[i]->attr.name);
                        goto failed_remove_files;
                }
@@ -483,6 +487,52 @@ static struct device_attribute bd2802_adv_conf_attr = {
        .store = bd2802_store_adv_conf,
 };
+#define BD2802_CONTROL_ATTR(attr_name, name_str)                        \
+static ssize_t bd2802_show_##attr_name(struct device *dev,              \
+        struct device_attribute *attr, char *buf)                       \
+{                                                                       \
+        struct bd2802_led *led = i2c_get_clientdata(to_i2c_client(dev));\
+        ssize_t ret;                                                    \
+        down_read(&led->rwsem);                                         \
+        ret = sprintf(buf, "0x%02x\n", led->attr_name);                 \
+        up_read(&led->rwsem);                                           \
+        return ret;                                                     \
+}                                                                       \
+static ssize_t bd2802_store_##attr_name(struct device *dev,             \
+        struct device_attribute *attr, const char *buf, size_t count)   \
+{                                                                       \
+        struct bd2802_led *led = i2c_get_clientdata(to_i2c_client(dev));\
+        unsigned long val;                                              \
+        int ret;                                                        \
+        if (!count)                                                     \
+                return -EINVAL;                                         \
+        ret = strict_strtoul(buf, 16, &val);                            \
+        if (ret)                                                        \
+                return ret;                                             \
+        down_write(&led->rwsem);                                        \
+        led->attr_name = val;                                           \
+        up_write(&led->rwsem);                                          \
+        return count;                                                   \
+}                                                                       \
+static struct device_attribute bd2802_##attr_name##_attr = {            \
+        .attr = {                                                       \
+                .name = name_str,                                       \
+                .mode = 0644,                                           \
+                .owner = THIS_MODULE                                    \
+        },                                                              \
+        .show = bd2802_show_##attr_name,                                \
+        .store = bd2802_store_##attr_name,                              \
+};
+BD2802_CONTROL_ATTR(wave_pattern, "wave_pattern");
+BD2802_CONTROL_ATTR(rgb_current, "rgb_current");
+static struct device_attribute *bd2802_attributes[] = {
+        &bd2802_adv_conf_attr,
+        &bd2802_wave_pattern_attr,
+        &bd2802_rgb_current_attr,
+};
 static void bd2802_led_work(struct work_struct *work)
 {
        struct bd2802_led *led = container_of(work, struct bd2802_led, work);
@@ -538,7 +588,6 @@ static int bd2802_register_led_classdev(struct bd2802_led *led)
        led->cdev_led1r.brightness = LED_OFF;
        led->cdev_led1r.brightness_set = bd2802_set_led1r_brightness;
        led->cdev_led1r.blink_set = bd2802_set_led1r_blink;
-        led->cdev_led1r.flags |= LED_CORE_SUSPENDRESUME;
        ret = led_classdev_register(&led->client->dev, &led->cdev_led1r);
        if (ret < 0) {
@@ -551,7 +600,6 @@ static int bd2802_register_led_classdev(struct bd2802_led *led)
        led->cdev_led1g.brightness = LED_OFF;
        led->cdev_led1g.brightness_set = bd2802_set_led1g_brightness;
        led->cdev_led1g.blink_set = bd2802_set_led1g_blink;
-        led->cdev_led1g.flags |= LED_CORE_SUSPENDRESUME;
        ret = led_classdev_register(&led->client->dev, &led->cdev_led1g);
        if (ret < 0) {
@@ -564,7 +612,6 @@ static int bd2802_register_led_classdev(struct bd2802_led *led)
        led->cdev_led1b.brightness = LED_OFF;
        led->cdev_led1b.brightness_set = bd2802_set_led1b_brightness;
        led->cdev_led1b.blink_set = bd2802_set_led1b_blink;
-        led->cdev_led1b.flags |= LED_CORE_SUSPENDRESUME;
        ret = led_classdev_register(&led->client->dev, &led->cdev_led1b);
        if (ret < 0) {
@@ -577,7 +624,6 @@ static int bd2802_register_led_classdev(struct bd2802_led *led)
        led->cdev_led2r.brightness = LED_OFF;
        led->cdev_led2r.brightness_set = bd2802_set_led2r_brightness;
        led->cdev_led2r.blink_set = bd2802_set_led2r_blink;
-        led->cdev_led2r.flags |= LED_CORE_SUSPENDRESUME;
        ret = led_classdev_register(&led->client->dev, &led->cdev_led2r);
        if (ret < 0) {
@@ -590,7 +636,6 @@ static int bd2802_register_led_classdev(struct bd2802_led *led)
        led->cdev_led2g.brightness = LED_OFF;
        led->cdev_led2g.brightness_set = bd2802_set_led2g_brightness;
        led->cdev_led2g.blink_set = bd2802_set_led2g_blink;
-        led->cdev_led2g.flags |= LED_CORE_SUSPENDRESUME;
        ret = led_classdev_register(&led->client->dev, &led->cdev_led2g);
        if (ret < 0) {
@@ -640,7 +685,7 @@ static int __devinit bd2802_probe(struct i2c_client *client,
 {
        struct bd2802_led *led;
        struct bd2802_led_platform_data *pdata;
-        int ret;
+        int ret, i;
        led = kzalloc(sizeof(struct bd2802_led), GFP_KERNEL);
        if (!led) {
@@ -670,13 +715,20 @@ static int __devinit bd2802_probe(struct i2c_client *client,
        /* To save the power, reset BD2802 after detecting */
        gpio_set_value(led->pdata->reset_gpio, 0);
+        /* Default attributes */
+        led->wave_pattern = BD2802_PATTERN_HALF;
+        led->rgb_current = BD2802_CURRENT_032;
        init_rwsem(&led->rwsem);
-        ret = device_create_file(&client->dev, &bd2802_adv_conf_attr);
+        for (i = 0; i < ARRAY_SIZE(bd2802_attributes); i++) {
-        if (ret) {
+                ret = device_create_file(&led->client->dev,
-                dev_err(&client->dev, "failed to create sysfs file %s\n",
+                                                bd2802_attributes[i]);
-                                        bd2802_adv_conf_attr.attr.name);
+                if (ret) {
-                goto failed_free;
+                        dev_err(&led->client->dev, "failed: sysfs file %s\n",
+                                        bd2802_attributes[i]->attr.name);
+                        goto failed_unregister_dev_file;
+                }
        }
        ret = bd2802_register_led_classdev(led);
@@ -686,7 +738,8 @@ static int __devinit bd2802_probe(struct i2c_client *client,
        return 0;
 failed_unregister_dev_file:
-        device_remove_file(&client->dev, &bd2802_adv_conf_attr);
+        for (i--; i >= 0; i--)
+                device_remove_file(&led->client->dev, bd2802_attributes[i]);
 failed_free:
        i2c_set_clientdata(client, NULL);
        kfree(led);
@@ -697,12 +750,14 @@ failed_free:
 static int __exit bd2802_remove(struct i2c_client *client)
 {
        struct bd2802_led *led = i2c_get_clientdata(client);
+        int i;
-        bd2802_unregister_led_classdev(led);
        gpio_set_value(led->pdata->reset_gpio, 0);
+        bd2802_unregister_led_classdev(led);
        if (led->adf_on)
                bd2802_disable_adv_conf(led);
-        device_remove_file(&client->dev, &bd2802_adv_conf_attr);
+        for (i = 0; i < ARRAY_SIZE(bd2802_attributes); i++)
+                device_remove_file(&led->client->dev, bd2802_attributes[i]);
        i2c_set_clientdata(client, NULL);
        kfree(led);
@@ -723,8 +778,7 @@ static int bd2802_resume(struct i2c_client *client)
        struct bd2802_led *led = i2c_get_clientdata(client);
        if (!bd2802_is_all_off(led) || led->adf_on) {
-                gpio_set_value(led->pdata->reset_gpio, 1);
+                bd2802_reset_cancel(led);
-                udelay(100);
                bd2802_restore_state(led);
        }
@@ -762,4 +816,4 @@ module_exit(bd2802_exit);
 MODULE_AUTHOR("Kim Kyuwon <q1.kim@samsung.com>");
 MODULE_DESCRIPTION("BD2802 LED driver");
-MODULE_LICENSE("GPL");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/leds/leds-gpio.c b/drivers/leds/leds-gpio.c
index d2109054de85..6b06638eb5b4 100644
--- a/drivers/leds/leds-gpio.c
+++ b/drivers/leds/leds-gpio.c
@@ -76,7 +76,7 @@ static int __devinit create_gpio_led(const struct gpio_led *template,
        struct gpio_led_data *led_dat, struct device *parent,
        int (*blink_set)(unsigned, unsigned long *, unsigned long *))
 {
-        int ret;
+        int ret, state;
        /* skip leds that aren't available */
        if (!gpio_is_valid(template->gpio)) {
@@ -99,11 +99,15 @@ static int __devinit create_gpio_led(const struct gpio_led *template,
                led_dat->cdev.blink_set = gpio_blink_set;
        }
        led_dat->cdev.brightness_set = gpio_led_set;
-        led_dat->cdev.brightness = LED_OFF;
+        if (template->default_state == LEDS_GPIO_DEFSTATE_KEEP)
+                state = !!gpio_get_value(led_dat->gpio) ^ led_dat->active_low;
+        else
+                state = (template->default_state == LEDS_GPIO_DEFSTATE_ON);
+        led_dat->cdev.brightness = state ? LED_FULL : LED_OFF;
        if (!template->retain_state_suspended)
                led_dat->cdev.flags |= LED_CORE_SUSPENDRESUME;
-        ret = gpio_direction_output(led_dat->gpio, led_dat->active_low);
+        ret = gpio_direction_output(led_dat->gpio, led_dat->active_low ^ state);
        if (ret < 0)
                goto err;
@@ -129,7 +133,7 @@ static void delete_gpio_led(struct gpio_led_data *led)
 }
 #ifdef CONFIG_LEDS_GPIO_PLATFORM
-static int gpio_led_probe(struct platform_device *pdev)
+static int __devinit gpio_led_probe(struct platform_device *pdev)
 {
        struct gpio_led_platform_data *pdata = pdev->dev.platform_data;
        struct gpio_led_data *leds_data;
@@ -223,12 +227,22 @@ static int __devinit of_gpio_leds_probe(struct of_device *ofdev,
        memset(&led, 0, sizeof(led));
        for_each_child_of_node(np, child) {
                enum of_gpio_flags flags;
+                const char *state;
                led.gpio = of_get_gpio_flags(child, 0, &flags);
                led.active_low = flags & OF_GPIO_ACTIVE_LOW;
                led.name = of_get_property(child, "label", NULL) ? : child->name;
                led.default_trigger =
                        of_get_property(child, "linux,default-trigger", NULL);
+                state = of_get_property(child, "default-state", NULL);
+                if (state) {
+                        if (!strcmp(state, "keep"))
+                                led.default_state = LEDS_GPIO_DEFSTATE_KEEP;
+                        else if(!strcmp(state, "on"))
+                                led.default_state = LEDS_GPIO_DEFSTATE_ON;
+                        else
+                                led.default_state = LEDS_GPIO_DEFSTATE_OFF;
+                }
                ret = create_gpio_led(&led, &pdata->led_data[pdata->num_leds++],
                                      &ofdev->dev, NULL);
diff --git a/drivers/leds/leds-lp3944.c b/drivers/leds/leds-lp3944.c
new file mode 100644
index 000000000000..5946208ba26e
--- /dev/null
+++ b/drivers/leds/leds-lp3944.c
@@ -0,0 +1,466 @@
+/*
+ * leds-lp3944.c - driver for National Semiconductor LP3944 Funlight Chip
+ *
+ * Copyright (C) 2009 Antonio Ospite <ospite@studenti.unina.it>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+/*
+ * I2C driver for National Semiconductor LP3944 Funlight Chip
+ * http://www.national.com/pf/LP/LP3944.html
+ *
+ * This helper chip can drive up to 8 leds, with two programmable DIM modes;
+ * it could even be used as a gpio expander but this driver assumes it is used
+ * as a led controller.
+ *
+ * The DIM modes are used to set _blink_ patterns for leds, the pattern is
+ * specified supplying two parameters:
+ *   - period: from 0s to 1.6s
+ *   - duty cycle: percentage of the period the led is on, from 0 to 100
+ *
+ * LP3944 can be found on Motorola A910 smartphone, where it drives the rgb
+ * leds, the camera flash light and the displays backlights.
+ */
+#include <linux/module.h>
+#include <linux/i2c.h>
+#include <linux/leds.h>
+#include <linux/mutex.h>
+#include <linux/workqueue.h>
+#include <linux/leds-lp3944.h>
+/* Read Only Registers */
+#define LP3944_REG_INPUT1     0x00 /* LEDs 0-7 InputRegister (Read Only) */
+#define LP3944_REG_REGISTER1  0x01 /* None (Read Only) */
+#define LP3944_REG_PSC0       0x02 /* Frequency Prescaler 0 (R/W) */
+#define LP3944_REG_PWM0       0x03 /* PWM Register 0 (R/W) */
+#define LP3944_REG_PSC1       0x04 /* Frequency Prescaler 1 (R/W) */
+#define LP3944_REG_PWM1       0x05 /* PWM Register 1 (R/W) */
+#define LP3944_REG_LS0        0x06 /* LEDs 0-3 Selector (R/W) */
+#define LP3944_REG_LS1        0x07 /* LEDs 4-7 Selector (R/W) */
+/* These registers are not used to control leds in LP3944, they can store
+ * arbitrary values which the chip will ignore.
+ */
+#define LP3944_REG_REGISTER8  0x08
+#define LP3944_REG_REGISTER9  0x09
+#define LP3944_DIM0 0
+#define LP3944_DIM1 1
+/* period in ms */
+#define LP3944_PERIOD_MIN 0
+#define LP3944_PERIOD_MAX 1600
+/* duty cycle is a percentage */
+#define LP3944_DUTY_CYCLE_MIN 0
+#define LP3944_DUTY_CYCLE_MAX 100
+#define ldev_to_led(c)       container_of(c, struct lp3944_led_data, ldev)
+/* Saved data */
+struct lp3944_led_data {
+        u8 id;
+        enum lp3944_type type;
+        enum lp3944_status status;
+        struct led_classdev ldev;
+        struct i2c_client *client;
+        struct work_struct work;
+};
+struct lp3944_data {
+        struct mutex lock;
+        struct i2c_client *client;
+        struct lp3944_led_data leds[LP3944_LEDS_MAX];
+};
+static int lp3944_reg_read(struct i2c_client *client, u8 reg, u8 *value)
+{
+        int tmp;
+        tmp = i2c_smbus_read_byte_data(client, reg);
+        if (tmp < 0)
+                return -EINVAL;
+        *value = tmp;
+        return 0;
+}
+static int lp3944_reg_write(struct i2c_client *client, u8 reg, u8 value)
+{
+        return i2c_smbus_write_byte_data(client, reg, value);
+}
+/**
+ * Set the period for DIM status
+ *
+ * @client: the i2c client
+ * @dim: either LP3944_DIM0 or LP3944_DIM1
+ * @period: period of a blink, that is a on/off cycle, expressed in ms.
+ */
+static int lp3944_dim_set_period(struct i2c_client *client, u8 dim, u16 period)
+{
+        u8 psc_reg;
+        u8 psc_value;
+        int err;
+        if (dim == LP3944_DIM0)
+                psc_reg = LP3944_REG_PSC0;
+        else if (dim == LP3944_DIM1)
+                psc_reg = LP3944_REG_PSC1;
+        else
+                return -EINVAL;
+        /* Convert period to Prescaler value */
+        if (period > LP3944_PERIOD_MAX)
+                return -EINVAL;
+        psc_value = (period * 255) / LP3944_PERIOD_MAX;
+        err = lp3944_reg_write(client, psc_reg, psc_value);
+        return err;
+}
+/**
+ * Set the duty cycle for DIM status
+ *
+ * @client: the i2c client
+ * @dim: either LP3944_DIM0 or LP3944_DIM1
+ * @duty_cycle: percentage of a period during which a led is ON
+ */
+static int lp3944_dim_set_dutycycle(struct i2c_client *client, u8 dim,
+                                    u8 duty_cycle)
+{
+        u8 pwm_reg;
+        u8 pwm_value;
+        int err;
+        if (dim == LP3944_DIM0)
+                pwm_reg = LP3944_REG_PWM0;
+        else if (dim == LP3944_DIM1)
+                pwm_reg = LP3944_REG_PWM1;
+        else
+                return -EINVAL;
+        /* Convert duty cycle to PWM value */
+        if (duty_cycle > LP3944_DUTY_CYCLE_MAX)
+                return -EINVAL;
+        pwm_value = (duty_cycle * 255) / LP3944_DUTY_CYCLE_MAX;
+        err = lp3944_reg_write(client, pwm_reg, pwm_value);
+        return err;
+}
+/**
+ * Set the led status
+ *
+ * @led: a lp3944_led_data structure
+ * @status: one of LP3944_LED_STATUS_OFF
+ *                 LP3944_LED_STATUS_ON
+ *                 LP3944_LED_STATUS_DIM0
+ *                 LP3944_LED_STATUS_DIM1
+ */
+static int lp3944_led_set(struct lp3944_led_data *led, u8 status)
+{
+        struct lp3944_data *data = i2c_get_clientdata(led->client);
+        u8 id = led->id;
+        u8 reg;
+        u8 val = 0;
+        int err;
+        dev_dbg(&led->client->dev, "%s: %s, status before normalization:%d\n",
+                __func__, led->ldev.name, status);
+        switch (id) {
+        case LP3944_LED0:
+        case LP3944_LED1:
+        case LP3944_LED2:
+        case LP3944_LED3:
+                reg = LP3944_REG_LS0;
+                break;
+        case LP3944_LED4:
+        case LP3944_LED5:
+        case LP3944_LED6:
+        case LP3944_LED7:
+                id -= LP3944_LED4;
+                reg = LP3944_REG_LS1;
+                break;
+        default:
+                return -EINVAL;
+        }
+        if (status > LP3944_LED_STATUS_DIM1)
+                return -EINVAL;
+        /* invert only 0 and 1, leave unchanged the other values,
+         * remember we are abusing status to set blink patterns
+         */
+        if (led->type == LP3944_LED_TYPE_LED_INVERTED && status < 2)
+                status = 1 - status;
+        mutex_lock(&data->lock);
+        lp3944_reg_read(led->client, reg, &val);
+        val &= ~(LP3944_LED_STATUS_MASK << (id << 1));
+        val |= (status << (id << 1));
+        dev_dbg(&led->client->dev, "%s: %s, reg:%d id:%d status:%d val:%#x\n",
+                __func__, led->ldev.name, reg, id, status, val);
+        /* set led status */
+        err = lp3944_reg_write(led->client, reg, val);
+        mutex_unlock(&data->lock);
+        return err;
+}
+static int lp3944_led_set_blink(struct led_classdev *led_cdev,
+                                unsigned long *delay_on,
+                                unsigned long *delay_off)
+{
+        struct lp3944_led_data *led = ldev_to_led(led_cdev);
+        u16 period;
+        u8 duty_cycle;
+        int err;
+        /* units are in ms */
+        if (*delay_on + *delay_off > LP3944_PERIOD_MAX)
+                return -EINVAL;
+        if (*delay_on == 0 && *delay_off == 0) {
+                /* Special case: the leds subsystem requires a default user
+                 * friendly blink pattern for the LED.  Let's blink the led
+                 * slowly (1Hz).
+                 */
+                *delay_on = 500;
+                *delay_off = 500;
+        }
+        period = (*delay_on) + (*delay_off);
+        /* duty_cycle is the percentage of period during which the led is ON */
+        duty_cycle = 100 * (*delay_on) / period;
+        /* invert duty cycle for inverted leds, this has the same effect of
+         * swapping delay_on and delay_off
+         */
+        if (led->type == LP3944_LED_TYPE_LED_INVERTED)
+                duty_cycle = 100 - duty_cycle;
+        /* NOTE: using always the first DIM mode, this means that all leds
+         * will have the same blinking pattern.
+         *
+         * We could find a way later to have two leds blinking in hardware
+         * with different patterns at the same time, falling back to software
+         * control for the other ones.
+         */
+        err = lp3944_dim_set_period(led->client, LP3944_DIM0, period);
+        if (err)
+                return err;
+        err = lp3944_dim_set_dutycycle(led->client, LP3944_DIM0, duty_cycle);
+        if (err)
+                return err;
+        dev_dbg(&led->client->dev, "%s: OK hardware accelerated blink!\n",
+                __func__);
+        led->status = LP3944_LED_STATUS_DIM0;
+        schedule_work(&led->work);
+        return 0;
+}
+static void lp3944_led_set_brightness(struct led_classdev *led_cdev,
+                                      enum led_brightness brightness)
+{
+        struct lp3944_led_data *led = ldev_to_led(led_cdev);
+        dev_dbg(&led->client->dev, "%s: %s, %d\n",
+                __func__, led_cdev->name, brightness);
+        led->status = brightness;
+        schedule_work(&led->work);
+}
+static void lp3944_led_work(struct work_struct *work)
+{
+        struct lp3944_led_data *led;
+        led = container_of(work, struct lp3944_led_data, work);
+        lp3944_led_set(led, led->status);
+}
+static int lp3944_configure(struct i2c_client *client,
+                            struct lp3944_data *data,
+                            struct lp3944_platform_data *pdata)
+{
+        int i, err = 0;
+        for (i = 0; i < pdata->leds_size; i++) {
+                struct lp3944_led *pled = &pdata->leds[i];
+                struct lp3944_led_data *led = &data->leds[i];
+                led->client = client;
+                led->id = i;
+                switch (pled->type) {
+                case LP3944_LED_TYPE_LED:
+                case LP3944_LED_TYPE_LED_INVERTED:
+                        led->type = pled->type;
+                        led->status = pled->status;
+                        led->ldev.name = pled->name;
+                        led->ldev.max_brightness = 1;
+                        led->ldev.brightness_set = lp3944_led_set_brightness;
+                        led->ldev.blink_set = lp3944_led_set_blink;
+                        led->ldev.flags = LED_CORE_SUSPENDRESUME;
+                        INIT_WORK(&led->work, lp3944_led_work);
+                        err = led_classdev_register(&client->dev, &led->ldev);
+                        if (err < 0) {
+                                dev_err(&client->dev,
+                                        "couldn't register LED %s\n",
+                                        led->ldev.name);
+                                goto exit;
+                        }
+                        /* to expose the default value to userspace */
+                        led->ldev.brightness = led->status;
+                        /* Set the default led status */
+                        err = lp3944_led_set(led, led->status);
+                        if (err < 0) {
+                                dev_err(&client->dev,
+                                        "%s couldn't set STATUS %d\n",
+                                        led->ldev.name, led->status);
+                                goto exit;
+                        }
+                        break;
+                case LP3944_LED_TYPE_NONE:
+                default:
+                        break;
+                }
+        }
+        return 0;
+exit:
+        if (i > 0)
+                for (i = i - 1; i >= 0; i--)
+                        switch (pdata->leds[i].type) {
+                        case LP3944_LED_TYPE_LED:
+                        case LP3944_LED_TYPE_LED_INVERTED:
+                                led_classdev_unregister(&data->leds[i].ldev);
+                                cancel_work_sync(&data->leds[i].work);
+                                break;
+                        case LP3944_LED_TYPE_NONE:
+                        default:
+                                break;
+                        }
+        return err;
+}
+static int __devinit lp3944_probe(struct i2c_client *client,
+                                  const struct i2c_device_id *id)
+{
+        struct lp3944_platform_data *lp3944_pdata = client->dev.platform_data;
+        struct lp3944_data *data;
+        if (lp3944_pdata == NULL) {
+                dev_err(&client->dev, "no platform data\n");
+                return -EINVAL;
+        }
+        /* Let's see whether this adapter can support what we need. */
+        if (!i2c_check_functionality(client->adapter,
+                                I2C_FUNC_SMBUS_BYTE_DATA)) {
+                dev_err(&client->dev, "insufficient functionality!\n");
+                return -ENODEV;
+        }
+        data = kzalloc(sizeof(struct lp3944_data), GFP_KERNEL);
+        if (!data)
+                return -ENOMEM;
+        data->client = client;
+        i2c_set_clientdata(client, data);
+        mutex_init(&data->lock);
+        dev_info(&client->dev, "lp3944 enabled\n");
+        lp3944_configure(client, data, lp3944_pdata);
+        return 0;
+}
+static int __devexit lp3944_remove(struct i2c_client *client)
+{
+        struct lp3944_platform_data *pdata = client->dev.platform_data;
+        struct lp3944_data *data = i2c_get_clientdata(client);
+        int i;
+        for (i = 0; i < pdata->leds_size; i++)
+                switch (data->leds[i].type) {
+                case LP3944_LED_TYPE_LED:
+                case LP3944_LED_TYPE_LED_INVERTED:
+                        led_classdev_unregister(&data->leds[i].ldev);
+                        cancel_work_sync(&data->leds[i].work);
+                        break;
+                case LP3944_LED_TYPE_NONE:
+                default:
+                        break;
+                }
+        kfree(data);
+        i2c_set_clientdata(client, NULL);
+        return 0;
+}
+/* lp3944 i2c driver struct */
+static const struct i2c_device_id lp3944_id[] = {
+        {"lp3944", 0},
+        {}
+};
+MODULE_DEVICE_TABLE(i2c, lp3944_id);
+static struct i2c_driver lp3944_driver = {
+        .driver   = {
+                   .name = "lp3944",
+        },
+        .probe    = lp3944_probe,
+        .remove   = __devexit_p(lp3944_remove),
+        .id_table = lp3944_id,
+};
+static int __init lp3944_module_init(void)
+{
+        return i2c_add_driver(&lp3944_driver);
+}
+static void __exit lp3944_module_exit(void)
+{
+        i2c_del_driver(&lp3944_driver);
+}
+module_init(lp3944_module_init);
+module_exit(lp3944_module_exit);
+MODULE_AUTHOR("Antonio Ospite <ospite@studenti.unina.it>");
+MODULE_DESCRIPTION("LP3944 Fun Light Chip");
+MODULE_LICENSE("GPL");
diff --git a/drivers/leds/leds-pca9532.c b/drivers/leds/leds-pca9532.c
index 3937244fdcab..dba8921240f2 100644
--- a/drivers/leds/leds-pca9532.c
+++ b/drivers/leds/leds-pca9532.c
@@ -35,7 +35,7 @@ struct pca9532_data {
        struct pca9532_led leds[16];
        struct mutex update_lock;
        struct input_dev    *idev;
-       struct work_struct work;
+        struct work_struct work;
        u8 pwm[2];
        u8 psc[2];
 };
@@ -87,14 +87,14 @@ static int pca9532_calcpwm(struct i2c_client *client, int pwm, int blink,
        if (b > 0xFF)
                return -EINVAL;
        data->pwm[pwm] = b;
-       data->psc[pwm] = blink;
+        data->psc[pwm] = blink;
-       return 0;
+        return 0;
 }
 static int pca9532_setpwm(struct i2c_client *client, int pwm)
 {
-       struct pca9532_data *data = i2c_get_clientdata(client);
+        struct pca9532_data *data = i2c_get_clientdata(client);
-       mutex_lock(&data->update_lock);
+        mutex_lock(&data->update_lock);
        i2c_smbus_write_byte_data(client, PCA9532_REG_PWM(pwm),
                data->pwm[pwm]);
        i2c_smbus_write_byte_data(client, PCA9532_REG_PSC(pwm),
@@ -132,11 +132,11 @@ static void pca9532_set_brightness(struct led_classdev *led_cdev,
                led->state = PCA9532_ON;
        else {
                led->state = PCA9532_PWM0; /* Thecus: hardcode one pwm */
-               err = pca9532_calcpwm(led->client, 0, 0, value);
+                err = pca9532_calcpwm(led->client, 0, 0, value);
                if (err)
                        return; /* XXX: led api doesn't allow error code? */
        }
-       schedule_work(&led->work);
+        schedule_work(&led->work);
 }
 static int pca9532_set_blink(struct led_classdev *led_cdev,
@@ -145,7 +145,7 @@ static int pca9532_set_blink(struct led_classdev *led_cdev,
        struct pca9532_led *led = ldev_to_led(led_cdev);
        struct i2c_client *client = led->client;
        int psc;
-       int err = 0;
+        int err = 0;
        if (*delay_on == 0 && *delay_off == 0) {
        /* led subsystem ask us for a blink rate */
@@ -157,11 +157,11 @@ static int pca9532_set_blink(struct led_classdev *led_cdev,
        /* Thecus specific: only use PSC/PWM 0 */
        psc = (*delay_on * 152-1)/1000;
-       err = pca9532_calcpwm(client, 0, psc, led_cdev->brightness);
+        err = pca9532_calcpwm(client, 0, psc, led_cdev->brightness);
-       if (err)
+        if (err)
-               return err;
+                return err;
-       schedule_work(&led->work);
+        schedule_work(&led->work);
-       return 0;
+        return 0;
 }
 static int pca9532_event(struct input_dev *dev, unsigned int type,
@@ -178,15 +178,15 @@ static int pca9532_event(struct input_dev *dev, unsigned int type,
        else
                data->pwm[1] = 0;
-       schedule_work(&data->work);
+        schedule_work(&data->work);
-       return 0;
+        return 0;
 }
 static void pca9532_input_work(struct work_struct *work)
 {
-       struct pca9532_data *data;
+        struct pca9532_data *data;
-       data = container_of(work, struct pca9532_data, work);
+        data = container_of(work, struct pca9532_data, work);
        mutex_lock(&data->update_lock);
        i2c_smbus_write_byte_data(data->client, PCA9532_REG_PWM(1),
                data->pwm[1]);
@@ -195,11 +195,11 @@ static void pca9532_input_work(struct work_struct *work)
 static void pca9532_led_work(struct work_struct *work)
 {
-       struct pca9532_led *led;
+        struct pca9532_led *led;
-       led = container_of(work, struct pca9532_led, work);
+        led = container_of(work, struct pca9532_led, work);
-       if (led->state == PCA9532_PWM0)
+        if (led->state == PCA9532_PWM0)
-               pca9532_setpwm(led->client, 0);
+                pca9532_setpwm(led->client, 0);
-       pca9532_setled(led);
+        pca9532_setled(led);
 }
 static int pca9532_configure(struct i2c_client *client,
@@ -232,7 +232,7 @@ static int pca9532_configure(struct i2c_client *client,
                        led->ldev.brightness = LED_OFF;
                        led->ldev.brightness_set = pca9532_set_brightness;
                        led->ldev.blink_set = pca9532_set_blink;
-                       INIT_WORK(&led->work, pca9532_led_work);
+                        INIT_WORK(&led->work, pca9532_led_work);
                        err = led_classdev_register(&client->dev, &led->ldev);
                        if (err < 0) {
                                dev_err(&client->dev,
@@ -262,11 +262,11 @@ static int pca9532_configure(struct i2c_client *client,
                                                BIT_MASK(SND_TONE);
                        data->idev->event = pca9532_event;
                        input_set_drvdata(data->idev, data);
-                       INIT_WORK(&data->work, pca9532_input_work);
+                        INIT_WORK(&data->work, pca9532_input_work);
                        err = input_register_device(data->idev);
                        if (err) {
                                input_free_device(data->idev);
-                               cancel_work_sync(&data->work);
+                                cancel_work_sync(&data->work);
                                data->idev = NULL;
                                goto exit;
                        }
@@ -283,13 +283,13 @@ exit:
                                break;
                        case PCA9532_TYPE_LED:
                                led_classdev_unregister(&data->leds[i].ldev);
-                               cancel_work_sync(&data->leds[i].work);
+                                cancel_work_sync(&data->leds[i].work);
                                break;
                        case PCA9532_TYPE_N2100_BEEP:
                                if (data->idev != NULL) {
                                        input_unregister_device(data->idev);
                                        input_free_device(data->idev);
-                                       cancel_work_sync(&data->work);
+                                        cancel_work_sync(&data->work);
                                        data->idev = NULL;
                                }
                                break;
@@ -340,13 +340,13 @@ static int pca9532_remove(struct i2c_client *client)
                        break;
                case PCA9532_TYPE_LED:
                        led_classdev_unregister(&data->leds[i].ldev);
-                       cancel_work_sync(&data->leds[i].work);
+                        cancel_work_sync(&data->leds[i].work);
                        break;
                case PCA9532_TYPE_N2100_BEEP:
                        if (data->idev != NULL) {
                                input_unregister_device(data->idev);
                                input_free_device(data->idev);
-                               cancel_work_sync(&data->work);
+                                cancel_work_sync(&data->work);
                                data->idev = NULL;
                        }
                        break;
diff --git a/drivers/lguest/lg.h b/drivers/lguest/lg.h
index d4e8979735cb..9c3138265f8e 100644
--- a/drivers/lguest/lg.h
+++ b/drivers/lguest/lg.h
@@ -82,7 +82,7 @@ struct lg_cpu {
 struct lg_eventfd {
        unsigned long addr;
-        struct file *event;
+        struct eventfd_ctx *event;
 };
 struct lg_eventfd_map {
diff --git a/drivers/lguest/lguest_user.c b/drivers/lguest/lguest_user.c
index 32e297121058..9f9a2953b383 100644
--- a/drivers/lguest/lguest_user.c
+++ b/drivers/lguest/lguest_user.c
@@ -50,7 +50,7 @@ static int add_eventfd(struct lguest *lg, unsigned long addr, int fd)
        /* Now append new entry. */
        new->map[new->num].addr = addr;
-        new->map[new->num].event = eventfd_fget(fd);
+        new->map[new->num].event = eventfd_ctx_fdget(fd);
        if (IS_ERR(new->map[new->num].event)) {
                kfree(new);
                return PTR_ERR(new->map[new->num].event);
@@ -357,7 +357,7 @@ static int close(struct inode *inode, struct file *file)
        /* Release any eventfds they registered. */
        for (i = 0; i < lg->eventfds->num; i++)
-                fput(lg->eventfds->map[i].event);
+                eventfd_ctx_put(lg->eventfds->map[i].event);
        kfree(lg->eventfds);
        /* If lg->dead doesn't contain an error code it will be NULL or a
diff --git a/drivers/md/dm-exception-store.c b/drivers/md/dm-exception-store.c
index c3ae51584b12..3710ff88fc10 100644
--- a/drivers/md/dm-exception-store.c
+++ b/drivers/md/dm-exception-store.c
@@ -195,7 +195,7 @@ int dm_exception_store_create(struct dm_target *ti, int argc, char **argv,
                              struct dm_exception_store **store)
 {
        int r = 0;
-        struct dm_exception_store_type *type;
+        struct dm_exception_store_type *type = NULL;
        struct dm_exception_store *tmp_store;
        char persistent;
@@ -211,12 +211,15 @@ int dm_exception_store_create(struct dm_target *ti, int argc, char **argv,
        }
        persistent = toupper(*argv[1]);
-        if (persistent != 'P' && persistent != 'N') {
+        if (persistent == 'P')
+                type = get_type("P");
+        else if (persistent == 'N')
+                type = get_type("N");
+        else {
                ti->error = "Persistent flag is not P or N";
                return -EINVAL;
        }
-        type = get_type(&persistent);
        if (!type) {
                ti->error = "Exception store type not recognised";
                r = -EINVAL;
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 4899ebe767c8..2cba557d9e61 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -495,7 +495,7 @@ int dm_set_device_limits(struct dm_target *ti, struct dm_dev *dev,
                return 0;
        }
-        if (blk_stack_limits(limits, &q->limits, start) < 0)
+        if (blk_stack_limits(limits, &q->limits, start << 9) < 0)
                DMWARN("%s: target device %s is misaligned",
                       dm_device_name(ti->table->md), bdevname(bdev, b));
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 3c6d4ee8921d..9acd54a5cffb 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -1017,7 +1017,7 @@ static struct bio *split_bvec(struct bio *bio, sector_t sector,
        clone->bi_flags |= 1 << BIO_CLONED;
        if (bio_integrity(bio)) {
-                bio_integrity_clone(clone, bio, GFP_NOIO);
+                bio_integrity_clone(clone, bio, GFP_NOIO, bs);
                bio_integrity_trim(clone,
                                   bio_sector_offset(bio, idx, offset), len);
        }
@@ -1045,7 +1045,7 @@ static struct bio *clone_bio(struct bio *bio, sector_t sector,
        clone->bi_flags &= ~(1 << BIO_SEG_VALID);
        if (bio_integrity(bio)) {
-                bio_integrity_clone(clone, bio, GFP_NOIO);
+                bio_integrity_clone(clone, bio, GFP_NOIO, bs);
                if (idx != bio->bi_idx || clone->bi_size < bio->bi_size)
                        bio_integrity_trim(clone,
diff --git a/drivers/md/linear.c b/drivers/md/linear.c
index 15c8b7b25a9b..5810fa906af0 100644
--- a/drivers/md/linear.c
+++ b/drivers/md/linear.c
@@ -166,8 +166,8 @@ static linear_conf_t *linear_conf(mddev_t *mddev, int raid_disks)
                        rdev->sectors = sectors * mddev->chunk_sectors;
                }
-                blk_queue_stack_limits(mddev->queue,
+                disk_stack_limits(mddev->gendisk, rdev->bdev,
-                                       rdev->bdev->bd_disk->queue);
+                                  rdev->data_offset << 9);
                /* as we don't honour merge_bvec_fn, we must never risk
                 * violating it, so limit ->max_sector to one PAGE, as
                 * a one page request is never in violation.
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 09be637d52cb..0f4a70c43ffc 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -3573,7 +3573,8 @@ suspend_lo_store(mddev_t *mddev, const char *buf, size_t len)
        char *e;
        unsigned long long new = simple_strtoull(buf, &e, 10);
-        if (mddev->pers->quiesce == NULL)
+        if (mddev->pers == NULL || 
+            mddev->pers->quiesce == NULL)
                return -EINVAL;
        if (buf == e || (*e && *e != '\n'))
                return -EINVAL;
@@ -3601,7 +3602,8 @@ suspend_hi_store(mddev_t *mddev, const char *buf, size_t len)
        char *e;
        unsigned long long new = simple_strtoull(buf, &e, 10);
-        if (mddev->pers->quiesce == NULL)
+        if (mddev->pers == NULL ||
+            mddev->pers->quiesce == NULL)
                return -EINVAL;
        if (buf == e || (*e && *e != '\n'))
                return -EINVAL;
@@ -3844,11 +3846,9 @@ static int md_alloc(dev_t dev, char *name)
        flush_scheduled_work();
        mutex_lock(&disks_mutex);
-        if (mddev->gendisk) {
+        error = -EEXIST;
-                mutex_unlock(&disks_mutex);
+        if (mddev->gendisk)
-                mddev_put(mddev);
+                goto abort;
-                return -EEXIST;
-        }
        if (name) {
                /* Need to ensure that 'name' is not a duplicate.
@@ -3860,17 +3860,15 @@ static int md_alloc(dev_t dev, char *name)
                        if (mddev2->gendisk &&
                            strcmp(mddev2->gendisk->disk_name, name) == 0) {
                                spin_unlock(&all_mddevs_lock);
-                                return -EEXIST;
+                                goto abort;
                        }
                spin_unlock(&all_mddevs_lock);
        }
+        error = -ENOMEM;
        mddev->queue = blk_alloc_queue(GFP_KERNEL);
-        if (!mddev->queue) {
+        if (!mddev->queue)
-                mutex_unlock(&disks_mutex);
+                goto abort;
-                mddev_put(mddev);
-                return -ENOMEM;
-        }
        mddev->queue->queuedata = mddev;
        /* Can be unlocked because the queue is new: no concurrency */
@@ -3880,11 +3878,9 @@ static int md_alloc(dev_t dev, char *name)
        disk = alloc_disk(1 << shift);
        if (!disk) {
-                mutex_unlock(&disks_mutex);
                blk_cleanup_queue(mddev->queue);
                mddev->queue = NULL;
-                mddev_put(mddev);
+                goto abort;
-                return -ENOMEM;
        }
        disk->major = MAJOR(mddev->unit);
        disk->first_minor = unit << shift;
@@ -3906,16 +3902,22 @@ static int md_alloc(dev_t dev, char *name)
        mddev->gendisk = disk;
        error = kobject_init_and_add(&mddev->kobj, &md_ktype,
                                     &disk_to_dev(disk)->kobj, "%s", "md");
-        mutex_unlock(&disks_mutex);
+        if (error) {
-        if (error)
+                /* This isn't possible, but as kobject_init_and_add is marked
+                 * __must_check, we must do something with the result
+                 */
                printk(KERN_WARNING "md: cannot register %s/md - name in use\n",
                       disk->disk_name);
-        else {
+                error = 0;
+        }
+ abort:
+        mutex_unlock(&disks_mutex);
+        if (!error) {
                kobject_uevent(&mddev->kobj, KOBJ_ADD);
                mddev->sysfs_state = sysfs_get_dirent(mddev->kobj.sd, "array_state");
        }
        mddev_put(mddev);
-        return 0;
+        return error;
 }
 static struct kobject *md_probe(dev_t dev, int *part, void *data)
@@ -6334,10 +6336,16 @@ void md_do_sync(mddev_t *mddev)
                        sysfs_notify(&mddev->kobj, NULL, "sync_completed");
                }
-                if (j >= mddev->resync_max)
+                while (j >= mddev->resync_max && !kthread_should_stop()) {
-                        wait_event(mddev->recovery_wait,
+                        /* As this condition is controlled by user-space,
-                                   mddev->resync_max > j
+                         * we can block indefinitely, so use '_interruptible'
-                                   || kthread_should_stop());
+                         * to avoid triggering warnings.
+                         */
+                        flush_signals(current); /* just in case */
+                        wait_event_interruptible(mddev->recovery_wait,
+                                                 mddev->resync_max > j
+                                                 || kthread_should_stop());
+                }
                if (kthread_should_stop())
                        goto interrupted;
diff --git a/drivers/md/multipath.c b/drivers/md/multipath.c
index cbe368fa6598..237fe3fd235c 100644
--- a/drivers/md/multipath.c
+++ b/drivers/md/multipath.c
@@ -294,7 +294,8 @@ static int multipath_add_disk(mddev_t *mddev, mdk_rdev_t *rdev)
        for (path = first; path <= last; path++)
                if ((p=conf->multipaths+path)->rdev == NULL) {
                        q = rdev->bdev->bd_disk->queue;
-                        blk_queue_stack_limits(mddev->queue, q);
+                        disk_stack_limits(mddev->gendisk, rdev->bdev,
+                                          rdev->data_offset << 9);
                /* as we don't honour merge_bvec_fn, we must never risk
                 * violating it, so limit ->max_sector to one PAGE, as
@@ -463,9 +464,9 @@ static int multipath_run (mddev_t *mddev)
                disk = conf->multipaths + disk_idx;
                disk->rdev = rdev;
+                disk_stack_limits(mddev->gendisk, rdev->bdev,
+                                  rdev->data_offset << 9);
-                blk_queue_stack_limits(mddev->queue,
-                                       rdev->bdev->bd_disk->queue);
                /* as we don't honour merge_bvec_fn, we must never risk
                 * violating it, not that we ever expect a device with
                 * a merge_bvec_fn to be involved in multipath */
diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index ab4a489d8695..335f490dcad6 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c
@@ -170,8 +170,8 @@ static int create_strip_zones(mddev_t *mddev)
                }
                dev[j] = rdev1;
-                blk_queue_stack_limits(mddev->queue,
+                disk_stack_limits(mddev->gendisk, rdev1->bdev,
-                                       rdev1->bdev->bd_disk->queue);
+                                  rdev1->data_offset << 9);
                /* as we don't honour merge_bvec_fn, we must never risk
                 * violating it, so limit ->max_sector to one PAGE, as
                 * a one page request is never in violation.
@@ -250,6 +250,11 @@ static int create_strip_zones(mddev_t *mddev)
                       mddev->chunk_sectors << 9);
                goto abort;
        }
+        blk_queue_io_min(mddev->queue, mddev->chunk_sectors << 9);
+        blk_queue_io_opt(mddev->queue,
+                         (mddev->chunk_sectors << 9) * mddev->raid_disks);
        printk(KERN_INFO "raid0: done.\n");
        mddev->private = conf;
        return 0;
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 89939a7aef57..0569efba0c02 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1123,8 +1123,8 @@ static int raid1_add_disk(mddev_t *mddev, mdk_rdev_t *rdev)
        for (mirror = first; mirror <= last; mirror++)
                if ( !(p=conf->mirrors+mirror)->rdev) {
-                        blk_queue_stack_limits(mddev->queue,
+                        disk_stack_limits(mddev->gendisk, rdev->bdev,
-                                               rdev->bdev->bd_disk->queue);
+                                          rdev->data_offset << 9);
                        /* as we don't honour merge_bvec_fn, we must never risk
                         * violating it, so limit ->max_sector to one PAGE, as
                         * a one page request is never in violation.
@@ -1988,9 +1988,8 @@ static int run(mddev_t *mddev)
                disk = conf->mirrors + disk_idx;
                disk->rdev = rdev;
+                disk_stack_limits(mddev->gendisk, rdev->bdev,
-                blk_queue_stack_limits(mddev->queue,
+                                  rdev->data_offset << 9);
-                                       rdev->bdev->bd_disk->queue);
                /* as we don't honour merge_bvec_fn, we must never risk
                 * violating it, so limit ->max_sector to one PAGE, as
                 * a one page request is never in violation.
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index ae12ceafe10c..7298a5e5a183 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1151,8 +1151,8 @@ static int raid10_add_disk(mddev_t *mddev, mdk_rdev_t *rdev)
        for ( ; mirror <= last ; mirror++)
                if ( !(p=conf->mirrors+mirror)->rdev) {
-                        blk_queue_stack_limits(mddev->queue,
+                        disk_stack_limits(mddev->gendisk, rdev->bdev,
-                                               rdev->bdev->bd_disk->queue);
+                                          rdev->data_offset << 9);
                        /* as we don't honour merge_bvec_fn, we must never risk
                         * violating it, so limit ->max_sector to one PAGE, as
                         * a one page request is never in violation.
@@ -2044,7 +2044,7 @@ raid10_size(mddev_t *mddev, sector_t sectors, int raid_disks)
 static int run(mddev_t *mddev)
 {
        conf_t *conf;
-        int i, disk_idx;
+        int i, disk_idx, chunk_size;
        mirror_info_t *disk;
        mdk_rdev_t *rdev;
        int nc, fc, fo;
@@ -2130,6 +2130,14 @@ static int run(mddev_t *mddev)
        spin_lock_init(&conf->device_lock);
        mddev->queue->queue_lock = &conf->device_lock;
+        chunk_size = mddev->chunk_sectors << 9;
+        blk_queue_io_min(mddev->queue, chunk_size);
+        if (conf->raid_disks % conf->near_copies)
+                blk_queue_io_opt(mddev->queue, chunk_size * conf->raid_disks);
+        else
+                blk_queue_io_opt(mddev->queue, chunk_size *
+                                 (conf->raid_disks / conf->near_copies));
        list_for_each_entry(rdev, &mddev->disks, same_set) {
                disk_idx = rdev->raid_disk;
                if (disk_idx >= mddev->raid_disks
@@ -2138,9 +2146,8 @@ static int run(mddev_t *mddev)
                disk = conf->mirrors + disk_idx;
                disk->rdev = rdev;
+                disk_stack_limits(mddev->gendisk, rdev->bdev,
-                blk_queue_stack_limits(mddev->queue,
+                                  rdev->data_offset << 9);
-                                       rdev->bdev->bd_disk->queue);
                /* as we don't honour merge_bvec_fn, we must never risk
                 * violating it, so limit ->max_sector to one PAGE, as
                 * a one page request is never in violation.
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index f9f991e6e138..37835538b58e 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3699,13 +3699,21 @@ static int make_request(struct request_queue *q, struct bio * bi)
                                        goto retry;
                                }
                        }
-                        /* FIXME what if we get a false positive because these
-                         * are being updated.
+                        if (bio_data_dir(bi) == WRITE &&
-                         */
+                            logical_sector >= mddev->suspend_lo &&
-                        if (logical_sector >= mddev->suspend_lo &&
                            logical_sector < mddev->suspend_hi) {
                                release_stripe(sh);
-                                schedule();
+                                /* As the suspend_* range is controlled by
+                                 * userspace, we want an interruptible
+                                 * wait.
+                                 */
+                                flush_signals(current);
+                                prepare_to_wait(&conf->wait_for_overlap,
+                                                &w, TASK_INTERRUPTIBLE);
+                                if (logical_sector >= mddev->suspend_lo &&
+                                    logical_sector < mddev->suspend_hi)
+                                        schedule();
                                goto retry;
                        }
@@ -4452,7 +4460,7 @@ static raid5_conf_t *setup_conf(mddev_t *mddev)
 static int run(mddev_t *mddev)
 {
        raid5_conf_t *conf;
-        int working_disks = 0;
+        int working_disks = 0, chunk_size;
        mdk_rdev_t *rdev;
        if (mddev->recovery_cp != MaxSector)
@@ -4607,6 +4615,14 @@ static int run(mddev_t *mddev)
        md_set_array_sectors(mddev, raid5_size(mddev, 0, 0));
        blk_queue_merge_bvec(mddev->queue, raid5_mergeable_bvec);
+        chunk_size = mddev->chunk_sectors << 9;
+        blk_queue_io_min(mddev->queue, chunk_size);
+        blk_queue_io_opt(mddev->queue, chunk_size *
+                         (conf->raid_disks - conf->max_degraded));
+        list_for_each_entry(rdev, &mddev->disks, same_set)
+                disk_stack_limits(mddev->gendisk, rdev->bdev,
+                                  rdev->data_offset << 9);
        return 0;
 abort:
diff --git a/drivers/mmc/host/mmc_spi.c b/drivers/mmc/host/mmc_spi.c
index 240608cc7ae9..a461017ce5ce 100644
--- a/drivers/mmc/host/mmc_spi.c
+++ b/drivers/mmc/host/mmc_spi.c
@@ -1313,6 +1313,12 @@ static int mmc_spi_probe(struct spi_device *spi)
        struct mmc_spi_host     *host;
        int                     status;
+        /* We rely on full duplex transfers, mostly to reduce
+         * per-transfer overheads (by making fewer transfers).
+         */
+        if (spi->master->flags & SPI_MASTER_HALF_DUPLEX)
+                return -EINVAL;
        /* MMC and SD specs only seem to care that sampling is on the
         * rising edge ... meaning SPI modes 0 or 3.  So either SPI mode
         * should be legit.  We'll use mode 0 since the steady state is 0,
diff --git a/drivers/mtd/cmdlinepart.c b/drivers/mtd/cmdlinepart.c
index 5011fa73f918..1479da6d3aa6 100644
--- a/drivers/mtd/cmdlinepart.c
+++ b/drivers/mtd/cmdlinepart.c
@@ -194,7 +194,7 @@ static struct mtd_partition * newpart(char *s,
        parts[this_part].name = extra_mem;
        extra_mem += name_len + 1;
-        dbg(("partition %d: name <%s>, offset %x, size %x, mask flags %x\n",
+        dbg(("partition %d: name <%s>, offset %llx, size %llx, mask flags %x\n",
             this_part,
             parts[this_part].name,
             parts[this_part].offset,
diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
index 59c46126a5ce..ae5fe91867e1 100644
--- a/drivers/mtd/devices/m25p80.c
+++ b/drivers/mtd/devices/m25p80.c
@@ -54,7 +54,7 @@
 #define SR_SRWD                 0x80    /* SR write protect */
 /* Define max times to check status register before we give up. */
-#define MAX_READY_WAIT_JIFFIES  (10 * HZ)       /* eg. M25P128 specs 6s max sector erase */
+#define MAX_READY_WAIT_JIFFIES  (40 * HZ)       /* M25P16 specs 40s max chip erase */
 #define CMD_SIZE                4
 #ifdef CONFIG_M25PXX_USE_FAST_READ
diff --git a/drivers/mtd/inftlcore.c b/drivers/mtd/inftlcore.c
index 73f05227dc8c..d8cf29c01cc4 100644
--- a/drivers/mtd/inftlcore.c
+++ b/drivers/mtd/inftlcore.c
@@ -226,7 +226,7 @@ static u16 INFTL_findfreeblock(struct INFTLrecord *inftl, int desperate)
        if (!desperate && inftl->numfreeEUNs < 2) {
                DEBUG(MTD_DEBUG_LEVEL1, "INFTL: there are too few free "
                        "EUNs (%d)\n", inftl->numfreeEUNs);
-                return 0xffff;
+                return BLOCK_NIL;
        }
        /* Scan for a free block */
@@ -281,7 +281,8 @@ static u16 INFTL_foldchain(struct INFTLrecord *inftl, unsigned thisVUC, unsigned
        silly = MAX_LOOPS;
        while (thisEUN < inftl->nb_blocks) {
                for (block = 0; block < inftl->EraseSize/SECTORSIZE; block ++) {
-                        if ((BlockMap[block] != 0xffff) || BlockDeleted[block])
+                        if ((BlockMap[block] != BLOCK_NIL) ||
+                            BlockDeleted[block])
                                continue;
                        if (inftl_read_oob(mtd, (thisEUN * inftl->EraseSize)
@@ -525,7 +526,7 @@ static inline u16 INFTL_findwriteunit(struct INFTLrecord *inftl, unsigned block)
                        if (!silly--) {
                                printk(KERN_WARNING "INFTL: infinite loop in "
                                        "Virtual Unit Chain 0x%x\n", thisVUC);
-                                return 0xffff;
+                                return BLOCK_NIL;
                        }
                        /* Skip to next block in chain */
@@ -549,7 +550,7 @@ hitused:
                         * waiting to be picked up. We're going to have to fold
                         * a chain to make room.
                         */
-                        thisEUN = INFTL_makefreeblock(inftl, 0xffff);
+                        thisEUN = INFTL_makefreeblock(inftl, BLOCK_NIL);
                        /*
                         * Hopefully we free something, lets try again.
@@ -631,7 +632,7 @@ hitused:
        printk(KERN_WARNING "INFTL: error folding to make room for Virtual "
                "Unit Chain 0x%x\n", thisVUC);
-        return 0xffff;
+        return BLOCK_NIL;
 }
 /*
diff --git a/drivers/mtd/maps/integrator-flash.c b/drivers/mtd/maps/integrator-flash.c
index b08a798ee254..2aac41bde8b3 100644
--- a/drivers/mtd/maps/integrator-flash.c
+++ b/drivers/mtd/maps/integrator-flash.c
@@ -42,10 +42,8 @@
 #include <mach/hardware.h>
 #include <asm/system.h>
-#define SUBDEV_NAME_SIZE        (BUS_ID_SIZE + 2)
 struct armflash_subdev_info {
-        char                    name[SUBDEV_NAME_SIZE];
+        char                    *name;
        struct mtd_info         *mtd;
        struct map_info         map;
        struct flash_platform_data *plat;
@@ -134,6 +132,8 @@ static void armflash_subdev_remove(struct armflash_subdev_info *subdev)
                map_destroy(subdev->mtd);
        if (subdev->map.virt)
                iounmap(subdev->map.virt);
+        kfree(subdev->name);
+        subdev->name = NULL;
        release_mem_region(subdev->map.phys, subdev->map.size);
 }
@@ -177,16 +177,22 @@ static int armflash_probe(struct platform_device *dev)
                if (nr == 1)
                        /* No MTD concatenation, just use the default name */
-                        snprintf(subdev->name, SUBDEV_NAME_SIZE, "%s",
+                        subdev->name = kstrdup(dev_name(&dev->dev), GFP_KERNEL);
-                                 dev_name(&dev->dev));
                else
-                        snprintf(subdev->name, SUBDEV_NAME_SIZE, "%s-%d",
+                        subdev->name = kasprintf(GFP_KERNEL, "%s-%d",
-                                 dev_name(&dev->dev), i);
+                                                 dev_name(&dev->dev), i);
+                if (!subdev->name) {
+                        err = -ENOMEM;
+                        break;
+                }
                subdev->plat = plat;
                err = armflash_subdev_probe(subdev, res);
-                if (err)
+                if (err) {
+                        kfree(subdev->name);
+                        subdev->name = NULL;
                        break;
+                }
        }
        info->nr_subdev = i;
diff --git a/drivers/mtd/nand/atmel_nand.c b/drivers/mtd/nand/atmel_nand.c
index 2802992b39da..20c828ba9405 100644
--- a/drivers/mtd/nand/atmel_nand.c
+++ b/drivers/mtd/nand/atmel_nand.c
@@ -534,7 +534,7 @@ static int __init atmel_nand_probe(struct platform_device *pdev)
                                                         &num_partitions);
        if ((!partitions) || (num_partitions == 0)) {
-                printk(KERN_ERR "atmel_nand: No parititions defined, or unsupported device.\n");
+                printk(KERN_ERR "atmel_nand: No partitions defined, or unsupported device.\n");
                res = ENXIO;
                goto err_no_partitions;
        }
diff --git a/drivers/mtd/nand/omap2.c b/drivers/mtd/nand/omap2.c
index 0cd76f89f4b0..ebd07e95b814 100644
--- a/drivers/mtd/nand/omap2.c
+++ b/drivers/mtd/nand/omap2.c
@@ -11,6 +11,8 @@
 #include <linux/platform_device.h>
 #include <linux/dma-mapping.h>
 #include <linux/delay.h>
+#include <linux/jiffies.h>
+#include <linux/sched.h>
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/nand.h>
 #include <linux/mtd/partitions.h>
@@ -541,7 +543,7 @@ static int omap_wait(struct mtd_info *mtd, struct nand_chip *chip)
        struct omap_nand_info *info = container_of(mtd, struct omap_nand_info,
                                                        mtd);
        unsigned long timeo = jiffies;
-        int status, state = this->state;
+        int status = NAND_STATUS_FAIL, state = this->state;
        if (state == FL_ERASING)
                timeo += (HZ * 400) / 1000;
@@ -556,8 +558,9 @@ static int omap_wait(struct mtd_info *mtd, struct nand_chip *chip)
        while (time_before(jiffies, timeo)) {
                status = __raw_readb(this->IO_ADDR_R);
-                if (!(status & 0x40))
+                if (status & NAND_STATUS_READY)
                        break;
+                cond_resched();
        }
        return status;
 }
diff --git a/drivers/mtd/nftlcore.c b/drivers/mtd/nftlcore.c
index e3f8495a94c2..fb86cacd5bdb 100644
--- a/drivers/mtd/nftlcore.c
+++ b/drivers/mtd/nftlcore.c
@@ -208,7 +208,7 @@ static u16 NFTL_findfreeblock(struct NFTLrecord *nftl, int desperate )
        /* Normally, we force a fold to happen before we run out of free blocks completely */
        if (!desperate && nftl->numfreeEUNs < 2) {
                DEBUG(MTD_DEBUG_LEVEL1, "NFTL_findfreeblock: there are too few free EUNs\n");
-                return 0xffff;
+                return BLOCK_NIL;
        }
        /* Scan for a free block */
@@ -230,11 +230,11 @@ static u16 NFTL_findfreeblock(struct NFTLrecord *nftl, int desperate )
                        printk("Argh! No free blocks found! LastFreeEUN = %d, "
                               "FirstEUN = %d\n", nftl->LastFreeEUN,
                               le16_to_cpu(nftl->MediaHdr.FirstPhysicalEUN));
-                        return 0xffff;
+                        return BLOCK_NIL;
                }
        } while (pot != nftl->LastFreeEUN);
-        return 0xffff;
+        return BLOCK_NIL;
 }
 static u16 NFTL_foldchain (struct NFTLrecord *nftl, unsigned thisVUC, unsigned pendingblock )
@@ -431,7 +431,7 @@ static u16 NFTL_foldchain (struct NFTLrecord *nftl, unsigned thisVUC, unsigned p
        /* add the header so that it is now a valid chain */
        oob.u.a.VirtUnitNum = oob.u.a.SpareVirtUnitNum = cpu_to_le16(thisVUC);
-        oob.u.a.ReplUnitNum = oob.u.a.SpareReplUnitNum = 0xffff;
+        oob.u.a.ReplUnitNum = oob.u.a.SpareReplUnitNum = BLOCK_NIL;
        nftl_write_oob(mtd, (nftl->EraseSize * targetEUN) + 8,
                       8, &retlen, (char *)&oob.u);
@@ -515,7 +515,7 @@ static u16 NFTL_makefreeblock( struct NFTLrecord *nftl , unsigned pendingblock)
        if (ChainLength < 2) {
                printk(KERN_WARNING "No Virtual Unit Chains available for folding. "
                       "Failing request\n");
-                return 0xffff;
+                return BLOCK_NIL;
        }
        return NFTL_foldchain (nftl, LongestChain, pendingblock);
@@ -578,7 +578,7 @@ static inline u16 NFTL_findwriteunit(struct NFTLrecord *nftl, unsigned block)
                                printk(KERN_WARNING
                                       "Infinite loop in Virtual Unit Chain 0x%x\n",
                                       thisVUC);
-                                return 0xffff;
+                                return BLOCK_NIL;
                        }
                        /* Skip to next block in chain */
@@ -601,7 +601,7 @@ static inline u16 NFTL_findwriteunit(struct NFTLrecord *nftl, unsigned block)
                        //u16 startEUN = nftl->EUNtable[thisVUC];
                        //printk("Write to VirtualUnitChain %d, calling makefreeblock()\n", thisVUC);
-                        writeEUN = NFTL_makefreeblock(nftl, 0xffff);
+                        writeEUN = NFTL_makefreeblock(nftl, BLOCK_NIL);
                        if (writeEUN == BLOCK_NIL) {
                                /* OK, we accept that the above comment is
@@ -673,7 +673,7 @@ static inline u16 NFTL_findwriteunit(struct NFTLrecord *nftl, unsigned block)
        printk(KERN_WARNING "Error folding to make room for Virtual Unit Chain 0x%x\n",
               thisVUC);
-        return 0xffff;
+        return BLOCK_NIL;
 }
 static int nftl_writeblock(struct mtd_blktrans_dev *mbd, unsigned long block,
diff --git a/drivers/net/atl1c/atl1c_ethtool.c b/drivers/net/atl1c/atl1c_ethtool.c
index e4afbd628c23..607007d75b6f 100644
--- a/drivers/net/atl1c/atl1c_ethtool.c
+++ b/drivers/net/atl1c/atl1c_ethtool.c
@@ -281,6 +281,8 @@ static int atl1c_set_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)
        if (wol->wolopts & WAKE_PHY)
                adapter->wol |= AT_WUFC_LNKC;
+        device_set_wakeup_enable(&adapter->pdev->dev, adapter->wol);
        return 0;
 }
diff --git a/drivers/net/atl1e/atl1e_ethtool.c b/drivers/net/atl1e/atl1e_ethtool.c
index 619c6583e1aa..4003955d7a96 100644
--- a/drivers/net/atl1e/atl1e_ethtool.c
+++ b/drivers/net/atl1e/atl1e_ethtool.c
@@ -365,6 +365,8 @@ static int atl1e_set_wol(struct net_device *netdev, struct ethtool_wolinfo *wol)
        if (wol->wolopts & WAKE_PHY)
                adapter->wol |= AT_WUFC_LNKC;
+        device_set_wakeup_enable(&adapter->pdev->dev, adapter->wol);
        return 0;
 }
diff --git a/drivers/net/benet/be.h b/drivers/net/benet/be.h
index f703758f0a6e..5b4bf3d2cdc2 100644
--- a/drivers/net/benet/be.h
+++ b/drivers/net/benet/be.h
@@ -73,7 +73,7 @@ static inline char *nic_name(struct pci_dev *pdev)
 #define RX_FRAGS_REFILL_WM      (RX_Q_LEN - MAX_RX_POST)
 #define BE_MAX_LRO_DESCRIPTORS  16
-#define BE_MAX_FRAGS_PER_FRAME  16
+#define BE_MAX_FRAGS_PER_FRAME  (min((u32) 16, (u32) MAX_SKB_FRAGS))
 struct be_dma_mem {
        void *va;
diff --git a/drivers/net/benet/be_ethtool.c b/drivers/net/benet/be_ethtool.c
index 9592f22e4c8c..cccc5419ad72 100644
--- a/drivers/net/benet/be_ethtool.c
+++ b/drivers/net/benet/be_ethtool.c
@@ -162,8 +162,8 @@ be_set_coalesce(struct net_device *netdev, struct ethtool_coalesce *coalesce)
                return -EINVAL;
        adapter->max_rx_coal = coalesce->rx_max_coalesced_frames;
-        if (adapter->max_rx_coal > MAX_SKB_FRAGS)
+        if (adapter->max_rx_coal > BE_MAX_FRAGS_PER_FRAME)
-                adapter->max_rx_coal = MAX_SKB_FRAGS - 1;
+                adapter->max_rx_coal = BE_MAX_FRAGS_PER_FRAME;
        /* if AIC is being turned on now, start with an EQD of 0 */
        if (rx_eq->enable_aic == 0 &&
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index 66c10c87f517..308eb09ca56b 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -666,7 +666,7 @@ static void skb_fill_rx_data(struct be_adapter *adapter,
 {
        struct be_queue_info *rxq = &adapter->rx_obj.q;
        struct be_rx_page_info *page_info;
-        u16 rxq_idx, i, num_rcvd;
+        u16 rxq_idx, i, num_rcvd, j;
        u32 pktsize, hdr_len, curr_frag_len;
        u8 *start;
@@ -709,22 +709,33 @@ static void skb_fill_rx_data(struct be_adapter *adapter,
        /* More frags present for this completion */
        pktsize -= curr_frag_len; /* account for above copied frag */
-        for (i = 1; i < num_rcvd; i++) {
+        for (i = 1, j = 0; i < num_rcvd; i++) {
                index_inc(&rxq_idx, rxq->len);
                page_info = get_rx_page_info(adapter, rxq_idx);
                curr_frag_len = min(pktsize, rx_frag_size);
-                skb_shinfo(skb)->frags[i].page = page_info->page;
+                /* Coalesce all frags from the same physical page in one slot */
-                skb_shinfo(skb)->frags[i].page_offset = page_info->page_offset;
+                if (page_info->page_offset == 0) {
-                skb_shinfo(skb)->frags[i].size = curr_frag_len;
+                        /* Fresh page */
+                        j++;
+                        skb_shinfo(skb)->frags[j].page = page_info->page;
+                        skb_shinfo(skb)->frags[j].page_offset =
+                                                        page_info->page_offset;
+                        skb_shinfo(skb)->frags[j].size = 0;
+                        skb_shinfo(skb)->nr_frags++;
+                } else {
+                        put_page(page_info->page);
+                }
+                skb_shinfo(skb)->frags[j].size += curr_frag_len;
                skb->len += curr_frag_len;
                skb->data_len += curr_frag_len;
-                skb_shinfo(skb)->nr_frags++;
                pktsize -= curr_frag_len;
                memset(page_info, 0, sizeof(*page_info));
        }
+        BUG_ON(j > MAX_SKB_FRAGS);
 done:
        be_rx_stats_update(adapter, pktsize, num_rcvd);
@@ -786,7 +797,7 @@ static void be_rx_compl_process_lro(struct be_adapter *adapter,
        struct skb_frag_struct rx_frags[BE_MAX_FRAGS_PER_FRAME];
        struct be_queue_info *rxq = &adapter->rx_obj.q;
        u32 num_rcvd, pkt_size, remaining, vlanf, curr_frag_len;
-        u16 i, rxq_idx = 0, vid;
+        u16 i, rxq_idx = 0, vid, j;
        num_rcvd = AMAP_GET_BITS(struct amap_eth_rx_compl, numfrags, rxcp);
        pkt_size = AMAP_GET_BITS(struct amap_eth_rx_compl, pktsize, rxcp);
@@ -794,20 +805,28 @@ static void be_rx_compl_process_lro(struct be_adapter *adapter,
        rxq_idx = AMAP_GET_BITS(struct amap_eth_rx_compl, fragndx, rxcp);
        remaining = pkt_size;
-        for (i = 0; i < num_rcvd; i++) {
+        for (i = 0, j = -1; i < num_rcvd; i++) {
                page_info = get_rx_page_info(adapter, rxq_idx);
                curr_frag_len = min(remaining, rx_frag_size);
-                rx_frags[i].page = page_info->page;
+                /* Coalesce all frags from the same physical page in one slot */
-                rx_frags[i].page_offset = page_info->page_offset;
+                if (i == 0 || page_info->page_offset == 0) {
-                rx_frags[i].size = curr_frag_len;
+                        /* First frag or Fresh page */
-                remaining -= curr_frag_len;
+                        j++;
+                        rx_frags[j].page = page_info->page;
+                        rx_frags[j].page_offset = page_info->page_offset;
+                        rx_frags[j].size = 0;
+                } else {
+                        put_page(page_info->page);
+                }
+                rx_frags[j].size += curr_frag_len;
+                remaining -= curr_frag_len;
                index_inc(&rxq_idx, rxq->len);
                memset(page_info, 0, sizeof(*page_info));
        }
+        BUG_ON(j > MAX_SKB_FRAGS);
        if (likely(!vlanf)) {
                lro_receive_frags(&adapter->rx_obj.lro_mgr, rx_frags, pkt_size,
diff --git a/drivers/net/bnx2x_main.c b/drivers/net/bnx2x_main.c
index fbf1352e9c1c..951714a7f90a 100644
--- a/drivers/net/bnx2x_main.c
+++ b/drivers/net/bnx2x_main.c
@@ -8637,6 +8637,14 @@ static int bnx2x_nway_reset(struct net_device *dev)
        return 0;
 }
+static u32
+bnx2x_get_link(struct net_device *dev)
+{
+        struct bnx2x *bp = netdev_priv(dev);
+        return bp->link_vars.link_up;
+}
 static int bnx2x_get_eeprom_len(struct net_device *dev)
 {
        struct bnx2x *bp = netdev_priv(dev);
@@ -10034,7 +10042,7 @@ static struct ethtool_ops bnx2x_ethtool_ops = {
        .get_msglevel           = bnx2x_get_msglevel,
        .set_msglevel           = bnx2x_set_msglevel,
        .nway_reset             = bnx2x_nway_reset,
-        .get_link               = ethtool_op_get_link,
+        .get_link               = bnx2x_get_link,
        .get_eeprom_len         = bnx2x_get_eeprom_len,
        .get_eeprom             = bnx2x_get_eeprom,
        .set_eeprom             = bnx2x_set_eeprom,
diff --git a/drivers/net/cpmac.c b/drivers/net/cpmac.c
index 58afafbd3b9c..fd5e32cbcb87 100644
--- a/drivers/net/cpmac.c
+++ b/drivers/net/cpmac.c
@@ -1097,7 +1097,7 @@ static const struct net_device_ops cpmac_netdev_ops = {
        .ndo_start_xmit         = cpmac_start_xmit,
        .ndo_tx_timeout         = cpmac_tx_timeout,
        .ndo_set_multicast_list = cpmac_set_multicast_list,
-        .ndo_so_ioctl           = cpmac_ioctl,
+        .ndo_do_ioctl           = cpmac_ioctl,
        .ndo_set_config         = cpmac_config,
        .ndo_change_mtu         = eth_change_mtu,
        .ndo_validate_addr      = eth_validate_addr,
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 5e3356f8eb5a..5b8cbdb4b520 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -2185,12 +2185,16 @@ static void e1000_clean_rx_ring(struct e1000_adapter *adapter,
        /* Free all the Rx ring sk_buffs */
        for (i = 0; i < rx_ring->count; i++) {
                buffer_info = &rx_ring->buffer_info[i];
-                if (buffer_info->skb) {
+                if (buffer_info->dma) {
                        pci_unmap_single(pdev,
                                         buffer_info->dma,
                                         buffer_info->length,
                                         PCI_DMA_FROMDEVICE);
+                }
+                buffer_info->dma = 0;
+                if (buffer_info->skb) {
                        dev_kfree_skb(buffer_info->skb);
                        buffer_info->skb = NULL;
                }
@@ -4033,6 +4037,7 @@ static bool e1000_clean_rx_irq(struct e1000_adapter *adapter,
                                 buffer_info->dma,
                                 buffer_info->length,
                                 PCI_DMA_FROMDEVICE);
+                buffer_info->dma = 0;
                length = le16_to_cpu(rx_desc->length);
                /* !EOP means multiple descriptors were used to store a single
@@ -4222,6 +4227,7 @@ map_skb:
                        pci_unmap_single(pdev, buffer_info->dma,
                                         adapter->rx_buffer_len,
                                         PCI_DMA_FROMDEVICE);
+                        buffer_info->dma = 0;
                        break; /* while !buffer_info->skb */
                }
@@ -4817,6 +4823,9 @@ static pci_ers_result_t e1000_io_error_detected(struct pci_dev *pdev,
        netif_device_detach(netdev);
+        if (state == pci_channel_io_perm_failure)
+                return PCI_ERS_RESULT_DISCONNECT;
        if (netif_running(netdev))
                e1000_down(adapter);
        pci_disable_device(pdev);
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 679885a122b4..63415bb6f48f 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -4785,6 +4785,9 @@ static pci_ers_result_t e1000_io_error_detected(struct pci_dev *pdev,
        netif_device_detach(netdev);
+        if (state == pci_channel_io_perm_failure)
+                return PCI_ERS_RESULT_DISCONNECT;
        if (netif_running(netdev))
                e1000e_down(adapter);
        pci_disable_device(pdev);
diff --git a/drivers/net/fsl_pq_mdio.c b/drivers/net/fsl_pq_mdio.c
index 3af581303ca2..d167090248e2 100644
--- a/drivers/net/fsl_pq_mdio.c
+++ b/drivers/net/fsl_pq_mdio.c
@@ -188,7 +188,7 @@ static int fsl_pq_mdio_find_free(struct mii_bus *new_bus)
 }
-#ifdef CONFIG_GIANFAR
+#if defined(CONFIG_GIANFAR) || defined(CONFIG_GIANFAR_MODULE)
 static u32 __iomem *get_gfar_tbipa(struct fsl_pq_mdio __iomem *regs)
 {
        struct gfar __iomem *enet_regs;
@@ -206,7 +206,7 @@ static u32 __iomem *get_gfar_tbipa(struct fsl_pq_mdio __iomem *regs)
 #endif
-#ifdef CONFIG_UCC_GETH
+#if defined(CONFIG_UCC_GETH) || defined(CONFIG_UCC_GETH_MODULE)
 static int get_ucc_id_for_range(u64 start, u64 end, u32 *ucc_id)
 {
        struct device_node *np = NULL;
@@ -291,7 +291,7 @@ static int fsl_pq_mdio_probe(struct of_device *ofdev,
        if (of_device_is_compatible(np, "fsl,gianfar-mdio") ||
                        of_device_is_compatible(np, "fsl,gianfar-tbi") ||
                        of_device_is_compatible(np, "gianfar")) {
-#ifdef CONFIG_GIANFAR
+#if defined(CONFIG_GIANFAR) || defined(CONFIG_GIANFAR_MODULE)
                tbipa = get_gfar_tbipa(regs);
 #else
                err = -ENODEV;
@@ -299,7 +299,7 @@ static int fsl_pq_mdio_probe(struct of_device *ofdev,
 #endif
        } else if (of_device_is_compatible(np, "fsl,ucc-mdio") ||
                        of_device_is_compatible(np, "ucc_geth_phy")) {
-#ifdef CONFIG_UCC_GETH
+#if defined(CONFIG_UCC_GETH) || defined(CONFIG_UCC_GETH_MODULE)
                u32 id;
                static u32 mii_mng_master;
diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
index ea17319624aa..be480292aba1 100644
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -4549,11 +4549,12 @@ static bool igb_clean_rx_irq_adv(struct igb_ring *rx_ring,
                cleaned = true;
                cleaned_count++;
+                /* this is the fast path for the non-packet split case */
                if (!adapter->rx_ps_hdr_size) {
                        pci_unmap_single(pdev, buffer_info->dma,
-                                         adapter->rx_buffer_len +
+                                         adapter->rx_buffer_len,
-                                           NET_IP_ALIGN,
                                         PCI_DMA_FROMDEVICE);
+                        buffer_info->dma = 0;
                        skb_put(skb, length);
                        goto send_up;
                }
@@ -4570,8 +4571,9 @@ static bool igb_clean_rx_irq_adv(struct igb_ring *rx_ring,
                if (!skb_shinfo(skb)->nr_frags) {
                        pci_unmap_single(pdev, buffer_info->dma,
-                                         adapter->rx_ps_hdr_size + NET_IP_ALIGN,
+                                         adapter->rx_ps_hdr_size,
                                         PCI_DMA_FROMDEVICE);
+                        buffer_info->dma = 0;
                        skb_put(skb, hlen);
                }
@@ -4713,7 +4715,6 @@ static void igb_alloc_rx_buffers_adv(struct igb_ring *rx_ring,
                bufsz = adapter->rx_ps_hdr_size;
        else
                bufsz = adapter->rx_buffer_len;
-        bufsz += NET_IP_ALIGN;
        while (cleaned_count--) {
                rx_desc = E1000_RX_DESC_ADV(*rx_ring, i);
@@ -4737,7 +4738,7 @@ static void igb_alloc_rx_buffers_adv(struct igb_ring *rx_ring,
                }
                if (!buffer_info->skb) {
-                        skb = netdev_alloc_skb(netdev, bufsz);
+                        skb = netdev_alloc_skb(netdev, bufsz + NET_IP_ALIGN);
                        if (!skb) {
                                adapter->alloc_rx_buff_failed++;
                                goto no_buffers;
@@ -5338,6 +5339,9 @@ static pci_ers_result_t igb_io_error_detected(struct pci_dev *pdev,
        netif_device_detach(netdev);
+        if (state == pci_channel_io_perm_failure)
+                return PCI_ERS_RESULT_DISCONNECT;
        if (netif_running(netdev))
                igb_down(adapter);
        pci_disable_device(pdev);
diff --git a/drivers/net/irda/bfin_sir.c b/drivers/net/irda/bfin_sir.c
index f3eed6a8fba5..911c082cee5a 100644
--- a/drivers/net/irda/bfin_sir.c
+++ b/drivers/net/irda/bfin_sir.c
@@ -677,6 +677,14 @@ static int bfin_sir_init_iobuf(iobuff_t *io, int size)
        return 0;
 }
+static const struct net_device_ops bfin_sir_ndo = {
+        .ndo_open               = bfin_sir_open,
+        .ndo_stop               = bfin_sir_stop,
+        .ndo_start_xmit         = bfin_sir_hard_xmit,
+        .ndo_do_ioctl           = bfin_sir_ioctl,
+        .ndo_get_stats          = bfin_sir_stats,
+};
 static int __devinit bfin_sir_probe(struct platform_device *pdev)
 {
        struct net_device *dev;
@@ -718,12 +726,8 @@ static int __devinit bfin_sir_probe(struct platform_device *pdev)
        if (err)
                goto err_mem_3;
-        dev->hard_start_xmit = bfin_sir_hard_xmit;
+        dev->netdev_ops = &bfin_sir_ndo;
-        dev->open            = bfin_sir_open;
+        dev->irq = sir_port->irq;
-        dev->stop            = bfin_sir_stop;
-        dev->do_ioctl        = bfin_sir_ioctl;
-        dev->get_stats       = bfin_sir_stats;
-        dev->irq             = sir_port->irq;
        irda_init_max_qos_capabilies(&self->qos);
diff --git a/drivers/net/ixgbe/ixgbe_ethtool.c b/drivers/net/ixgbe/ixgbe_ethtool.c
index 86f4f3e36f27..0f7b6a3a2e68 100644
--- a/drivers/net/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ixgbe/ixgbe_ethtool.c
@@ -139,7 +139,7 @@ static int ixgbe_get_settings(struct net_device *netdev,
        ecmd->autoneg = AUTONEG_ENABLE;
        ecmd->transceiver = XCVR_EXTERNAL;
        if ((hw->phy.media_type == ixgbe_media_type_copper) ||
-            (hw->mac.type == ixgbe_mac_82599EB)) {
+            (hw->phy.multispeed_fiber)) {
                ecmd->supported |= (SUPPORTED_1000baseT_Full |
                                    SUPPORTED_Autoneg);
@@ -217,7 +217,7 @@ static int ixgbe_set_settings(struct net_device *netdev,
        s32 err = 0;
        if ((hw->phy.media_type == ixgbe_media_type_copper) ||
-            (hw->mac.type == ixgbe_mac_82599EB)) {
+            (hw->phy.multispeed_fiber)) {
                /* 10000/copper and 1000/copper must autoneg
                 * this function does not support any duplex forcing, but can
                 * limit the advertising of the adapter to only 10000 or 1000 */
@@ -245,6 +245,7 @@ static int ixgbe_set_settings(struct net_device *netdev,
        } else {
                /* in this case we currently only support 10Gb/FULL */
                if ((ecmd->autoneg == AUTONEG_ENABLE) ||
+                    (ecmd->advertising != ADVERTISED_10000baseT_Full) ||
                    (ecmd->speed + ecmd->duplex != SPEED_10000 + DUPLEX_FULL))
                        return -EINVAL;
        }
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index e756e220db32..5588ef493a3d 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -563,7 +563,6 @@ static void ixgbe_alloc_rx_buffers(struct ixgbe_adapter *adapter,
        union ixgbe_adv_rx_desc *rx_desc;
        struct ixgbe_rx_buffer *bi;
        unsigned int i;
-        unsigned int bufsz = rx_ring->rx_buf_len + NET_IP_ALIGN;
        i = rx_ring->next_to_use;
        bi = &rx_ring->rx_buffer_info[i];
@@ -593,7 +592,9 @@ static void ixgbe_alloc_rx_buffers(struct ixgbe_adapter *adapter,
                if (!bi->skb) {
                        struct sk_buff *skb;
-                        skb = netdev_alloc_skb(adapter->netdev, bufsz);
+                        skb = netdev_alloc_skb(adapter->netdev,
+                                               (rx_ring->rx_buf_len +
+                                                NET_IP_ALIGN));
                        if (!skb) {
                                adapter->alloc_rx_buff_failed++;
@@ -608,7 +609,8 @@ static void ixgbe_alloc_rx_buffers(struct ixgbe_adapter *adapter,
                        skb_reserve(skb, NET_IP_ALIGN);
                        bi->skb = skb;
-                        bi->dma = pci_map_single(pdev, skb->data, bufsz,
+                        bi->dma = pci_map_single(pdev, skb->data,
+                                                 rx_ring->rx_buf_len,
                                                 PCI_DMA_FROMDEVICE);
                }
                /* Refresh the desc even if buffer_addrs didn't change because
@@ -732,6 +734,7 @@ static bool ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector,
                        pci_unmap_single(pdev, rx_buffer_info->dma,
                                         rx_ring->rx_buf_len,
                                         PCI_DMA_FROMDEVICE);
+                        rx_buffer_info->dma = 0;
                        skb_put(skb, len);
                }
@@ -2701,7 +2704,10 @@ static int ixgbe_up_complete(struct ixgbe_adapter *adapter)
         */
        err = hw->phy.ops.identify(hw);
        if (err == IXGBE_ERR_SFP_NOT_SUPPORTED) {
-                DPRINTK(PROBE, ERR, "PHY not supported on this NIC %d\n", err);
+                dev_err(&adapter->pdev->dev, "failed to initialize because "
+                        "an unsupported SFP+ module type was detected.\n"
+                        "Reload the driver after installing a supported "
+                        "module.\n");
                ixgbe_down(adapter);
                return err;
        }
@@ -2812,9 +2818,11 @@ static void ixgbe_clean_rx_ring(struct ixgbe_adapter *adapter,
                }
                if (!rx_buffer_info->page)
                        continue;
-                pci_unmap_page(pdev, rx_buffer_info->page_dma, PAGE_SIZE / 2,
+                if (rx_buffer_info->page_dma) {
-                               PCI_DMA_FROMDEVICE);
+                        pci_unmap_page(pdev, rx_buffer_info->page_dma,
-                rx_buffer_info->page_dma = 0;
+                                       PAGE_SIZE / 2, PCI_DMA_FROMDEVICE);
+                        rx_buffer_info->page_dma = 0;
+                }
                put_page(rx_buffer_info->page);
                rx_buffer_info->page = NULL;
                rx_buffer_info->page_offset = 0;
@@ -3720,10 +3728,11 @@ static void ixgbe_sfp_task(struct work_struct *work)
                        goto reschedule;
                ret = hw->phy.ops.reset(hw);
                if (ret == IXGBE_ERR_SFP_NOT_SUPPORTED) {
-                        DPRINTK(PROBE, ERR, "failed to initialize because an "
+                        dev_err(&adapter->pdev->dev, "failed to initialize "
-                                "unsupported SFP+ module type was detected.\n"
+                                "because an unsupported SFP+ module type "
-                                "Reload the driver after installing a "
+                                "was detected.\n"
-                                "supported module.\n");
+                                "Reload the driver after installing a "
+                                "supported module.\n");
                        unregister_netdev(adapter->netdev);
                } else {
                        DPRINTK(PROBE, INFO, "detected SFP+: %d\n",
@@ -4502,7 +4511,8 @@ static void ixgbe_multispeed_fiber_task(struct work_struct *work)
        u32 autoneg;
        adapter->flags |= IXGBE_FLAG_IN_SFP_LINK_TASK;
-        if (hw->mac.ops.get_link_capabilities)
+        autoneg = hw->phy.autoneg_advertised;
+        if ((!autoneg) && (hw->mac.ops.get_link_capabilities))
                hw->mac.ops.get_link_capabilities(hw, &autoneg,
                                                  &hw->mac.autoneg);
        if (hw->mac.ops.setup_link_speed)
@@ -4526,7 +4536,10 @@ static void ixgbe_sfp_config_module_task(struct work_struct *work)
        adapter->flags |= IXGBE_FLAG_IN_SFP_MOD_TASK;
        err = hw->phy.ops.identify_sfp(hw);
        if (err == IXGBE_ERR_SFP_NOT_SUPPORTED) {
-                DPRINTK(PROBE, ERR, "PHY not supported on this NIC %d\n", err);
+                dev_err(&adapter->pdev->dev, "failed to initialize because "
+                        "an unsupported SFP+ module type was detected.\n"
+                        "Reload the driver after installing a supported "
+                        "module.\n");
                ixgbe_down(adapter);
                return;
        }
@@ -5513,8 +5526,10 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
                          round_jiffies(jiffies + (2 * HZ)));
                err = 0;
        } else if (err == IXGBE_ERR_SFP_NOT_SUPPORTED) {
-                dev_err(&adapter->pdev->dev, "failed to load because an "
+                dev_err(&adapter->pdev->dev, "failed to initialize because "
-                        "unsupported SFP+ module type was detected.\n");
+                        "an unsupported SFP+ module type was detected.\n"
+                        "Reload the driver after installing a supported "
+                        "module.\n");
                goto err_sw_init;
        } else if (err) {
                dev_err(&adapter->pdev->dev, "HW Init failed: %d\n", err);
diff --git a/drivers/net/mdio.c b/drivers/net/mdio.c
index dc45e9856c35..6851bdb2ce29 100644
--- a/drivers/net/mdio.c
+++ b/drivers/net/mdio.c
@@ -14,6 +14,10 @@
 #include <linux/mdio.h>
 #include <linux/module.h>
+MODULE_DESCRIPTION("Generic support for MDIO-compatible transceivers");
+MODULE_AUTHOR("Copyright 2006-2009 Solarflare Communications Inc.");
+MODULE_LICENSE("GPL");
 /**
 * mdio45_probe - probe for an MDIO (clause 45) device
 * @mdio: MDIO interface
diff --git a/drivers/net/sh_eth.c b/drivers/net/sh_eth.c
index 341882f959f3..a2d82ddb3b4d 100644
--- a/drivers/net/sh_eth.c
+++ b/drivers/net/sh_eth.c
@@ -865,8 +865,7 @@ static irqreturn_t sh_eth_interrupt(int irq, void *netdev)
        struct sh_eth_private *mdp = netdev_priv(ndev);
        struct sh_eth_cpu_data *cd = mdp->cd;
        irqreturn_t ret = IRQ_NONE;
-        u32 ioaddr, boguscnt = RX_RING_SIZE;
+        u32 ioaddr, intr_status = 0;
-        u32 intr_status = 0;
        ioaddr = ndev->base_addr;
        spin_lock(&mdp->lock);
@@ -901,12 +900,6 @@ static irqreturn_t sh_eth_interrupt(int irq, void *netdev)
        if (intr_status & cd->eesr_err_check)
                sh_eth_error(ndev, intr_status);
-        if (--boguscnt < 0) {
-                printk(KERN_WARNING
-                       "%s: Too much work at interrupt, status=0x%4.4x.\n",
-                       ndev->name, intr_status);
-        }
 other_irq:
        spin_unlock(&mdp->lock);
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 7681d28c53d7..daf961ab68bc 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -2495,7 +2495,7 @@ static int sky2_status_intr(struct sky2_hw *hw, int to_do, u16 idx)
                        if (likely(status >> 16 == (status & 0xffff))) {
                                skb = sky2->rx_ring[sky2->rx_next].skb;
                                skb->ip_summed = CHECKSUM_COMPLETE;
-                                skb->csum = status & 0xffff;
+                                skb->csum = le16_to_cpu(status);
                        } else {
                                printk(KERN_NOTICE PFX "%s: hardware receive "
                                       "checksum problem (status = %#x)\n",
diff --git a/drivers/net/usb/cdc_eem.c b/drivers/net/usb/cdc_eem.c
index 80e01778dd3b..cd35d50e46d4 100644
--- a/drivers/net/usb/cdc_eem.c
+++ b/drivers/net/usb/cdc_eem.c
@@ -319,7 +319,7 @@ static int eem_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
                                return crc == crc2;
                        if (unlikely(crc != crc2)) {
-                                dev->stats.rx_errors++;
+                                dev->net->stats.rx_errors++;
                                dev_kfree_skb_any(skb2);
                        } else
                                usbnet_skb_return(dev, skb2);
diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c
index 7ae82446b93a..1d3730d6690f 100644
--- a/drivers/net/usb/dm9601.c
+++ b/drivers/net/usb/dm9601.c
@@ -513,11 +513,11 @@ static int dm9601_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
        len = (skb->data[1] | (skb->data[2] << 8)) - 4;
        if (unlikely(status & 0xbf)) {
-                if (status & 0x01) dev->stats.rx_fifo_errors++;
+                if (status & 0x01) dev->net->stats.rx_fifo_errors++;
-                if (status & 0x02) dev->stats.rx_crc_errors++;
+                if (status & 0x02) dev->net->stats.rx_crc_errors++;
-                if (status & 0x04) dev->stats.rx_frame_errors++;
+                if (status & 0x04) dev->net->stats.rx_frame_errors++;
-                if (status & 0x20) dev->stats.rx_missed_errors++;
+                if (status & 0x20) dev->net->stats.rx_missed_errors++;
-                if (status & 0x90) dev->stats.rx_length_errors++;
+                if (status & 0x90) dev->net->stats.rx_length_errors++;
                return 0;
        }
diff --git a/drivers/net/usb/net1080.c b/drivers/net/usb/net1080.c
index 034e8a73ca6b..aeb1ab03a9ee 100644
--- a/drivers/net/usb/net1080.c
+++ b/drivers/net/usb/net1080.c
@@ -433,7 +433,7 @@ static int net1080_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
                dbg("rx framesize %d range %d..%d mtu %d", skb->len,
                        net->hard_header_len, dev->hard_mtu, net->mtu);
 #endif
-                dev->stats.rx_frame_errors++;
+                dev->net->stats.rx_frame_errors++;
                nc_ensure_sync(dev);
                return 0;
        }
@@ -442,12 +442,12 @@ static int net1080_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
        hdr_len = le16_to_cpup(&header->hdr_len);
        packet_len = le16_to_cpup(&header->packet_len);
        if (FRAMED_SIZE(packet_len) > NC_MAX_PACKET) {
-                dev->stats.rx_frame_errors++;
+                dev->net->stats.rx_frame_errors++;
                dbg("packet too big, %d", packet_len);
                nc_ensure_sync(dev);
                return 0;
        } else if (hdr_len < MIN_HEADER) {
-                dev->stats.rx_frame_errors++;
+                dev->net->stats.rx_frame_errors++;
                dbg("header too short, %d", hdr_len);
                nc_ensure_sync(dev);
                return 0;
@@ -465,21 +465,21 @@ static int net1080_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
        if ((packet_len & 0x01) == 0) {
                if (skb->data [packet_len] != PAD_BYTE) {
-                        dev->stats.rx_frame_errors++;
+                        dev->net->stats.rx_frame_errors++;
                        dbg("bad pad");
                        return 0;
                }
                skb_trim(skb, skb->len - 1);
        }
        if (skb->len != packet_len) {
-                dev->stats.rx_frame_errors++;
+                dev->net->stats.rx_frame_errors++;
                dbg("bad packet len %d (expected %d)",
                        skb->len, packet_len);
                nc_ensure_sync(dev);
                return 0;
        }
        if (header->packet_id != get_unaligned(&trailer->packet_id)) {
-                dev->stats.rx_fifo_errors++;
+                dev->net->stats.rx_fifo_errors++;
                dbg("(2+ dropped) rx packet_id mismatch 0x%x 0x%x",
                        le16_to_cpu(header->packet_id),
                        le16_to_cpu(trailer->packet_id));
diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c
index 1bf243ef950e..2232232b7989 100644
--- a/drivers/net/usb/rndis_host.c
+++ b/drivers/net/usb/rndis_host.c
@@ -487,7 +487,7 @@ int rndis_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
                if (unlikely(hdr->msg_type != RNDIS_MSG_PACKET
                                || skb->len < msg_len
                                || (data_offset + data_len + 8) > msg_len)) {
-                        dev->stats.rx_frame_errors++;
+                        dev->net->stats.rx_frame_errors++;
                        devdbg(dev, "bad rndis message %d/%d/%d/%d, len %d",
                                le32_to_cpu(hdr->msg_type),
                                msg_len, data_offset, data_len, skb->len);
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 89a91f8c22de..fe045896406b 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -1108,18 +1108,18 @@ static int smsc95xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
                if (unlikely(header & RX_STS_ES_)) {
                        if (netif_msg_rx_err(dev))
                                devdbg(dev, "Error header=0x%08x", header);
-                        dev->stats.rx_errors++;
+                        dev->net->stats.rx_errors++;
-                        dev->stats.rx_dropped++;
+                        dev->net->stats.rx_dropped++;
                        if (header & RX_STS_CRC_) {
-                                dev->stats.rx_crc_errors++;
+                                dev->net->stats.rx_crc_errors++;
                        } else {
                                if (header & (RX_STS_TL_ | RX_STS_RF_))
-                                        dev->stats.rx_frame_errors++;
+                                        dev->net->stats.rx_frame_errors++;
                                if ((header & RX_STS_LE_) &&
                                        (!(header & RX_STS_FT_)))
-                                        dev->stats.rx_length_errors++;
+                                        dev->net->stats.rx_length_errors++;
                        }
                } else {
                        /* ETH_FRAME_LEN + 4(CRC) + 2(COE) + 4(Vlan) */
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 22c0585a0319..edfd9e10ceba 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -234,8 +234,8 @@ void usbnet_skb_return (struct usbnet *dev, struct sk_buff *skb)
        int     status;
        skb->protocol = eth_type_trans (skb, dev->net);
-        dev->stats.rx_packets++;
+        dev->net->stats.rx_packets++;
-        dev->stats.rx_bytes += skb->len;
+        dev->net->stats.rx_bytes += skb->len;
        if (netif_msg_rx_status (dev))
                devdbg (dev, "< rx, len %zu, type 0x%x",
@@ -397,7 +397,7 @@ static inline void rx_process (struct usbnet *dev, struct sk_buff *skb)
                if (netif_msg_rx_err (dev))
                        devdbg (dev, "drop");
 error:
-                dev->stats.rx_errors++;
+                dev->net->stats.rx_errors++;
                skb_queue_tail (&dev->done, skb);
        }
 }
@@ -420,8 +420,8 @@ static void rx_complete (struct urb *urb)
        case 0:
                if (skb->len < dev->net->hard_header_len) {
                        entry->state = rx_cleanup;
-                        dev->stats.rx_errors++;
+                        dev->net->stats.rx_errors++;
-                        dev->stats.rx_length_errors++;
+                        dev->net->stats.rx_length_errors++;
                        if (netif_msg_rx_err (dev))
                                devdbg (dev, "rx length %d", skb->len);
                }
@@ -433,7 +433,7 @@ static void rx_complete (struct urb *urb)
         * storm, recovering as needed.
         */
        case -EPIPE:
-                dev->stats.rx_errors++;
+                dev->net->stats.rx_errors++;
                usbnet_defer_kevent (dev, EVENT_RX_HALT);
                // FALLTHROUGH
@@ -451,7 +451,7 @@ static void rx_complete (struct urb *urb)
        case -EPROTO:
        case -ETIME:
        case -EILSEQ:
-                dev->stats.rx_errors++;
+                dev->net->stats.rx_errors++;
                if (!timer_pending (&dev->delay)) {
                        mod_timer (&dev->delay, jiffies + THROTTLE_JIFFIES);
                        if (netif_msg_link (dev))
@@ -465,12 +465,12 @@ block:
        /* data overrun ... flush fifo? */
        case -EOVERFLOW:
-                dev->stats.rx_over_errors++;
+                dev->net->stats.rx_over_errors++;
                // FALLTHROUGH
        default:
                entry->state = rx_cleanup;
-                dev->stats.rx_errors++;
+                dev->net->stats.rx_errors++;
                if (netif_msg_rx_err (dev))
                        devdbg (dev, "rx status %d", urb_status);
                break;
@@ -583,8 +583,8 @@ int usbnet_stop (struct net_device *net)
        if (netif_msg_ifdown (dev))
                devinfo (dev, "stop stats: rx/tx %ld/%ld, errs %ld/%ld",
-                        dev->stats.rx_packets, dev->stats.tx_packets,
+                        net->stats.rx_packets, net->stats.tx_packets,
-                        dev->stats.rx_errors, dev->stats.tx_errors
+                        net->stats.rx_errors, net->stats.tx_errors
                        );
        // ensure there are no more active urbs
@@ -891,10 +891,10 @@ static void tx_complete (struct urb *urb)
        struct usbnet           *dev = entry->dev;
        if (urb->status == 0) {
-                dev->stats.tx_packets++;
+                dev->net->stats.tx_packets++;
-                dev->stats.tx_bytes += entry->length;
+                dev->net->stats.tx_bytes += entry->length;
        } else {
-                dev->stats.tx_errors++;
+                dev->net->stats.tx_errors++;
                switch (urb->status) {
                case -EPIPE:
@@ -1020,7 +1020,7 @@ int usbnet_start_xmit (struct sk_buff *skb, struct net_device *net)
                        devdbg (dev, "drop, code %d", retval);
 drop:
                retval = NET_XMIT_SUCCESS;
-                dev->stats.tx_dropped++;
+                dev->net->stats.tx_dropped++;
                if (skb)
                        dev_kfree_skb_any (skb);
                usb_free_urb (urb);
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 87197dd9c788..1097c72e44d5 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -208,11 +208,14 @@ rx_drop:
 static struct net_device_stats *veth_get_stats(struct net_device *dev)
 {
-        struct veth_priv *priv = netdev_priv(dev);
+        struct veth_priv *priv;
-        struct net_device_stats *dev_stats = &dev->stats;
+        struct net_device_stats *dev_stats;
-        unsigned int cpu;
+        int cpu;
        struct veth_net_stats *stats;
+        priv = netdev_priv(dev);
+        dev_stats = &dev->stats;
        dev_stats->rx_packets = 0;
        dev_stats->tx_packets = 0;
        dev_stats->rx_bytes = 0;
@@ -220,17 +223,16 @@ static struct net_device_stats *veth_get_stats(struct net_device *dev)
        dev_stats->tx_dropped = 0;
        dev_stats->rx_dropped = 0;
-        if (priv->stats)
+        for_each_online_cpu(cpu) {
-                for_each_online_cpu(cpu) {
+                stats = per_cpu_ptr(priv->stats, cpu);
-                        stats = per_cpu_ptr(priv->stats, cpu);
-                        dev_stats->rx_packets += stats->rx_packets;
+                dev_stats->rx_packets += stats->rx_packets;
-                        dev_stats->tx_packets += stats->tx_packets;
+                dev_stats->tx_packets += stats->tx_packets;
-                        dev_stats->rx_bytes += stats->rx_bytes;
+                dev_stats->rx_bytes += stats->rx_bytes;
-                        dev_stats->tx_bytes += stats->tx_bytes;
+                dev_stats->tx_bytes += stats->tx_bytes;
-                        dev_stats->tx_dropped += stats->tx_dropped;
+                dev_stats->tx_dropped += stats->tx_dropped;
-                        dev_stats->rx_dropped += stats->rx_dropped;
+                dev_stats->rx_dropped += stats->rx_dropped;
-                }
+        }
        return dev_stats;
 }
@@ -257,8 +259,6 @@ static int veth_close(struct net_device *dev)
        netif_carrier_off(dev);
        netif_carrier_off(priv->peer);
-        free_percpu(priv->stats);
-        priv->stats = NULL;
        return 0;
 }
@@ -289,6 +289,15 @@ static int veth_dev_init(struct net_device *dev)
        return 0;
 }
+static void veth_dev_free(struct net_device *dev)
+{
+        struct veth_priv *priv;
+        priv = netdev_priv(dev);
+        free_percpu(priv->stats);
+        free_netdev(dev);
+}
 static const struct net_device_ops veth_netdev_ops = {
        .ndo_init            = veth_dev_init,
        .ndo_open            = veth_open,
@@ -306,7 +315,7 @@ static void veth_setup(struct net_device *dev)
        dev->netdev_ops = &veth_netdev_ops;
        dev->ethtool_ops = &veth_ethtool_ops;
        dev->features |= NETIF_F_LLTX;
-        dev->destructor = free_netdev;
+        dev->destructor = veth_dev_free;
 }
 /*
diff --git a/drivers/parport/parport_pc.c b/drivers/parport/parport_pc.c
index 1032d5fdbd42..2597145a066e 100644
--- a/drivers/parport/parport_pc.c
+++ b/drivers/parport/parport_pc.c
@@ -2907,6 +2907,7 @@ enum parport_pc_pci_cards {
        netmos_9755,
        netmos_9805,
        netmos_9815,
+        netmos_9901,
        quatech_sppxp100,
 };
@@ -2987,7 +2988,7 @@ static struct parport_pc_pci {
        /* netmos_9755 */               { 2, { { 0, 1 }, { 2, 3 },} },
        /* netmos_9805 */               { 1, { { 0, -1 }, } },
        /* netmos_9815 */               { 2, { { 0, -1 }, { 2, -1 }, } },
+        /* netmos_9901 */               { 1, { { 0, -1 }, } },
        /* quatech_sppxp100 */          { 1, { { 0, 1 }, } },
 };
@@ -3089,6 +3090,8 @@ static const struct pci_device_id parport_pc_pci_tbl[] = {
          PCI_ANY_ID, PCI_ANY_ID, 0, 0, netmos_9805 },
        { PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9815,
          PCI_ANY_ID, PCI_ANY_ID, 0, 0, netmos_9815 },
+        { PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9901,
+          0xA000, 0x2000, 0, 0, netmos_9901 },
        /* Quatech SPPXP-100 Parallel port PCI ExpressCard */
        { PCI_VENDOR_ID_QUATECH, PCI_DEVICE_ID_QUATECH_SPPXP_100,
          PCI_ANY_ID, PCI_ANY_ID, 0, 0, quatech_sppxp100 },
diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
index e53eacd75c8d..53075424a434 100644
--- a/drivers/pci/intel-iommu.c
+++ b/drivers/pci/intel-iommu.c
@@ -39,7 +39,6 @@
 #include <linux/sysdev.h>
 #include <asm/cacheflush.h>
 #include <asm/iommu.h>
-#include <asm/e820.h>
 #include "pci.h"
 #define ROOT_SIZE               VTD_PAGE_SIZE
@@ -57,14 +56,32 @@
 #define MAX_AGAW_WIDTH 64
 #define DOMAIN_MAX_ADDR(gaw) ((((u64)1) << gaw) - 1)
+#define DOMAIN_MAX_PFN(gaw)  ((((u64)1) << (gaw-VTD_PAGE_SHIFT)) - 1)
 #define IOVA_PFN(addr)          ((addr) >> PAGE_SHIFT)
 #define DMA_32BIT_PFN           IOVA_PFN(DMA_BIT_MASK(32))
 #define DMA_64BIT_PFN           IOVA_PFN(DMA_BIT_MASK(64))
-#ifndef PHYSICAL_PAGE_MASK
-#define PHYSICAL_PAGE_MASK PAGE_MASK
+/* VT-d pages must always be _smaller_ than MM pages. Otherwise things
-#endif
+   are never going to work. */
+static inline unsigned long dma_to_mm_pfn(unsigned long dma_pfn)
+{
+        return dma_pfn >> (PAGE_SHIFT - VTD_PAGE_SHIFT);
+}
+static inline unsigned long mm_to_dma_pfn(unsigned long mm_pfn)
+{
+        return mm_pfn << (PAGE_SHIFT - VTD_PAGE_SHIFT);
+}
+static inline unsigned long page_to_dma_pfn(struct page *pg)
+{
+        return mm_to_dma_pfn(page_to_pfn(pg));
+}
+static inline unsigned long virt_to_dma_pfn(void *p)
+{
+        return page_to_dma_pfn(virt_to_page(p));
+}
 /* global iommu list, set NULL for ignored DMAR units */
 static struct intel_iommu **g_iommus;
@@ -205,12 +222,17 @@ static inline void dma_set_pte_prot(struct dma_pte *pte, unsigned long prot)
 static inline u64 dma_pte_addr(struct dma_pte *pte)
 {
-        return (pte->val & VTD_PAGE_MASK);
+#ifdef CONFIG_64BIT
+        return pte->val & VTD_PAGE_MASK;
+#else
+        /* Must have a full atomic 64-bit read */
+        return  __cmpxchg64(pte, 0ULL, 0ULL) & VTD_PAGE_MASK;
+#endif
 }
-static inline void dma_set_pte_addr(struct dma_pte *pte, u64 addr)
+static inline void dma_set_pte_pfn(struct dma_pte *pte, unsigned long pfn)
 {
-        pte->val |= (addr & VTD_PAGE_MASK);
+        pte->val |= (uint64_t)pfn << VTD_PAGE_SHIFT;
 }
 static inline bool dma_pte_present(struct dma_pte *pte)
@@ -218,6 +240,11 @@ static inline bool dma_pte_present(struct dma_pte *pte)
        return (pte->val & 3) != 0;
 }
+static inline int first_pte_in_page(struct dma_pte *pte)
+{
+        return !((unsigned long)pte & ~VTD_PAGE_MASK);
+}
 /*
 * This domain is a statically identity mapping domain.
 *      1. This domain creats a static 1:1 mapping to all usable memory.
@@ -245,7 +272,6 @@ struct dmar_domain {
        struct iova_domain iovad;       /* iova's that belong to this domain */
        struct dma_pte  *pgd;           /* virtual address */
-        spinlock_t      mapping_lock;   /* page table lock */
        int             gaw;            /* max guest address width */
        /* adjusted guest address width, 0 is level 2 30-bit */
@@ -649,80 +675,78 @@ static inline int width_to_agaw(int width)
 static inline unsigned int level_to_offset_bits(int level)
 {
-        return (12 + (level - 1) * LEVEL_STRIDE);
+        return (level - 1) * LEVEL_STRIDE;
 }
-static inline int address_level_offset(u64 addr, int level)
+static inline int pfn_level_offset(unsigned long pfn, int level)
 {
-        return ((addr >> level_to_offset_bits(level)) & LEVEL_MASK);
+        return (pfn >> level_to_offset_bits(level)) & LEVEL_MASK;
 }
-static inline u64 level_mask(int level)
+static inline unsigned long level_mask(int level)
 {
-        return ((u64)-1 << level_to_offset_bits(level));
+        return -1UL << level_to_offset_bits(level);
 }
-static inline u64 level_size(int level)
+static inline unsigned long level_size(int level)
 {
-        return ((u64)1 << level_to_offset_bits(level));
+        return 1UL << level_to_offset_bits(level);
 }
-static inline u64 align_to_level(u64 addr, int level)
+static inline unsigned long align_to_level(unsigned long pfn, int level)
 {
-        return ((addr + level_size(level) - 1) & level_mask(level));
+        return (pfn + level_size(level) - 1) & level_mask(level);
 }
-static struct dma_pte * addr_to_dma_pte(struct dmar_domain *domain, u64 addr)
+static struct dma_pte *pfn_to_dma_pte(struct dmar_domain *domain,
+                                      unsigned long pfn)
 {
-        int addr_width = agaw_to_width(domain->agaw);
+        int addr_width = agaw_to_width(domain->agaw) - VTD_PAGE_SHIFT;
        struct dma_pte *parent, *pte = NULL;
        int level = agaw_to_level(domain->agaw);
        int offset;
-        unsigned long flags;
        BUG_ON(!domain->pgd);
+        BUG_ON(addr_width < BITS_PER_LONG && pfn >> addr_width);
-        addr &= (((u64)1) << addr_width) - 1;
        parent = domain->pgd;
-        spin_lock_irqsave(&domain->mapping_lock, flags);
        while (level > 0) {
                void *tmp_page;
-                offset = address_level_offset(addr, level);
+                offset = pfn_level_offset(pfn, level);
                pte = &parent[offset];
                if (level == 1)
                        break;
                if (!dma_pte_present(pte)) {
+                        uint64_t pteval;
                        tmp_page = alloc_pgtable_page();
-                        if (!tmp_page) {
+                        if (!tmp_page)
-                                spin_unlock_irqrestore(&domain->mapping_lock,
-                                        flags);
                                return NULL;
+                        domain_flush_cache(domain, tmp_page, VTD_PAGE_SIZE);
+                        pteval = (virt_to_dma_pfn(tmp_page) << VTD_PAGE_SHIFT) | DMA_PTE_READ | DMA_PTE_WRITE;
+                        if (cmpxchg64(&pte->val, 0ULL, pteval)) {
+                                /* Someone else set it while we were thinking; use theirs. */
+                                free_pgtable_page(tmp_page);
+                        } else {
+                                dma_pte_addr(pte);
+                                domain_flush_cache(domain, pte, sizeof(*pte));
                        }
-                        domain_flush_cache(domain, tmp_page, PAGE_SIZE);
-                        dma_set_pte_addr(pte, virt_to_phys(tmp_page));
-                        /*
-                         * high level table always sets r/w, last level page
-                         * table control read/write
-                         */
-                        dma_set_pte_readable(pte);
-                        dma_set_pte_writable(pte);
-                        domain_flush_cache(domain, pte, sizeof(*pte));
                }
                parent = phys_to_virt(dma_pte_addr(pte));
                level--;
        }
-        spin_unlock_irqrestore(&domain->mapping_lock, flags);
        return pte;
 }
 /* return address's pte at specific level */
-static struct dma_pte *dma_addr_level_pte(struct dmar_domain *domain, u64 addr,
+static struct dma_pte *dma_pfn_level_pte(struct dmar_domain *domain,
-                int level)
+                                         unsigned long pfn,
+                                         int level)
 {
        struct dma_pte *parent, *pte = NULL;
        int total = agaw_to_level(domain->agaw);
@@ -730,7 +754,7 @@ static struct dma_pte *dma_addr_level_pte(struct dmar_domain *domain, u64 addr,
        parent = domain->pgd;
        while (level <= total) {
-                offset = address_level_offset(addr, total);
+                offset = pfn_level_offset(pfn, total);
                pte = &parent[offset];
                if (level == total)
                        return pte;
@@ -743,74 +767,82 @@ static struct dma_pte *dma_addr_level_pte(struct dmar_domain *domain, u64 addr,
        return NULL;
 }
-/* clear one page's page table */
-static void dma_pte_clear_one(struct dmar_domain *domain, u64 addr)
-{
-        struct dma_pte *pte = NULL;
-        /* get last level pte */
-        pte = dma_addr_level_pte(domain, addr, 1);
-        if (pte) {
-                dma_clear_pte(pte);
-                domain_flush_cache(domain, pte, sizeof(*pte));
-        }
-}
 /* clear last level pte, a tlb flush should be followed */
-static void dma_pte_clear_range(struct dmar_domain *domain, u64 start, u64 end)
+static void dma_pte_clear_range(struct dmar_domain *domain,
+                                unsigned long start_pfn,
+                                unsigned long last_pfn)
 {
-        int addr_width = agaw_to_width(domain->agaw);
+        int addr_width = agaw_to_width(domain->agaw) - VTD_PAGE_SHIFT;
-        int npages;
+        struct dma_pte *first_pte, *pte;
+        BUG_ON(addr_width < BITS_PER_LONG && start_pfn >> addr_width);
+        BUG_ON(addr_width < BITS_PER_LONG && last_pfn >> addr_width);
-        start &= (((u64)1) << addr_width) - 1;
+        /* we don't need lock here; nobody else touches the iova range */
-        end &= (((u64)1) << addr_width) - 1;
+        while (start_pfn <= last_pfn) {
-        /* in case it's partial page */
+                first_pte = pte = dma_pfn_level_pte(domain, start_pfn, 1);
-        start &= PAGE_MASK;
+                if (!pte) {
-        end = PAGE_ALIGN(end);
+                        start_pfn = align_to_level(start_pfn + 1, 2);
-        npages = (end - start) / VTD_PAGE_SIZE;
+                        continue;
+                }
+                do { 
+                        dma_clear_pte(pte);
+                        start_pfn++;
+                        pte++;
+                } while (start_pfn <= last_pfn && !first_pte_in_page(pte));
-        /* we don't need lock here, nobody else touches the iova range */
+                domain_flush_cache(domain, first_pte,
-        while (npages--) {
+                                   (void *)pte - (void *)first_pte);
-                dma_pte_clear_one(domain, start);
-                start += VTD_PAGE_SIZE;
        }
 }
 /* free page table pages. last level pte should already be cleared */
 static void dma_pte_free_pagetable(struct dmar_domain *domain,
-        u64 start, u64 end)
+                                   unsigned long start_pfn,
+                                   unsigned long last_pfn)
 {
-        int addr_width = agaw_to_width(domain->agaw);
+        int addr_width = agaw_to_width(domain->agaw) - VTD_PAGE_SHIFT;
-        struct dma_pte *pte;
+        struct dma_pte *first_pte, *pte;
        int total = agaw_to_level(domain->agaw);
        int level;
-        u64 tmp;
+        unsigned long tmp;
-        start &= (((u64)1) << addr_width) - 1;
+        BUG_ON(addr_width < BITS_PER_LONG && start_pfn >> addr_width);
-        end &= (((u64)1) << addr_width) - 1;
+        BUG_ON(addr_width < BITS_PER_LONG && last_pfn >> addr_width);
-        /* we don't need lock here, nobody else touches the iova range */
+        /* We don't need lock here; nobody else touches the iova range */
        level = 2;
        while (level <= total) {
-                tmp = align_to_level(start, level);
+                tmp = align_to_level(start_pfn, level);
-                if (tmp >= end || (tmp + level_size(level) > end))
+                /* If we can't even clear one PTE at this level, we're done */
+                if (tmp + level_size(level) - 1 > last_pfn)
                        return;
-                while (tmp < end) {
+                while (tmp + level_size(level) - 1 <= last_pfn) {
-                        pte = dma_addr_level_pte(domain, tmp, level);
+                        first_pte = pte = dma_pfn_level_pte(domain, tmp, level);
-                        if (pte) {
+                        if (!pte) {
-                                free_pgtable_page(
+                                tmp = align_to_level(tmp + 1, level + 1);
-                                        phys_to_virt(dma_pte_addr(pte)));
+                                continue;
-                                dma_clear_pte(pte);
-                                domain_flush_cache(domain, pte, sizeof(*pte));
                        }
-                        tmp += level_size(level);
+                        do {
+                                if (dma_pte_present(pte)) {
+                                        free_pgtable_page(phys_to_virt(dma_pte_addr(pte)));
+                                        dma_clear_pte(pte);
+                                }
+                                pte++;
+                                tmp += level_size(level);
+                        } while (!first_pte_in_page(pte) &&
+                                 tmp + level_size(level) - 1 <= last_pfn);
+                        domain_flush_cache(domain, first_pte,
+                                           (void *)pte - (void *)first_pte);
+                        
                }
                level++;
        }
        /* free pgd */
-        if (start == 0 && end >= ((((u64)1) << addr_width) - 1)) {
+        if (start_pfn == 0 && last_pfn == DOMAIN_MAX_PFN(domain->gaw)) {
                free_pgtable_page(domain->pgd);
                domain->pgd = NULL;
        }
@@ -1036,11 +1068,11 @@ static void iommu_flush_dev_iotlb(struct dmar_domain *domain,
 }
 static void iommu_flush_iotlb_psi(struct intel_iommu *iommu, u16 did,
-                                  u64 addr, unsigned int pages)
+                                  unsigned long pfn, unsigned int pages)
 {
        unsigned int mask = ilog2(__roundup_pow_of_two(pages));
+        uint64_t addr = (uint64_t)pfn << VTD_PAGE_SHIFT;
-        BUG_ON(addr & (~VTD_PAGE_MASK));
        BUG_ON(pages == 0);
        /*
@@ -1055,7 +1087,12 @@ static void iommu_flush_iotlb_psi(struct intel_iommu *iommu, u16 did,
        else
                iommu->flush.flush_iotlb(iommu, did, addr, mask,
                                                DMA_TLB_PSI_FLUSH);
-        if (did)
+        /*
+         * In caching mode, domain ID 0 is reserved for non-present to present
+         * mapping flush. Device IOTLB doesn't need to be flushed in this case.
+         */
+        if (!cap_caching_mode(iommu->cap) || did)
                iommu_flush_dev_iotlb(iommu->domains[did], addr, mask);
 }
@@ -1280,7 +1317,6 @@ static void dmar_init_reserved_ranges(void)
        struct pci_dev *pdev = NULL;
        struct iova *iova;
        int i;
-        u64 addr, size;
        init_iova_domain(&reserved_iova_list, DMA_32BIT_PFN);
@@ -1303,12 +1339,9 @@ static void dmar_init_reserved_ranges(void)
                        r = &pdev->resource[i];
                        if (!r->flags || !(r->flags & IORESOURCE_MEM))
                                continue;
-                        addr = r->start;
+                        iova = reserve_iova(&reserved_iova_list,
-                        addr &= PHYSICAL_PAGE_MASK;
+                                            IOVA_PFN(r->start),
-                        size = r->end - addr;
+                                            IOVA_PFN(r->end));
-                        size = PAGE_ALIGN(size);
-                        iova = reserve_iova(&reserved_iova_list, IOVA_PFN(addr),
-                                IOVA_PFN(size + addr) - 1);
                        if (!iova)
                                printk(KERN_ERR "Reserve iova failed\n");
                }
@@ -1342,7 +1375,6 @@ static int domain_init(struct dmar_domain *domain, int guest_width)
        unsigned long sagaw;
        init_iova_domain(&domain->iovad, DMA_32BIT_PFN);
-        spin_lock_init(&domain->mapping_lock);
        spin_lock_init(&domain->iommu_lock);
        domain_reserve_special_ranges(domain);
@@ -1389,7 +1421,6 @@ static void domain_exit(struct dmar_domain *domain)
 {
        struct dmar_drhd_unit *drhd;
        struct intel_iommu *iommu;
-        u64 end;
        /* Domain 0 is reserved, so dont process it */
        if (!domain)
@@ -1398,14 +1429,12 @@ static void domain_exit(struct dmar_domain *domain)
        domain_remove_dev_info(domain);
        /* destroy iovas */
        put_iova_domain(&domain->iovad);
-        end = DOMAIN_MAX_ADDR(domain->gaw);
-        end = end & (~PAGE_MASK);
        /* clear ptes */
-        dma_pte_clear_range(domain, 0, end);
+        dma_pte_clear_range(domain, 0, DOMAIN_MAX_PFN(domain->gaw));
        /* free page tables */
-        dma_pte_free_pagetable(domain, 0, end);
+        dma_pte_free_pagetable(domain, 0, DOMAIN_MAX_PFN(domain->gaw));
        for_each_active_iommu(iommu, drhd)
                if (test_bit(iommu->seq_id, &domain->iommu_bmp))
@@ -1619,42 +1648,86 @@ static int domain_context_mapped(struct pci_dev *pdev)
                                             tmp->devfn);
 }
-static int
+static int __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn,
-domain_page_mapping(struct dmar_domain *domain, dma_addr_t iova,
+                            struct scatterlist *sg, unsigned long phys_pfn,
-                        u64 hpa, size_t size, int prot)
+                            unsigned long nr_pages, int prot)
 {
-        u64 start_pfn, end_pfn;
+        struct dma_pte *first_pte = NULL, *pte = NULL;
-        struct dma_pte *pte;
+        phys_addr_t uninitialized_var(pteval);
-        int index;
+        int addr_width = agaw_to_width(domain->agaw) - VTD_PAGE_SHIFT;
-        int addr_width = agaw_to_width(domain->agaw);
+        unsigned long sg_res;
-        hpa &= (((u64)1) << addr_width) - 1;
+        BUG_ON(addr_width < BITS_PER_LONG && (iov_pfn + nr_pages - 1) >> addr_width);
        if ((prot & (DMA_PTE_READ|DMA_PTE_WRITE)) == 0)
                return -EINVAL;
-        iova &= PAGE_MASK;
-        start_pfn = ((u64)hpa) >> VTD_PAGE_SHIFT;
+        prot &= DMA_PTE_READ | DMA_PTE_WRITE | DMA_PTE_SNP;
-        end_pfn = (VTD_PAGE_ALIGN(((u64)hpa) + size)) >> VTD_PAGE_SHIFT;
-        index = 0;
+        if (sg)
-        while (start_pfn < end_pfn) {
+                sg_res = 0;
-                pte = addr_to_dma_pte(domain, iova + VTD_PAGE_SIZE * index);
+        else {
-                if (!pte)
+                sg_res = nr_pages + 1;
-                        return -ENOMEM;
+                pteval = ((phys_addr_t)phys_pfn << VTD_PAGE_SHIFT) | prot;
+        }
+        while (nr_pages--) {
+                uint64_t tmp;
+                if (!sg_res) {
+                        sg_res = (sg->offset + sg->length + VTD_PAGE_SIZE - 1) >> VTD_PAGE_SHIFT;
+                        sg->dma_address = ((dma_addr_t)iov_pfn << VTD_PAGE_SHIFT) + sg->offset;
+                        sg->dma_length = sg->length;
+                        pteval = page_to_phys(sg_page(sg)) | prot;
+                }
+                if (!pte) {
+                        first_pte = pte = pfn_to_dma_pte(domain, iov_pfn);
+                        if (!pte)
+                                return -ENOMEM;
+                }
                /* We don't need lock here, nobody else
                 * touches the iova range
                 */
-                BUG_ON(dma_pte_addr(pte));
+                tmp = cmpxchg64_local(&pte->val, 0ULL, pteval);
-                dma_set_pte_addr(pte, start_pfn << VTD_PAGE_SHIFT);
+                if (tmp) {
-                dma_set_pte_prot(pte, prot);
+                        static int dumps = 5;
-                if (prot & DMA_PTE_SNP)
+                        printk(KERN_CRIT "ERROR: DMA PTE for vPFN 0x%lx already set (to %llx not %llx)\n",
-                        dma_set_pte_snp(pte);
+                               iov_pfn, tmp, (unsigned long long)pteval);
-                domain_flush_cache(domain, pte, sizeof(*pte));
+                        if (dumps) {
-                start_pfn++;
+                                dumps--;
-                index++;
+                                debug_dma_dump_mappings(NULL);
+                        }
+                        WARN_ON(1);
+                }
+                pte++;
+                if (!nr_pages || first_pte_in_page(pte)) {
+                        domain_flush_cache(domain, first_pte,
+                                           (void *)pte - (void *)first_pte);
+                        pte = NULL;
+                }
+                iov_pfn++;
+                pteval += VTD_PAGE_SIZE;
+                sg_res--;
+                if (!sg_res)
+                        sg = sg_next(sg);
        }
        return 0;
 }
+static inline int domain_sg_mapping(struct dmar_domain *domain, unsigned long iov_pfn,
+                                    struct scatterlist *sg, unsigned long nr_pages,
+                                    int prot)
+{
+        return __domain_mapping(domain, iov_pfn, sg, 0, nr_pages, prot);
+}
+static inline int domain_pfn_mapping(struct dmar_domain *domain, unsigned long iov_pfn,
+                                     unsigned long phys_pfn, unsigned long nr_pages,
+                                     int prot)
+{
+        return __domain_mapping(domain, iov_pfn, NULL, phys_pfn, nr_pages, prot);
+}
 static void iommu_detach_dev(struct intel_iommu *iommu, u8 bus, u8 devfn)
 {
        if (!iommu)
@@ -1845,58 +1918,61 @@ error:
 static int iommu_identity_mapping;
+static int iommu_domain_identity_map(struct dmar_domain *domain,
+                                     unsigned long long start,
+                                     unsigned long long end)
+{
+        unsigned long first_vpfn = start >> VTD_PAGE_SHIFT;
+        unsigned long last_vpfn = end >> VTD_PAGE_SHIFT;
+        if (!reserve_iova(&domain->iovad, dma_to_mm_pfn(first_vpfn),
+                          dma_to_mm_pfn(last_vpfn))) {
+                printk(KERN_ERR "IOMMU: reserve iova failed\n");
+                return -ENOMEM;
+        }
+        pr_debug("Mapping reserved region %llx-%llx for domain %d\n",
+                 start, end, domain->id);
+        /*
+         * RMRR range might have overlap with physical memory range,
+         * clear it first
+         */
+        dma_pte_clear_range(domain, first_vpfn, last_vpfn);
+        return domain_pfn_mapping(domain, first_vpfn, first_vpfn,
+                                  last_vpfn - first_vpfn + 1,
+                                  DMA_PTE_READ|DMA_PTE_WRITE);
+}
 static int iommu_prepare_identity_map(struct pci_dev *pdev,
                                      unsigned long long start,
                                      unsigned long long end)
 {
        struct dmar_domain *domain;
-        unsigned long size;
-        unsigned long long base;
        int ret;
        printk(KERN_INFO
-                "IOMMU: Setting identity map for device %s [0x%Lx - 0x%Lx]\n",
+               "IOMMU: Setting identity map for device %s [0x%Lx - 0x%Lx]\n",
-                pci_name(pdev), start, end);
+               pci_name(pdev), start, end);
-        if (iommu_identity_mapping)
-                domain = si_domain;
+        domain = get_domain_for_dev(pdev, DEFAULT_DOMAIN_ADDRESS_WIDTH);
-        else
-                /* page table init */
-                domain = get_domain_for_dev(pdev, DEFAULT_DOMAIN_ADDRESS_WIDTH);
        if (!domain)
                return -ENOMEM;
-        /* The address might not be aligned */
+        ret = iommu_domain_identity_map(domain, start, end);
-        base = start & PAGE_MASK;
-        size = end - base;
-        size = PAGE_ALIGN(size);
-        if (!reserve_iova(&domain->iovad, IOVA_PFN(base),
-                        IOVA_PFN(base + size) - 1)) {
-                printk(KERN_ERR "IOMMU: reserve iova failed\n");
-                ret = -ENOMEM;
-                goto error;
-        }
-        pr_debug("Mapping reserved region %lx@%llx for %s\n",
-                size, base, pci_name(pdev));
-        /*
-         * RMRR range might have overlap with physical memory range,
-         * clear it first
-         */
-        dma_pte_clear_range(domain, base, base + size);
-        ret = domain_page_mapping(domain, base, base, size,
-                DMA_PTE_READ|DMA_PTE_WRITE);
        if (ret)
                goto error;
        /* context entry init */
        ret = domain_context_mapping(domain, pdev, CONTEXT_TT_MULTI_LEVEL);
-        if (!ret)
+        if (ret)
-                return 0;
+                goto error;
-error:
+        return 0;
+ error:
        domain_exit(domain);
        return ret;
 }
 static inline int iommu_prepare_rmrr_dev(struct dmar_rmrr_unit *rmrr,
@@ -1908,64 +1984,6 @@ static inline int iommu_prepare_rmrr_dev(struct dmar_rmrr_unit *rmrr,
                rmrr->end_address + 1);
 }
-#ifdef CONFIG_DMAR_GFX_WA
-struct iommu_prepare_data {
-        struct pci_dev *pdev;
-        int ret;
-};
-static int __init iommu_prepare_work_fn(unsigned long start_pfn,
-                                         unsigned long end_pfn, void *datax)
-{
-        struct iommu_prepare_data *data;
-        data = (struct iommu_prepare_data *)datax;
-        data->ret = iommu_prepare_identity_map(data->pdev,
-                                start_pfn<<PAGE_SHIFT, end_pfn<<PAGE_SHIFT);
-        return data->ret;
-}
-static int __init iommu_prepare_with_active_regions(struct pci_dev *pdev)
-{
-        int nid;
-        struct iommu_prepare_data data;
-        data.pdev = pdev;
-        data.ret = 0;
-        for_each_online_node(nid) {
-                work_with_active_regions(nid, iommu_prepare_work_fn, &data);
-                if (data.ret)
-                        return data.ret;
-        }
-        return data.ret;
-}
-static void __init iommu_prepare_gfx_mapping(void)
-{
-        struct pci_dev *pdev = NULL;
-        int ret;
-        for_each_pci_dev(pdev) {
-                if (pdev->dev.archdata.iommu == DUMMY_DEVICE_DOMAIN_INFO ||
-                                !IS_GFX_DEVICE(pdev))
-                        continue;
-                printk(KERN_INFO "IOMMU: gfx device %s 1-1 mapping\n",
-                        pci_name(pdev));
-                ret = iommu_prepare_with_active_regions(pdev);
-                if (ret)
-                        printk(KERN_ERR "IOMMU: mapping reserved region failed\n");
-        }
-}
-#else /* !CONFIG_DMAR_GFX_WA */
-static inline void iommu_prepare_gfx_mapping(void)
-{
-        return;
-}
-#endif
 #ifdef CONFIG_DMAR_FLOPPY_WA
 static inline void iommu_prepare_isa(void)
 {
@@ -1976,12 +1994,12 @@ static inline void iommu_prepare_isa(void)
        if (!pdev)
                return;
-        printk(KERN_INFO "IOMMU: Prepare 0-16M unity mapping for LPC\n");
+        printk(KERN_INFO "IOMMU: Prepare 0-16MiB unity mapping for LPC\n");
        ret = iommu_prepare_identity_map(pdev, 0, 16*1024*1024);
        if (ret)
-                printk(KERN_ERR "IOMMU: Failed to create 0-64M identity map, "
+                printk(KERN_ERR "IOMMU: Failed to create 0-16MiB identity map; "
-                        "floppy might not work\n");
+                       "floppy might not work\n");
 }
 #else
@@ -2009,16 +2027,30 @@ static int __init init_context_pass_through(void)
 }
 static int md_domain_init(struct dmar_domain *domain, int guest_width);
+static int __init si_domain_work_fn(unsigned long start_pfn,
+                                    unsigned long end_pfn, void *datax)
+{
+        int *ret = datax;
+        *ret = iommu_domain_identity_map(si_domain,
+                                         (uint64_t)start_pfn << PAGE_SHIFT,
+                                         (uint64_t)end_pfn << PAGE_SHIFT);
+        return *ret;
+}
 static int si_domain_init(void)
 {
        struct dmar_drhd_unit *drhd;
        struct intel_iommu *iommu;
-        int ret = 0;
+        int nid, ret = 0;
        si_domain = alloc_domain();
        if (!si_domain)
                return -EFAULT;
+        pr_debug("Identity mapping domain is domain %d\n", si_domain->id);
        for_each_active_iommu(iommu, drhd) {
                ret = iommu_attach_domain(si_domain, iommu);
@@ -2035,6 +2067,12 @@ static int si_domain_init(void)
        si_domain->flags = DOMAIN_FLAG_STATIC_IDENTITY;
+        for_each_online_node(nid) {
+                work_with_active_regions(nid, si_domain_work_fn, &ret);
+                if (ret)
+                        return ret;
+        }
        return 0;
 }
@@ -2081,7 +2119,6 @@ static int domain_add_dev_info(struct dmar_domain *domain,
 static int iommu_prepare_static_identity_mapping(void)
 {
-        int i;
        struct pci_dev *pdev = NULL;
        int ret;
@@ -2089,20 +2126,14 @@ static int iommu_prepare_static_identity_mapping(void)
        if (ret)
                return -EFAULT;
-        printk(KERN_INFO "IOMMU: Setting identity map:\n");
        for_each_pci_dev(pdev) {
-                for (i = 0; i < e820.nr_map; i++) {
+                printk(KERN_INFO "IOMMU: identity mapping for device %s\n",
-                        struct e820entry *ei = &e820.map[i];
+                       pci_name(pdev));
-                        if (ei->type == E820_RAM) {
+                ret = domain_context_mapping(si_domain, pdev,
-                                ret = iommu_prepare_identity_map(pdev,
+                                             CONTEXT_TT_MULTI_LEVEL);
-                                        ei->addr, ei->addr + ei->size);
+                if (ret)
-                                if (ret)  {
+                        return ret;
-                                        printk(KERN_INFO "1:1 mapping to one domain failed.\n");
-                                        return -EFAULT;
-                                }
-                        }
-                }
                ret = domain_add_dev_info(si_domain, pdev);
                if (ret)
                        return ret;
@@ -2293,8 +2324,6 @@ int __init init_dmars(void)
                        }
                }
-                iommu_prepare_gfx_mapping();
                iommu_prepare_isa();
        }
@@ -2339,50 +2368,40 @@ error:
        return ret;
 }
-static inline u64 aligned_size(u64 host_addr, size_t size)
+static inline unsigned long aligned_nrpages(unsigned long host_addr,
-{
+                                            size_t size)
-        u64 addr;
-        addr = (host_addr & (~PAGE_MASK)) + size;
-        return PAGE_ALIGN(addr);
-}
-struct iova *
-iommu_alloc_iova(struct dmar_domain *domain, size_t size, u64 end)
 {
-        struct iova *piova;
+        host_addr &= ~PAGE_MASK;
+        host_addr += size + PAGE_SIZE - 1;
-        /* Make sure it's in range */
+        return host_addr >> VTD_PAGE_SHIFT;
-        end = min_t(u64, DOMAIN_MAX_ADDR(domain->gaw), end);
-        if (!size || (IOVA_START_ADDR + size > end))
-                return NULL;
-        piova = alloc_iova(&domain->iovad,
-                        size >> PAGE_SHIFT, IOVA_PFN(end), 1);
-        return piova;
 }
-static struct iova *
+static struct iova *intel_alloc_iova(struct device *dev,
-__intel_alloc_iova(struct device *dev, struct dmar_domain *domain,
+                                     struct dmar_domain *domain,
-                   size_t size, u64 dma_mask)
+                                     unsigned long nrpages, uint64_t dma_mask)
 {
        struct pci_dev *pdev = to_pci_dev(dev);
        struct iova *iova = NULL;
-        if (dma_mask <= DMA_BIT_MASK(32) || dmar_forcedac)
+        /* Restrict dma_mask to the width that the iommu can handle */
-                iova = iommu_alloc_iova(domain, size, dma_mask);
+        dma_mask = min_t(uint64_t, DOMAIN_MAX_ADDR(domain->gaw), dma_mask);
-        else {
+        if (!dmar_forcedac && dma_mask > DMA_BIT_MASK(32)) {
                /*
                 * First try to allocate an io virtual address in
                 * DMA_BIT_MASK(32) and if that fails then try allocating
                 * from higher range
                 */
-                iova = iommu_alloc_iova(domain, size, DMA_BIT_MASK(32));
+                iova = alloc_iova(&domain->iovad, nrpages,
-                if (!iova)
+                                  IOVA_PFN(DMA_BIT_MASK(32)), 1);
-                        iova = iommu_alloc_iova(domain, size, dma_mask);
+                if (iova)
-        }
+                        return iova;
+        }
-        if (!iova) {
+        iova = alloc_iova(&domain->iovad, nrpages, IOVA_PFN(dma_mask), 1);
-                printk(KERN_ERR"Allocating iova for %s failed", pci_name(pdev));
+        if (unlikely(!iova)) {
+                printk(KERN_ERR "Allocating %ld-page iova for %s failed",
+                       nrpages, pci_name(pdev));
                return NULL;
        }
@@ -2485,14 +2504,12 @@ static dma_addr_t __intel_map_single(struct device *hwdev, phys_addr_t paddr,
                return 0;
        iommu = domain_get_iommu(domain);
-        size = aligned_size((u64)paddr, size);
+        size = aligned_nrpages(paddr, size);
-        iova = __intel_alloc_iova(hwdev, domain, size, pdev->dma_mask);
+        iova = intel_alloc_iova(hwdev, domain, size, pdev->dma_mask);
        if (!iova)
                goto error;
-        start_paddr = (phys_addr_t)iova->pfn_lo << PAGE_SHIFT;
        /*
         * Check if DMAR supports zero-length reads on write only
         * mappings..
@@ -2508,20 +2525,20 @@ static dma_addr_t __intel_map_single(struct device *hwdev, phys_addr_t paddr,
         * might have two guest_addr mapping to the same host paddr, but this
         * is not a big problem
         */
-        ret = domain_page_mapping(domain, start_paddr,
+        ret = domain_pfn_mapping(domain, mm_to_dma_pfn(iova->pfn_lo),
-                                  ((u64)paddr) & PHYSICAL_PAGE_MASK,
+                                 paddr >> VTD_PAGE_SHIFT, size, prot);
-                                  size, prot);
        if (ret)
                goto error;
        /* it's a non-present to present mapping. Only flush if caching mode */
        if (cap_caching_mode(iommu->cap))
-                iommu_flush_iotlb_psi(iommu, 0, start_paddr,
+                iommu_flush_iotlb_psi(iommu, 0, mm_to_dma_pfn(iova->pfn_lo), size);
-                                      size >> VTD_PAGE_SHIFT);
        else
                iommu_flush_write_buffer(iommu);
-        return start_paddr + ((u64)paddr & (~PAGE_MASK));
+        start_paddr = (phys_addr_t)iova->pfn_lo << PAGE_SHIFT;
+        start_paddr += paddr & ~PAGE_MASK;
+        return start_paddr;
 error:
        if (iova)
@@ -2614,7 +2631,7 @@ static void intel_unmap_page(struct device *dev, dma_addr_t dev_addr,
 {
        struct pci_dev *pdev = to_pci_dev(dev);
        struct dmar_domain *domain;
-        unsigned long start_addr;
+        unsigned long start_pfn, last_pfn;
        struct iova *iova;
        struct intel_iommu *iommu;
@@ -2627,22 +2644,25 @@ static void intel_unmap_page(struct device *dev, dma_addr_t dev_addr,
        iommu = domain_get_iommu(domain);
        iova = find_iova(&domain->iovad, IOVA_PFN(dev_addr));
-        if (!iova)
+        if (WARN_ONCE(!iova, "Driver unmaps unmatched page at PFN %llx\n",
+                      (unsigned long long)dev_addr))
                return;
-        start_addr = iova->pfn_lo << PAGE_SHIFT;
+        start_pfn = mm_to_dma_pfn(iova->pfn_lo);
-        size = aligned_size((u64)dev_addr, size);
+        last_pfn = mm_to_dma_pfn(iova->pfn_hi + 1) - 1;
-        pr_debug("Device %s unmapping: %zx@%llx\n",
+        pr_debug("Device %s unmapping: pfn %lx-%lx\n",
-                pci_name(pdev), size, (unsigned long long)start_addr);
+                 pci_name(pdev), start_pfn, last_pfn);
        /*  clear the whole page */
-        dma_pte_clear_range(domain, start_addr, start_addr + size);
+        dma_pte_clear_range(domain, start_pfn, last_pfn);
        /* free page tables */
-        dma_pte_free_pagetable(domain, start_addr, start_addr + size);
+        dma_pte_free_pagetable(domain, start_pfn, last_pfn);
        if (intel_iommu_strict) {
-                iommu_flush_iotlb_psi(iommu, domain->id, start_addr,
+                iommu_flush_iotlb_psi(iommu, domain->id, start_pfn,
-                                      size >> VTD_PAGE_SHIFT);
+                                      last_pfn - start_pfn + 1);
                /* free iova */
                __free_iova(&domain->iovad, iova);
        } else {
@@ -2700,14 +2720,10 @@ static void intel_unmap_sg(struct device *hwdev, struct scatterlist *sglist,
                           int nelems, enum dma_data_direction dir,
                           struct dma_attrs *attrs)
 {
-        int i;
        struct pci_dev *pdev = to_pci_dev(hwdev);
        struct dmar_domain *domain;
-        unsigned long start_addr;
+        unsigned long start_pfn, last_pfn;
        struct iova *iova;
-        size_t size = 0;
-        phys_addr_t addr;
-        struct scatterlist *sg;
        struct intel_iommu *iommu;
        if (iommu_no_mapping(pdev))
@@ -2719,22 +2735,21 @@ static void intel_unmap_sg(struct device *hwdev, struct scatterlist *sglist,
        iommu = domain_get_iommu(domain);
        iova = find_iova(&domain->iovad, IOVA_PFN(sglist[0].dma_address));
-        if (!iova)
+        if (WARN_ONCE(!iova, "Driver unmaps unmatched sglist at PFN %llx\n",
+                      (unsigned long long)sglist[0].dma_address))
                return;
-        for_each_sg(sglist, sg, nelems, i) {
-                addr = page_to_phys(sg_page(sg)) + sg->offset;
-                size += aligned_size((u64)addr, sg->length);
-        }
-        start_addr = iova->pfn_lo << PAGE_SHIFT;
+        start_pfn = mm_to_dma_pfn(iova->pfn_lo);
+        last_pfn = mm_to_dma_pfn(iova->pfn_hi + 1) - 1;
        /*  clear the whole page */
-        dma_pte_clear_range(domain, start_addr, start_addr + size);
+        dma_pte_clear_range(domain, start_pfn, last_pfn);
        /* free page tables */
-        dma_pte_free_pagetable(domain, start_addr, start_addr + size);
+        dma_pte_free_pagetable(domain, start_pfn, last_pfn);
-        iommu_flush_iotlb_psi(iommu, domain->id, start_addr,
+        iommu_flush_iotlb_psi(iommu, domain->id, start_pfn,
-                              size >> VTD_PAGE_SHIFT);
+                              (last_pfn - start_pfn + 1));
        /* free iova */
        __free_iova(&domain->iovad, iova);
@@ -2757,17 +2772,16 @@ static int intel_nontranslate_map_sg(struct device *hddev,
 static int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int nelems,
                        enum dma_data_direction dir, struct dma_attrs *attrs)
 {
-        phys_addr_t addr;
        int i;
        struct pci_dev *pdev = to_pci_dev(hwdev);
        struct dmar_domain *domain;
        size_t size = 0;
        int prot = 0;
-        size_t offset = 0;
+        size_t offset_pfn = 0;
        struct iova *iova = NULL;
        int ret;
        struct scatterlist *sg;
-        unsigned long start_addr;
+        unsigned long start_vpfn;
        struct intel_iommu *iommu;
        BUG_ON(dir == DMA_NONE);
@@ -2780,12 +2794,10 @@ static int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int ne
        iommu = domain_get_iommu(domain);
-        for_each_sg(sglist, sg, nelems, i) {
+        for_each_sg(sglist, sg, nelems, i)
-                addr = page_to_phys(sg_page(sg)) + sg->offset;
+                size += aligned_nrpages(sg->offset, sg->length);
-                size += aligned_size((u64)addr, sg->length);
-        }
-        iova = __intel_alloc_iova(hwdev, domain, size, pdev->dma_mask);
+        iova = intel_alloc_iova(hwdev, domain, size, pdev->dma_mask);
        if (!iova) {
                sglist->dma_length = 0;
                return 0;
@@ -2801,35 +2813,24 @@ static int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int ne
        if (dir == DMA_FROM_DEVICE || dir == DMA_BIDIRECTIONAL)
                prot |= DMA_PTE_WRITE;
-        start_addr = iova->pfn_lo << PAGE_SHIFT;
+        start_vpfn = mm_to_dma_pfn(iova->pfn_lo);
-        offset = 0;
-        for_each_sg(sglist, sg, nelems, i) {
+        ret = domain_sg_mapping(domain, start_vpfn, sglist, mm_to_dma_pfn(size), prot);
-                addr = page_to_phys(sg_page(sg)) + sg->offset;
+        if (unlikely(ret)) {
-                size = aligned_size((u64)addr, sg->length);
+                /*  clear the page */
-                ret = domain_page_mapping(domain, start_addr + offset,
+                dma_pte_clear_range(domain, start_vpfn,
-                                          ((u64)addr) & PHYSICAL_PAGE_MASK,
+                                    start_vpfn + size - 1);
-                                          size, prot);
+                /* free page tables */
-                if (ret) {
+                dma_pte_free_pagetable(domain, start_vpfn,
-                        /*  clear the page */
+                                       start_vpfn + size - 1);
-                        dma_pte_clear_range(domain, start_addr,
+                /* free iova */
-                                  start_addr + offset);
+                __free_iova(&domain->iovad, iova);
-                        /* free page tables */
+                return 0;
-                        dma_pte_free_pagetable(domain, start_addr,
-                                  start_addr + offset);
-                        /* free iova */
-                        __free_iova(&domain->iovad, iova);
-                        return 0;
-                }
-                sg->dma_address = start_addr + offset +
-                                ((u64)addr & (~PAGE_MASK));
-                sg->dma_length = sg->length;
-                offset += size;
        }
        /* it's a non-present to present mapping. Only flush if caching mode */
        if (cap_caching_mode(iommu->cap))
-                iommu_flush_iotlb_psi(iommu, 0, start_addr,
+                iommu_flush_iotlb_psi(iommu, 0, start_vpfn, offset_pfn);
-                                      offset >> VTD_PAGE_SHIFT);
        else
                iommu_flush_write_buffer(iommu);
@@ -3334,7 +3335,6 @@ static int md_domain_init(struct dmar_domain *domain, int guest_width)
        int adjust_width;
        init_iova_domain(&domain->iovad, DMA_32BIT_PFN);
-        spin_lock_init(&domain->mapping_lock);
        spin_lock_init(&domain->iommu_lock);
        domain_reserve_special_ranges(domain);
@@ -3388,8 +3388,6 @@ static void iommu_free_vm_domain(struct dmar_domain *domain)
 static void vm_domain_exit(struct dmar_domain *domain)
 {
-        u64 end;
        /* Domain 0 is reserved, so dont process it */
        if (!domain)
                return;
@@ -3397,14 +3395,12 @@ static void vm_domain_exit(struct dmar_domain *domain)
        vm_domain_remove_all_dev_info(domain);
        /* destroy iovas */
        put_iova_domain(&domain->iovad);
-        end = DOMAIN_MAX_ADDR(domain->gaw);
-        end = end & (~VTD_PAGE_MASK);
        /* clear ptes */
-        dma_pte_clear_range(domain, 0, end);
+        dma_pte_clear_range(domain, 0, DOMAIN_MAX_PFN(domain->gaw));
        /* free page tables */
-        dma_pte_free_pagetable(domain, 0, end);
+        dma_pte_free_pagetable(domain, 0, DOMAIN_MAX_PFN(domain->gaw));
        iommu_free_vm_domain(domain);
        free_domain_mem(domain);
@@ -3513,7 +3509,7 @@ static int intel_iommu_map_range(struct iommu_domain *domain,
        if ((iommu_prot & IOMMU_CACHE) && dmar_domain->iommu_snooping)
                prot |= DMA_PTE_SNP;
-        max_addr = (iova & VTD_PAGE_MASK) + VTD_PAGE_ALIGN(size);
+        max_addr = iova + size;
        if (dmar_domain->max_addr < max_addr) {
                int min_agaw;
                u64 end;
@@ -3531,8 +3527,11 @@ static int intel_iommu_map_range(struct iommu_domain *domain,
                }
                dmar_domain->max_addr = max_addr;
        }
+        /* Round up size to next multiple of PAGE_SIZE, if it and
-        ret = domain_page_mapping(dmar_domain, iova, hpa, size, prot);
+           the low bits of hpa would take us onto the next page */
+        size = aligned_nrpages(hpa, size);
+        ret = domain_pfn_mapping(dmar_domain, iova >> VTD_PAGE_SHIFT,
+                                 hpa >> VTD_PAGE_SHIFT, size, prot);
        return ret;
 }
@@ -3540,15 +3539,12 @@ static void intel_iommu_unmap_range(struct iommu_domain *domain,
                                    unsigned long iova, size_t size)
 {
        struct dmar_domain *dmar_domain = domain->priv;
-        dma_addr_t base;
-        /* The address might not be aligned */
+        dma_pte_clear_range(dmar_domain, iova >> VTD_PAGE_SHIFT,
-        base = iova & VTD_PAGE_MASK;
+                            (iova + size - 1) >> VTD_PAGE_SHIFT);
-        size = VTD_PAGE_ALIGN(size);
-        dma_pte_clear_range(dmar_domain, base, base + size);
-        if (dmar_domain->max_addr == base + size)
+        if (dmar_domain->max_addr == iova + size)
-                dmar_domain->max_addr = base;
+                dmar_domain->max_addr = iova;
 }
 static phys_addr_t intel_iommu_iova_to_phys(struct iommu_domain *domain,
@@ -3558,7 +3554,7 @@ static phys_addr_t intel_iommu_iova_to_phys(struct iommu_domain *domain,
        struct dma_pte *pte;
        u64 phys = 0;
-        pte = addr_to_dma_pte(dmar_domain, iova);
+        pte = pfn_to_dma_pte(dmar_domain, iova >> VTD_PAGE_SHIFT);
        if (pte)
                phys = dma_pte_addr(pte);
diff --git a/drivers/pci/iova.c b/drivers/pci/iova.c
index 2287116e9822..46dd440e2315 100644
--- a/drivers/pci/iova.c
+++ b/drivers/pci/iova.c
@@ -1,9 +1,19 @@
 /*
- * Copyright (c) 2006, Intel Corporation.
+ * Copyright © 2006-2009, Intel Corporation.
 *
- * This file is released under the GPLv2.
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms and conditions of the GNU General Public License,
+ * version 2, as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program; if not, write to the Free Software Foundation, Inc., 59 Temple
+ * Place - Suite 330, Boston, MA 02111-1307 USA.
 *
- * Copyright (C) 2006-2008 Intel Corporation
 * Author: Anil S Keshavamurthy <anil.s.keshavamurthy@intel.com>
 */
@@ -123,7 +133,15 @@ move_left:
        /* Insert the new_iova into domain rbtree by holding writer lock */
        /* Add new node and rebalance tree. */
        {
-                struct rb_node **entry = &((prev)), *parent = NULL;
+                struct rb_node **entry, *parent = NULL;
+                /* If we have 'prev', it's a valid place to start the
+                   insertion. Otherwise, start from the root. */
+                if (prev)
+                        entry = &prev;
+                else
+                        entry = &iovad->rbroot.rb_node;
                /* Figure out where to put new node */
                while (*entry) {
                        struct iova *this = container_of(*entry,
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index fee6a4022bc1..46dad12f952f 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -355,10 +355,9 @@ config EEEPC_LAPTOP
        depends on INPUT
        depends on EXPERIMENTAL
        depends on RFKILL || RFKILL = n
+        depends on HOTPLUG_PCI
        select BACKLIGHT_CLASS_DEVICE
        select HWMON
-        select HOTPLUG
-        select HOTPLUG_PCI if PCI
        ---help---
          This driver supports the Fn-Fx keys on Eee PC laptops.
diff --git a/drivers/rtc/rtc-bfin.c b/drivers/rtc/rtc-bfin.c
index aafd3e6ebb0d..a118eb0f1e67 100644
--- a/drivers/rtc/rtc-bfin.c
+++ b/drivers/rtc/rtc-bfin.c
@@ -1,8 +1,8 @@
 /*
 * Blackfin On-Chip Real Time Clock Driver
- *  Supports BF52[257]/BF53[123]/BF53[467]/BF54[24789]
+ *  Supports BF51x/BF52x/BF53[123]/BF53[467]/BF54x
 *
- * Copyright 2004-2008 Analog Devices Inc.
+ * Copyright 2004-2009 Analog Devices Inc.
 *
 * Enter bugs at http://blackfin.uclinux.org/
 *
@@ -363,7 +363,7 @@ static int __devinit bfin_rtc_probe(struct platform_device *pdev)
        struct bfin_rtc *rtc;
        struct device *dev = &pdev->dev;
        int ret = 0;
-        unsigned long timeout;
+        unsigned long timeout = jiffies + HZ;
        dev_dbg_stamp(dev);
@@ -374,32 +374,32 @@ static int __devinit bfin_rtc_probe(struct platform_device *pdev)
        platform_set_drvdata(pdev, rtc);
        device_init_wakeup(dev, 1);
+        /* Register our RTC with the RTC framework */
+        rtc->rtc_dev = rtc_device_register(pdev->name, dev, &bfin_rtc_ops,
+                                                THIS_MODULE);
+        if (unlikely(IS_ERR(rtc->rtc_dev))) {
+                ret = PTR_ERR(rtc->rtc_dev);
+                goto err;
+        }
        /* Grab the IRQ and init the hardware */
        ret = request_irq(IRQ_RTC, bfin_rtc_interrupt, IRQF_SHARED, pdev->name, dev);
        if (unlikely(ret))
-                goto err;
+                goto err_reg;
        /* sometimes the bootloader touched things, but the write complete was not
         * enabled, so let's just do a quick timeout here since the IRQ will not fire ...
         */
-        timeout = jiffies + HZ;
        while (bfin_read_RTC_ISTAT() & RTC_ISTAT_WRITE_PENDING)
                if (time_after(jiffies, timeout))
                        break;
        bfin_rtc_reset(dev, RTC_ISTAT_WRITE_COMPLETE);
        bfin_write_RTC_SWCNT(0);
-        /* Register our RTC with the RTC framework */
-        rtc->rtc_dev = rtc_device_register(pdev->name, dev, &bfin_rtc_ops, THIS_MODULE);
-        if (unlikely(IS_ERR(rtc->rtc_dev))) {
-                ret = PTR_ERR(rtc->rtc_dev);
-                goto err_irq;
-        }
        return 0;
- err_irq:
+err_reg:
-        free_irq(IRQ_RTC, dev);
+        rtc_device_unregister(rtc->rtc_dev);
- err:
+err:
        kfree(rtc);
        return ret;
 }
diff --git a/drivers/scsi/cxgb3i/cxgb3i_iscsi.c b/drivers/scsi/cxgb3i/cxgb3i_iscsi.c
index 74369a3f963b..c399f485aa7d 100644
--- a/drivers/scsi/cxgb3i/cxgb3i_iscsi.c
+++ b/drivers/scsi/cxgb3i/cxgb3i_iscsi.c
@@ -13,6 +13,7 @@
 #include <linux/inet.h>
 #include <linux/crypto.h>
+#include <linux/if_vlan.h>
 #include <net/dst.h>
 #include <net/tcp.h>
 #include <scsi/scsi_cmnd.h>
@@ -184,6 +185,9 @@ static struct cxgb3i_hba *cxgb3i_hba_find_by_netdev(struct net_device *ndev)
        struct cxgb3i_adapter *snic;
        int i;
+        if (ndev->priv_flags & IFF_802_1Q_VLAN)
+                ndev = vlan_dev_real_dev(ndev);
        read_lock(&cxgb3i_snic_rwlock);
        list_for_each_entry(snic, &cxgb3i_snic_list, list_head) {
                for (i = 0; i < snic->hba_cnt; i++) {
diff --git a/drivers/scsi/fnic/fnic_main.c b/drivers/scsi/fnic/fnic_main.c
index a84072865fc2..2c266c01dc5a 100644
--- a/drivers/scsi/fnic/fnic_main.c
+++ b/drivers/scsi/fnic/fnic_main.c
@@ -473,16 +473,16 @@ static int __devinit fnic_probe(struct pci_dev *pdev,
         * limitation for the device.  Try 40-bit first, and
         * fail to 32-bit.
         */
-        err = pci_set_dma_mask(pdev, DMA_40BIT_MASK);
+        err = pci_set_dma_mask(pdev, DMA_BIT_MASK(40));
        if (err) {
-                err = pci_set_dma_mask(pdev, DMA_32BIT_MASK);
+                err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
                if (err) {
                        shost_printk(KERN_ERR, fnic->lport->host,
                                     "No usable DMA configuration "
                                     "aborting\n");
                        goto err_out_release_regions;
                }
-                err = pci_set_consistent_dma_mask(pdev, DMA_32BIT_MASK);
+                err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(32));
                if (err) {
                        shost_printk(KERN_ERR, fnic->lport->host,
                                     "Unable to obtain 32-bit DMA "
@@ -490,7 +490,7 @@ static int __devinit fnic_probe(struct pci_dev *pdev,
                        goto err_out_release_regions;
                }
        } else {
-                err = pci_set_consistent_dma_mask(pdev, DMA_40BIT_MASK);
+                err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(40));
                if (err) {
                        shost_printk(KERN_ERR, fnic->lport->host,
                                     "Unable to obtain 40-bit DMA "
diff --git a/drivers/scsi/fnic/fnic_scsi.c b/drivers/scsi/fnic/fnic_scsi.c
index eabf36502856..bfc996971b81 100644
--- a/drivers/scsi/fnic/fnic_scsi.c
+++ b/drivers/scsi/fnic/fnic_scsi.c
@@ -245,7 +245,7 @@ static inline int fnic_queue_wq_copy_desc(struct fnic *fnic,
                                          struct vnic_wq_copy *wq,
                                          struct fnic_io_req *io_req,
                                          struct scsi_cmnd *sc,
-                                          u32 sg_count)
+                                          int sg_count)
 {
        struct scatterlist *sg;
        struct fc_rport *rport = starget_to_rport(scsi_target(sc->device));
@@ -260,9 +260,6 @@ static inline int fnic_queue_wq_copy_desc(struct fnic *fnic,
        char msg[2];
        if (sg_count) {
-                BUG_ON(sg_count < 0);
-                BUG_ON(sg_count > FNIC_MAX_SG_DESC_CNT);
                /* For each SGE, create a device desc entry */
                desc = io_req->sgl_list;
                for_each_sg(scsi_sglist(sc), sg, sg_count, i) {
@@ -344,7 +341,7 @@ int fnic_queuecommand(struct scsi_cmnd *sc, void (*done)(struct scsi_cmnd *))
        struct fnic *fnic;
        struct vnic_wq_copy *wq;
        int ret;
-        u32 sg_count;
+        int sg_count;
        unsigned long flags;
        unsigned long ptr;
diff --git a/drivers/scsi/ibmvscsi/ibmvscsi.c b/drivers/scsi/ibmvscsi/ibmvscsi.c
index 869a11bdccbd..9928704e235f 100644
--- a/drivers/scsi/ibmvscsi/ibmvscsi.c
+++ b/drivers/scsi/ibmvscsi/ibmvscsi.c
@@ -1095,9 +1095,14 @@ static void adapter_info_rsp(struct srp_event_struct *evt_struct)
                                MAX_INDIRECT_BUFS);
                        hostdata->host->sg_tablesize = MAX_INDIRECT_BUFS;
                }
+                if (hostdata->madapter_info.os_type == 3) {
+                        enable_fast_fail(hostdata);
+                        return;
+                }
        }
-        enable_fast_fail(hostdata);
+        send_srp_login(hostdata);
 }
 /**
diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index 2eee9e6e4fe8..292c02f810d0 100644
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -3670,13 +3670,14 @@ static void
 fc_bsg_goose_queue(struct fc_rport *rport)
 {
        int flagset;
+        unsigned long flags;
        if (!rport->rqst_q)
                return;
        get_device(&rport->dev);
-        spin_lock(rport->rqst_q->queue_lock);
+        spin_lock_irqsave(rport->rqst_q->queue_lock, flags);
        flagset = test_bit(QUEUE_FLAG_REENTER, &rport->rqst_q->queue_flags) &&
                  !test_bit(QUEUE_FLAG_REENTER, &rport->rqst_q->queue_flags);
        if (flagset)
@@ -3684,7 +3685,7 @@ fc_bsg_goose_queue(struct fc_rport *rport)
        __blk_run_queue(rport->rqst_q);
        if (flagset)
                queue_flag_clear(QUEUE_FLAG_REENTER, rport->rqst_q);
-        spin_unlock(rport->rqst_q->queue_lock);
+        spin_unlock_irqrestore(rport->rqst_q->queue_lock, flags);
        put_device(&rport->dev);
 }
diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c
index 8201387b4daa..ef142fd47a83 100644
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -210,13 +210,11 @@ static void sg_put_dev(Sg_device *sdp);
 static int sg_allow_access(struct file *filp, unsigned char *cmd)
 {
        struct sg_fd *sfp = (struct sg_fd *)filp->private_data;
-        struct request_queue *q = sfp->parentdp->device->request_queue;
        if (sfp->parentdp->device->type == TYPE_SCANNER)
                return 0;
-        return blk_verify_command(&q->cmd_filter,
+        return blk_verify_command(cmd, filp->f_mode & FMODE_WRITE);
-                                  cmd, filp->f_mode & FMODE_WRITE);
 }
 static int
diff --git a/drivers/scsi/zalon.c b/drivers/scsi/zalon.c
index 97f3158fa7b5..27e84e4b1fa9 100644
--- a/drivers/scsi/zalon.c
+++ b/drivers/scsi/zalon.c
@@ -134,7 +134,7 @@ zalon_probe(struct parisc_device *dev)
        host = ncr_attach(&zalon7xx_template, unit, &device);
        if (!host)
-                goto fail;
+                return -ENODEV;
        if (request_irq(dev->irq, ncr53c8xx_intr, IRQF_SHARED, "zalon", host)) {
          dev_printk(KERN_ERR, &dev->dev, "irq problem with %d, detaching\n ",
diff --git a/drivers/serial/8250_pci.c b/drivers/serial/8250_pci.c
index a07015d646dd..6160e03f410c 100644
--- a/drivers/serial/8250_pci.c
+++ b/drivers/serial/8250_pci.c
@@ -759,6 +759,8 @@ static int pci_netmos_init(struct pci_dev *dev)
        /* subdevice 0x00PS means <P> parallel, <S> serial */
        unsigned int num_serial = dev->subsystem_device & 0xf;
+        if (dev->device == PCI_DEVICE_ID_NETMOS_9901)
+                return 0;
        if (dev->subsystem_vendor == PCI_VENDOR_ID_IBM &&
                        dev->subsystem_device == 0x0299)
                return 0;
@@ -3557,6 +3559,10 @@ static struct pci_device_id serial_pci_tbl[] = {
                PCI_VENDOR_ID_IBM, 0x0299,
                0, 0, pbn_b0_bt_2_115200 },
+        {       PCI_VENDOR_ID_NETMOS, PCI_DEVICE_ID_NETMOS_9901,
+                0xA000, 0x1000,
+                0, 0, pbn_b0_1_115200 },
        /*
         * These entries match devices with class COMMUNICATION_SERIAL,
         * COMMUNICATION_MODEM or COMMUNICATION_MULTISERIAL
diff --git a/drivers/spi/omap_uwire.c b/drivers/spi/omap_uwire.c
index aa90ddb37066..8980a5640bd9 100644
--- a/drivers/spi/omap_uwire.c
+++ b/drivers/spi/omap_uwire.c
@@ -514,6 +514,8 @@ static int __init uwire_probe(struct platform_device *pdev)
        /* the spi->mode bits understood by this driver: */
        master->mode_bits = SPI_CPOL | SPI_CPHA | SPI_CS_HIGH;
+        master->flags = SPI_MASTER_HALF_DUPLEX;
        master->bus_num = 2;    /* "official" */
        master->num_chipselect = 4;
        master->setup = uwire_setup;
diff --git a/drivers/spi/spi_bitbang.c b/drivers/spi/spi_bitbang.c
index 2a5abc08e857..f1db395dd889 100644
--- a/drivers/spi/spi_bitbang.c
+++ b/drivers/spi/spi_bitbang.c
@@ -258,6 +258,11 @@ static void bitbang_work(struct work_struct *work)
        struct spi_bitbang      *bitbang =
                container_of(work, struct spi_bitbang, work);
        unsigned long           flags;
+        int                     do_setup = -1;
+        int                     (*setup_transfer)(struct spi_device *,
+                                        struct spi_transfer *);
+        setup_transfer = bitbang->setup_transfer;
        spin_lock_irqsave(&bitbang->lock, flags);
        bitbang->busy = 1;
@@ -269,8 +274,6 @@ static void bitbang_work(struct work_struct *work)
                unsigned                tmp;
                unsigned                cs_change;
                int                     status;
-                int                     (*setup_transfer)(struct spi_device *,
-                                                struct spi_transfer *);
                m = container_of(bitbang->queue.next, struct spi_message,
                                queue);
@@ -287,19 +290,19 @@ static void bitbang_work(struct work_struct *work)
                tmp = 0;
                cs_change = 1;
                status = 0;
-                setup_transfer = NULL;
                list_for_each_entry (t, &m->transfers, transfer_list) {
-                        /* override or restore speed and wordsize */
+                        /* override speed or wordsize? */
-                        if (t->speed_hz || t->bits_per_word) {
+                        if (t->speed_hz || t->bits_per_word)
-                                setup_transfer = bitbang->setup_transfer;
+                                do_setup = 1;
+                        /* init (-1) or override (1) transfer params */
+                        if (do_setup != 0) {
                                if (!setup_transfer) {
                                        status = -ENOPROTOOPT;
                                        break;
                                }
-                        }
-                        if (setup_transfer) {
                                status = setup_transfer(spi, t);
                                if (status < 0)
                                        break;
@@ -363,9 +366,10 @@ static void bitbang_work(struct work_struct *work)
                m->status = status;
                m->complete(m->context);
-                /* restore speed and wordsize */
+                /* restore speed and wordsize if it was overridden */
-                if (setup_transfer)
+                if (do_setup == 1)
                        setup_transfer(spi, NULL);
+                do_setup = 0;
                /* normally deactivate chipselect ... unless no error and
                 * cs_change has hinted that the next message will probably
diff --git a/drivers/spi/spidev.c b/drivers/spi/spidev.c
index 5d869c4d3eb2..606e7a40a8da 100644
--- a/drivers/spi/spidev.c
+++ b/drivers/spi/spidev.c
@@ -58,15 +58,20 @@ static unsigned long	minors[N_SPI_MINORS / BITS_PER_LONG];
 /* Bit masks for spi_device.mode management.  Note that incorrect
- * settings for CS_HIGH and 3WIRE can cause *lots* of trouble for other
+ * settings for some settings can cause *lots* of trouble for other
- * devices on a shared bus:  CS_HIGH, because this device will be
+ * devices on a shared bus:
- * active when it shouldn't be;  3WIRE, because when active it won't
- * behave as it should.
 *
- * REVISIT should changing those two modes be privileged?
+ *  - CS_HIGH ... this device will be active when it shouldn't be
+ *  - 3WIRE ... when active, it won't behave as it should
+ *  - NO_CS ... there will be no explicit message boundaries; this
+ *      is completely incompatible with the shared bus model
+ *  - READY ... transfers may proceed when they shouldn't.
+ *
+ * REVISIT should changing those flags be privileged?
 */
 #define SPI_MODE_MASK           (SPI_CPHA | SPI_CPOL | SPI_CS_HIGH \
-                                | SPI_LSB_FIRST | SPI_3WIRE | SPI_LOOP)
+                                | SPI_LSB_FIRST | SPI_3WIRE | SPI_LOOP \
+                                | SPI_NO_CS | SPI_READY)
 struct spidev_data {
        dev_t                   devt;
diff --git a/drivers/video/atafb.c b/drivers/video/atafb.c
index 018850c116c6..497ff8af03ed 100644
--- a/drivers/video/atafb.c
+++ b/drivers/video/atafb.c
@@ -2414,7 +2414,10 @@ static int atafb_get_fix(struct fb_fix_screeninfo *fix, struct fb_info *info)
        if (err)
                return err;
        memset(fix, 0, sizeof(struct fb_fix_screeninfo));
-        return fbhw->encode_fix(fix, &par);
+        mutex_lock(&info->mm_lock);
+        err = fbhw->encode_fix(fix, &par);
+        mutex_unlock(&info->mm_lock);
+        return err;
 }
 static int atafb_get_var(struct fb_var_screeninfo *var, struct fb_info *info)
@@ -2743,7 +2746,9 @@ static int atafb_set_par(struct fb_info *info)
        /* Decode wanted screen parameters */
        fbhw->decode_var(&info->var, par);
+        mutex_lock(&info->mm_lock);
        fbhw->encode_fix(&info->fix, par);
+        mutex_unlock(&info->mm_lock);
        /* Set new videomode */
        ata_set_par(par);
diff --git a/drivers/video/atmel_lcdfb.c b/drivers/video/atmel_lcdfb.c
index 5afd64482f55..cb88394ba995 100644
--- a/drivers/video/atmel_lcdfb.c
+++ b/drivers/video/atmel_lcdfb.c
@@ -270,7 +270,9 @@ static int atmel_lcdfb_alloc_video_memory(struct atmel_lcdfb_info *sinfo)
        smem_len = (var->xres_virtual * var->yres_virtual
                    * ((var->bits_per_pixel + 7) / 8));
+        mutex_lock(&info->mm_lock);
        info->fix.smem_len = max(smem_len, sinfo->smem_len);
+        mutex_unlock(&info->mm_lock);
        info->screen_base = dma_alloc_writecombine(info->device, info->fix.smem_len,
                                        (dma_addr_t *)&info->fix.smem_start, GFP_KERNEL);
diff --git a/drivers/video/aty/atyfb.h b/drivers/video/aty/atyfb.h
index 7691e73823d3..1f39a62f899b 100644
--- a/drivers/video/aty/atyfb.h
+++ b/drivers/video/aty/atyfb.h
@@ -187,6 +187,8 @@ struct atyfb_par {
        int mtrr_reg;
 #endif
        u32 mem_cntl;
+        struct crtc saved_crtc;
+        union aty_pll saved_pll;
 };
    /*
@@ -217,6 +219,7 @@ struct atyfb_par {
 #define M64F_XL_DLL             0x00080000
 #define M64F_MFB_FORCE_4        0x00100000
 #define M64F_HW_TRIPLE          0x00200000
+#define M64F_XL_MEM             0x00400000
    /*
     *  Register access
     */
diff --git a/drivers/video/aty/atyfb_base.c b/drivers/video/aty/atyfb_base.c
index 1207c208a30b..63d3739d43a8 100644
--- a/drivers/video/aty/atyfb_base.c
+++ b/drivers/video/aty/atyfb_base.c
@@ -66,6 +66,8 @@
 #include <linux/spinlock.h>
 #include <linux/wait.h>
 #include <linux/backlight.h>
+#include <linux/reboot.h>
+#include <linux/dmi.h>
 #include <asm/io.h>
 #include <linux/uaccess.h>
@@ -249,8 +251,6 @@ static int aty_init(struct fb_info *info);
 static int store_video_par(char *videopar, unsigned char m64_num);
 #endif
-static struct crtc saved_crtc;
-static union aty_pll saved_pll;
 static void aty_get_crtc(const struct atyfb_par *par, struct crtc *crtc);
 static void aty_set_crtc(const struct atyfb_par *par, const struct crtc *crtc);
@@ -261,6 +261,8 @@ static void set_off_pitch(struct atyfb_par *par, const struct fb_info *info);
 static int read_aty_sense(const struct atyfb_par *par);
 #endif
+static DEFINE_MUTEX(reboot_lock);
+static struct fb_info *reboot_info;
    /*
     *  Interface used by the world
@@ -361,8 +363,8 @@ static unsigned long phys_guiregbase[FB_MAX] __devinitdata = { 0, };
 #define ATI_CHIP_264GTPRO  (ATI_MODERN_SET | M64F_SDRAM_MAGIC_PLL | M64F_HW_TRIPLE | M64F_FIFO_32 | M64F_RESET_3D)
 #define ATI_CHIP_264LTPRO  (ATI_MODERN_SET | M64F_HW_TRIPLE | M64F_FIFO_32 | M64F_RESET_3D)
-#define ATI_CHIP_264XL     (ATI_MODERN_SET | M64F_HW_TRIPLE | M64F_FIFO_32 | M64F_RESET_3D | M64F_XL_DLL | M64F_MFB_FORCE_4)
+#define ATI_CHIP_264XL     (ATI_MODERN_SET | M64F_HW_TRIPLE | M64F_FIFO_32 | M64F_RESET_3D | M64F_XL_DLL | M64F_MFB_FORCE_4 | M64F_XL_MEM)
-#define ATI_CHIP_MOBILITY  (ATI_MODERN_SET | M64F_HW_TRIPLE | M64F_FIFO_32 | M64F_RESET_3D | M64F_XL_DLL | M64F_MFB_FORCE_4 | M64F_MOBIL_BUS)
+#define ATI_CHIP_MOBILITY  (ATI_MODERN_SET | M64F_HW_TRIPLE | M64F_FIFO_32 | M64F_RESET_3D | M64F_XL_DLL | M64F_MFB_FORCE_4 | M64F_XL_MEM | M64F_MOBIL_BUS)
 static struct {
        u16 pci_id;
@@ -539,6 +541,7 @@ static char ram_edo[] __devinitdata = "EDO";
 static char ram_sdram[] __devinitdata = "SDRAM (1:1)";
 static char ram_sgram[] __devinitdata = "SGRAM (1:1)";
 static char ram_sdram32[] __devinitdata = "SDRAM (2:1) (32-bit)";
+static char ram_wram[] __devinitdata = "WRAM";
 static char ram_off[] __devinitdata = "OFF";
 #endif /* CONFIG_FB_ATY_CT */
@@ -553,6 +556,10 @@ static char *aty_gx_ram[8] __devinitdata = {
 #ifdef CONFIG_FB_ATY_CT
 static char *aty_ct_ram[8] __devinitdata = {
        ram_off, ram_dram, ram_edo, ram_edo,
+        ram_sdram, ram_sgram, ram_wram, ram_resv
+};
+static char *aty_xl_ram[8] __devinitdata = {
+        ram_off, ram_dram, ram_edo, ram_edo,
        ram_sdram, ram_sgram, ram_sdram32, ram_resv
 };
 #endif /* CONFIG_FB_ATY_CT */
@@ -760,6 +767,17 @@ static void aty_set_crtc(const struct atyfb_par *par, const struct crtc *crtc)
 #endif /* CONFIG_FB_ATY_GENERIC_LCD */
 }
+static u32 calc_line_length(struct atyfb_par *par, u32 vxres, u32 bpp)
+{
+        u32 line_length = vxres * bpp / 8;
+        if (par->ram_type == SGRAM ||
+            (!M64_HAS(XL_MEM) && par->ram_type == WRAM))
+                line_length = (line_length + 63) & ~63;
+        return line_length;
+}
 static int aty_var_to_crtc(const struct fb_info *info,
        const struct fb_var_screeninfo *var, struct crtc *crtc)
 {
@@ -769,13 +787,14 @@ static int aty_var_to_crtc(const struct fb_info *info,
        u32 h_total, h_disp, h_sync_strt, h_sync_end, h_sync_dly, h_sync_wid, h_sync_pol;
        u32 v_total, v_disp, v_sync_strt, v_sync_end, v_sync_wid, v_sync_pol, c_sync;
        u32 pix_width, dp_pix_width, dp_chain_mask;
+        u32 line_length;
        /* input */
-        xres = var->xres;
+        xres = (var->xres + 7) & ~7;
        yres = var->yres;
-        vxres = var->xres_virtual;
+        vxres = (var->xres_virtual + 7) & ~7;
        vyres = var->yres_virtual;
-        xoffset = var->xoffset;
+        xoffset = (var->xoffset + 7) & ~7;
        yoffset = var->yoffset;
        bpp = var->bits_per_pixel;
        if (bpp == 16)
@@ -827,7 +846,9 @@ static int aty_var_to_crtc(const struct fb_info *info,
        } else
                FAIL("invalid bpp");
-        if (vxres * vyres * bpp / 8 > info->fix.smem_len)
+        line_length = calc_line_length(par, vxres, bpp);
+        if (vyres * line_length > info->fix.smem_len)
                FAIL("not enough video RAM");
        h_sync_pol = sync & FB_SYNC_HOR_HIGH_ACT ? 0 : 1;
@@ -969,7 +990,9 @@ static int aty_var_to_crtc(const struct fb_info *info,
        crtc->xoffset = xoffset;
        crtc->yoffset = yoffset;
        crtc->bpp = bpp;
-        crtc->off_pitch = ((yoffset*vxres+xoffset)*bpp/64) | (vxres<<19);
+        crtc->off_pitch =
+                ((yoffset * line_length + xoffset * bpp / 8) / 8) |
+                ((line_length / bpp) << 22);
        crtc->vline_crnt_vline = 0;
        crtc->h_tot_disp = h_total | (h_disp<<16);
@@ -1394,7 +1417,9 @@ static int atyfb_set_par(struct fb_info *info)
        }
        aty_st_8(DAC_MASK, 0xff, par);
-        info->fix.line_length = var->xres_virtual * var->bits_per_pixel/8;
+        info->fix.line_length = calc_line_length(par, var->xres_virtual,
+                                                 var->bits_per_pixel);
        info->fix.visual = var->bits_per_pixel <= 8 ?
                FB_VISUAL_PSEUDOCOLOR : FB_VISUAL_DIRECTCOLOR;
@@ -1505,10 +1530,12 @@ static void set_off_pitch(struct atyfb_par *par, const struct fb_info *info)
 {
        u32 xoffset = info->var.xoffset;
        u32 yoffset = info->var.yoffset;
-        u32 vxres = par->crtc.vxres;
+        u32 line_length = info->fix.line_length;
        u32 bpp = info->var.bits_per_pixel;
-        par->crtc.off_pitch = ((yoffset * vxres + xoffset) * bpp / 64) | (vxres << 19);
+        par->crtc.off_pitch =
+                ((yoffset * line_length + xoffset * bpp / 8) / 8) |
+                ((line_length / bpp) << 22);
 }
@@ -2201,7 +2228,7 @@ static void __devinit aty_calc_mem_refresh(struct atyfb_par *par, int xclk)
        const int *refresh_tbl;
        int i, size;
-        if (IS_XL(par->pci_id) || IS_MOBILITY(par->pci_id)) {
+        if (M64_HAS(XL_MEM)) {
                refresh_tbl = ragexl_tbl;
                size = ARRAY_SIZE(ragexl_tbl);
        } else {
@@ -2335,7 +2362,10 @@ static int __devinit aty_init(struct fb_info *info)
                par->pll_ops = &aty_pll_ct;
                par->bus_type = PCI;
                par->ram_type = (aty_ld_le32(CNFG_STAT0, par) & 0x07);
-                ramname = aty_ct_ram[par->ram_type];
+                if (M64_HAS(XL_MEM))
+                        ramname = aty_xl_ram[par->ram_type];
+                else
+                        ramname = aty_ct_ram[par->ram_type];
                /* for many chips, the mclk is 67 MHz for SDRAM, 63 MHz otherwise */
                if (par->pll_limits.mclk == 67 && par->ram_type < SDRAM)
                        par->pll_limits.mclk = 63;
@@ -2390,9 +2420,9 @@ static int __devinit aty_init(struct fb_info *info)
 #endif /* CONFIG_FB_ATY_CT */
        /* save previous video mode */
-        aty_get_crtc(par, &saved_crtc);
+        aty_get_crtc(par, &par->saved_crtc);
        if(par->pll_ops->get_pll)
-                par->pll_ops->get_pll(info, &saved_pll);
+                par->pll_ops->get_pll(info, &par->saved_pll);
        par->mem_cntl = aty_ld_le32(MEM_CNTL, par);
        gtb_memsize = M64_HAS(GTB_DSP);
@@ -2667,8 +2697,8 @@ static int __devinit aty_init(struct fb_info *info)
 aty_init_exit:
        /* restore video mode */
-        aty_set_crtc(par, &saved_crtc);
+        aty_set_crtc(par, &par->saved_crtc);
-        par->pll_ops->set_pll(info, &saved_pll);
+        par->pll_ops->set_pll(info, &par->saved_pll);
 #ifdef CONFIG_MTRR
        if (par->mtrr_reg >= 0) {
@@ -3502,6 +3532,11 @@ static int __devinit atyfb_pci_probe(struct pci_dev *pdev, const struct pci_devi
        par->mmap_map[1].prot_flag = _PAGE_E;
 #endif /* __sparc__ */
+        mutex_lock(&reboot_lock);
+        if (!reboot_info)
+                reboot_info = info;
+        mutex_unlock(&reboot_lock);
        return 0;
 err_release_io:
@@ -3614,8 +3649,8 @@ static void __devexit atyfb_remove(struct fb_info *info)
        struct atyfb_par *par = (struct atyfb_par *) info->par;
        /* restore video mode */
-        aty_set_crtc(par, &saved_crtc);
+        aty_set_crtc(par, &par->saved_crtc);
-        par->pll_ops->set_pll(info, &saved_pll);
+        par->pll_ops->set_pll(info, &par->saved_pll);
        unregister_framebuffer(info);
@@ -3661,6 +3696,11 @@ static void __devexit atyfb_pci_remove(struct pci_dev *pdev)
 {
        struct fb_info *info = pci_get_drvdata(pdev);
+        mutex_lock(&reboot_lock);
+        if (reboot_info == info)
+                reboot_info = NULL;
+        mutex_unlock(&reboot_lock);
        atyfb_remove(info);
 }
@@ -3808,6 +3848,56 @@ static int __init atyfb_setup(char *options)
 }
 #endif  /*  MODULE  */
+static int atyfb_reboot_notify(struct notifier_block *nb,
+                               unsigned long code, void *unused)
+{
+        struct atyfb_par *par;
+        if (code != SYS_RESTART)
+                return NOTIFY_DONE;
+        mutex_lock(&reboot_lock);
+        if (!reboot_info)
+                goto out;
+        if (!lock_fb_info(reboot_info))
+                goto out;
+        par = reboot_info->par;
+        /*
+         * HP OmniBook 500's BIOS doesn't like the state of the
+         * hardware after atyfb has been used. Restore the hardware
+         * to the original state to allow successful reboots.
+         */
+        aty_set_crtc(par, &par->saved_crtc);
+        par->pll_ops->set_pll(reboot_info, &par->saved_pll);
+        unlock_fb_info(reboot_info);
+ out:
+        mutex_unlock(&reboot_lock);
+        return NOTIFY_DONE;
+}
+static struct notifier_block atyfb_reboot_notifier = {
+        .notifier_call = atyfb_reboot_notify,
+};
+static const struct dmi_system_id atyfb_reboot_ids[] = {
+        {
+                .ident = "HP OmniBook 500",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "HP OmniBook PC"),
+                        DMI_MATCH(DMI_PRODUCT_VERSION, "HP OmniBook 500 FA"),
+                },
+        },
+        { }
+};
 static int __init atyfb_init(void)
 {
    int err1 = 1, err2 = 1;
@@ -3826,11 +3916,20 @@ static int __init atyfb_init(void)
    err2 = atyfb_atari_probe();
 #endif
-    return (err1 && err2) ? -ENODEV : 0;
+    if (err1 && err2)
+        return -ENODEV;
+    if (dmi_check_system(atyfb_reboot_ids))
+        register_reboot_notifier(&atyfb_reboot_notifier);
+    return 0;
 }
 static void __exit atyfb_exit(void)
 {
+        if (dmi_check_system(atyfb_reboot_ids))
+                unregister_reboot_notifier(&atyfb_reboot_notifier);
 #ifdef CONFIG_PCI
        pci_unregister_driver(&atyfb_driver);
 #endif
diff --git a/drivers/video/aty/mach64_accel.c b/drivers/video/aty/mach64_accel.c
index 0cc9724e61a2..51fcc0a2c94a 100644
--- a/drivers/video/aty/mach64_accel.c
+++ b/drivers/video/aty/mach64_accel.c
@@ -63,14 +63,17 @@ static void reset_GTC_3D_engine(const struct atyfb_par *par)
 void aty_init_engine(struct atyfb_par *par, struct fb_info *info)
 {
        u32 pitch_value;
+        u32 vxres;
        /* determine modal information from global mode structure */
-        pitch_value = info->var.xres_virtual;
+        pitch_value = info->fix.line_length / (info->var.bits_per_pixel / 8);
+        vxres = info->var.xres_virtual;
        if (info->var.bits_per_pixel == 24) {
                /* In 24 bpp, the engine is in 8 bpp - this requires that all */
                /* horizontal coordinates and widths must be adjusted */
                pitch_value *= 3;
+                vxres *= 3;
        }
        /* On GTC (RagePro), we need to reset the 3D engine before */
@@ -133,7 +136,7 @@ void aty_init_engine(struct atyfb_par *par, struct fb_info *info)
        aty_st_le32(SC_LEFT, 0, par);
        aty_st_le32(SC_TOP, 0, par);
        aty_st_le32(SC_BOTTOM, par->crtc.vyres - 1, par);
-        aty_st_le32(SC_RIGHT, pitch_value - 1, par);
+        aty_st_le32(SC_RIGHT, vxres - 1, par);
        /* set background color to minimum value (usually BLACK) */
        aty_st_le32(DP_BKGD_CLR, 0, par);
diff --git a/drivers/video/backlight/tdo24m.c b/drivers/video/backlight/tdo24m.c
index 1dae7f8f3c6b..51422fc4f606 100644
--- a/drivers/video/backlight/tdo24m.c
+++ b/drivers/video/backlight/tdo24m.c
@@ -356,7 +356,7 @@ static int __devinit tdo24m_probe(struct spi_device *spi)
        lcd->power = FB_BLANK_POWERDOWN;
        lcd->mode = MODE_VGA;   /* default to VGA */
-        lcd->buf = kmalloc(TDO24M_SPI_BUFF_SIZE, sizeof(GFP_KERNEL));
+        lcd->buf = kmalloc(TDO24M_SPI_BUFF_SIZE, GFP_KERNEL);
        if (lcd->buf == NULL) {
                kfree(lcd);
                return -ENOMEM;
diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
index f8a09bf8d0cd..53ea05645ff8 100644
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbmem.c
@@ -1310,8 +1310,6 @@ static long fb_compat_ioctl(struct file *file, unsigned int cmd,
 static int
 fb_mmap(struct file *file, struct vm_area_struct * vma)
-__acquires(&info->lock)
-__releases(&info->lock)
 {
        int fbidx = iminor(file->f_path.dentry->d_inode);
        struct fb_info *info = registered_fb[fbidx];
@@ -1325,16 +1323,14 @@ __releases(&info->lock)
        off = vma->vm_pgoff << PAGE_SHIFT;
        if (!fb)
                return -ENODEV;
+        mutex_lock(&info->mm_lock);
        if (fb->fb_mmap) {
                int res;
-                mutex_lock(&info->lock);
                res = fb->fb_mmap(info, vma);
-                mutex_unlock(&info->lock);
+                mutex_unlock(&info->mm_lock);
                return res;
        }
-        mutex_lock(&info->lock);
        /* frame buffer memory */
        start = info->fix.smem_start;
        len = PAGE_ALIGN((start & ~PAGE_MASK) + info->fix.smem_len);
@@ -1342,13 +1338,13 @@ __releases(&info->lock)
                /* memory mapped io */
                off -= len;
                if (info->var.accel_flags) {
-                        mutex_unlock(&info->lock);
+                        mutex_unlock(&info->mm_lock);
                        return -EINVAL;
                }
                start = info->fix.mmio_start;
                len = PAGE_ALIGN((start & ~PAGE_MASK) + info->fix.mmio_len);
        }
-        mutex_unlock(&info->lock);
+        mutex_unlock(&info->mm_lock);
        start &= PAGE_MASK;
        if ((vma->vm_end - vma->vm_start + off) > len)
                return -EINVAL;
@@ -1518,6 +1514,7 @@ register_framebuffer(struct fb_info *fb_info)
                        break;
        fb_info->node = i;
        mutex_init(&fb_info->lock);
+        mutex_init(&fb_info->mm_lock);
        fb_info->dev = device_create(fb_class, fb_info->device,
                                     MKDEV(FB_MAJOR, i), NULL, "fb%d", i);
diff --git a/drivers/video/fsl-diu-fb.c b/drivers/video/fsl-diu-fb.c
index f153c581cbd7..0bf2190928d0 100644
--- a/drivers/video/fsl-diu-fb.c
+++ b/drivers/video/fsl-diu-fb.c
@@ -750,24 +750,26 @@ static void update_lcdc(struct fb_info *info)
 static int map_video_memory(struct fb_info *info)
 {
        phys_addr_t phys;
+        u32 smem_len = info->fix.line_length * info->var.yres_virtual;
        pr_debug("info->var.xres_virtual = %d\n", info->var.xres_virtual);
        pr_debug("info->var.yres_virtual = %d\n", info->var.yres_virtual);
        pr_debug("info->fix.line_length  = %d\n", info->fix.line_length);
+        pr_debug("MAP_VIDEO_MEMORY: smem_len = %u\n", smem_len);
-        info->fix.smem_len = info->fix.line_length * info->var.yres_virtual;
+        info->screen_base = fsl_diu_alloc(smem_len, &phys);
-        pr_debug("MAP_VIDEO_MEMORY: smem_len = %d\n", info->fix.smem_len);
-        info->screen_base = fsl_diu_alloc(info->fix.smem_len, &phys);
        if (info->screen_base == NULL) {
                printk(KERN_ERR "Unable to allocate fb memory\n");
                return -ENOMEM;
        }
+        mutex_lock(&info->mm_lock);
        info->fix.smem_start = (unsigned long) phys;
+        info->fix.smem_len = smem_len;
+        mutex_unlock(&info->mm_lock);
        info->screen_size = info->fix.smem_len;
        pr_debug("Allocated fb @ paddr=0x%08lx, size=%d.\n",
-                                info->fix.smem_start,
+                 info->fix.smem_start, info->fix.smem_len);
-                info->fix.smem_len);
        pr_debug("screen base %p\n", info->screen_base);
        return 0;
@@ -776,9 +778,11 @@ static int map_video_memory(struct fb_info *info)
 static void unmap_video_memory(struct fb_info *info)
 {
        fsl_diu_free(info->screen_base, info->fix.smem_len);
+        mutex_lock(&info->mm_lock);
        info->screen_base = NULL;
        info->fix.smem_start = 0;
        info->fix.smem_len = 0;
+        mutex_unlock(&info->mm_lock);
 }
 /*
diff --git a/drivers/video/i810/i810_main.c b/drivers/video/i810/i810_main.c
index 2e940199fc89..71960672d721 100644
--- a/drivers/video/i810/i810_main.c
+++ b/drivers/video/i810/i810_main.c
@@ -1090,8 +1090,10 @@ static int encode_fix(struct fb_fix_screeninfo *fix, struct fb_info *info)
        memset(fix, 0, sizeof(struct fb_fix_screeninfo));
        strcpy(fix->id, "I810");
+        mutex_lock(&info->mm_lock);
        fix->smem_start = par->fb.physical;
        fix->smem_len = par->fb.size;
+        mutex_unlock(&info->mm_lock);
        fix->type = FB_TYPE_PACKED_PIXELS;
        fix->type_aux = 0;
        fix->xpanstep = 8;
diff --git a/drivers/video/matrox/matroxfb_base.c b/drivers/video/matrox/matroxfb_base.c
index 8e7a275df50c..59c3a2e14913 100644
--- a/drivers/video/matrox/matroxfb_base.c
+++ b/drivers/video/matrox/matroxfb_base.c
@@ -724,8 +724,10 @@ static void matroxfb_update_fix(WPMINFO2)
        struct fb_fix_screeninfo *fix = &ACCESS_FBINFO(fbcon).fix;
        DBG(__func__)
+        mutex_lock(&ACCESS_FBINFO(fbcon).mm_lock);
        fix->smem_start = ACCESS_FBINFO(video.base) + ACCESS_FBINFO(curr.ydstorg.bytes);
        fix->smem_len = ACCESS_FBINFO(video.len_usable) - ACCESS_FBINFO(curr.ydstorg.bytes);
+        mutex_unlock(&ACCESS_FBINFO(fbcon).mm_lock);
 }
 static int matroxfb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
@@ -2081,6 +2083,7 @@ static int matroxfb_probe(struct pci_dev* pdev, const struct pci_device_id* dumm
        spin_lock_init(&ACCESS_FBINFO(lock.accel));
        init_rwsem(&ACCESS_FBINFO(crtc2.lock));
        init_rwsem(&ACCESS_FBINFO(altout.lock));
+        mutex_init(&ACCESS_FBINFO(fbcon).mm_lock);
        ACCESS_FBINFO(irq_flags) = 0;
        init_waitqueue_head(&ACCESS_FBINFO(crtc1.vsync.wait));
        init_waitqueue_head(&ACCESS_FBINFO(crtc2.vsync.wait));
diff --git a/drivers/video/matrox/matroxfb_crtc2.c b/drivers/video/matrox/matroxfb_crtc2.c
index 7ac4c5f6145d..909e10a11898 100644
--- a/drivers/video/matrox/matroxfb_crtc2.c
+++ b/drivers/video/matrox/matroxfb_crtc2.c
@@ -289,13 +289,16 @@ static int matroxfb_dh_release(struct fb_info* info, int user) {
 #undef m2info
 }
-static void matroxfb_dh_init_fix(struct matroxfb_dh_fb_info *m2info) {
+static void matroxfb_dh_init_fix(struct matroxfb_dh_fb_info *m2info)
+{
        struct fb_fix_screeninfo *fix = &m2info->fbcon.fix;
        strcpy(fix->id, "MATROX DH");
+        mutex_lock(&m2info->fbcon.mm_lock);
        fix->smem_start = m2info->video.base;
        fix->smem_len = m2info->video.len_usable;
+        mutex_unlock(&m2info->fbcon.mm_lock);
        fix->ypanstep = 1;
        fix->ywrapstep = 0;
        fix->xpanstep = 8;      /* TBD */
diff --git a/drivers/video/mx3fb.c b/drivers/video/mx3fb.c
index b7af5256e887..567fb944bd2a 100644
--- a/drivers/video/mx3fb.c
+++ b/drivers/video/mx3fb.c
@@ -669,7 +669,7 @@ static uint32_t bpp_to_pixfmt(int bpp)
 }
 static int mx3fb_blank(int blank, struct fb_info *fbi);
-static int mx3fb_map_video_memory(struct fb_info *fbi);
+static int mx3fb_map_video_memory(struct fb_info *fbi, unsigned int mem_len);
 static int mx3fb_unmap_video_memory(struct fb_info *fbi);
 /**
@@ -742,8 +742,7 @@ static int mx3fb_set_par(struct fb_info *fbi)
                if (fbi->fix.smem_start)
                        mx3fb_unmap_video_memory(fbi);
-                fbi->fix.smem_len = mem_len;
+                if (mx3fb_map_video_memory(fbi, mem_len) < 0) {
-                if (mx3fb_map_video_memory(fbi) < 0) {
                        mutex_unlock(&mx3_fbi->mutex);
                        return -ENOMEM;
                }
@@ -1198,6 +1197,7 @@ static int mx3fb_resume(struct platform_device *pdev)
 /**
 * mx3fb_map_video_memory() - allocates the DRAM memory for the frame buffer.
 * @fbi:        framebuffer information pointer
+ * @mem_len:    length of mapped memory
 * @return:     Error code indicating success or failure
 *
 * This buffer is remapped into a non-cached, non-buffered, memory region to
@@ -1205,23 +1205,26 @@ static int mx3fb_resume(struct platform_device *pdev)
 * area is remapped, all virtual memory access to the video memory should occur
 * at the new region.
 */
-static int mx3fb_map_video_memory(struct fb_info *fbi)
+static int mx3fb_map_video_memory(struct fb_info *fbi, unsigned int mem_len)
 {
        int retval = 0;
        dma_addr_t addr;
        fbi->screen_base = dma_alloc_writecombine(fbi->device,
-                                                  fbi->fix.smem_len,
+                                                  mem_len,
                                                  &addr, GFP_DMA);
        if (!fbi->screen_base) {
                dev_err(fbi->device, "Cannot allocate %u bytes framebuffer memory\n",
-                        fbi->fix.smem_len);
+                        mem_len);
                retval = -EBUSY;
                goto err0;
        }
+        mutex_lock(&fbi->mm_lock);
        fbi->fix.smem_start = addr;
+        fbi->fix.smem_len = mem_len;
+        mutex_unlock(&fbi->mm_lock);
        dev_dbg(fbi->device, "allocated fb @ p=0x%08x, v=0x%p, size=%d.\n",
                (uint32_t) fbi->fix.smem_start, fbi->screen_base, fbi->fix.smem_len);
@@ -1251,8 +1254,10 @@ static int mx3fb_unmap_video_memory(struct fb_info *fbi)
                              fbi->screen_base, fbi->fix.smem_start);
        fbi->screen_base = 0;
+        mutex_lock(&fbi->mm_lock);
        fbi->fix.smem_start = 0;
        fbi->fix.smem_len = 0;
+        mutex_unlock(&fbi->mm_lock);
        return 0;
 }
diff --git a/drivers/video/omap/omapfb_main.c b/drivers/video/omap/omapfb_main.c
index 060d72fe57cb..4ea99bfc37b4 100644
--- a/drivers/video/omap/omapfb_main.c
+++ b/drivers/video/omap/omapfb_main.c
@@ -393,8 +393,10 @@ static void set_fb_fix(struct fb_info *fbi)
        rg = &plane->fbdev->mem_desc.region[plane->idx];
        fbi->screen_base        = rg->vaddr;
+        mutex_lock(&fbi->mm_lock);
        fix->smem_start         = rg->paddr;
        fix->smem_len           = rg->size;
+        mutex_unlock(&fbi->mm_lock);
        fix->type = FB_TYPE_PACKED_PIXELS;
        bpp = var->bits_per_pixel;
@@ -886,8 +888,10 @@ static int omapfb_setup_mem(struct fb_info *fbi, struct omapfb_mem_info *mi)
                                 * plane memory is dealloce'd, the other
                                 * screen parameters in var / fix are invalid.
                                 */
+                                mutex_lock(&fbi->mm_lock);
                                fbi->fix.smem_start = 0;
                                fbi->fix.smem_len = 0;
+                                mutex_unlock(&fbi->mm_lock);
                        }
                }
        }
diff --git a/drivers/video/platinumfb.c b/drivers/video/platinumfb.c
index 03b3670130a0..bacfabd9ce16 100644
--- a/drivers/video/platinumfb.c
+++ b/drivers/video/platinumfb.c
@@ -141,7 +141,9 @@ static int platinumfb_set_par (struct fb_info *info)
                offset = 0x10;
        info->screen_base = pinfo->frame_buffer + init->fb_offset + offset;
+        mutex_lock(&info->mm_lock);
        info->fix.smem_start = (pinfo->frame_buffer_phys) + init->fb_offset + offset;
+        mutex_unlock(&info->mm_lock);
        info->fix.visual = (pinfo->cmode == CMODE_8) ?
                FB_VISUAL_PSEUDOCOLOR : FB_VISUAL_DIRECTCOLOR;
        info->fix.line_length = vmode_attrs[pinfo->vmode-1].hres * (1<<pinfo->cmode)
diff --git a/drivers/video/pxafb.c b/drivers/video/pxafb.c
index 0889d50c3288..6506117c134b 100644
--- a/drivers/video/pxafb.c
+++ b/drivers/video/pxafb.c
@@ -815,8 +815,10 @@ static int overlayfb_map_video_memory(struct pxafb_layer *ofb)
        ofb->video_mem_phys = virt_to_phys(ofb->video_mem);
        ofb->video_mem_size = size;
+        mutex_lock(&ofb->fb.mm_lock);
        ofb->fb.fix.smem_start  = ofb->video_mem_phys;
        ofb->fb.fix.smem_len    = ofb->fb.fix.line_length * var->yres_virtual;
+        mutex_unlock(&ofb->fb.mm_lock);
        ofb->fb.screen_base     = ofb->video_mem;
        return 0;
 }
diff --git a/drivers/video/sh7760fb.c b/drivers/video/sh7760fb.c
index 653bdfee3057..9f6d6e61f0cc 100644
--- a/drivers/video/sh7760fb.c
+++ b/drivers/video/sh7760fb.c
@@ -120,18 +120,6 @@ static int sh7760_setcolreg (u_int regno,
        return 0;
 }
-static void encode_fix(struct fb_fix_screeninfo *fix, struct fb_info *info,
-                       unsigned long stride)
-{
-        memset(fix, 0, sizeof(struct fb_fix_screeninfo));
-        strcpy(fix->id, "sh7760-lcdc");
-        fix->smem_start = (unsigned long)info->screen_base;
-        fix->smem_len = info->screen_size;
-        fix->line_length = stride;
-}
 static int sh7760fb_get_color_info(struct device *dev,
                                   u16 lddfr, int *bpp, int *gray)
 {
@@ -334,7 +322,8 @@ static int sh7760fb_set_par(struct fb_info *info)
        iowrite32(ldsarl, par->base + LDSARL);  /* mem for lower half of DSTN */
-        encode_fix(&info->fix, info, stride);
+        info->fix.line_length = stride;
        sh7760fb_check_var(&info->var, info);
        sh7760fb_blank(FB_BLANK_UNBLANK, info); /* panel on! */
@@ -435,6 +424,8 @@ static int sh7760fb_alloc_mem(struct fb_info *info)
        info->screen_base = fbmem;
        info->screen_size = vram;
+        info->fix.smem_start = (unsigned long)info->screen_base;
+        info->fix.smem_len = info->screen_size;
        return 0;
 }
@@ -520,6 +511,8 @@ static int __devinit sh7760fb_probe(struct platform_device *pdev)
        info->var.transp.length = 0;
        info->var.transp.msb_right = 0;
+        strcpy(info->fix.id, "sh7760-lcdc");
        /* set the DON2 bit now, before cmap allocation, as it will randomize
         * palette memory.
         */
diff --git a/drivers/video/sh_mobile_lcdcfb.c b/drivers/video/sh_mobile_lcdcfb.c
index f10d2fbeda06..da983b720f08 100644
--- a/drivers/video/sh_mobile_lcdcfb.c
+++ b/drivers/video/sh_mobile_lcdcfb.c
@@ -17,6 +17,7 @@
 #include <linux/platform_device.h>
 #include <linux/dma-mapping.h>
 #include <linux/interrupt.h>
+#include <linux/vmalloc.h>
 #include <video/sh_mobile_lcdc.h>
 #include <asm/atomic.h>
@@ -33,6 +34,7 @@ struct sh_mobile_lcdc_chan {
        struct fb_info info;
        dma_addr_t dma_handle;
        struct fb_deferred_io defio;
+        struct scatterlist *sglist;
        unsigned long frame_end;
        wait_queue_head_t frame_end_wait;
 };
@@ -206,16 +208,38 @@ static void sh_mobile_lcdc_clk_on(struct sh_mobile_lcdc_priv *priv) {}
 static void sh_mobile_lcdc_clk_off(struct sh_mobile_lcdc_priv *priv) {}
 #endif
+static int sh_mobile_lcdc_sginit(struct fb_info *info,
+                                  struct list_head *pagelist)
+{
+        struct sh_mobile_lcdc_chan *ch = info->par;
+        unsigned int nr_pages_max = info->fix.smem_len >> PAGE_SHIFT;
+        struct page *page;
+        int nr_pages = 0;
+        sg_init_table(ch->sglist, nr_pages_max);
+        list_for_each_entry(page, pagelist, lru)
+                sg_set_page(&ch->sglist[nr_pages++], page, PAGE_SIZE, 0);
+        return nr_pages;
+}
 static void sh_mobile_lcdc_deferred_io(struct fb_info *info,
                                       struct list_head *pagelist)
 {
        struct sh_mobile_lcdc_chan *ch = info->par;
+        unsigned int nr_pages;
        /* enable clocks before accessing hardware */
        sh_mobile_lcdc_clk_on(ch->lcdc);
+        nr_pages = sh_mobile_lcdc_sginit(info, pagelist);
+        dma_map_sg(info->dev, ch->sglist, nr_pages, DMA_TO_DEVICE);
        /* trigger panel update */
        lcdc_write_chan(ch, LDSM2R, 1);
+        dma_unmap_sg(info->dev, ch->sglist, nr_pages, DMA_TO_DEVICE);
 }
 static void sh_mobile_lcdc_deferred_io_touch(struct fb_info *info)
@@ -846,21 +870,31 @@ static int __init sh_mobile_lcdc_probe(struct platform_device *pdev)
        }
        for (i = 0; i < j; i++) {
-                error = register_framebuffer(&priv->ch[i].info);
+                struct sh_mobile_lcdc_chan *ch = priv->ch + i;
+                info = &ch->info;
+                if (info->fbdefio) {
+                        priv->ch->sglist = vmalloc(sizeof(struct scatterlist) *
+                                        info->fix.smem_len >> PAGE_SHIFT);
+                        if (!priv->ch->sglist) {
+                                dev_err(&pdev->dev, "cannot allocate sglist\n");
+                                goto err1;
+                        }
+                }
+                error = register_framebuffer(info);
                if (error < 0)
                        goto err1;
-        }
-        for (i = 0; i < j; i++) {
-                info = &priv->ch[i].info;
                dev_info(info->dev,
                         "registered %s/%s as %dx%d %dbpp.\n",
                         pdev->name,
-                         (priv->ch[i].cfg.chan == LCDC_CHAN_MAINLCD) ?
+                         (ch->cfg.chan == LCDC_CHAN_MAINLCD) ?
                         "mainlcd" : "sublcd",
-                         (int) priv->ch[i].cfg.lcd_cfg.xres,
+                         (int) ch->cfg.lcd_cfg.xres,
-                         (int) priv->ch[i].cfg.lcd_cfg.yres,
+                         (int) ch->cfg.lcd_cfg.yres,
-                         priv->ch[i].cfg.bpp);
+                         ch->cfg.bpp);
                /* deferred io mode: disable clock to save power */
                if (info->fbdefio)
@@ -892,6 +926,9 @@ static int sh_mobile_lcdc_remove(struct platform_device *pdev)
                if (!info->device)
                        continue;
+                if (priv->ch[i].sglist)
+                        vfree(priv->ch[i].sglist);
                dma_free_coherent(&pdev->dev, info->fix.smem_len,
                                  info->screen_base, priv->ch[i].dma_handle);
                fb_dealloc_cmap(&info->cmap);
diff --git a/drivers/video/sis/sis_main.c b/drivers/video/sis/sis_main.c
index 7072d19080d5..fd33455389b8 100644
--- a/drivers/video/sis/sis_main.c
+++ b/drivers/video/sis/sis_main.c
@@ -1847,8 +1847,10 @@ sisfb_get_fix(struct fb_fix_screeninfo *fix, int con, struct fb_info *info)
        strcpy(fix->id, ivideo->myid);
+        mutex_lock(&info->mm_lock);
        fix->smem_start  = ivideo->video_base + ivideo->video_offset;
        fix->smem_len    = ivideo->sisfb_mem;
+        mutex_unlock(&info->mm_lock);
        fix->type        = FB_TYPE_PACKED_PIXELS;
        fix->type_aux    = 0;
        fix->visual      = (ivideo->video_bpp == 8) ? FB_VISUAL_PSEUDOCOLOR : FB_VISUAL_TRUECOLOR;
diff --git a/drivers/video/sm501fb.c b/drivers/video/sm501fb.c
index eb5d73a06702..98f24f0ec00d 100644
--- a/drivers/video/sm501fb.c
+++ b/drivers/video/sm501fb.c
@@ -145,7 +145,7 @@ static inline void sm501fb_sync_regs(struct sm501fb_info *info)
 #define SM501_MEMF_ACCEL                (8)
 static int sm501_alloc_mem(struct sm501fb_info *inf, struct sm501_mem *mem,
-                           unsigned int why, size_t size)
+                           unsigned int why, size_t size, u32 smem_len)
 {
        struct sm501fb_par *par;
        struct fb_info *fbi;
@@ -172,7 +172,7 @@ static int sm501_alloc_mem(struct sm501fb_info *inf, struct sm501_mem *mem,
                if (ptr > 0)
                        ptr &= ~(PAGE_SIZE - 1);
-                if (fbi && ptr < fbi->fix.smem_len)
+                if (fbi && ptr < smem_len)
                        return -ENOMEM;
                break;
@@ -197,7 +197,7 @@ static int sm501_alloc_mem(struct sm501fb_info *inf, struct sm501_mem *mem,
        case SM501_MEMF_ACCEL:
                fbi = inf->fb[HEAD_CRT];
-                ptr = fbi ? fbi->fix.smem_len : 0;
+                ptr = fbi ? smem_len : 0;
                fbi = inf->fb[HEAD_PANEL];
                if (fbi) {
@@ -413,6 +413,7 @@ static int sm501fb_set_par_common(struct fb_info *info,
        unsigned int mem_type;
        unsigned int clock_type;
        unsigned int head_addr;
+        unsigned int smem_len;
        dev_dbg(fbi->dev, "%s: %dx%d, bpp = %d, virtual %dx%d\n",
                __func__, var->xres, var->yres, var->bits_per_pixel,
@@ -453,18 +454,20 @@ static int sm501fb_set_par_common(struct fb_info *info,
        /* allocate fb memory within 501 */
        info->fix.line_length = (var->xres_virtual * var->bits_per_pixel)/8;
-        info->fix.smem_len    = info->fix.line_length * var->yres_virtual;
+        smem_len = info->fix.line_length * var->yres_virtual;
        dev_dbg(fbi->dev, "%s: line length = %u\n", __func__,
                info->fix.line_length);
-        if (sm501_alloc_mem(fbi, &par->screen, mem_type,
+        if (sm501_alloc_mem(fbi, &par->screen, mem_type, smem_len, smem_len)) {
-                            info->fix.smem_len)) {
                dev_err(fbi->dev, "no memory available\n");
                return -ENOMEM;
        }
+        mutex_lock(&info->mm_lock);
        info->fix.smem_start = fbi->fbmem_res->start + par->screen.sm_addr;
+        info->fix.smem_len   = smem_len;
+        mutex_unlock(&info->mm_lock);
        info->screen_base = fbi->fbmem + par->screen.sm_addr;
        info->screen_size = info->fix.smem_len;
@@ -637,7 +640,8 @@ static int sm501fb_set_par_crt(struct fb_info *info)
        if ((control & SM501_DC_CRT_CONTROL_SEL) == 0) {
                /* the head is displaying panel data... */
-                sm501_alloc_mem(fbi, &par->screen, SM501_MEMF_CRT, 0);
+                sm501_alloc_mem(fbi, &par->screen, SM501_MEMF_CRT, 0,
+                                info->fix.smem_len);
                goto out_update;
        }
@@ -1289,7 +1293,8 @@ static int sm501_init_cursor(struct fb_info *fbi, unsigned int reg_base)
        par->cursor_regs = info->regs + reg_base;
-        ret = sm501_alloc_mem(info, &par->cursor, SM501_MEMF_CURSOR, 1024);
+        ret = sm501_alloc_mem(info, &par->cursor, SM501_MEMF_CURSOR, 1024,
+                              fbi->fix.smem_len);
        if (ret < 0)
                return ret;
diff --git a/drivers/video/w100fb.c b/drivers/video/w100fb.c
index d0674f1e3f10..8a141c2c637b 100644
--- a/drivers/video/w100fb.c
+++ b/drivers/video/w100fb.c
@@ -523,6 +523,7 @@ static int w100fb_set_par(struct fb_info *info)
                info->fix.ywrapstep = 0;
                info->fix.line_length = par->xres * BITS_PER_PIXEL / 8;
+                mutex_lock(&info->mm_lock);
                if ((par->xres*par->yres*BITS_PER_PIXEL/8) > (MEM_INT_SIZE+1)) {
                        par->extmem_active = 1;
                        info->fix.smem_len = par->mach->mem->size+1;
@@ -530,6 +531,7 @@ static int w100fb_set_par(struct fb_info *info)
                        par->extmem_active = 0;
                        info->fix.smem_len = MEM_INT_SIZE+1;
                }
+                mutex_unlock(&info->mm_lock);
                w100fb_activate_var(par);
        }