52 files changed, 632 insertions, 187 deletions

diff --git a/drivers/base/iommu.c b/drivers/base/iommu.c
index 9f0e672f4be8..8ad4ffea6920 100644
--- a/drivers/base/iommu.c
+++ b/drivers/base/iommu.c
@@ -18,6 +18,8 @@
 
 #include <linux/bug.h>
 #include <linux/types.h>
+#include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/iommu.h>
 
diff --git a/drivers/char/vt_ioctl.c b/drivers/char/vt_ioctl.c
index a2dee0eb6dad..e6ce632a393e 100644
--- a/drivers/char/vt_ioctl.c
+++ b/drivers/char/vt_ioctl.c
@@ -400,6 +400,9 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
         case KIOCSOUND:
                 if (!perm)
                         goto eperm;
+                /* FIXME: This is an old broken API but we need to keep it
+                   supported and somehow separate the historic advertised
+                   tick rate from any real one */
                 if (arg)
                         arg = CLOCK_TICK_RATE / arg;
                 kd_mksound(arg, 0);
@@ -417,6 +420,9 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                  */
                 ticks = HZ * ((arg >> 16) & 0xffff) / 1000;
                 count = ticks ? (arg & 0xffff) : 0;
+                /* FIXME: This is an old broken API but we need to keep it
+                   supported and somehow separate the historic advertised
+                   tick rate from any real one */
                 if (count)
                         count = CLOCK_TICK_RATE / count;
                 kd_mksound(count, ticks);
diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
index a04639dc633d..45890447feec 100644
--- a/drivers/gpu/drm/drm_crtc_helper.c
+++ b/drivers/gpu/drm/drm_crtc_helper.c
@@ -561,7 +561,6 @@ bool drm_crtc_helper_set_mode(struct drm_crtc *crtc,
         int saved_x, saved_y;
         struct drm_encoder *encoder;
         bool ret = true;
-        bool depth_changed, bpp_changed;
 
         adjusted_mode = drm_mode_duplicate(dev, mode);
 
@@ -570,15 +569,6 @@ bool drm_crtc_helper_set_mode(struct drm_crtc *crtc,
         if (!crtc->enabled)
                 return true;
 
-        if (old_fb && crtc->fb) {
-                depth_changed = (old_fb->depth != crtc->fb->depth);
-                bpp_changed = (old_fb->bits_per_pixel !=
-                               crtc->fb->bits_per_pixel);
-        } else {
-                depth_changed = true;
-                bpp_changed = true;
-        }
-
         saved_mode = crtc->mode;
         saved_x = crtc->x;
         saved_y = crtc->y;
@@ -590,15 +580,6 @@ bool drm_crtc_helper_set_mode(struct drm_crtc *crtc,
         crtc->x = x;
         crtc->y = y;
 
-        if (drm_mode_equal(&saved_mode, &crtc->mode)) {
-                if (saved_x != crtc->x || saved_y != crtc->y ||
-                    depth_changed || bpp_changed) {
-                        ret = !crtc_funcs->mode_set_base(crtc, crtc->x, crtc->y,
-                                                         old_fb);
-                        goto done;
-                }
-        }
-
         /* Pass our mode to the connectors and the CRTC to give them a chance to
          * adjust it according to limitations or connector properties, and also
          * a chance to reject the mode entirely.
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index c4ada8b6295b..f01def16a669 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -456,7 +456,8 @@ int drm_ioctl(struct inode *inode, struct file *filp,
                 retcode = -EINVAL;
         } else if (((ioctl->flags & DRM_ROOT_ONLY) && !capable(CAP_SYS_ADMIN)) ||
                    ((ioctl->flags & DRM_AUTH) && !file_priv->authenticated) ||
-                   ((ioctl->flags & DRM_MASTER) && !file_priv->is_master)) {
+                   ((ioctl->flags & DRM_MASTER) && !file_priv->is_master) ||
+                   (!(ioctl->flags & DRM_CONTROL_ALLOW) && (file_priv->minor->type == DRM_MINOR_CONTROL))) {
                 retcode = -EACCES;
         } else {
                 if (cmd & (IOC_IN | IOC_OUT)) {
diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c
index ef878615c49f..b9631e3a1ea6 100644
--- a/drivers/gpu/drm/drm_stub.c
+++ b/drivers/gpu/drm/drm_stub.c
@@ -402,14 +402,14 @@ int drm_get_dev(struct pci_dev *pdev, const struct pci_device_id *ent,
         if (dev->driver->load) {
                 ret = dev->driver->load(dev, ent->driver_data);
                 if (ret)
-                        goto err_g3;
+                        goto err_g4;
         }
 
         /* setup the grouping for the legacy output */
         if (drm_core_check_feature(dev, DRIVER_MODESET)) {
                 ret = drm_mode_group_init_legacy_group(dev, &dev->primary->mode_group);
                 if (ret)
-                        goto err_g3;
+                        goto err_g4;
         }
 
         list_add_tail(&dev->driver_item, &driver->device_list);
@@ -420,8 +420,11 @@ int drm_get_dev(struct pci_dev *pdev, const struct pci_device_id *ent,
 
         return 0;
 
-err_g3:
+err_g4:
         drm_put_minor(&dev->primary);
+err_g3:
+        if (drm_core_check_feature(dev, DRIVER_MODESET))
+                drm_put_minor(&dev->control);
 err_g2:
         pci_disable_device(pdev);
 err_g1:
@@ -502,11 +505,11 @@ void drm_put_dev(struct drm_device *dev)
                 dev->agp = NULL;
         }
 
-        drm_ht_remove(&dev->map_hash);
-        drm_ctxbitmap_cleanup(dev);
-
         list_for_each_entry_safe(r_list, list_temp, &dev->maplist, head)
                 drm_rmmap(dev, r_list->map);
+        drm_ht_remove(&dev->map_hash);
+
+        drm_ctxbitmap_cleanup(dev);
 
         if (drm_core_check_feature(dev, DRIVER_MODESET))
                 drm_put_minor(&dev->control);
diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c
index 022876ae34f0..8f9372921f82 100644
--- a/drivers/gpu/drm/drm_sysfs.c
+++ b/drivers/gpu/drm/drm_sysfs.c
@@ -489,9 +489,7 @@ int drm_sysfs_device_add(struct drm_minor *minor)
 
         return 0;
 
-        device_unregister(&minor->kdev);
 err_out:
-
         return err;
 }
 
diff --git a/drivers/gpu/drm/r128/r128_cce.c b/drivers/gpu/drm/r128/r128_cce.c
index 32de4cedc363..077c0455a6b9 100644
--- a/drivers/gpu/drm/r128/r128_cce.c
+++ b/drivers/gpu/drm/r128/r128_cce.c
@@ -511,9 +511,9 @@ static int r128_do_init_cce(struct drm_device * dev, drm_r128_init_t * init)
 
 #if __OS_HAS_AGP
         if (!dev_priv->is_pci) {
-                drm_core_ioremap(dev_priv->cce_ring, dev);
-                drm_core_ioremap(dev_priv->ring_rptr, dev);
-                drm_core_ioremap(dev->agp_buffer_map, dev);
+                drm_core_ioremap_wc(dev_priv->cce_ring, dev);
+                drm_core_ioremap_wc(dev_priv->ring_rptr, dev);
+                drm_core_ioremap_wc(dev->agp_buffer_map, dev);
                 if (!dev_priv->cce_ring->handle ||
                     !dev_priv->ring_rptr->handle ||
                     !dev->agp_buffer_map->handle) {
diff --git a/drivers/gpu/drm/radeon/radeon_drv.h b/drivers/gpu/drm/radeon/radeon_drv.h
index ed4d27e6ee6f..8071d965f142 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.h
+++ b/drivers/gpu/drm/radeon/radeon_drv.h
@@ -99,9 +99,10 @@
  * 1.27- Add support for IGP GART
  * 1.28- Add support for VBL on CRTC2
  * 1.29- R500 3D cmd buffer support
+ * 1.30- Add support for occlusion queries
  */
 #define DRIVER_MAJOR            1
-#define DRIVER_MINOR            29
+#define DRIVER_MINOR            30
 #define DRIVER_PATCHLEVEL       0
 
 /*
diff --git a/drivers/i2c/algos/i2c-algo-bit.c b/drivers/i2c/algos/i2c-algo-bit.c
index d420cc5f5633..e25e13980af3 100644
--- a/drivers/i2c/algos/i2c-algo-bit.c
+++ b/drivers/i2c/algos/i2c-algo-bit.c
@@ -104,7 +104,7 @@ static int sclhi(struct i2c_algo_bit_data *adap)
                  * chips may hold it low ("clock stretching") while they
                  * are processing data internally.
                  */
-                if (time_after_eq(jiffies, start + adap->timeout))
+                if (time_after(jiffies, start + adap->timeout))
                         return -ETIMEDOUT;
                 cond_resched();
         }
diff --git a/drivers/i2c/algos/i2c-algo-pca.c b/drivers/i2c/algos/i2c-algo-pca.c
index 6318f7ddc1d4..78d42aae0089 100644
--- a/drivers/i2c/algos/i2c-algo-pca.c
+++ b/drivers/i2c/algos/i2c-algo-pca.c
@@ -287,10 +287,21 @@ static int pca_xfer(struct i2c_adapter *i2c_adap,
 
                 case 0x30: /* Data byte in I2CDAT has been transmitted; NOT ACK has been received */
                         DEB2("NOT ACK received after data byte\n");
+                        pca_stop(adap);
                         goto out;
 
                 case 0x38: /* Arbitration lost during SLA+W, SLA+R or data bytes */
                         DEB2("Arbitration lost\n");
+                        /*
+                         * The PCA9564 data sheet (2006-09-01) says "A
+                         * START condition will be transmitted when the
+                         * bus becomes free (STOP or SCL and SDA high)"
+                         * when the STA bit is set (p. 11).
+                         *
+                         * In case this won't work, try pca_reset()
+                         * instead.
+                         */
+                        pca_start(adap);
                         goto out;
 
                 case 0x58: /* Data byte has been received; NOT ACK has been returned */
diff --git a/drivers/i2c/busses/i2c-ali1535.c b/drivers/i2c/busses/i2c-ali1535.c
index 981e080b32ae..d108450df064 100644
--- a/drivers/i2c/busses/i2c-ali1535.c
+++ b/drivers/i2c/busses/i2c-ali1535.c
@@ -284,7 +284,7 @@ static int ali1535_transaction(struct i2c_adapter *adap)
                  && (timeout++ < MAX_TIMEOUT));
 
         /* If the SMBus is still busy, we give up */
-        if (timeout >= MAX_TIMEOUT) {
+        if (timeout > MAX_TIMEOUT) {
                 result = -ETIMEDOUT;
                 dev_err(&adap->dev, "SMBus Timeout!\n");
         }
diff --git a/drivers/i2c/busses/i2c-ali15x3.c b/drivers/i2c/busses/i2c-ali15x3.c
index 39066dee46e3..d627fceb790b 100644
--- a/drivers/i2c/busses/i2c-ali15x3.c
+++ b/drivers/i2c/busses/i2c-ali15x3.c
@@ -306,7 +306,7 @@ static int ali15x3_transaction(struct i2c_adapter *adap)
                  && (timeout++ < MAX_TIMEOUT));
 
         /* If the SMBus is still busy, we give up */
-        if (timeout >= MAX_TIMEOUT) {
+        if (timeout > MAX_TIMEOUT) {
                 result = -ETIMEDOUT;
                 dev_err(&adap->dev, "SMBus Timeout!\n");
         }
diff --git a/drivers/i2c/busses/i2c-amd756.c b/drivers/i2c/busses/i2c-amd756.c
index 220f4a1eee1d..f7d6fe9c49ba 100644
--- a/drivers/i2c/busses/i2c-amd756.c
+++ b/drivers/i2c/busses/i2c-amd756.c
@@ -126,7 +126,7 @@ static int amd756_transaction(struct i2c_adapter *adap)
                 } while ((temp & (GS_HST_STS | GS_SMB_STS)) &&
                          (timeout++ < MAX_TIMEOUT));
                 /* If the SMBus is still busy, we give up */
-                if (timeout >= MAX_TIMEOUT) {
+                if (timeout > MAX_TIMEOUT) {
                         dev_dbg(&adap->dev, "Busy wait timeout (%04x)\n", temp);
                         goto abort;
                 }
@@ -143,7 +143,7 @@ static int amd756_transaction(struct i2c_adapter *adap)
         } while ((temp & GS_HST_STS) && (timeout++ < MAX_TIMEOUT));
 
         /* If the SMBus is still busy, we give up */
-        if (timeout >= MAX_TIMEOUT) {
+        if (timeout > MAX_TIMEOUT) {
                 dev_dbg(&adap->dev, "Completion timeout!\n");
                 goto abort;
         }
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 10411848fd70..9d2c5adf5d4f 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -237,7 +237,7 @@ static int i801_transaction(int xact)
                 status = inb_p(SMBHSTSTS);
         } while ((status & SMBHSTSTS_HOST_BUSY) && (timeout++ < MAX_TIMEOUT));
 
-        result = i801_check_post(status, timeout >= MAX_TIMEOUT);
+        result = i801_check_post(status, timeout > MAX_TIMEOUT);
         if (result < 0)
                 return result;
 
@@ -257,9 +257,9 @@ static void i801_wait_hwpec(void)
         } while ((!(status & SMBHSTSTS_INTR))
                  && (timeout++ < MAX_TIMEOUT));
 
-        if (timeout >= MAX_TIMEOUT) {
+        if (timeout > MAX_TIMEOUT)
                 dev_dbg(&I801_dev->dev, "PEC Timeout!\n");
-        }
+
         outb_p(status, SMBHSTSTS);
 }
 
@@ -344,7 +344,7 @@ static int i801_block_transaction_byte_by_byte(union i2c_smbus_data *data,
                 while ((!(status & SMBHSTSTS_BYTE_DONE))
                        && (timeout++ < MAX_TIMEOUT));
 
-                result = i801_check_post(status, timeout >= MAX_TIMEOUT);
+                result = i801_check_post(status, timeout > MAX_TIMEOUT);
                 if (result < 0)
                         return result;
 
diff --git a/drivers/i2c/busses/i2c-isch.c b/drivers/i2c/busses/i2c-isch.c
index b9c01aa90036..9f6b8e0f8632 100644
--- a/drivers/i2c/busses/i2c-isch.c
+++ b/drivers/i2c/busses/i2c-isch.c
@@ -112,7 +112,7 @@ static int sch_transaction(void)
         } while ((temp & 0x08) && (timeout++ < MAX_TIMEOUT));
 
         /* If the SMBus is still busy, we give up */
-        if (timeout >= MAX_TIMEOUT) {
+        if (timeout > MAX_TIMEOUT) {
                 dev_err(&sch_adapter.dev, "SMBus Timeout!\n");
                 result = -ETIMEDOUT;
         }
diff --git a/drivers/i2c/busses/i2c-nforce2.c b/drivers/i2c/busses/i2c-nforce2.c
index 2ff4683703a8..ec11d1c4e77b 100644
--- a/drivers/i2c/busses/i2c-nforce2.c
+++ b/drivers/i2c/busses/i2c-nforce2.c
@@ -173,7 +173,7 @@ static int nforce2_check_status(struct i2c_adapter *adap)
                 temp = inb_p(NVIDIA_SMB_STS);
         } while ((!temp) && (timeout++ < MAX_TIMEOUT));
 
-        if (timeout >= MAX_TIMEOUT) {
+        if (timeout > MAX_TIMEOUT) {
                 dev_dbg(&adap->dev, "SMBus Timeout!\n");
                 if (smbus->can_abort)
                         nforce2_abort(adap);
diff --git a/drivers/i2c/busses/i2c-sis5595.c b/drivers/i2c/busses/i2c-sis5595.c
index f320ab27da46..139f0c7f12a4 100644
--- a/drivers/i2c/busses/i2c-sis5595.c
+++ b/drivers/i2c/busses/i2c-sis5595.c
@@ -256,7 +256,7 @@ static int sis5595_transaction(struct i2c_adapter *adap)
         } while (!(temp & 0x40) && (timeout++ < MAX_TIMEOUT));
 
         /* If the SMBus is still busy, we give up */
-        if (timeout >= MAX_TIMEOUT) {
+        if (timeout > MAX_TIMEOUT) {
                 dev_dbg(&adap->dev, "SMBus Timeout!\n");
                 result = -ETIMEDOUT;
         }
diff --git a/drivers/i2c/busses/i2c-sis630.c b/drivers/i2c/busses/i2c-sis630.c
index 50c3610e6028..70ca41e90e58 100644
--- a/drivers/i2c/busses/i2c-sis630.c
+++ b/drivers/i2c/busses/i2c-sis630.c
@@ -173,7 +173,7 @@ static int sis630_transaction_wait(struct i2c_adapter *adap, int size)
         } while (!(temp & 0x0e) && (timeout++ < MAX_TIMEOUT));
 
         /* If the SMBus is still busy, we give up */
-        if (timeout >= MAX_TIMEOUT) {
+        if (timeout > MAX_TIMEOUT) {
                 dev_dbg(&adap->dev, "SMBus Timeout!\n");
                 result = -ETIMEDOUT;
         }
diff --git a/drivers/i2c/busses/i2c-sis96x.c b/drivers/i2c/busses/i2c-sis96x.c
index 7e1594b40579..8295885b2fdb 100644
--- a/drivers/i2c/busses/i2c-sis96x.c
+++ b/drivers/i2c/busses/i2c-sis96x.c
@@ -132,7 +132,7 @@ static int sis96x_transaction(int size)
         } while (!(temp & 0x0e) && (timeout++ < MAX_TIMEOUT));
 
         /* If the SMBus is still busy, we give up */
-        if (timeout >= MAX_TIMEOUT) {
+        if (timeout > MAX_TIMEOUT) {
                 dev_dbg(&sis96x_adapter.dev, "SMBus Timeout! (0x%02x)\n", temp);
                 result = -ETIMEDOUT;
         }
diff --git a/drivers/misc/isl29003.c b/drivers/misc/isl29003.c
index 2e2a5923d4c2..a71e245801ee 100644
--- a/drivers/misc/isl29003.c
+++ b/drivers/misc/isl29003.c
@@ -64,6 +64,7 @@ struct isl29003_data {
         struct i2c_client *client;
         struct mutex lock;
         u8 reg_cache[ISL29003_NUM_CACHABLE_REGS];
+        u8 power_state_before_suspend;
 };
 
 static int gain_range[] = {
@@ -411,6 +412,9 @@ static int __devexit isl29003_remove(struct i2c_client *client)
 #ifdef CONFIG_PM
 static int isl29003_suspend(struct i2c_client *client, pm_message_t mesg)
 {
+        struct isl29003_data *data = i2c_get_clientdata(client);
+
+        data->power_state_before_suspend = isl29003_get_power_state(client);
         return isl29003_set_power_state(client, 0);
 }
 
@@ -421,10 +425,11 @@ static int isl29003_resume(struct i2c_client *client)
 
         /* restore registers from cache */
         for (i = 0; i < ARRAY_SIZE(data->reg_cache); i++)
-                if (!i2c_smbus_write_byte_data(client, i, data->reg_cache[i]))
+                if (i2c_smbus_write_byte_data(client, i, data->reg_cache[i]))
                         return -EIO;
 
-        return 0;
+        return isl29003_set_power_state(client,
+                data->power_state_before_suspend);
 }
 
 #else
diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
index fe8041e619ea..b25e9b6516ae 100644
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -254,6 +254,14 @@ static int mmc_blk_issue_rq(struct mmc_queue *mq, struct request *req)
                 brq.data.blocks = req->nr_sectors;
 
                 /*
+                 * The block layer doesn't support all sector count
+                 * restrictions, so we need to be prepared for too big
+                 * requests.
+                 */
+                if (brq.data.blocks > card->host->max_blk_count)
+                        brq.data.blocks = card->host->max_blk_count;
+
+                /*
                  * After a read error, we redo the request one sector at a time
                  * in order to accurately determine which sectors can be read
                  * successfully.
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index fa073ab3fa34..264911732756 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -706,7 +706,7 @@ static void mmc_power_up(struct mmc_host *host)
          * This delay should be sufficient to allow the power supply
          * to reach the minimum voltage.
          */
-        mmc_delay(2);
+        mmc_delay(10);
 
         host->ios.clock = host->f_min;
         host->ios.power_mode = MMC_POWER_ON;
@@ -716,7 +716,7 @@ static void mmc_power_up(struct mmc_host *host)
          * This delay must be at least 74 clock sizes, or 1 ms, or the
          * time required to reach a stable voltage.
          */
-        mmc_delay(2);
+        mmc_delay(10);
 }
 
 static void mmc_power_off(struct mmc_host *host)
diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
index a663429b3d55..36875dcfa492 100644
--- a/drivers/mmc/host/mmci.c
+++ b/drivers/mmc/host/mmci.c
@@ -514,6 +514,7 @@ static int __devinit mmci_probe(struct amba_device *dev, void *id)
         }
 
         host = mmc_priv(mmc);
+        host->mmc = mmc;
         /* Bits 12 thru 19 is the designer */
         host->hw_designer = (dev->periphid >> 12) & 0xff;
         /* Bits 20 thru 23 is the revison */
@@ -545,7 +546,6 @@ static int __devinit mmci_probe(struct amba_device *dev, void *id)
                 host->mclk = clk_get_rate(host->clk);
                 DBG(host, "eventual mclk rate: %u Hz\n", host->mclk);
         }
-        host->mmc = mmc;
         host->base = ioremap(dev->res.start, SZ_4K);
         if (!host->base) {
                 ret = -ENOMEM;
diff --git a/drivers/mmc/host/mvsdio.c b/drivers/mmc/host/mvsdio.c
index b5c375d94ab3..c643d0fe118f 100644
--- a/drivers/mmc/host/mvsdio.c
+++ b/drivers/mmc/host/mvsdio.c
@@ -825,24 +825,23 @@ static int __exit mvsd_remove(struct platform_device *pdev)
 }
 
 #ifdef CONFIG_PM
-static int mvsd_suspend(struct platform_device *dev, pm_message_t state,
-                           u32 level)
+static int mvsd_suspend(struct platform_device *dev, pm_message_t state)
 {
         struct mmc_host *mmc = platform_get_drvdata(dev);
         int ret = 0;
 
-        if (mmc && level == SUSPEND_DISABLE)
+        if (mmc)
                 ret = mmc_suspend_host(mmc, state);
 
         return ret;
 }
 
-static int mvsd_resume(struct platform_device *dev, u32 level)
+static int mvsd_resume(struct platform_device *dev)
 {
-        struct mmc_host *mmc = platform_dev_get_drvdata(dev);
+        struct mmc_host *mmc = platform_get_drvdata(dev);
         int ret = 0;
 
-        if (mmc && level == RESUME_ENABLE)
+        if (mmc)
                 ret = mmc_resume_host(mmc);
 
         return ret;
diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
index cd37962ec44f..65be27995d5c 100644
--- a/drivers/mmc/host/sdhci-pci.c
+++ b/drivers/mmc/host/sdhci-pci.c
@@ -522,8 +522,8 @@ static struct sdhci_pci_slot * __devinit sdhci_pci_probe_slot(
 
         host = sdhci_alloc_host(&pdev->dev, sizeof(struct sdhci_pci_slot));
         if (IS_ERR(host)) {
-                ret = PTR_ERR(host);
-                goto unmap;
+                dev_err(&pdev->dev, "cannot allocate host\n");
+                return ERR_PTR(PTR_ERR(host));
         }
 
         slot = sdhci_priv(host);
@@ -541,7 +541,7 @@ static struct sdhci_pci_slot * __devinit sdhci_pci_probe_slot(
         ret = pci_request_region(pdev, bar, mmc_hostname(host->mmc));
         if (ret) {
                 dev_err(&pdev->dev, "cannot request region\n");
-                return ERR_PTR(ret);
+                goto free;
         }
 
         addr = pci_resource_start(pdev, bar);
@@ -572,6 +572,8 @@ unmap:
 
 release:
         pci_release_region(pdev, bar);
+
+free:
         sdhci_free_host(host);
 
         return ERR_PTR(ret);
diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
index f20a834f4309..65c6f996bbd3 100644
--- a/drivers/mmc/host/sdhci.h
+++ b/drivers/mmc/host/sdhci.h
@@ -125,7 +125,7 @@
 #define  SDHCI_INT_DATA_MASK    (SDHCI_INT_DATA_END | SDHCI_INT_DMA_END | \
                 SDHCI_INT_DATA_AVAIL | SDHCI_INT_SPACE_AVAIL | \
                 SDHCI_INT_DATA_TIMEOUT | SDHCI_INT_DATA_CRC | \
-                SDHCI_INT_DATA_END_BIT)
+                SDHCI_INT_DATA_END_BIT | SDHCI_ADMA_ERROR)
 #define SDHCI_INT_ALL_MASK      ((unsigned int)-1)
 
 #define SDHCI_ACMD12_ERR        0x3C
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index 553a89919778..46d312bedfb8 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -1706,10 +1706,8 @@ void bond_alb_handle_active_change(struct bonding *bond, struct slave *new_slave
  * Called with RTNL
  */
 int bond_alb_set_mac_address(struct net_device *bond_dev, void *addr)
-        __releases(&bond->curr_slave_lock)
-        __releases(&bond->lock)
         __acquires(&bond->lock)
-        __acquires(&bond->curr_slave_lock)
+        __releases(&bond->lock)
 {
         struct bonding *bond = netdev_priv(bond_dev);
         struct sockaddr *sa = addr;
@@ -1745,9 +1743,6 @@ int bond_alb_set_mac_address(struct net_device *bond_dev, void *addr)
                 }
         }
 
-        write_unlock_bh(&bond->curr_slave_lock);
-        read_unlock(&bond->lock);
-
         if (swap_slave) {
                 alb_swap_mac_addr(bond, swap_slave, bond->curr_active_slave);
                 alb_fasten_mac_swap(bond, swap_slave, bond->curr_active_slave);
@@ -1755,16 +1750,15 @@ int bond_alb_set_mac_address(struct net_device *bond_dev, void *addr)
                 alb_set_slave_mac_addr(bond->curr_active_slave, bond_dev->dev_addr,
                                        bond->alb_info.rlb_enabled);
 
+                read_lock(&bond->lock);
                 alb_send_learning_packets(bond->curr_active_slave, bond_dev->dev_addr);
                 if (bond->alb_info.rlb_enabled) {
                         /* inform clients mac address has changed */
                         rlb_req_update_slave_clients(bond, bond->curr_active_slave);
                 }
+                read_unlock(&bond->lock);
         }
 
-        read_lock(&bond->lock);
-        write_lock_bh(&bond->curr_slave_lock);
-
         return 0;
 }
 
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 63369b6b14d4..2188a96fc090 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2213,33 +2213,24 @@ static int bond_slave_info_query(struct net_device *bond_dev, struct ifslave *in
 {
         struct bonding *bond = netdev_priv(bond_dev);
         struct slave *slave;
-        int i, found = 0;
-
-        if (info->slave_id < 0) {
-                return -ENODEV;
-        }
+        int i, res = -ENODEV;
 
         read_lock(&bond->lock);
 
         bond_for_each_slave(bond, slave, i) {
                 if (i == (int)info->slave_id) {
-                        found = 1;
+                        res = 0;
+                        strcpy(info->slave_name, slave->dev->name);
+                        info->link = slave->link;
+                        info->state = slave->state;
+                        info->link_failure_count = slave->link_failure_count;
                         break;
                 }
         }
 
         read_unlock(&bond->lock);
 
-        if (found) {
-                strcpy(info->slave_name, slave->dev->name);
-                info->link = slave->link;
-                info->state = slave->state;
-                info->link_failure_count = slave->link_failure_count;
-        } else {
-                return -ENODEV;
-        }
-
-        return 0;
+        return res;
 }
 
 /*-------------------------------- Monitoring -------------------------------*/
@@ -5167,16 +5158,15 @@ int bond_create(char *name, struct bond_params *params)
         up_write(&bonding_rwsem);
         rtnl_unlock(); /* allows sysfs registration of net device */
         res = bond_create_sysfs_entry(netdev_priv(bond_dev));
-        if (res < 0) {
-                rtnl_lock();
-                down_write(&bonding_rwsem);
-                bond_deinit(bond_dev);
-                unregister_netdevice(bond_dev);
-                goto out_rtnl;
-        }
+        if (res < 0)
+                goto out_unreg;
 
         return 0;
 
+out_unreg:
+        rtnl_lock();
+        down_write(&bonding_rwsem);
+        unregister_netdevice(bond_dev);
 out_bond:
         bond_deinit(bond_dev);
 out_netdev:
diff --git a/drivers/net/cxgb3/t3_hw.c b/drivers/net/cxgb3/t3_hw.c
index e1bd690ff831..4f68aeb2679a 100644
--- a/drivers/net/cxgb3/t3_hw.c
+++ b/drivers/net/cxgb3/t3_hw.c
@@ -3779,7 +3779,7 @@ int t3_prep_adapter(struct adapter *adapter, const struct adapter_info *ai,
 
         adapter->params.info = ai;
         adapter->params.nports = ai->nports0 + ai->nports1;
-        adapter->params.chan_map = !!ai->nports0 | (!!ai->nports1 << 1);
+        adapter->params.chan_map = (!!ai->nports0) | (!!ai->nports1 << 1);
         adapter->params.rev = t3_read_reg(adapter, A_PL_REV);
         /*
          * We used to only run the "adapter check task" once a second if
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 6a46ceed9436..b1419e21b46b 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -3738,7 +3738,7 @@ static irqreturn_t e1000_intr(int irq, void *data)
         struct e1000_hw *hw = &adapter->hw;
         u32 rctl, icr = er32(ICR);
 
-        if (unlikely((!icr) || test_bit(__E1000_RESETTING, &adapter->flags)))
+        if (unlikely((!icr) || test_bit(__E1000_DOWN, &adapter->flags)))
                 return IRQ_NONE;  /* Not our interrupt */
 
         /* IMS will not auto-mask if INT_ASSERTED is not set, and if it is
diff --git a/drivers/net/ehea/ehea.h b/drivers/net/ehea/ehea.h
index 6e317caf429c..16a41389575a 100644
--- a/drivers/net/ehea/ehea.h
+++ b/drivers/net/ehea/ehea.h
@@ -40,7 +40,7 @@
 #include <asm/io.h>
 
 #define DRV_NAME        "ehea"
-#define DRV_VERSION     "EHEA_0100"
+#define DRV_VERSION     "EHEA_0101"
 
 /* eHEA capability flags */
 #define DLPAR_PORT_ADD_REM 1
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index 604c844d0769..b22dab9153f6 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -545,14 +545,17 @@ static inline struct sk_buff *get_skb_by_index(struct sk_buff **skb_array,
         x &= (arr_len - 1);
 
         pref = skb_array[x];
-        prefetchw(pref);
-        prefetchw(pref + EHEA_CACHE_LINE);
-
-        pref = (skb_array[x]->data);
-        prefetch(pref);
-        prefetch(pref + EHEA_CACHE_LINE);
-        prefetch(pref + EHEA_CACHE_LINE * 2);
-        prefetch(pref + EHEA_CACHE_LINE * 3);
+        if (pref) {
+                prefetchw(pref);
+                prefetchw(pref + EHEA_CACHE_LINE);
+
+                pref = (skb_array[x]->data);
+                prefetch(pref);
+                prefetch(pref + EHEA_CACHE_LINE);
+                prefetch(pref + EHEA_CACHE_LINE * 2);
+                prefetch(pref + EHEA_CACHE_LINE * 3);
+        }
+
         skb = skb_array[skb_index];
         skb_array[skb_index] = NULL;
         return skb;
@@ -569,12 +572,14 @@ static inline struct sk_buff *get_skb_by_index_ll(struct sk_buff **skb_array,
         x &= (arr_len - 1);
 
         pref = skb_array[x];
-        prefetchw(pref);
-        prefetchw(pref + EHEA_CACHE_LINE);
+        if (pref) {
+                prefetchw(pref);
+                prefetchw(pref + EHEA_CACHE_LINE);
 
-        pref = (skb_array[x]->data);
-        prefetchw(pref);
-        prefetchw(pref + EHEA_CACHE_LINE);
+                pref = (skb_array[x]->data);
+                prefetchw(pref);
+                prefetchw(pref + EHEA_CACHE_LINE);
+        }
 
         skb = skb_array[wqe_index];
         skb_array[wqe_index] = NULL;
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index b3185bf2c158..a400d7115f78 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -393,12 +393,12 @@ struct mv643xx_eth_private {
         struct work_struct tx_timeout_task;
 
         struct napi_struct napi;
+        u8 oom;
         u8 work_link;
         u8 work_tx;
         u8 work_tx_end;
         u8 work_rx;
         u8 work_rx_refill;
-        u8 work_rx_oom;
 
         int skb_size;
         struct sk_buff_head rx_recycle;
@@ -661,7 +661,7 @@ static int rxq_refill(struct rx_queue *rxq, int budget)
                                             dma_get_cache_alignment() - 1);
 
                 if (skb == NULL) {
-                        mp->work_rx_oom |= 1 << rxq->index;
+                        mp->oom = 1;
                         goto oom;
                 }
 
@@ -1255,7 +1255,6 @@ static void mib_counters_update(struct mv643xx_eth_private *mp)
 
         spin_lock_bh(&mp->mib_counters_lock);
         p->good_octets_received += mib_read(mp, 0x00);
-        p->good_octets_received += (u64)mib_read(mp, 0x04) << 32;
         p->bad_octets_received += mib_read(mp, 0x08);
         p->internal_mac_transmit_err += mib_read(mp, 0x0c);
         p->good_frames_received += mib_read(mp, 0x10);
@@ -1269,7 +1268,6 @@ static void mib_counters_update(struct mv643xx_eth_private *mp)
         p->frames_512_to_1023_octets += mib_read(mp, 0x30);
         p->frames_1024_to_max_octets += mib_read(mp, 0x34);
         p->good_octets_sent += mib_read(mp, 0x38);
-        p->good_octets_sent += (u64)mib_read(mp, 0x3c) << 32;
         p->good_frames_sent += mib_read(mp, 0x40);
         p->excessive_collision += mib_read(mp, 0x44);
         p->multicast_frames_sent += mib_read(mp, 0x48);
@@ -2167,8 +2165,10 @@ static int mv643xx_eth_poll(struct napi_struct *napi, int budget)
 
         mp = container_of(napi, struct mv643xx_eth_private, napi);
 
-        mp->work_rx_refill |= mp->work_rx_oom;
-        mp->work_rx_oom = 0;
+        if (unlikely(mp->oom)) {
+                mp->oom = 0;
+                del_timer(&mp->rx_oom);
+        }
 
         work_done = 0;
         while (work_done < budget) {
@@ -2182,8 +2182,10 @@ static int mv643xx_eth_poll(struct napi_struct *napi, int budget)
                         continue;
                 }
 
-                queue_mask = mp->work_tx | mp->work_tx_end |
-                                mp->work_rx | mp->work_rx_refill;
+                queue_mask = mp->work_tx | mp->work_tx_end | mp->work_rx;
+                if (likely(!mp->oom))
+                        queue_mask |= mp->work_rx_refill;
+
                 if (!queue_mask) {
                         if (mv643xx_eth_collect_events(mp))
                                 continue;
@@ -2204,7 +2206,7 @@ static int mv643xx_eth_poll(struct napi_struct *napi, int budget)
                         txq_maybe_wake(mp->txq + queue);
                 } else if (mp->work_rx & queue_mask) {
                         work_done += rxq_process(mp->rxq + queue, work_tbd);
-                } else if (mp->work_rx_refill & queue_mask) {
+                } else if (!mp->oom && (mp->work_rx_refill & queue_mask)) {
                         work_done += rxq_refill(mp->rxq + queue, work_tbd);
                 } else {
                         BUG();
@@ -2212,7 +2214,7 @@ static int mv643xx_eth_poll(struct napi_struct *napi, int budget)
         }
 
         if (work_done < budget) {
-                if (mp->work_rx_oom)
+                if (mp->oom)
                         mod_timer(&mp->rx_oom, jiffies + (HZ / 10));
                 napi_complete(napi);
                 wrlp(mp, INT_MASK, INT_TX_END | INT_RX | INT_EXT);
@@ -2372,7 +2374,7 @@ static int mv643xx_eth_open(struct net_device *dev)
                 rxq_refill(mp->rxq + i, INT_MAX);
         }
 
-        if (mp->work_rx_oom) {
+        if (mp->oom) {
                 mp->rx_oom.expires = jiffies + (HZ / 10);
                 add_timer(&mp->rx_oom);
         }
diff --git a/drivers/net/ne2k-pci.c b/drivers/net/ne2k-pci.c
index eb66f658f9d1..7d83896b8c26 100644
--- a/drivers/net/ne2k-pci.c
+++ b/drivers/net/ne2k-pci.c
@@ -374,18 +374,17 @@ static int __devinit ne2k_pci_init_one (struct pci_dev *pdev,
         dev->ethtool_ops = &ne2k_pci_ethtool_ops;
         NS8390_init(dev, 0);
 
+        memcpy(dev->dev_addr, SA_prom, 6);
+        memcpy(dev->perm_addr, dev->dev_addr, dev->addr_len);
+
         i = register_netdev(dev);
         if (i)
                 goto err_out_free_netdev;
 
-        for(i = 0; i < 6; i++)
-                dev->dev_addr[i] = SA_prom[i];
         printk("%s: %s found at %#lx, IRQ %d, %pM.\n",
                dev->name, pci_clone_list[chip_idx].name, ioaddr, dev->irq,
                dev->dev_addr);
 
-        memcpy(dev->perm_addr, dev->dev_addr, dev->addr_len);
-
         return 0;
 
 err_out_free_netdev:
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index eceadf787a67..bf4af5248cb7 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -664,7 +664,7 @@ static int netconsole_netdev_event(struct notifier_block *this,
         struct netconsole_target *nt;
         struct net_device *dev = ptr;
 
-        if (!(event == NETDEV_CHANGENAME))
+        if (!(event == NETDEV_CHANGENAME || event == NETDEV_UNREGISTER))
                 goto done;
 
         spin_lock_irqsave(&target_list_lock, flags);
@@ -675,6 +675,15 @@ static int netconsole_netdev_event(struct notifier_block *this,
                         case NETDEV_CHANGENAME:
                                 strlcpy(nt->np.dev_name, dev->name, IFNAMSIZ);
                                 break;
+                        case NETDEV_UNREGISTER:
+                                if (!nt->enabled)
+                                        break;
+                                netpoll_cleanup(&nt->np);
+                                nt->enabled = 0;
+                                printk(KERN_INFO "netconsole: network logging stopped"
+                                        ", interface %s unregistered\n",
+                                        dev->name);
+                                break;
                         }
                 }
                 netconsole_target_put(nt);
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 8ee21030e9ac..dfc6cf765fbd 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -180,6 +180,20 @@ config USB_NET_CDCETHER
           IEEE 802 "local assignment" bit is set in the address, a "usbX"
           name is used instead.
 
+config USB_NET_CDC_EEM
+        tristate "CDC EEM support"
+        depends on USB_USBNET && EXPERIMENTAL
+        help
+          This option supports devices conforming to the Communication Device
+          Class (CDC) Ethernet Emulation Model, a specification that's easy to
+          implement in device firmware.  The CDC EEM specifications are available
+          from <http://www.usb.org/>.
+
+          This driver creates an interface named "ethX", where X depends on
+          what other networking devices you have in use.  However, if the
+          IEEE 802 "local assignment" bit is set in the address, a "usbX"
+          name is used instead.
+
 config USB_NET_DM9601
         tristate "Davicom DM9601 based USB 1.1 10/100 ethernet devices"
         depends on USB_USBNET
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index 88a87eeb376a..c8aef62cf2b7 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -9,6 +9,7 @@ obj-$(CONFIG_USB_RTL8150)	+= rtl8150.o
 obj-$(CONFIG_USB_HSO)           += hso.o
 obj-$(CONFIG_USB_NET_AX8817X)   += asix.o
 obj-$(CONFIG_USB_NET_CDCETHER)  += cdc_ether.o
+obj-$(CONFIG_USB_NET_CDC_EEM)   += cdc_eem.o
 obj-$(CONFIG_USB_NET_DM9601)    += dm9601.o
 obj-$(CONFIG_USB_NET_SMSC95XX)  += smsc95xx.o
 obj-$(CONFIG_USB_NET_GL620A)    += gl620a.o
diff --git a/drivers/net/usb/cdc_eem.c b/drivers/net/usb/cdc_eem.c
new file mode 100644
index 000000000000..80e01778dd3b
--- /dev/null
+++ b/drivers/net/usb/cdc_eem.c
@@ -0,0 +1,381 @@
+/*
+ * USB CDC EEM network interface driver
+ * Copyright (C) 2009 Oberthur Technologies
+ * by Omar Laazimani, Olivier Condemine
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/ctype.h>
+#include <linux/ethtool.h>
+#include <linux/workqueue.h>
+#include <linux/mii.h>
+#include <linux/usb.h>
+#include <linux/crc32.h>
+#include <linux/usb/cdc.h>
+#include <linux/usb/usbnet.h>
+
+
+/*
+ * This driver is an implementation of the CDC "Ethernet Emulation
+ * Model" (EEM) specification, which encapsulates Ethernet frames
+ * for transport over USB using a simpler USB device model than the
+ * previous CDC "Ethernet Control Model" (ECM, or "CDC Ethernet").
+ *
+ * For details, see www.usb.org/developers/devclass_docs/CDC_EEM10.pdf
+ *
+ * This version has been tested with GIGAntIC WuaoW SIM Smart Card on 2.6.24,
+ * 2.6.27 and 2.6.30rc2 kernel.
+ * It has also been validated on Openmoko Om 2008.12 (based on 2.6.24 kernel).
+ * build on 23-April-2009
+ */
+
+#define EEM_HEAD        2               /* 2 byte header */
+
+/*-------------------------------------------------------------------------*/
+
+static void eem_linkcmd_complete(struct urb *urb)
+{
+        dev_kfree_skb(urb->context);
+        usb_free_urb(urb);
+}
+
+static void eem_linkcmd(struct usbnet *dev, struct sk_buff *skb)
+{
+        struct urb              *urb;
+        int                     status;
+
+        urb = usb_alloc_urb(0, GFP_ATOMIC);
+        if (!urb)
+                goto fail;
+
+        usb_fill_bulk_urb(urb, dev->udev, dev->out,
+                        skb->data, skb->len, eem_linkcmd_complete, skb);
+
+        status = usb_submit_urb(urb, GFP_ATOMIC);
+        if (status) {
+                usb_free_urb(urb);
+fail:
+                dev_kfree_skb(skb);
+                devwarn(dev, "link cmd failure\n");
+                return;
+        }
+}
+
+static int eem_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        int status = 0;
+
+        status = usbnet_get_endpoints(dev, intf);
+        if (status < 0) {
+                usb_set_intfdata(intf, NULL);
+                usb_driver_release_interface(driver_of(intf), intf);
+                return status;
+        }
+
+        /* no jumbogram (16K) support for now */
+
+        dev->net->hard_header_len += EEM_HEAD + ETH_FCS_LEN;
+
+        return 0;
+}
+
+/*
+ * EEM permits packing multiple Ethernet frames into USB transfers
+ * (a "bundle"), but for TX we don't try to do that.
+ */
+static struct sk_buff *eem_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
+                                       gfp_t flags)
+{
+        struct sk_buff  *skb2 = NULL;
+        u16             len = skb->len;
+        u32             crc = 0;
+        int             padlen = 0;
+
+        /* When ((len + EEM_HEAD + ETH_FCS_LEN) % dev->maxpacket) is
+         * zero, stick two bytes of zero length EEM packet on the end.
+         * Else the framework would add invalid single byte padding,
+         * since it can't know whether ZLPs will be handled right by
+         * all the relevant hardware and software.
+         */
+        if (!((len + EEM_HEAD + ETH_FCS_LEN) % dev->maxpacket))
+                padlen += 2;
+
+        if (!skb_cloned(skb)) {
+                int     headroom = skb_headroom(skb);
+                int     tailroom = skb_tailroom(skb);
+
+                if ((tailroom >= ETH_FCS_LEN + padlen)
+                                && (headroom >= EEM_HEAD))
+                        goto done;
+
+                if ((headroom + tailroom)
+                                > (EEM_HEAD + ETH_FCS_LEN + padlen)) {
+                        skb->data = memmove(skb->head +
+                                        EEM_HEAD,
+                                        skb->data,
+                                        skb->len);
+                        skb_set_tail_pointer(skb, len);
+                        goto done;
+                }
+        }
+
+        skb2 = skb_copy_expand(skb, EEM_HEAD, ETH_FCS_LEN + padlen, flags);
+        if (!skb2)
+                return NULL;
+
+        dev_kfree_skb_any(skb);
+        skb = skb2;
+
+done:
+        /* we don't use the "no Ethernet CRC" option */
+        crc = crc32_le(~0, skb->data, skb->len);
+        crc = ~crc;
+
+        put_unaligned_le32(crc, skb_put(skb, 4));
+
+        /* EEM packet header format:
+         * b0..13:      length of ethernet frame
+         * b14:         bmCRC (1 == valid Ethernet CRC)
+         * b15:         bmType (0 == data)
+         */
+        len = skb->len;
+        put_unaligned_le16(BIT(14) | len, skb_push(skb, 2));
+
+        /* Bundle a zero length EEM packet if needed */
+        if (padlen)
+                put_unaligned_le16(0, skb_put(skb, 2));
+
+        return skb;
+}
+
+static int eem_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+{
+        /*
+         * Our task here is to strip off framing, leaving skb with one
+         * data frame for the usbnet framework code to process.  But we
+         * may have received multiple EEM payloads, or command payloads.
+         * So we must process _everything_ as if it's a header, except
+         * maybe the last data payload
+         *
+         * REVISIT the framework needs updating so that when we consume
+         * all payloads (the last or only message was a command, or a
+         * zero length EEM packet) that is not accounted as an rx_error.
+         */
+        do {
+                struct sk_buff  *skb2 = NULL;
+                u16             header;
+                u16             len = 0;
+
+                /* incomplete EEM header? */
+                if (skb->len < EEM_HEAD)
+                        return 0;
+
+                /*
+                 * EEM packet header format:
+                 * b0..14:      EEM type dependant (Data or Command)
+                 * b15:         bmType
+                 */
+                header = get_unaligned_le16(skb->data);
+                skb_pull(skb, EEM_HEAD);
+
+                /*
+                 * The bmType bit helps to denote when EEM
+                 * packet is data or command :
+                 *      bmType = 0      : EEM data payload
+                 *      bmType = 1      : EEM (link) command
+                 */
+                if (header & BIT(15)) {
+                        u16     bmEEMCmd;
+
+                        /*
+                         * EEM (link) command packet:
+                         * b0..10:      bmEEMCmdParam
+                         * b11..13:     bmEEMCmd
+                         * b14:         bmReserved (must be 0)
+                         * b15:         1 (EEM command)
+                         */
+                        if (header & BIT(14)) {
+                                devdbg(dev, "reserved command %04x\n", header);
+                                continue;
+                        }
+
+                        bmEEMCmd = (header >> 11) & 0x7;
+                        switch (bmEEMCmd) {
+
+                        /* Responding to echo requests is mandatory. */
+                        case 0:         /* Echo command */
+                                len = header & 0x7FF;
+
+                                /* bogus command? */
+                                if (skb->len < len)
+                                        return 0;
+
+                                skb2 = skb_clone(skb, GFP_ATOMIC);
+                                if (unlikely(!skb2))
+                                        goto next;
+                                skb_trim(skb2, len);
+                                put_unaligned_le16(BIT(15) | (1 << 11) | len,
+                                                skb_push(skb2, 2));
+                                eem_linkcmd(dev, skb2);
+                                break;
+
+                        /*
+                         * Host may choose to ignore hints.
+                         *  - suspend: peripheral ready to suspend
+                         *  - response: suggest N millisec polling
+                         *  - response complete: suggest N sec polling
+                         */
+                        case 2:         /* Suspend hint */
+                        case 3:         /* Response hint */
+                        case 4:         /* Response complete hint */
+                                continue;
+
+                        /*
+                         * Hosts should never receive host-to-peripheral
+                         * or reserved command codes; or responses to an
+                         * echo command we didn't send.
+                         */
+                        case 1:         /* Echo response */
+                        case 5:         /* Tickle */
+                        default:        /* reserved */
+                                devwarn(dev, "unexpected link command %d\n",
+                                                bmEEMCmd);
+                                continue;
+                        }
+
+                } else {
+                        u32     crc, crc2;
+                        int     is_last;
+
+                        /* zero length EEM packet? */
+                        if (header == 0)
+                                continue;
+
+                        /*
+                         * EEM data packet header :
+                         * b0..13:      length of ethernet frame
+                         * b14:         bmCRC
+                         * b15:         0 (EEM data)
+                         */
+                        len = header & 0x3FFF;
+
+                        /* bogus EEM payload? */
+                        if (skb->len < len)
+                                return 0;
+
+                        /* bogus ethernet frame? */
+                        if (len < (ETH_HLEN + ETH_FCS_LEN))
+                                goto next;
+
+                        /*
+                         * Treat the last payload differently: framework
+                         * code expects our "fixup" to have stripped off
+                         * headers, so "skb" is a data packet (or error).
+                         * Else if it's not the last payload, keep "skb"
+                         * for further processing.
+                         */
+                        is_last = (len == skb->len);
+                        if (is_last)
+                                skb2 = skb;
+                        else {
+                                skb2 = skb_clone(skb, GFP_ATOMIC);
+                                if (unlikely(!skb2))
+                                        return 0;
+                        }
+
+                        crc = get_unaligned_le32(skb2->data
+                                        + len - ETH_FCS_LEN);
+                        skb_trim(skb2, len - ETH_FCS_LEN);
+
+                        /*
+                         * The bmCRC helps to denote when the CRC field in
+                         * the Ethernet frame contains a calculated CRC:
+                         *      bmCRC = 1       : CRC is calculated
+                         *      bmCRC = 0       : CRC = 0xDEADBEEF
+                         */
+                        if (header & BIT(14))
+                                crc2 = ~crc32_le(~0, skb2->data, len);
+                        else
+                                crc2 = 0xdeadbeef;
+
+                        if (is_last)
+                                return crc == crc2;
+
+                        if (unlikely(crc != crc2)) {
+                                dev->stats.rx_errors++;
+                                dev_kfree_skb_any(skb2);
+                        } else
+                                usbnet_skb_return(dev, skb2);
+                }
+
+next:
+                skb_pull(skb, len);
+        } while (skb->len);
+
+        return 1;
+}
+
+static const struct driver_info eem_info = {
+        .description =  "CDC EEM Device",
+        .flags =        FLAG_ETHER,
+        .bind =         eem_bind,
+        .rx_fixup =     eem_rx_fixup,
+        .tx_fixup =     eem_tx_fixup,
+};
+
+/*-------------------------------------------------------------------------*/
+
+static const struct usb_device_id products[] = {
+{
+        USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_EEM,
+                        USB_CDC_PROTO_EEM),
+        .driver_info = (unsigned long) &eem_info,
+},
+{
+        /* EMPTY == end of list */
+},
+};
+MODULE_DEVICE_TABLE(usb, products);
+
+static struct usb_driver eem_driver = {
+        .name =         "cdc_eem",
+        .id_table =     products,
+        .probe =        usbnet_probe,
+        .disconnect =   usbnet_disconnect,
+        .suspend =      usbnet_suspend,
+        .resume =       usbnet_resume,
+};
+
+
+static int __init eem_init(void)
+{
+        return usb_register(&eem_driver);
+}
+module_init(eem_init);
+
+static void __exit eem_exit(void)
+{
+        usb_deregister(&eem_driver);
+}
+module_exit(eem_exit);
+
+MODULE_AUTHOR("Omar Laazimani <omar.oberthur@gmail.com>");
+MODULE_DESCRIPTION("USB CDC EEM");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index dc1665326592..5a7283372b53 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -941,6 +941,16 @@ static int smsc95xx_reset(struct usbnet *dev)
         if (netif_msg_ifup(dev))
                 devdbg(dev, "ID_REV = 0x%08x", read_buf);
 
+        /* Configure GPIO pins as LED outputs */
+        write_buf = LED_GPIO_CFG_SPD_LED | LED_GPIO_CFG_LNK_LED |
+                LED_GPIO_CFG_FDX_LED;
+        ret = smsc95xx_write_reg(dev, LED_GPIO_CFG, write_buf);
+        if (ret < 0) {
+                devwarn(dev, "Failed to write LED_GPIO_CFG register, ret=%d",
+                        ret);
+                return ret;
+        }
+
         /* Init Tx */
         write_buf = 0;
         ret = smsc95xx_write_reg(dev, FLOW, write_buf);
@@ -1231,6 +1241,11 @@ static const struct usb_device_id products[] = {
                 USB_DEVICE(0x0424, 0x9500),
                 .driver_info = (unsigned long) &smsc95xx_info,
         },
+        {
+                /* SMSC9512/9514 USB Hub & Ethernet Device */
+                USB_DEVICE(0x0424, 0xec00),
+                .driver_info = (unsigned long) &smsc95xx_info,
+        },
         { },            /* END */
 };
 MODULE_DEVICE_TABLE(usb, products);
diff --git a/drivers/net/usb/smsc95xx.h b/drivers/net/usb/smsc95xx.h
index 66b5c84f302e..86bc44977fbd 100644
--- a/drivers/net/usb/smsc95xx.h
+++ b/drivers/net/usb/smsc95xx.h
@@ -99,6 +99,9 @@
 #define PM_CTL_WUPS_MULTI_              (0x00000003)
 
 #define LED_GPIO_CFG                    (0x24)
+#define LED_GPIO_CFG_SPD_LED            (0x01000000)
+#define LED_GPIO_CFG_LNK_LED            (0x00100000)
+#define LED_GPIO_CFG_FDX_LED            (0x00010000)
 
 #define GPIO_CFG                        (0x28)
 
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 9c82a39497e5..4d1d47953fc6 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -616,10 +616,11 @@ static int virtnet_open(struct net_device *dev)
 static bool virtnet_send_command(struct virtnet_info *vi, u8 class, u8 cmd,
                                  struct scatterlist *data, int out, int in)
 {
-        struct scatterlist sg[VIRTNET_SEND_COMMAND_SG_MAX + 2];
+        struct scatterlist *s, sg[VIRTNET_SEND_COMMAND_SG_MAX + 2];
         struct virtio_net_ctrl_hdr ctrl;
         virtio_net_ctrl_ack status = ~0;
         unsigned int tmp;
+        int i;
 
         if (!virtio_has_feature(vi->vdev, VIRTIO_NET_F_CTRL_VQ)) {
                 BUG();  /* Caller should know better */
@@ -637,7 +638,8 @@ static bool virtnet_send_command(struct virtnet_info *vi, u8 class, u8 cmd,
         sg_init_table(sg, out + in);
 
         sg_set_buf(&sg[0], &ctrl, sizeof(ctrl));
-        memcpy(&sg[1], data, sizeof(struct scatterlist) * (out + in - 2));
+        for_each_sg(data, s, out + in - 2, i)
+                sg_set_buf(&sg[i + 1], sg_virt(s), s->length);
         sg_set_buf(&sg[out + in - 1], &status, sizeof(status));
 
         if (vi->cvq->vq_ops->add_buf(vi->cvq, sg, out, in, vi) != 0)
@@ -692,7 +694,7 @@ static void virtnet_set_rx_mode(struct net_device *dev)
         promisc = ((dev->flags & IFF_PROMISC) != 0);
         allmulti = ((dev->flags & IFF_ALLMULTI) != 0);
 
-        sg_set_buf(sg, &promisc, sizeof(promisc));
+        sg_init_one(sg, &promisc, sizeof(promisc));
 
         if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_RX,
                                   VIRTIO_NET_CTRL_RX_PROMISC,
@@ -700,7 +702,7 @@ static void virtnet_set_rx_mode(struct net_device *dev)
                 dev_warn(&dev->dev, "Failed to %sable promisc mode.\n",
                          promisc ? "en" : "dis");
 
-        sg_set_buf(sg, &allmulti, sizeof(allmulti));
+        sg_init_one(sg, &allmulti, sizeof(allmulti));
 
         if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_RX,
                                   VIRTIO_NET_CTRL_RX_ALLMULTI,
@@ -716,6 +718,8 @@ static void virtnet_set_rx_mode(struct net_device *dev)
                 return;
         }
 
+        sg_init_table(sg, 2);
+
         /* Store the unicast list and count in the front of the buffer */
         mac_data->entries = dev->uc_count;
         addr = dev->uc_list;
@@ -744,24 +748,24 @@ static void virtnet_set_rx_mode(struct net_device *dev)
         kfree(buf);
 }
 
-static void virnet_vlan_rx_add_vid(struct net_device *dev, u16 vid)
+static void virtnet_vlan_rx_add_vid(struct net_device *dev, u16 vid)
 {
         struct virtnet_info *vi = netdev_priv(dev);
         struct scatterlist sg;
 
-        sg_set_buf(&sg, &vid, sizeof(vid));
+        sg_init_one(&sg, &vid, sizeof(vid));
 
         if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_VLAN,
                                   VIRTIO_NET_CTRL_VLAN_ADD, &sg, 1, 0))
                 dev_warn(&dev->dev, "Failed to add VLAN ID %d.\n", vid);
 }
 
-static void virnet_vlan_rx_kill_vid(struct net_device *dev, u16 vid)
+static void virtnet_vlan_rx_kill_vid(struct net_device *dev, u16 vid)
 {
         struct virtnet_info *vi = netdev_priv(dev);
         struct scatterlist sg;
 
-        sg_set_buf(&sg, &vid, sizeof(vid));
+        sg_init_one(&sg, &vid, sizeof(vid));
 
         if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_VLAN,
                                   VIRTIO_NET_CTRL_VLAN_DEL, &sg, 1, 0))
@@ -794,8 +798,8 @@ static const struct net_device_ops virtnet_netdev = {
         .ndo_set_mac_address = virtnet_set_mac_address,
         .ndo_set_rx_mode     = virtnet_set_rx_mode,
         .ndo_change_mtu      = virtnet_change_mtu,
-        .ndo_vlan_rx_add_vid = virnet_vlan_rx_add_vid,
-        .ndo_vlan_rx_kill_vid = virnet_vlan_rx_kill_vid,
+        .ndo_vlan_rx_add_vid = virtnet_vlan_rx_add_vid,
+        .ndo_vlan_rx_kill_vid = virtnet_vlan_rx_kill_vid,
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller = virtnet_netpoll,
 #endif
diff --git a/drivers/net/wireless/ath5k/debug.c b/drivers/net/wireless/ath5k/debug.c
index 9770bb3d40f9..4904a07e4b59 100644
--- a/drivers/net/wireless/ath5k/debug.c
+++ b/drivers/net/wireless/ath5k/debug.c
@@ -424,7 +424,7 @@ ath5k_debug_dump_bands(struct ath5k_softc *sc)
 
         for (b = 0; b < IEEE80211_NUM_BANDS; b++) {
                 struct ieee80211_supported_band *band = &sc->sbands[b];
-                char bname[5];
+                char bname[6];
                 switch (band->band) {
                 case IEEE80211_BAND_2GHZ:
                         strcpy(bname, "2 GHz");
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index 23644cf884f1..e7c65c4f741b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -925,11 +925,11 @@ void iwl_bg_scan_completed(struct work_struct *work)
 
         IWL_DEBUG_SCAN(priv, "SCAN complete scan\n");
 
+        ieee80211_scan_completed(priv->hw, false);
+
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
 
-        ieee80211_scan_completed(priv->hw, false);
-
         /* Since setting the TXPOWER may have been deferred while
          * performing the scan, fire one off */
         mutex_lock(&priv->mutex);
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 617c4235d971..70a00c8ee42e 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -1694,7 +1694,6 @@ void iwl3945_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
         rxq->free_count = 0;
         spin_unlock_irqrestore(&rxq->lock, flags);
 }
-EXPORT_SYMBOL(iwl3945_rx_queue_reset);
 
 /*
  * this should be called while priv->lock is locked
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index db91db776508..bebf735cd4bd 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -2558,6 +2558,11 @@ static int rndis_wext_bind(struct usbnet *usbdev, struct usb_interface *intf)
         mutex_init(&priv->command_lock);
         spin_lock_init(&priv->stats_lock);
 
+        /* because rndis_command() sleeps we need to use workqueue */
+        priv->workqueue = create_singlethread_workqueue("rndis_wlan");
+        INIT_WORK(&priv->work, rndis_wext_worker);
+        INIT_DELAYED_WORK(&priv->stats_work, rndis_update_wireless_stats);
+
         /* try bind rndis_host */
         retval = generic_rndis_bind(usbdev, intf, FLAG_RNDIS_PHYM_WIRELESS);
         if (retval < 0)
@@ -2603,16 +2608,17 @@ static int rndis_wext_bind(struct usbnet *usbdev, struct usb_interface *intf)
         disassociate(usbdev, 1);
         netif_carrier_off(usbdev->net);
 
-        /* because rndis_command() sleeps we need to use workqueue */
-        priv->workqueue = create_singlethread_workqueue("rndis_wlan");
-        INIT_DELAYED_WORK(&priv->stats_work, rndis_update_wireless_stats);
         queue_delayed_work(priv->workqueue, &priv->stats_work,
                 round_jiffies_relative(STATS_UPDATE_JIFFIES));
-        INIT_WORK(&priv->work, rndis_wext_worker);
 
         return 0;
 
 fail:
+        cancel_delayed_work_sync(&priv->stats_work);
+        cancel_work_sync(&priv->work);
+        flush_workqueue(priv->workqueue);
+        destroy_workqueue(priv->workqueue);
+
         kfree(priv);
         return retval;
 }
diff --git a/drivers/serial/jsm/jsm.h b/drivers/serial/jsm/jsm.h
index 8871aaa3dba6..c0a3e2734e24 100644
--- a/drivers/serial/jsm/jsm.h
+++ b/drivers/serial/jsm/jsm.h
@@ -130,8 +130,6 @@ struct jsm_board
         struct pci_dev  *pci_dev;
         u32             maxports;       /* MAX ports this board can handle */
 
-        spinlock_t      bd_lock;        /* Used to protect board */
-
         spinlock_t      bd_intr_lock;   /* Used to protect the poller tasklet and
                                          * the interrupt routine from each other.
                                          */
diff --git a/drivers/serial/jsm/jsm_driver.c b/drivers/serial/jsm/jsm_driver.c
index d2d32a198629..b3604aa322a4 100644
--- a/drivers/serial/jsm/jsm_driver.c
+++ b/drivers/serial/jsm/jsm_driver.c
@@ -88,7 +88,6 @@ static int __devinit jsm_probe_one(struct pci_dev *pdev, const struct pci_device
         else
                 brd->maxports = 2;
 
-        spin_lock_init(&brd->bd_lock);
         spin_lock_init(&brd->bd_intr_lock);
 
         /* store which revision we have */
diff --git a/drivers/video/Makefile b/drivers/video/Makefile
index 0dbd6c68d76b..d8d0be5151e3 100644
--- a/drivers/video/Makefile
+++ b/drivers/video/Makefile
@@ -56,7 +56,6 @@ obj-$(CONFIG_FB_CT65550)          += chipsfb.o
 obj-$(CONFIG_FB_IMSTT)            += imsttfb.o
 obj-$(CONFIG_FB_FM2)              += fm2fb.o
 obj-$(CONFIG_FB_VT8623)           += vt8623fb.o
-obj-$(CONFIG_FB_CYBLA)            += cyblafb.o
 obj-$(CONFIG_FB_TRIDENT)          += tridentfb.o
 obj-$(CONFIG_FB_LE80578)          += vermilion/
 obj-$(CONFIG_FB_S3)               += s3fb.o
diff --git a/drivers/video/cfbfillrect.c b/drivers/video/cfbfillrect.c
index 64b35766b2a2..ba9f58b2a5e8 100644
--- a/drivers/video/cfbfillrect.c
+++ b/drivers/video/cfbfillrect.c
@@ -9,10 +9,6 @@
  *
  * NOTES:
  *
- *  The code for depths like 24 that don't have integer number of pixels per
- *  long is broken and needs to be fixed. For now I turned these types of
- *  mode off.
- *
  *  Also need to add code to deal with cards endians that are different than
  *  the native cpu endians. I also need to deal with MSB position in the word.
  *
@@ -139,7 +135,7 @@ bitfill_unaligned(struct fb_info *p, unsigned long __iomem *dst, int dst_idx,
 
                 // Trailing bits
                 if (last)
-                        FB_WRITEL(comp(pat, FB_READL(dst), first), dst);
+                        FB_WRITEL(comp(pat, FB_READL(dst), last), dst);
         }
 }
 
@@ -281,7 +277,7 @@ bitfill_unaligned_rev(struct fb_info *p, unsigned long __iomem *dst,
 
 void cfb_fillrect(struct fb_info *p, const struct fb_fillrect *rect)
 {
-        unsigned long pat, fg;
+        unsigned long pat, pat2, fg;
         unsigned long width = rect->width, height = rect->height;
         int bits = BITS_PER_LONG, bytes = bits >> 3;
         u32 bpp = p->var.bits_per_pixel;
@@ -297,7 +293,7 @@ void cfb_fillrect(struct fb_info *p, const struct fb_fillrect *rect)
         else
                 fg = rect->color;
 
-        pat = pixel_to_pat( bpp, fg);
+        pat = pixel_to_pat(bpp, fg);
 
         dst = (unsigned long __iomem *)((unsigned long)p->screen_base & ~(bytes-1));
         dst_idx = ((unsigned long)p->screen_base & (bytes - 1))*8;
@@ -333,17 +329,16 @@ void cfb_fillrect(struct fb_info *p, const struct fb_fillrect *rect)
                         dst_idx += p->fix.line_length*8;
                 }
         } else {
-                int right;
-                int r;
-                int rot = (left-dst_idx) % bpp;
+                int right, r;
                 void (*fill_op)(struct fb_info *p, unsigned long __iomem *dst,
                                 int dst_idx, unsigned long pat, int left,
                                 int right, unsigned n, int bits) = NULL;
-
-                /* rotate pattern to correct start position */
-                pat = pat << rot | pat >> (bpp-rot);
-
-                right = bpp-left;
+#ifdef __LITTLE_ENDIAN
+                right = left;
+                left = bpp - right;
+#else
+                right = bpp - left;
+#endif
                 switch (rect->rop) {
                 case ROP_XOR:
                         fill_op = bitfill_unaligned_rev;
@@ -352,17 +347,18 @@ void cfb_fillrect(struct fb_info *p, const struct fb_fillrect *rect)
                         fill_op = bitfill_unaligned;
                         break;
                 default:
-                        printk( KERN_ERR "cfb_fillrect(): unknown rop, defaulting to ROP_COPY\n");
+                        printk(KERN_ERR "cfb_fillrect(): unknown rop, defaulting to ROP_COPY\n");
                         fill_op = bitfill_unaligned;
                         break;
                 }
                 while (height--) {
-                        dst += dst_idx >> (ffs(bits) - 1);
+                        dst += dst_idx / bits;
                         dst_idx &= (bits - 1);
-                        fill_op(p, dst, dst_idx, pat, left, right,
+                        r = dst_idx % bpp;
+                        /* rotate pattern to the correct start position */
+                        pat2 = le_long_to_cpu(rolx(cpu_to_le_long(pat), r, bpp));
+                        fill_op(p, dst, dst_idx, pat2, left, right,
                                 width*bpp, bits);
-                        r = (p->fix.line_length*8) % bpp;
-                        pat = pat << (bpp-r) | pat >> r;
                         dst_idx += p->fix.line_length*8;
                 }
         }
diff --git a/drivers/video/fb_draw.h b/drivers/video/fb_draw.h
index 1db622192bde..04c01faaf772 100644
--- a/drivers/video/fb_draw.h
+++ b/drivers/video/fb_draw.h
@@ -33,11 +33,11 @@ pixel_to_pat( u32 bpp, u32 pixel)
         case 8:
                 return 0x0101010101010101ul*pixel;
         case 12:
-                return 0x0001001001001001ul*pixel;
+                return 0x1001001001001001ul*pixel;
         case 16:
                 return 0x0001000100010001ul*pixel;
         case 24:
-                return 0x0000000001000001ul*pixel;
+                return 0x0001000001000001ul*pixel;
         case 32:
                 return 0x0000000100000001ul*pixel;
         default:
@@ -58,11 +58,11 @@ pixel_to_pat( u32 bpp, u32 pixel)
         case 8:
                 return 0x01010101ul*pixel;
         case 12:
-                return 0x00001001ul*pixel;
+                return 0x01001001ul*pixel;
         case 16:
                 return 0x00010001ul*pixel;
         case 24:
-                return 0x00000001ul*pixel;
+                return 0x01000001ul*pixel;
         case 32:
                 return 0x00000001ul*pixel;
         default:
@@ -167,4 +167,17 @@ static inline unsigned long fb_rev_pixels_in_long(unsigned long val,
 
 #endif  /* CONFIG_FB_CFB_REV_PIXELS_IN_BYTE */
 
+#define cpu_to_le_long _cpu_to_le_long(BITS_PER_LONG)
+#define _cpu_to_le_long(x) __cpu_to_le_long(x)
+#define __cpu_to_le_long(x) cpu_to_le##x
+
+#define le_long_to_cpu _le_long_to_cpu(BITS_PER_LONG)
+#define _le_long_to_cpu(x) __le_long_to_cpu(x)
+#define __le_long_to_cpu(x) le##x##_to_cpu
+
+static inline unsigned long rolx(unsigned long word, unsigned int shift, unsigned int x)
+{
+        return (word << shift) | (word >> (x - shift));
+}
+
 #endif /* FB_DRAW_H */
diff --git a/drivers/video/sysfillrect.c b/drivers/video/sysfillrect.c
index f94d6b6e29ee..33ee3d34f9d2 100644
--- a/drivers/video/sysfillrect.c
+++ b/drivers/video/sysfillrect.c
@@ -124,7 +124,7 @@ bitfill_unaligned(struct fb_info *p, unsigned long *dst, int dst_idx,
 
                 /* Trailing bits */
                 if (last)
-                        *dst = comp(pat, *dst, first);
+                        *dst = comp(pat, *dst, last);
         }
 }
 
@@ -242,7 +242,7 @@ bitfill_unaligned_rev(struct fb_info *p, unsigned long *dst, int dst_idx,
 
 void sys_fillrect(struct fb_info *p, const struct fb_fillrect *rect)
 {
-        unsigned long pat, fg;
+        unsigned long pat, pat2, fg;
         unsigned long width = rect->width, height = rect->height;
         int bits = BITS_PER_LONG, bytes = bits >> 3;
         u32 bpp = p->var.bits_per_pixel;
@@ -292,17 +292,16 @@ void sys_fillrect(struct fb_info *p, const struct fb_fillrect *rect)
                         dst_idx += p->fix.line_length*8;
                 }
         } else {
-                int right;
-                int r;
-                int rot = (left-dst_idx) % bpp;
+                int right, r;
                 void (*fill_op)(struct fb_info *p, unsigned long *dst,
                                 int dst_idx, unsigned long pat, int left,
                                 int right, unsigned n, int bits) = NULL;
-
-                /* rotate pattern to correct start position */
-                pat = pat << rot | pat >> (bpp-rot);
-
-                right = bpp-left;
+#ifdef __LITTLE_ENDIAN
+                right = left;
+                left = bpp - right;
+#else
+                right = bpp - left;
+#endif
                 switch (rect->rop) {
                 case ROP_XOR:
                         fill_op = bitfill_unaligned_rev;
@@ -311,18 +310,19 @@ void sys_fillrect(struct fb_info *p, const struct fb_fillrect *rect)
                         fill_op = bitfill_unaligned;
                         break;
                 default:
-                        printk(KERN_ERR "cfb_fillrect(): unknown rop, "
+                        printk(KERN_ERR "sys_fillrect(): unknown rop, "
                                 "defaulting to ROP_COPY\n");
                         fill_op = bitfill_unaligned;
                         break;
                 }
                 while (height--) {
-                        dst += dst_idx >> (ffs(bits) - 1);
+                        dst += dst_idx / bits;
                         dst_idx &= (bits - 1);
-                        fill_op(p, dst, dst_idx, pat, left, right,
+                        r = dst_idx % bpp;
+                        /* rotate pattern to the correct start position */
+                        pat2 = le_long_to_cpu(rolx(cpu_to_le_long(pat), r, bpp));
+                        fill_op(p, dst, dst_idx, pat2, left, right,
                                 width*bpp, bits);
-                        r = (p->fix.line_length*8) % bpp;
-                        pat = pat << (bpp-r) | pat >> r;
                         dst_idx += p->fix.line_length*8;
                 }
         }
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index efa4b363ce72..f5bbd9e83416 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -513,7 +513,8 @@ static ssize_t show_target(struct sys_device *dev, struct sysdev_attribute *attr
                               char *buf)
 {
         return sprintf(buf, "%llu\n",
-                       (u64)balloon_stats.target_pages << PAGE_SHIFT);
+                       (unsigned long long)balloon_stats.target_pages
+                       << PAGE_SHIFT);
 }
 
 static ssize_t store_target(struct sys_device *dev,