157 files changed, 4271 insertions, 1585 deletions

diff --git a/drivers/acpi/acpi_pad.c b/drivers/acpi/acpi_pad.c
index 6b115f6c4313..6afceb3d4034 100644
--- a/drivers/acpi/acpi_pad.c
+++ b/drivers/acpi/acpi_pad.c
@@ -30,18 +30,13 @@
 #include <linux/slab.h>
 #include <acpi/acpi_bus.h>
 #include <acpi/acpi_drivers.h>
+#include <asm/mwait.h>
 
 #define ACPI_PROCESSOR_AGGREGATOR_CLASS "acpi_pad"
 #define ACPI_PROCESSOR_AGGREGATOR_DEVICE_NAME "Processor Aggregator"
 #define ACPI_PROCESSOR_AGGREGATOR_NOTIFY 0x80
 static DEFINE_MUTEX(isolated_cpus_lock);
 
-#define MWAIT_SUBSTATE_MASK     (0xf)
-#define MWAIT_CSTATE_MASK       (0xf)
-#define MWAIT_SUBSTATE_SIZE     (4)
-#define CPUID_MWAIT_LEAF (5)
-#define CPUID5_ECX_EXTENSIONS_SUPPORTED (0x1)
-#define CPUID5_ECX_INTERRUPT_BREAK      (0x2)
 static unsigned long power_saving_mwait_eax;
 
 static unsigned char tsc_detected_unstable;
diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c
index f7619600270a..af308d03f492 100644
--- a/drivers/acpi/blacklist.c
+++ b/drivers/acpi/blacklist.c
@@ -204,6 +204,23 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = {
                 },
         },
         {
+        /*
+         * There have a NVIF method in MSI GX723 DSDT need call by Nvidia
+         * driver (e.g. nouveau) when user press brightness hotkey.
+         * Currently, nouveau driver didn't do the job and it causes there
+         * have a infinite while loop in DSDT when user press hotkey.
+         * We add MSI GX723's dmi information to this table for workaround
+         * this issue.
+         * Will remove MSI GX723 from the table after nouveau grows support.
+         */
+        .callback = dmi_disable_osi_vista,
+        .ident = "MSI GX723",
+        .matches = {
+                     DMI_MATCH(DMI_SYS_VENDOR, "Micro-Star International"),
+                     DMI_MATCH(DMI_PRODUCT_NAME, "GX723"),
+                },
+        },
+        {
         .callback = dmi_disable_osi_vista,
         .ident = "Sony VGN-NS10J_S",
         .matches = {
diff --git a/drivers/acpi/processor_core.c b/drivers/acpi/processor_core.c
index b618f888d66b..bec561c14beb 100644
--- a/drivers/acpi/processor_core.c
+++ b/drivers/acpi/processor_core.c
@@ -346,4 +346,5 @@ void __init acpi_early_processor_set_pdc(void)
         acpi_walk_namespace(ACPI_TYPE_PROCESSOR, ACPI_ROOT_OBJECT,
                             ACPI_UINT32_MAX,
                             early_init_pdc, NULL, NULL, NULL);
+        acpi_get_devices("ACPI0007", early_init_pdc, NULL, NULL);
 }
diff --git a/drivers/atm/iphase.c b/drivers/atm/iphase.c
index ee9ddeb53417..8cb0347dec28 100644
--- a/drivers/atm/iphase.c
+++ b/drivers/atm/iphase.c
@@ -3156,7 +3156,6 @@ static int __devinit ia_init_one(struct pci_dev *pdev,
 {  
         struct atm_dev *dev;  
         IADEV *iadev;  
-        unsigned long flags;
         int ret;
 
         iadev = kzalloc(sizeof(*iadev), GFP_KERNEL);
@@ -3188,19 +3187,14 @@ static int __devinit ia_init_one(struct pci_dev *pdev,
         ia_dev[iadev_count] = iadev;
         _ia_dev[iadev_count] = dev;
         iadev_count++;
-        spin_lock_init(&iadev->misc_lock);
-        /* First fixes first. I don't want to think about this now. */
-        spin_lock_irqsave(&iadev->misc_lock, flags); 
         if (ia_init(dev) || ia_start(dev)) {  
                 IF_INIT(printk("IA register failed!\n");)
                 iadev_count--;
                 ia_dev[iadev_count] = NULL;
                 _ia_dev[iadev_count] = NULL;
-                spin_unlock_irqrestore(&iadev->misc_lock, flags); 
                 ret = -EINVAL;
                 goto err_out_deregister_dev;
         }
-        spin_unlock_irqrestore(&iadev->misc_lock, flags); 
         IF_EVENT(printk("iadev_count = %d\n", iadev_count);)
 
         iadev->next_board = ia_boards;  
diff --git a/drivers/atm/iphase.h b/drivers/atm/iphase.h
index b2cd20f549cb..077735e0e04b 100644
--- a/drivers/atm/iphase.h
+++ b/drivers/atm/iphase.h
@@ -1022,7 +1022,7 @@ typedef struct iadev_t {
         struct dle_q rx_dle_q;  
         struct free_desc_q *rx_free_desc_qhead;  
         struct sk_buff_head rx_dma_q;  
-        spinlock_t rx_lock, misc_lock;
+        spinlock_t rx_lock;
         struct atm_vcc **rx_open;       /* list of all open VCs */  
         u16 num_rx_desc, rx_buf_sz, rxing;
         u32 rx_pkt_ram, rx_tmp_cnt;
diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
index f916ddf63938..f46138ab38b6 100644
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c
@@ -444,6 +444,7 @@ static ssize_t console_show(struct device *dev, struct device_attribute *attr,
         struct atm_dev *atmdev = container_of(dev, struct atm_dev, class_dev);
         struct solos_card *card = atmdev->dev_data;
         struct sk_buff *skb;
+        unsigned int len;
 
         spin_lock(&card->cli_queue_lock);
         skb = skb_dequeue(&card->cli_queue[SOLOS_CHAN(atmdev)]);
@@ -451,11 +452,12 @@ static ssize_t console_show(struct device *dev, struct device_attribute *attr,
         if(skb == NULL)
                 return sprintf(buf, "No data.\n");
 
-        memcpy(buf, skb->data, skb->len);
-        dev_dbg(&card->dev->dev, "len: %d\n", skb->len);
+        len = skb->len;
+        memcpy(buf, skb->data, len);
+        dev_dbg(&card->dev->dev, "len: %d\n", len);
 
         kfree_skb(skb);
-        return skb->len;
+        return len;
 }
 
 static int send_command(struct solos_card *card, int dev, const char *buf, size_t size)
diff --git a/drivers/base/topology.c b/drivers/base/topology.c
index 9fc630ce1ddb..f6f37a05a0c3 100644
--- a/drivers/base/topology.c
+++ b/drivers/base/topology.c
@@ -45,7 +45,8 @@ static ssize_t show_##name(struct sys_device *dev,		\
         return sprintf(buf, "%d\n", topology_##name(cpu));      \
 }
 
-#if defined(topology_thread_cpumask) || defined(topology_core_cpumask)
+#if defined(topology_thread_cpumask) || defined(topology_core_cpumask) || \
+    defined(topology_book_cpumask)
 static ssize_t show_cpumap(int type, const struct cpumask *mask, char *buf)
 {
         ptrdiff_t len = PTR_ALIGN(buf + PAGE_SIZE - 1, PAGE_SIZE) - buf;
@@ -114,6 +115,14 @@ define_siblings_show_func(core_cpumask);
 define_one_ro_named(core_siblings, show_core_cpumask);
 define_one_ro_named(core_siblings_list, show_core_cpumask_list);
 
+#ifdef CONFIG_SCHED_BOOK
+define_id_show_func(book_id);
+define_one_ro(book_id);
+define_siblings_show_func(book_cpumask);
+define_one_ro_named(book_siblings, show_book_cpumask);
+define_one_ro_named(book_siblings_list, show_book_cpumask_list);
+#endif
+
 static struct attribute *default_attrs[] = {
         &attr_physical_package_id.attr,
         &attr_core_id.attr,
@@ -121,6 +130,11 @@ static struct attribute *default_attrs[] = {
         &attr_thread_siblings_list.attr,
         &attr_core_siblings.attr,
         &attr_core_siblings_list.attr,
+#ifdef CONFIG_SCHED_BOOK
+        &attr_book_id.attr,
+        &attr_book_siblings.attr,
+        &attr_book_siblings_list.attr,
+#endif
         NULL
 };
 
diff --git a/drivers/block/Kconfig b/drivers/block/Kconfig
index de277689da61..4b9359a6f6ca 100644
--- a/drivers/block/Kconfig
+++ b/drivers/block/Kconfig
@@ -488,4 +488,21 @@ config BLK_DEV_HD
 
           If unsure, say N.
 
+config BLK_DEV_RBD
+        tristate "Rados block device (RBD)"
+        depends on INET && EXPERIMENTAL && BLOCK
+        select CEPH_LIB
+        select LIBCRC32C
+        select CRYPTO_AES
+        select CRYPTO
+        default n
+        help
+          Say Y here if you want include the Rados block device, which stripes
+          a block device over objects stored in the Ceph distributed object
+          store.
+
+          More information at http://ceph.newdream.net/.
+
+          If unsure, say N.
+
 endif # BLK_DEV
diff --git a/drivers/block/Makefile b/drivers/block/Makefile
index aff5ac925c34..d7f463d6312d 100644
--- a/drivers/block/Makefile
+++ b/drivers/block/Makefile
@@ -37,5 +37,6 @@ obj-$(CONFIG_BLK_DEV_HD)	+= hd.o
 
 obj-$(CONFIG_XEN_BLKDEV_FRONTEND)       += xen-blkfront.o
 obj-$(CONFIG_BLK_DEV_DRBD)     += drbd/
+obj-$(CONFIG_BLK_DEV_RBD)     += rbd.o
 
 swim_mod-objs   := swim.o swim_asm.o
diff --git a/drivers/block/ps3disk.c b/drivers/block/ps3disk.c
index e9da874d0419..03688c2da319 100644
--- a/drivers/block/ps3disk.c
+++ b/drivers/block/ps3disk.c
@@ -113,7 +113,7 @@ static void ps3disk_scatter_gather(struct ps3_storage_device *dev,
                         memcpy(buf, dev->bounce_buf+offset, size);
                 offset += size;
                 flush_kernel_dcache_page(bvec->bv_page);
-                bvec_kunmap_irq(bvec, &flags);
+                bvec_kunmap_irq(buf, &flags);
                 i++;
         }
 }
diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
new file mode 100644
index 000000000000..6ec9d53806c5
--- /dev/null
+++ b/drivers/block/rbd.c
@@ -0,0 +1,1841 @@
+/*
+   rbd.c -- Export ceph rados objects as a Linux block device
+
+
+   based on drivers/block/osdblk.c:
+
+   Copyright 2009 Red Hat, Inc.
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program; see the file COPYING.  If not, write to
+   the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
+
+
+
+   Instructions for use
+   --------------------
+
+   1) Map a Linux block device to an existing rbd image.
+
+      Usage: <mon ip addr> <options> <pool name> <rbd image name> [snap name]
+
+      $ echo "192.168.0.1 name=admin rbd foo" > /sys/class/rbd/add
+
+      The snapshot name can be "-" or omitted to map the image read/write.
+
+   2) List all active blkdev<->object mappings.
+
+      In this example, we have performed step #1 twice, creating two blkdevs,
+      mapped to two separate rados objects in the rados rbd pool
+
+      $ cat /sys/class/rbd/list
+      #id     major   client_name     pool    name    snap    KB
+      0       254     client4143      rbd     foo     -      1024000
+
+      The columns, in order, are:
+      - blkdev unique id
+      - blkdev assigned major
+      - rados client id
+      - rados pool name
+      - rados block device name
+      - mapped snapshot ("-" if none)
+      - device size in KB
+
+
+   3) Create a snapshot.
+
+      Usage: <blkdev id> <snapname>
+
+      $ echo "0 mysnap" > /sys/class/rbd/snap_create
+
+
+   4) Listing a snapshot.
+
+      $ cat /sys/class/rbd/snaps_list
+      #id     snap    KB
+      0       -       1024000 (*)
+      0       foo     1024000
+
+      The columns, in order, are:
+      - blkdev unique id
+      - snapshot name, '-' means none (active read/write version)
+      - size of device at time of snapshot
+      - the (*) indicates this is the active version
+
+   5) Rollback to snapshot.
+
+      Usage: <blkdev id> <snapname>
+
+      $ echo "0 mysnap" > /sys/class/rbd/snap_rollback
+
+
+   6) Mapping an image using snapshot.
+
+      A snapshot mapping is read-only. This is being done by passing
+      snap=<snapname> to the options when adding a device.
+
+      $ echo "192.168.0.1 name=admin,snap=mysnap rbd foo" > /sys/class/rbd/add
+
+
+   7) Remove an active blkdev<->rbd image mapping.
+
+      In this example, we remove the mapping with blkdev unique id 1.
+
+      $ echo 1 > /sys/class/rbd/remove
+
+
+   NOTE:  The actual creation and deletion of rados objects is outside the scope
+   of this driver.
+
+ */
+
+#include <linux/ceph/libceph.h>
+#include <linux/ceph/osd_client.h>
+#include <linux/ceph/mon_client.h>
+#include <linux/ceph/decode.h>
+
+#include <linux/kernel.h>
+#include <linux/device.h>
+#include <linux/module.h>
+#include <linux/fs.h>
+#include <linux/blkdev.h>
+
+#include "rbd_types.h"
+
+#define DRV_NAME "rbd"
+#define DRV_NAME_LONG "rbd (rados block device)"
+
+#define RBD_MINORS_PER_MAJOR    256             /* max minors per blkdev */
+
+#define RBD_MAX_MD_NAME_LEN     (96 + sizeof(RBD_SUFFIX))
+#define RBD_MAX_POOL_NAME_LEN   64
+#define RBD_MAX_SNAP_NAME_LEN   32
+#define RBD_MAX_OPT_LEN         1024
+
+#define RBD_SNAP_HEAD_NAME      "-"
+
+#define DEV_NAME_LEN            32
+
+/*
+ * block device image metadata (in-memory version)
+ */
+struct rbd_image_header {
+        u64 image_size;
+        char block_name[32];
+        __u8 obj_order;
+        __u8 crypt_type;
+        __u8 comp_type;
+        struct rw_semaphore snap_rwsem;
+        struct ceph_snap_context *snapc;
+        size_t snap_names_len;
+        u64 snap_seq;
+        u32 total_snaps;
+
+        char *snap_names;
+        u64 *snap_sizes;
+};
+
+/*
+ * an instance of the client.  multiple devices may share a client.
+ */
+struct rbd_client {
+        struct ceph_client      *client;
+        struct kref             kref;
+        struct list_head        node;
+};
+
+/*
+ * a single io request
+ */
+struct rbd_request {
+        struct request          *rq;            /* blk layer request */
+        struct bio              *bio;           /* cloned bio */
+        struct page             **pages;        /* list of used pages */
+        u64                     len;
+};
+
+/*
+ * a single device
+ */
+struct rbd_device {
+        int                     id;             /* blkdev unique id */
+
+        int                     major;          /* blkdev assigned major */
+        struct gendisk          *disk;          /* blkdev's gendisk and rq */
+        struct request_queue    *q;
+
+        struct ceph_client      *client;
+        struct rbd_client       *rbd_client;
+
+        char                    name[DEV_NAME_LEN]; /* blkdev name, e.g. rbd3 */
+
+        spinlock_t              lock;           /* queue lock */
+
+        struct rbd_image_header header;
+        char                    obj[RBD_MAX_OBJ_NAME_LEN]; /* rbd image name */
+        int                     obj_len;
+        char                    obj_md_name[RBD_MAX_MD_NAME_LEN]; /* hdr nm. */
+        char                    pool_name[RBD_MAX_POOL_NAME_LEN];
+        int                     poolid;
+
+        char                    snap_name[RBD_MAX_SNAP_NAME_LEN];
+        u32 cur_snap;   /* index+1 of current snapshot within snap context
+                           0 - for the head */
+        int read_only;
+
+        struct list_head        node;
+};
+
+static spinlock_t node_lock;      /* protects client get/put */
+
+static struct class *class_rbd;   /* /sys/class/rbd */
+static DEFINE_MUTEX(ctl_mutex);   /* Serialize open/close/setup/teardown */
+static LIST_HEAD(rbd_dev_list);    /* devices */
+static LIST_HEAD(rbd_client_list);      /* clients */
+
+
+static int rbd_open(struct block_device *bdev, fmode_t mode)
+{
+        struct gendisk *disk = bdev->bd_disk;
+        struct rbd_device *rbd_dev = disk->private_data;
+
+        set_device_ro(bdev, rbd_dev->read_only);
+
+        if ((mode & FMODE_WRITE) && rbd_dev->read_only)
+                return -EROFS;
+
+        return 0;
+}
+
+static const struct block_device_operations rbd_bd_ops = {
+        .owner                  = THIS_MODULE,
+        .open                   = rbd_open,
+};
+
+/*
+ * Initialize an rbd client instance.
+ * We own *opt.
+ */
+static struct rbd_client *rbd_client_create(struct ceph_options *opt)
+{
+        struct rbd_client *rbdc;
+        int ret = -ENOMEM;
+
+        dout("rbd_client_create\n");
+        rbdc = kmalloc(sizeof(struct rbd_client), GFP_KERNEL);
+        if (!rbdc)
+                goto out_opt;
+
+        kref_init(&rbdc->kref);
+        INIT_LIST_HEAD(&rbdc->node);
+
+        rbdc->client = ceph_create_client(opt, rbdc);
+        if (IS_ERR(rbdc->client))
+                goto out_rbdc;
+        opt = NULL; /* Now rbdc->client is responsible for opt */
+
+        ret = ceph_open_session(rbdc->client);
+        if (ret < 0)
+                goto out_err;
+
+        spin_lock(&node_lock);
+        list_add_tail(&rbdc->node, &rbd_client_list);
+        spin_unlock(&node_lock);
+
+        dout("rbd_client_create created %p\n", rbdc);
+        return rbdc;
+
+out_err:
+        ceph_destroy_client(rbdc->client);
+out_rbdc:
+        kfree(rbdc);
+out_opt:
+        if (opt)
+                ceph_destroy_options(opt);
+        return ERR_PTR(ret);
+}
+
+/*
+ * Find a ceph client with specific addr and configuration.
+ */
+static struct rbd_client *__rbd_client_find(struct ceph_options *opt)
+{
+        struct rbd_client *client_node;
+
+        if (opt->flags & CEPH_OPT_NOSHARE)
+                return NULL;
+
+        list_for_each_entry(client_node, &rbd_client_list, node)
+                if (ceph_compare_options(opt, client_node->client) == 0)
+                        return client_node;
+        return NULL;
+}
+
+/*
+ * Get a ceph client with specific addr and configuration, if one does
+ * not exist create it.
+ */
+static int rbd_get_client(struct rbd_device *rbd_dev, const char *mon_addr,
+                          char *options)
+{
+        struct rbd_client *rbdc;
+        struct ceph_options *opt;
+        int ret;
+
+        ret = ceph_parse_options(&opt, options, mon_addr,
+                                 mon_addr + strlen(mon_addr), NULL, NULL);
+        if (ret < 0)
+                return ret;
+
+        spin_lock(&node_lock);
+        rbdc = __rbd_client_find(opt);
+        if (rbdc) {
+                ceph_destroy_options(opt);
+
+                /* using an existing client */
+                kref_get(&rbdc->kref);
+                rbd_dev->rbd_client = rbdc;
+                rbd_dev->client = rbdc->client;
+                spin_unlock(&node_lock);
+                return 0;
+        }
+        spin_unlock(&node_lock);
+
+        rbdc = rbd_client_create(opt);
+        if (IS_ERR(rbdc))
+                return PTR_ERR(rbdc);
+
+        rbd_dev->rbd_client = rbdc;
+        rbd_dev->client = rbdc->client;
+        return 0;
+}
+
+/*
+ * Destroy ceph client
+ */
+static void rbd_client_release(struct kref *kref)
+{
+        struct rbd_client *rbdc = container_of(kref, struct rbd_client, kref);
+
+        dout("rbd_release_client %p\n", rbdc);
+        spin_lock(&node_lock);
+        list_del(&rbdc->node);
+        spin_unlock(&node_lock);
+
+        ceph_destroy_client(rbdc->client);
+        kfree(rbdc);
+}
+
+/*
+ * Drop reference to ceph client node. If it's not referenced anymore, release
+ * it.
+ */
+static void rbd_put_client(struct rbd_device *rbd_dev)
+{
+        kref_put(&rbd_dev->rbd_client->kref, rbd_client_release);
+        rbd_dev->rbd_client = NULL;
+        rbd_dev->client = NULL;
+}
+
+
+/*
+ * Create a new header structure, translate header format from the on-disk
+ * header.
+ */
+static int rbd_header_from_disk(struct rbd_image_header *header,
+                                 struct rbd_image_header_ondisk *ondisk,
+                                 int allocated_snaps,
+                                 gfp_t gfp_flags)
+{
+        int i;
+        u32 snap_count = le32_to_cpu(ondisk->snap_count);
+        int ret = -ENOMEM;
+
+        init_rwsem(&header->snap_rwsem);
+
+        header->snap_names_len = le64_to_cpu(ondisk->snap_names_len);
+        header->snapc = kmalloc(sizeof(struct ceph_snap_context) +
+                                snap_count *
+                                 sizeof(struct rbd_image_snap_ondisk),
+                                gfp_flags);
+        if (!header->snapc)
+                return -ENOMEM;
+        if (snap_count) {
+                header->snap_names = kmalloc(header->snap_names_len,
+                                             GFP_KERNEL);
+                if (!header->snap_names)
+                        goto err_snapc;
+                header->snap_sizes = kmalloc(snap_count * sizeof(u64),
+                                             GFP_KERNEL);
+                if (!header->snap_sizes)
+                        goto err_names;
+        } else {
+                header->snap_names = NULL;
+                header->snap_sizes = NULL;
+        }
+        memcpy(header->block_name, ondisk->block_name,
+               sizeof(ondisk->block_name));
+
+        header->image_size = le64_to_cpu(ondisk->image_size);
+        header->obj_order = ondisk->options.order;
+        header->crypt_type = ondisk->options.crypt_type;
+        header->comp_type = ondisk->options.comp_type;
+
+        atomic_set(&header->snapc->nref, 1);
+        header->snap_seq = le64_to_cpu(ondisk->snap_seq);
+        header->snapc->num_snaps = snap_count;
+        header->total_snaps = snap_count;
+
+        if (snap_count &&
+            allocated_snaps == snap_count) {
+                for (i = 0; i < snap_count; i++) {
+                        header->snapc->snaps[i] =
+                                le64_to_cpu(ondisk->snaps[i].id);
+                        header->snap_sizes[i] =
+                                le64_to_cpu(ondisk->snaps[i].image_size);
+                }
+
+                /* copy snapshot names */
+                memcpy(header->snap_names, &ondisk->snaps[i],
+                        header->snap_names_len);
+        }
+
+        return 0;
+
+err_names:
+        kfree(header->snap_names);
+err_snapc:
+        kfree(header->snapc);
+        return ret;
+}
+
+static int snap_index(struct rbd_image_header *header, int snap_num)
+{
+        return header->total_snaps - snap_num;
+}
+
+static u64 cur_snap_id(struct rbd_device *rbd_dev)
+{
+        struct rbd_image_header *header = &rbd_dev->header;
+
+        if (!rbd_dev->cur_snap)
+                return 0;
+
+        return header->snapc->snaps[snap_index(header, rbd_dev->cur_snap)];
+}
+
+static int snap_by_name(struct rbd_image_header *header, const char *snap_name,
+                        u64 *seq, u64 *size)
+{
+        int i;
+        char *p = header->snap_names;
+
+        for (i = 0; i < header->total_snaps; i++, p += strlen(p) + 1) {
+                if (strcmp(snap_name, p) == 0)
+                        break;
+        }
+        if (i == header->total_snaps)
+                return -ENOENT;
+        if (seq)
+                *seq = header->snapc->snaps[i];
+
+        if (size)
+                *size = header->snap_sizes[i];
+
+        return i;
+}
+
+static int rbd_header_set_snap(struct rbd_device *dev,
+                               const char *snap_name,
+                               u64 *size)
+{
+        struct rbd_image_header *header = &dev->header;
+        struct ceph_snap_context *snapc = header->snapc;
+        int ret = -ENOENT;
+
+        down_write(&header->snap_rwsem);
+
+        if (!snap_name ||
+            !*snap_name ||
+            strcmp(snap_name, "-") == 0 ||
+            strcmp(snap_name, RBD_SNAP_HEAD_NAME) == 0) {
+                if (header->total_snaps)
+                        snapc->seq = header->snap_seq;
+                else
+                        snapc->seq = 0;
+                dev->cur_snap = 0;
+                dev->read_only = 0;
+                if (size)
+                        *size = header->image_size;
+        } else {
+                ret = snap_by_name(header, snap_name, &snapc->seq, size);
+                if (ret < 0)
+                        goto done;
+
+                dev->cur_snap = header->total_snaps - ret;
+                dev->read_only = 1;
+        }
+
+        ret = 0;
+done:
+        up_write(&header->snap_rwsem);
+        return ret;
+}
+
+static void rbd_header_free(struct rbd_image_header *header)
+{
+        kfree(header->snapc);
+        kfree(header->snap_names);
+        kfree(header->snap_sizes);
+}
+
+/*
+ * get the actual striped segment name, offset and length
+ */
+static u64 rbd_get_segment(struct rbd_image_header *header,
+                           const char *block_name,
+                           u64 ofs, u64 len,
+                           char *seg_name, u64 *segofs)
+{
+        u64 seg = ofs >> header->obj_order;
+
+        if (seg_name)
+                snprintf(seg_name, RBD_MAX_SEG_NAME_LEN,
+                         "%s.%012llx", block_name, seg);
+
+        ofs = ofs & ((1 << header->obj_order) - 1);
+        len = min_t(u64, len, (1 << header->obj_order) - ofs);
+
+        if (segofs)
+                *segofs = ofs;
+
+        return len;
+}
+
+/*
+ * bio helpers
+ */
+
+static void bio_chain_put(struct bio *chain)
+{
+        struct bio *tmp;
+
+        while (chain) {
+                tmp = chain;
+                chain = chain->bi_next;
+                bio_put(tmp);
+        }
+}
+
+/*
+ * zeros a bio chain, starting at specific offset
+ */
+static void zero_bio_chain(struct bio *chain, int start_ofs)
+{
+        struct bio_vec *bv;
+        unsigned long flags;
+        void *buf;
+        int i;
+        int pos = 0;
+
+        while (chain) {
+                bio_for_each_segment(bv, chain, i) {
+                        if (pos + bv->bv_len > start_ofs) {
+                                int remainder = max(start_ofs - pos, 0);
+                                buf = bvec_kmap_irq(bv, &flags);
+                                memset(buf + remainder, 0,
+                                       bv->bv_len - remainder);
+                                bvec_kunmap_irq(buf, &flags);
+                        }
+                        pos += bv->bv_len;
+                }
+
+                chain = chain->bi_next;
+        }
+}
+
+/*
+ * bio_chain_clone - clone a chain of bios up to a certain length.
+ * might return a bio_pair that will need to be released.
+ */
+static struct bio *bio_chain_clone(struct bio **old, struct bio **next,
+                                   struct bio_pair **bp,
+                                   int len, gfp_t gfpmask)
+{
+        struct bio *tmp, *old_chain = *old, *new_chain = NULL, *tail = NULL;
+        int total = 0;
+
+        if (*bp) {
+                bio_pair_release(*bp);
+                *bp = NULL;
+        }
+
+        while (old_chain && (total < len)) {
+                tmp = bio_kmalloc(gfpmask, old_chain->bi_max_vecs);
+                if (!tmp)
+                        goto err_out;
+
+                if (total + old_chain->bi_size > len) {
+                        struct bio_pair *bp;
+
+                        /*
+                         * this split can only happen with a single paged bio,
+                         * split_bio will BUG_ON if this is not the case
+                         */
+                        dout("bio_chain_clone split! total=%d remaining=%d"
+                             "bi_size=%d\n",
+                             (int)total, (int)len-total,
+                             (int)old_chain->bi_size);
+
+                        /* split the bio. We'll release it either in the next
+                           call, or it will have to be released outside */
+                        bp = bio_split(old_chain, (len - total) / 512ULL);
+                        if (!bp)
+                                goto err_out;
+
+                        __bio_clone(tmp, &bp->bio1);
+
+                        *next = &bp->bio2;
+                } else {
+                        __bio_clone(tmp, old_chain);
+                        *next = old_chain->bi_next;
+                }
+
+                tmp->bi_bdev = NULL;
+                gfpmask &= ~__GFP_WAIT;
+                tmp->bi_next = NULL;
+
+                if (!new_chain) {
+                        new_chain = tail = tmp;
+                } else {
+                        tail->bi_next = tmp;
+                        tail = tmp;
+                }
+                old_chain = old_chain->bi_next;
+
+                total += tmp->bi_size;
+        }
+
+        BUG_ON(total < len);
+
+        if (tail)
+                tail->bi_next = NULL;
+
+        *old = old_chain;
+
+        return new_chain;
+
+err_out:
+        dout("bio_chain_clone with err\n");
+        bio_chain_put(new_chain);
+        return NULL;
+}
+
+/*
+ * helpers for osd request op vectors.
+ */
+static int rbd_create_rw_ops(struct ceph_osd_req_op **ops,
+                            int num_ops,
+                            int opcode,
+                            u32 payload_len)
+{
+        *ops = kzalloc(sizeof(struct ceph_osd_req_op) * (num_ops + 1),
+                       GFP_NOIO);
+        if (!*ops)
+                return -ENOMEM;
+        (*ops)[0].op = opcode;
+        /*
+         * op extent offset and length will be set later on
+         * in calc_raw_layout()
+         */
+        (*ops)[0].payload_len = payload_len;
+        return 0;
+}
+
+static void rbd_destroy_ops(struct ceph_osd_req_op *ops)
+{
+        kfree(ops);
+}
+
+/*
+ * Send ceph osd request
+ */
+static int rbd_do_request(struct request *rq,
+                          struct rbd_device *dev,
+                          struct ceph_snap_context *snapc,
+                          u64 snapid,
+                          const char *obj, u64 ofs, u64 len,
+                          struct bio *bio,
+                          struct page **pages,
+                          int num_pages,
+                          int flags,
+                          struct ceph_osd_req_op *ops,
+                          int num_reply,
+                          void (*rbd_cb)(struct ceph_osd_request *req,
+                                         struct ceph_msg *msg))
+{
+        struct ceph_osd_request *req;
+        struct ceph_file_layout *layout;
+        int ret;
+        u64 bno;
+        struct timespec mtime = CURRENT_TIME;
+        struct rbd_request *req_data;
+        struct ceph_osd_request_head *reqhead;
+        struct rbd_image_header *header = &dev->header;
+
+        ret = -ENOMEM;
+        req_data = kzalloc(sizeof(*req_data), GFP_NOIO);
+        if (!req_data)
+                goto done;
+
+        dout("rbd_do_request len=%lld ofs=%lld\n", len, ofs);
+
+        down_read(&header->snap_rwsem);
+
+        req = ceph_osdc_alloc_request(&dev->client->osdc, flags,
+                                      snapc,
+                                      ops,
+                                      false,
+                                      GFP_NOIO, pages, bio);
+        if (IS_ERR(req)) {
+                up_read(&header->snap_rwsem);
+                ret = PTR_ERR(req);
+                goto done_pages;
+        }
+
+        req->r_callback = rbd_cb;
+
+        req_data->rq = rq;
+        req_data->bio = bio;
+        req_data->pages = pages;
+        req_data->len = len;
+
+        req->r_priv = req_data;
+
+        reqhead = req->r_request->front.iov_base;
+        reqhead->snapid = cpu_to_le64(CEPH_NOSNAP);
+
+        strncpy(req->r_oid, obj, sizeof(req->r_oid));
+        req->r_oid_len = strlen(req->r_oid);
+
+        layout = &req->r_file_layout;
+        memset(layout, 0, sizeof(*layout));
+        layout->fl_stripe_unit = cpu_to_le32(1 << RBD_MAX_OBJ_ORDER);
+        layout->fl_stripe_count = cpu_to_le32(1);
+        layout->fl_object_size = cpu_to_le32(1 << RBD_MAX_OBJ_ORDER);
+        layout->fl_pg_preferred = cpu_to_le32(-1);
+        layout->fl_pg_pool = cpu_to_le32(dev->poolid);
+        ceph_calc_raw_layout(&dev->client->osdc, layout, snapid,
+                             ofs, &len, &bno, req, ops);
+
+        ceph_osdc_build_request(req, ofs, &len,
+                                ops,
+                                snapc,
+                                &mtime,
+                                req->r_oid, req->r_oid_len);
+        up_read(&header->snap_rwsem);
+
+        ret = ceph_osdc_start_request(&dev->client->osdc, req, false);
+        if (ret < 0)
+                goto done_err;
+
+        if (!rbd_cb) {
+                ret = ceph_osdc_wait_request(&dev->client->osdc, req);
+                ceph_osdc_put_request(req);
+        }
+        return ret;
+
+done_err:
+        bio_chain_put(req_data->bio);
+        ceph_osdc_put_request(req);
+done_pages:
+        kfree(req_data);
+done:
+        if (rq)
+                blk_end_request(rq, ret, len);
+        return ret;
+}
+
+/*
+ * Ceph osd op callback
+ */
+static void rbd_req_cb(struct ceph_osd_request *req, struct ceph_msg *msg)
+{
+        struct rbd_request *req_data = req->r_priv;
+        struct ceph_osd_reply_head *replyhead;
+        struct ceph_osd_op *op;
+        __s32 rc;
+        u64 bytes;
+        int read_op;
+
+        /* parse reply */
+        replyhead = msg->front.iov_base;
+        WARN_ON(le32_to_cpu(replyhead->num_ops) == 0);
+        op = (void *)(replyhead + 1);
+        rc = le32_to_cpu(replyhead->result);
+        bytes = le64_to_cpu(op->extent.length);
+        read_op = (le32_to_cpu(op->op) == CEPH_OSD_OP_READ);
+
+        dout("rbd_req_cb bytes=%lld readop=%d rc=%d\n", bytes, read_op, rc);
+
+        if (rc == -ENOENT && read_op) {
+                zero_bio_chain(req_data->bio, 0);
+                rc = 0;
+        } else if (rc == 0 && read_op && bytes < req_data->len) {
+                zero_bio_chain(req_data->bio, bytes);
+                bytes = req_data->len;
+        }
+
+        blk_end_request(req_data->rq, rc, bytes);
+
+        if (req_data->bio)
+                bio_chain_put(req_data->bio);
+
+        ceph_osdc_put_request(req);
+        kfree(req_data);
+}
+
+/*
+ * Do a synchronous ceph osd operation
+ */
+static int rbd_req_sync_op(struct rbd_device *dev,
+                           struct ceph_snap_context *snapc,
+                           u64 snapid,
+                           int opcode,
+                           int flags,
+                           struct ceph_osd_req_op *orig_ops,
+                           int num_reply,
+                           const char *obj,
+                           u64 ofs, u64 len,
+                           char *buf)
+{
+        int ret;
+        struct page **pages;
+        int num_pages;
+        struct ceph_osd_req_op *ops = orig_ops;
+        u32 payload_len;
+
+        num_pages = calc_pages_for(ofs , len);
+        pages = ceph_alloc_page_vector(num_pages, GFP_KERNEL);
+        if (IS_ERR(pages))
+                return PTR_ERR(pages);
+
+        if (!orig_ops) {
+                payload_len = (flags & CEPH_OSD_FLAG_WRITE ? len : 0);
+                ret = rbd_create_rw_ops(&ops, 1, opcode, payload_len);
+                if (ret < 0)
+                        goto done;
+
+                if ((flags & CEPH_OSD_FLAG_WRITE) && buf) {
+                        ret = ceph_copy_to_page_vector(pages, buf, ofs, len);
+                        if (ret < 0)
+                                goto done_ops;
+                }
+        }
+
+        ret = rbd_do_request(NULL, dev, snapc, snapid,
+                          obj, ofs, len, NULL,
+                          pages, num_pages,
+                          flags,
+                          ops,
+                          2,
+                          NULL);
+        if (ret < 0)
+                goto done_ops;
+
+        if ((flags & CEPH_OSD_FLAG_READ) && buf)
+                ret = ceph_copy_from_page_vector(pages, buf, ofs, ret);
+
+done_ops:
+        if (!orig_ops)
+                rbd_destroy_ops(ops);
+done:
+        ceph_release_page_vector(pages, num_pages);
+        return ret;
+}
+
+/*
+ * Do an asynchronous ceph osd operation
+ */
+static int rbd_do_op(struct request *rq,
+                     struct rbd_device *rbd_dev ,
+                     struct ceph_snap_context *snapc,
+                     u64 snapid,
+                     int opcode, int flags, int num_reply,
+                     u64 ofs, u64 len,
+                     struct bio *bio)
+{
+        char *seg_name;
+        u64 seg_ofs;
+        u64 seg_len;
+        int ret;
+        struct ceph_osd_req_op *ops;
+        u32 payload_len;
+
+        seg_name = kmalloc(RBD_MAX_SEG_NAME_LEN + 1, GFP_NOIO);
+        if (!seg_name)
+                return -ENOMEM;
+
+        seg_len = rbd_get_segment(&rbd_dev->header,
+                                  rbd_dev->header.block_name,
+                                  ofs, len,
+                                  seg_name, &seg_ofs);
+
+        payload_len = (flags & CEPH_OSD_FLAG_WRITE ? seg_len : 0);
+
+        ret = rbd_create_rw_ops(&ops, 1, opcode, payload_len);
+        if (ret < 0)
+                goto done;
+
+        /* we've taken care of segment sizes earlier when we
+           cloned the bios. We should never have a segment
+           truncated at this point */
+        BUG_ON(seg_len < len);
+
+        ret = rbd_do_request(rq, rbd_dev, snapc, snapid,
+                             seg_name, seg_ofs, seg_len,
+                             bio,
+                             NULL, 0,
+                             flags,
+                             ops,
+                             num_reply,
+                             rbd_req_cb);
+done:
+        kfree(seg_name);
+        return ret;
+}
+
+/*
+ * Request async osd write
+ */
+static int rbd_req_write(struct request *rq,
+                         struct rbd_device *rbd_dev,
+                         struct ceph_snap_context *snapc,
+                         u64 ofs, u64 len,
+                         struct bio *bio)
+{
+        return rbd_do_op(rq, rbd_dev, snapc, CEPH_NOSNAP,
+                         CEPH_OSD_OP_WRITE,
+                         CEPH_OSD_FLAG_WRITE | CEPH_OSD_FLAG_ONDISK,
+                         2,
+                         ofs, len, bio);
+}
+
+/*
+ * Request async osd read
+ */
+static int rbd_req_read(struct request *rq,
+                         struct rbd_device *rbd_dev,
+                         u64 snapid,
+                         u64 ofs, u64 len,
+                         struct bio *bio)
+{
+        return rbd_do_op(rq, rbd_dev, NULL,
+                         (snapid ? snapid : CEPH_NOSNAP),
+                         CEPH_OSD_OP_READ,
+                         CEPH_OSD_FLAG_READ,
+                         2,
+                         ofs, len, bio);
+}
+
+/*
+ * Request sync osd read
+ */
+static int rbd_req_sync_read(struct rbd_device *dev,
+                          struct ceph_snap_context *snapc,
+                          u64 snapid,
+                          const char *obj,
+                          u64 ofs, u64 len,
+                          char *buf)
+{
+        return rbd_req_sync_op(dev, NULL,
+                               (snapid ? snapid : CEPH_NOSNAP),
+                               CEPH_OSD_OP_READ,
+                               CEPH_OSD_FLAG_READ,
+                               NULL,
+                               1, obj, ofs, len, buf);
+}
+
+/*
+ * Request sync osd read
+ */
+static int rbd_req_sync_rollback_obj(struct rbd_device *dev,
+                                     u64 snapid,
+                                     const char *obj)
+{
+        struct ceph_osd_req_op *ops;
+        int ret = rbd_create_rw_ops(&ops, 1, CEPH_OSD_OP_ROLLBACK, 0);
+        if (ret < 0)
+                return ret;
+
+        ops[0].snap.snapid = snapid;
+
+        ret = rbd_req_sync_op(dev, NULL,
+                               CEPH_NOSNAP,
+                               0,
+                               CEPH_OSD_FLAG_WRITE | CEPH_OSD_FLAG_ONDISK,
+                               ops,
+                               1, obj, 0, 0, NULL);
+
+        rbd_destroy_ops(ops);
+
+        if (ret < 0)
+                return ret;
+
+        return ret;
+}
+
+/*
+ * Request sync osd read
+ */
+static int rbd_req_sync_exec(struct rbd_device *dev,
+                             const char *obj,
+                             const char *cls,
+                             const char *method,
+                             const char *data,
+                             int len)
+{
+        struct ceph_osd_req_op *ops;
+        int cls_len = strlen(cls);
+        int method_len = strlen(method);
+        int ret = rbd_create_rw_ops(&ops, 1, CEPH_OSD_OP_CALL,
+                                    cls_len + method_len + len);
+        if (ret < 0)
+                return ret;
+
+        ops[0].cls.class_name = cls;
+        ops[0].cls.class_len = (__u8)cls_len;
+        ops[0].cls.method_name = method;
+        ops[0].cls.method_len = (__u8)method_len;
+        ops[0].cls.argc = 0;
+        ops[0].cls.indata = data;
+        ops[0].cls.indata_len = len;
+
+        ret = rbd_req_sync_op(dev, NULL,
+                               CEPH_NOSNAP,
+                               0,
+                               CEPH_OSD_FLAG_WRITE | CEPH_OSD_FLAG_ONDISK,
+                               ops,
+                               1, obj, 0, 0, NULL);
+
+        rbd_destroy_ops(ops);
+
+        dout("cls_exec returned %d\n", ret);
+        return ret;
+}
+
+/*
+ * block device queue callback
+ */
+static void rbd_rq_fn(struct request_queue *q)
+{
+        struct rbd_device *rbd_dev = q->queuedata;
+        struct request *rq;
+        struct bio_pair *bp = NULL;
+
+        rq = blk_fetch_request(q);
+
+        while (1) {
+                struct bio *bio;
+                struct bio *rq_bio, *next_bio = NULL;
+                bool do_write;
+                int size, op_size = 0;
+                u64 ofs;
+
+                /* peek at request from block layer */
+                if (!rq)
+                        break;
+
+                dout("fetched request\n");
+
+                /* filter out block requests we don't understand */
+                if ((rq->cmd_type != REQ_TYPE_FS)) {
+                        __blk_end_request_all(rq, 0);
+                        goto next;
+                }
+
+                /* deduce our operation (read, write) */
+                do_write = (rq_data_dir(rq) == WRITE);
+
+                size = blk_rq_bytes(rq);
+                ofs = blk_rq_pos(rq) * 512ULL;
+                rq_bio = rq->bio;
+                if (do_write && rbd_dev->read_only) {
+                        __blk_end_request_all(rq, -EROFS);
+                        goto next;
+                }
+
+                spin_unlock_irq(q->queue_lock);
+
+                dout("%s 0x%x bytes at 0x%llx\n",
+                     do_write ? "write" : "read",
+                     size, blk_rq_pos(rq) * 512ULL);
+
+                do {
+                        /* a bio clone to be passed down to OSD req */
+                        dout("rq->bio->bi_vcnt=%d\n", rq->bio->bi_vcnt);
+                        op_size = rbd_get_segment(&rbd_dev->header,
+                                                  rbd_dev->header.block_name,
+                                                  ofs, size,
+                                                  NULL, NULL);
+                        bio = bio_chain_clone(&rq_bio, &next_bio, &bp,
+                                              op_size, GFP_ATOMIC);
+                        if (!bio) {
+                                spin_lock_irq(q->queue_lock);
+                                __blk_end_request_all(rq, -ENOMEM);
+                                goto next;
+                        }
+
+                        /* init OSD command: write or read */
+                        if (do_write)
+                                rbd_req_write(rq, rbd_dev,
+                                              rbd_dev->header.snapc,
+                                              ofs,
+                                              op_size, bio);
+                        else
+                                rbd_req_read(rq, rbd_dev,
+                                             cur_snap_id(rbd_dev),
+                                             ofs,
+                                             op_size, bio);
+
+                        size -= op_size;
+                        ofs += op_size;
+
+                        rq_bio = next_bio;
+                } while (size > 0);
+
+                if (bp)
+                        bio_pair_release(bp);
+
+                spin_lock_irq(q->queue_lock);
+next:
+                rq = blk_fetch_request(q);
+        }
+}
+
+/*
+ * a queue callback. Makes sure that we don't create a bio that spans across
+ * multiple osd objects. One exception would be with a single page bios,
+ * which we handle later at bio_chain_clone
+ */
+static int rbd_merge_bvec(struct request_queue *q, struct bvec_merge_data *bmd,
+                          struct bio_vec *bvec)
+{
+        struct rbd_device *rbd_dev = q->queuedata;
+        unsigned int chunk_sectors = 1 << (rbd_dev->header.obj_order - 9);
+        sector_t sector = bmd->bi_sector + get_start_sect(bmd->bi_bdev);
+        unsigned int bio_sectors = bmd->bi_size >> 9;
+        int max;
+
+        max =  (chunk_sectors - ((sector & (chunk_sectors - 1))
+                                 + bio_sectors)) << 9;
+        if (max < 0)
+                max = 0; /* bio_add cannot handle a negative return */
+        if (max <= bvec->bv_len && bio_sectors == 0)
+                return bvec->bv_len;
+        return max;
+}
+
+static void rbd_free_disk(struct rbd_device *rbd_dev)
+{
+        struct gendisk *disk = rbd_dev->disk;
+
+        if (!disk)
+                return;
+
+        rbd_header_free(&rbd_dev->header);
+
+        if (disk->flags & GENHD_FL_UP)
+                del_gendisk(disk);
+        if (disk->queue)
+                blk_cleanup_queue(disk->queue);
+        put_disk(disk);
+}
+
+/*
+ * reload the ondisk the header 
+ */
+static int rbd_read_header(struct rbd_device *rbd_dev,
+                           struct rbd_image_header *header)
+{
+        ssize_t rc;
+        struct rbd_image_header_ondisk *dh;
+        int snap_count = 0;
+        u64 snap_names_len = 0;
+
+        while (1) {
+                int len = sizeof(*dh) +
+                          snap_count * sizeof(struct rbd_image_snap_ondisk) +
+                          snap_names_len;
+
+                rc = -ENOMEM;
+                dh = kmalloc(len, GFP_KERNEL);
+                if (!dh)
+                        return -ENOMEM;
+
+                rc = rbd_req_sync_read(rbd_dev,
+                                       NULL, CEPH_NOSNAP,
+                                       rbd_dev->obj_md_name,
+                                       0, len,
+                                       (char *)dh);
+                if (rc < 0)
+                        goto out_dh;
+
+                rc = rbd_header_from_disk(header, dh, snap_count, GFP_KERNEL);
+                if (rc < 0)
+                        goto out_dh;
+
+                if (snap_count != header->total_snaps) {
+                        snap_count = header->total_snaps;
+                        snap_names_len = header->snap_names_len;
+                        rbd_header_free(header);
+                        kfree(dh);
+                        continue;
+                }
+                break;
+        }
+
+out_dh:
+        kfree(dh);
+        return rc;
+}
+
+/*
+ * create a snapshot
+ */
+static int rbd_header_add_snap(struct rbd_device *dev,
+                               const char *snap_name,
+                               gfp_t gfp_flags)
+{
+        int name_len = strlen(snap_name);
+        u64 new_snapid;
+        int ret;
+        void *data, *data_start, *data_end;
+
+        /* we should create a snapshot only if we're pointing at the head */
+        if (dev->cur_snap)
+                return -EINVAL;
+
+        ret = ceph_monc_create_snapid(&dev->client->monc, dev->poolid,
+                                      &new_snapid);
+        dout("created snapid=%lld\n", new_snapid);
+        if (ret < 0)
+                return ret;
+
+        data = kmalloc(name_len + 16, gfp_flags);
+        if (!data)
+                return -ENOMEM;
+
+        data_start = data;
+        data_end = data + name_len + 16;
+
+        ceph_encode_string_safe(&data, data_end, snap_name, name_len, bad);
+        ceph_encode_64_safe(&data, data_end, new_snapid, bad);
+
+        ret = rbd_req_sync_exec(dev, dev->obj_md_name, "rbd", "snap_add",
+                                data_start, data - data_start);
+
+        kfree(data_start);
+
+        if (ret < 0)
+                return ret;
+
+        dev->header.snapc->seq =  new_snapid;
+
+        return 0;
+bad:
+        return -ERANGE;
+}
+
+/*
+ * only read the first part of the ondisk header, without the snaps info
+ */
+static int rbd_update_snaps(struct rbd_device *rbd_dev)
+{
+        int ret;
+        struct rbd_image_header h;
+        u64 snap_seq;
+
+        ret = rbd_read_header(rbd_dev, &h);
+        if (ret < 0)
+                return ret;
+
+        down_write(&rbd_dev->header.snap_rwsem);
+
+        snap_seq = rbd_dev->header.snapc->seq;
+
+        kfree(rbd_dev->header.snapc);
+        kfree(rbd_dev->header.snap_names);
+        kfree(rbd_dev->header.snap_sizes);
+
+        rbd_dev->header.total_snaps = h.total_snaps;
+        rbd_dev->header.snapc = h.snapc;
+        rbd_dev->header.snap_names = h.snap_names;
+        rbd_dev->header.snap_sizes = h.snap_sizes;
+        rbd_dev->header.snapc->seq = snap_seq;
+
+        up_write(&rbd_dev->header.snap_rwsem);
+
+        return 0;
+}
+
+static int rbd_init_disk(struct rbd_device *rbd_dev)
+{
+        struct gendisk *disk;
+        struct request_queue *q;
+        int rc;
+        u64 total_size = 0;
+
+        /* contact OSD, request size info about the object being mapped */
+        rc = rbd_read_header(rbd_dev, &rbd_dev->header);
+        if (rc)
+                return rc;
+
+        rc = rbd_header_set_snap(rbd_dev, rbd_dev->snap_name, &total_size);
+        if (rc)
+                return rc;
+
+        /* create gendisk info */
+        rc = -ENOMEM;
+        disk = alloc_disk(RBD_MINORS_PER_MAJOR);
+        if (!disk)
+                goto out;
+
+        sprintf(disk->disk_name, DRV_NAME "%d", rbd_dev->id);
+        disk->major = rbd_dev->major;
+        disk->first_minor = 0;
+        disk->fops = &rbd_bd_ops;
+        disk->private_data = rbd_dev;
+
+        /* init rq */
+        rc = -ENOMEM;
+        q = blk_init_queue(rbd_rq_fn, &rbd_dev->lock);
+        if (!q)
+                goto out_disk;
+        blk_queue_merge_bvec(q, rbd_merge_bvec);
+        disk->queue = q;
+
+        q->queuedata = rbd_dev;
+
+        rbd_dev->disk = disk;
+        rbd_dev->q = q;
+
+        /* finally, announce the disk to the world */
+        set_capacity(disk, total_size / 512ULL);
+        add_disk(disk);
+
+        pr_info("%s: added with size 0x%llx\n",
+                disk->disk_name, (unsigned long long)total_size);
+        return 0;
+
+out_disk:
+        put_disk(disk);
+out:
+        return rc;
+}
+
+/********************************************************************
+ * /sys/class/rbd/
+ *                   add        map rados objects to blkdev
+ *                   remove     unmap rados objects
+ *                   list       show mappings
+ *******************************************************************/
+
+static void class_rbd_release(struct class *cls)
+{
+        kfree(cls);
+}
+
+static ssize_t class_rbd_list(struct class *c,
+                              struct class_attribute *attr,
+                              char *data)
+{
+        int n = 0;
+        struct list_head *tmp;
+        int max = PAGE_SIZE;
+
+        mutex_lock_nested(&ctl_mutex, SINGLE_DEPTH_NESTING);
+
+        n += snprintf(data, max,
+                      "#id\tmajor\tclient_name\tpool\tname\tsnap\tKB\n");
+
+        list_for_each(tmp, &rbd_dev_list) {
+                struct rbd_device *rbd_dev;
+
+                rbd_dev = list_entry(tmp, struct rbd_device, node);
+                n += snprintf(data+n, max-n,
+                              "%d\t%d\tclient%lld\t%s\t%s\t%s\t%lld\n",
+                              rbd_dev->id,
+                              rbd_dev->major,
+                              ceph_client_id(rbd_dev->client),
+                              rbd_dev->pool_name,
+                              rbd_dev->obj, rbd_dev->snap_name,
+                              rbd_dev->header.image_size >> 10);
+                if (n == max)
+                        break;
+        }
+
+        mutex_unlock(&ctl_mutex);
+        return n;
+}
+
+static ssize_t class_rbd_add(struct class *c,
+                             struct class_attribute *attr,
+                             const char *buf, size_t count)
+{
+        struct ceph_osd_client *osdc;
+        struct rbd_device *rbd_dev;
+        ssize_t rc = -ENOMEM;
+        int irc, new_id = 0;
+        struct list_head *tmp;
+        char *mon_dev_name;
+        char *options;
+
+        if (!try_module_get(THIS_MODULE))
+                return -ENODEV;
+
+        mon_dev_name = kmalloc(RBD_MAX_OPT_LEN, GFP_KERNEL);
+        if (!mon_dev_name)
+                goto err_out_mod;
+
+        options = kmalloc(RBD_MAX_OPT_LEN, GFP_KERNEL);
+        if (!options)
+                goto err_mon_dev;
+
+        /* new rbd_device object */
+        rbd_dev = kzalloc(sizeof(*rbd_dev), GFP_KERNEL);
+        if (!rbd_dev)
+                goto err_out_opt;
+
+        /* static rbd_device initialization */
+        spin_lock_init(&rbd_dev->lock);
+        INIT_LIST_HEAD(&rbd_dev->node);
+
+        /* generate unique id: find highest unique id, add one */
+        mutex_lock_nested(&ctl_mutex, SINGLE_DEPTH_NESTING);
+
+        list_for_each(tmp, &rbd_dev_list) {
+                struct rbd_device *rbd_dev;
+
+                rbd_dev = list_entry(tmp, struct rbd_device, node);
+                if (rbd_dev->id >= new_id)
+                        new_id = rbd_dev->id + 1;
+        }
+
+        rbd_dev->id = new_id;
+
+        /* add to global list */
+        list_add_tail(&rbd_dev->node, &rbd_dev_list);
+
+        /* parse add command */
+        if (sscanf(buf, "%" __stringify(RBD_MAX_OPT_LEN) "s "
+                   "%" __stringify(RBD_MAX_OPT_LEN) "s "
+                   "%" __stringify(RBD_MAX_POOL_NAME_LEN) "s "
+                   "%" __stringify(RBD_MAX_OBJ_NAME_LEN) "s"
+                   "%" __stringify(RBD_MAX_SNAP_NAME_LEN) "s",
+                   mon_dev_name, options, rbd_dev->pool_name,
+                   rbd_dev->obj, rbd_dev->snap_name) < 4) {
+                rc = -EINVAL;
+                goto err_out_slot;
+        }
+
+        if (rbd_dev->snap_name[0] == 0)
+                rbd_dev->snap_name[0] = '-';
+
+        rbd_dev->obj_len = strlen(rbd_dev->obj);
+        snprintf(rbd_dev->obj_md_name, sizeof(rbd_dev->obj_md_name), "%s%s",
+                 rbd_dev->obj, RBD_SUFFIX);
+
+        /* initialize rest of new object */
+        snprintf(rbd_dev->name, DEV_NAME_LEN, DRV_NAME "%d", rbd_dev->id);
+        rc = rbd_get_client(rbd_dev, mon_dev_name, options);
+        if (rc < 0)
+                goto err_out_slot;
+
+        mutex_unlock(&ctl_mutex);
+
+        /* pick the pool */
+        osdc = &rbd_dev->client->osdc;
+        rc = ceph_pg_poolid_by_name(osdc->osdmap, rbd_dev->pool_name);
+        if (rc < 0)
+                goto err_out_client;
+        rbd_dev->poolid = rc;
+
+        /* register our block device */
+        irc = register_blkdev(0, rbd_dev->name);
+        if (irc < 0) {
+                rc = irc;
+                goto err_out_client;
+        }
+        rbd_dev->major = irc;
+
+        /* set up and announce blkdev mapping */
+        rc = rbd_init_disk(rbd_dev);
+        if (rc)
+                goto err_out_blkdev;
+
+        return count;
+
+err_out_blkdev:
+        unregister_blkdev(rbd_dev->major, rbd_dev->name);
+err_out_client:
+        rbd_put_client(rbd_dev);
+        mutex_lock_nested(&ctl_mutex, SINGLE_DEPTH_NESTING);
+err_out_slot:
+        list_del_init(&rbd_dev->node);
+        mutex_unlock(&ctl_mutex);
+
+        kfree(rbd_dev);
+err_out_opt:
+        kfree(options);
+err_mon_dev:
+        kfree(mon_dev_name);
+err_out_mod:
+        dout("Error adding device %s\n", buf);
+        module_put(THIS_MODULE);
+        return rc;
+}
+
+static struct rbd_device *__rbd_get_dev(unsigned long id)
+{
+        struct list_head *tmp;
+        struct rbd_device *rbd_dev;
+
+        list_for_each(tmp, &rbd_dev_list) {
+                rbd_dev = list_entry(tmp, struct rbd_device, node);
+                if (rbd_dev->id == id)
+                        return rbd_dev;
+        }
+        return NULL;
+}
+
+static ssize_t class_rbd_remove(struct class *c,
+                                struct class_attribute *attr,
+                                const char *buf,
+                                size_t count)
+{
+        struct rbd_device *rbd_dev = NULL;
+        int target_id, rc;
+        unsigned long ul;
+
+        rc = strict_strtoul(buf, 10, &ul);
+        if (rc)
+                return rc;
+
+        /* convert to int; abort if we lost anything in the conversion */
+        target_id = (int) ul;
+        if (target_id != ul)
+                return -EINVAL;
+
+        /* remove object from list immediately */
+        mutex_lock_nested(&ctl_mutex, SINGLE_DEPTH_NESTING);
+
+        rbd_dev = __rbd_get_dev(target_id);
+        if (rbd_dev)
+                list_del_init(&rbd_dev->node);
+
+        mutex_unlock(&ctl_mutex);
+
+        if (!rbd_dev)
+                return -ENOENT;
+
+        rbd_put_client(rbd_dev);
+
+        /* clean up and free blkdev */
+        rbd_free_disk(rbd_dev);
+        unregister_blkdev(rbd_dev->major, rbd_dev->name);
+        kfree(rbd_dev);
+
+        /* release module ref */
+        module_put(THIS_MODULE);
+
+        return count;
+}
+
+static ssize_t class_rbd_snaps_list(struct class *c,
+                              struct class_attribute *attr,
+                              char *data)
+{
+        struct rbd_device *rbd_dev = NULL;
+        struct list_head *tmp;
+        struct rbd_image_header *header;
+        int i, n = 0, max = PAGE_SIZE;
+        int ret;
+
+        mutex_lock_nested(&ctl_mutex, SINGLE_DEPTH_NESTING);
+
+        n += snprintf(data, max, "#id\tsnap\tKB\n");
+
+        list_for_each(tmp, &rbd_dev_list) {
+                char *names, *p;
+                struct ceph_snap_context *snapc;
+
+                rbd_dev = list_entry(tmp, struct rbd_device, node);
+                header = &rbd_dev->header;
+
+                down_read(&header->snap_rwsem);
+
+                names = header->snap_names;
+                snapc = header->snapc;
+
+                n += snprintf(data + n, max - n, "%d\t%s\t%lld%s\n",
+                              rbd_dev->id, RBD_SNAP_HEAD_NAME,
+                              header->image_size >> 10,
+                              (!rbd_dev->cur_snap ? " (*)" : ""));
+                if (n == max)
+                        break;
+
+                p = names;
+                for (i = 0; i < header->total_snaps; i++, p += strlen(p) + 1) {
+                        n += snprintf(data + n, max - n, "%d\t%s\t%lld%s\n",
+                              rbd_dev->id, p, header->snap_sizes[i] >> 10,
+                              (rbd_dev->cur_snap &&
+                               (snap_index(header, i) == rbd_dev->cur_snap) ?
+                               " (*)" : ""));
+                        if (n == max)
+                                break;
+                }
+
+                up_read(&header->snap_rwsem);
+        }
+
+
+        ret = n;
+        mutex_unlock(&ctl_mutex);
+        return ret;
+}
+
+static ssize_t class_rbd_snaps_refresh(struct class *c,
+                                struct class_attribute *attr,
+                                const char *buf,
+                                size_t count)
+{
+        struct rbd_device *rbd_dev = NULL;
+        int target_id, rc;
+        unsigned long ul;
+        int ret = count;
+
+        rc = strict_strtoul(buf, 10, &ul);
+        if (rc)
+                return rc;
+
+        /* convert to int; abort if we lost anything in the conversion */
+        target_id = (int) ul;
+        if (target_id != ul)
+                return -EINVAL;
+
+        mutex_lock_nested(&ctl_mutex, SINGLE_DEPTH_NESTING);
+
+        rbd_dev = __rbd_get_dev(target_id);
+        if (!rbd_dev) {
+                ret = -ENOENT;
+                goto done;
+        }
+
+        rc = rbd_update_snaps(rbd_dev);
+        if (rc < 0)
+                ret = rc;
+
+done:
+        mutex_unlock(&ctl_mutex);
+        return ret;
+}
+
+static ssize_t class_rbd_snap_create(struct class *c,
+                                struct class_attribute *attr,
+                                const char *buf,
+                                size_t count)
+{
+        struct rbd_device *rbd_dev = NULL;
+        int target_id, ret;
+        char *name;
+
+        name = kmalloc(RBD_MAX_SNAP_NAME_LEN + 1, GFP_KERNEL);
+        if (!name)
+                return -ENOMEM;
+
+        /* parse snaps add command */
+        if (sscanf(buf, "%d "
+                   "%" __stringify(RBD_MAX_SNAP_NAME_LEN) "s",
+                   &target_id,
+                   name) != 2) {
+                ret = -EINVAL;
+                goto done;
+        }
+
+        mutex_lock_nested(&ctl_mutex, SINGLE_DEPTH_NESTING);
+
+        rbd_dev = __rbd_get_dev(target_id);
+        if (!rbd_dev) {
+                ret = -ENOENT;
+                goto done_unlock;
+        }
+
+        ret = rbd_header_add_snap(rbd_dev,
+                                  name, GFP_KERNEL);
+        if (ret < 0)
+                goto done_unlock;
+
+        ret = rbd_update_snaps(rbd_dev);
+        if (ret < 0)
+                goto done_unlock;
+
+        ret = count;
+done_unlock:
+        mutex_unlock(&ctl_mutex);
+done:
+        kfree(name);
+        return ret;
+}
+
+static ssize_t class_rbd_rollback(struct class *c,
+                                struct class_attribute *attr,
+                                const char *buf,
+                                size_t count)
+{
+        struct rbd_device *rbd_dev = NULL;
+        int target_id, ret;
+        u64 snapid;
+        char snap_name[RBD_MAX_SNAP_NAME_LEN];
+        u64 cur_ofs;
+        char *seg_name;
+
+        /* parse snaps add command */
+        if (sscanf(buf, "%d "
+                   "%" __stringify(RBD_MAX_SNAP_NAME_LEN) "s",
+                   &target_id,
+                   snap_name) != 2) {
+                return -EINVAL;
+        }
+
+        ret = -ENOMEM;
+        seg_name = kmalloc(RBD_MAX_SEG_NAME_LEN + 1, GFP_NOIO);
+        if (!seg_name)
+                return ret;
+
+        mutex_lock_nested(&ctl_mutex, SINGLE_DEPTH_NESTING);
+
+        rbd_dev = __rbd_get_dev(target_id);
+        if (!rbd_dev) {
+                ret = -ENOENT;
+                goto done_unlock;
+        }
+
+        ret = snap_by_name(&rbd_dev->header, snap_name, &snapid, NULL);
+        if (ret < 0)
+                goto done_unlock;
+
+        dout("snapid=%lld\n", snapid);
+
+        cur_ofs = 0;
+        while (cur_ofs < rbd_dev->header.image_size) {
+                cur_ofs += rbd_get_segment(&rbd_dev->header,
+                                           rbd_dev->obj,
+                                           cur_ofs, (u64)-1,
+                                           seg_name, NULL);
+                dout("seg_name=%s\n", seg_name);
+
+                ret = rbd_req_sync_rollback_obj(rbd_dev, snapid, seg_name);
+                if (ret < 0)
+                        pr_warning("could not roll back obj %s err=%d\n",
+                                   seg_name, ret);
+        }
+
+        ret = rbd_update_snaps(rbd_dev);
+        if (ret < 0)
+                goto done_unlock;
+
+        ret = count;
+
+done_unlock:
+        mutex_unlock(&ctl_mutex);
+        kfree(seg_name);
+
+        return ret;
+}
+
+static struct class_attribute class_rbd_attrs[] = {
+        __ATTR(add,             0200, NULL, class_rbd_add),
+        __ATTR(remove,          0200, NULL, class_rbd_remove),
+        __ATTR(list,            0444, class_rbd_list, NULL),
+        __ATTR(snaps_refresh,   0200, NULL, class_rbd_snaps_refresh),
+        __ATTR(snap_create,     0200, NULL, class_rbd_snap_create),
+        __ATTR(snaps_list,      0444, class_rbd_snaps_list, NULL),
+        __ATTR(snap_rollback,   0200, NULL, class_rbd_rollback),
+        __ATTR_NULL
+};
+
+/*
+ * create control files in sysfs
+ * /sys/class/rbd/...
+ */
+static int rbd_sysfs_init(void)
+{
+        int ret = -ENOMEM;
+
+        class_rbd = kzalloc(sizeof(*class_rbd), GFP_KERNEL);
+        if (!class_rbd)
+                goto out;
+
+        class_rbd->name = DRV_NAME;
+        class_rbd->owner = THIS_MODULE;
+        class_rbd->class_release = class_rbd_release;
+        class_rbd->class_attrs = class_rbd_attrs;
+
+        ret = class_register(class_rbd);
+        if (ret)
+                goto out_class;
+        return 0;
+
+out_class:
+        kfree(class_rbd);
+        class_rbd = NULL;
+        pr_err(DRV_NAME ": failed to create class rbd\n");
+out:
+        return ret;
+}
+
+static void rbd_sysfs_cleanup(void)
+{
+        if (class_rbd)
+                class_destroy(class_rbd);
+        class_rbd = NULL;
+}
+
+int __init rbd_init(void)
+{
+        int rc;
+
+        rc = rbd_sysfs_init();
+        if (rc)
+                return rc;
+        spin_lock_init(&node_lock);
+        pr_info("loaded " DRV_NAME_LONG "\n");
+        return 0;
+}
+
+void __exit rbd_exit(void)
+{
+        rbd_sysfs_cleanup();
+}
+
+module_init(rbd_init);
+module_exit(rbd_exit);
+
+MODULE_AUTHOR("Sage Weil <sage@newdream.net>");
+MODULE_AUTHOR("Yehuda Sadeh <yehuda@hq.newdream.net>");
+MODULE_DESCRIPTION("rados block device");
+
+/* following authorship retained from original osdblk.c */
+MODULE_AUTHOR("Jeff Garzik <jeff@garzik.org>");
+
+MODULE_LICENSE("GPL");
diff --git a/drivers/block/rbd_types.h b/drivers/block/rbd_types.h
new file mode 100644
index 000000000000..fc6c678aa2cb
--- /dev/null
+++ b/drivers/block/rbd_types.h
@@ -0,0 +1,73 @@
+/*
+ * Ceph - scalable distributed file system
+ *
+ * Copyright (C) 2004-2010 Sage Weil <sage@newdream.net>
+ *
+ * This is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License version 2.1, as published by the Free Software
+ * Foundation.  See file COPYING.
+ *
+ */
+
+#ifndef CEPH_RBD_TYPES_H
+#define CEPH_RBD_TYPES_H
+
+#include <linux/types.h>
+
+/*
+ * rbd image 'foo' consists of objects
+ *   foo.rbd      - image metadata
+ *   foo.00000000
+ *   foo.00000001
+ *   ...          - data
+ */
+
+#define RBD_SUFFIX              ".rbd"
+#define RBD_DIRECTORY           "rbd_directory"
+#define RBD_INFO                "rbd_info"
+
+#define RBD_DEFAULT_OBJ_ORDER   22   /* 4MB */
+#define RBD_MIN_OBJ_ORDER       16
+#define RBD_MAX_OBJ_ORDER       30
+
+#define RBD_MAX_OBJ_NAME_LEN    96
+#define RBD_MAX_SEG_NAME_LEN    128
+
+#define RBD_COMP_NONE           0
+#define RBD_CRYPT_NONE          0
+
+#define RBD_HEADER_TEXT         "<<< Rados Block Device Image >>>\n"
+#define RBD_HEADER_SIGNATURE    "RBD"
+#define RBD_HEADER_VERSION      "001.005"
+
+struct rbd_info {
+        __le64 max_id;
+} __attribute__ ((packed));
+
+struct rbd_image_snap_ondisk {
+        __le64 id;
+        __le64 image_size;
+} __attribute__((packed));
+
+struct rbd_image_header_ondisk {
+        char text[40];
+        char block_name[24];
+        char signature[4];
+        char version[8];
+        struct {
+                __u8 order;
+                __u8 crypt_type;
+                __u8 comp_type;
+                __u8 unused;
+        } __attribute__((packed)) options;
+        __le64 image_size;
+        __le64 snap_seq;
+        __le32 snap_count;
+        __le32 reserved;
+        __le64 snap_names_len;
+        struct rbd_image_snap_ondisk snaps[0];
+} __attribute__((packed));
+
+
+#endif
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 2aafafca2b13..8320490226b7 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -2,7 +2,6 @@
 #include <linux/spinlock.h>
 #include <linux/slab.h>
 #include <linux/blkdev.h>
-#include <linux/smp_lock.h>
 #include <linux/hdreg.h>
 #include <linux/virtio.h>
 #include <linux/virtio_blk.h>
@@ -202,6 +201,7 @@ static int virtblk_get_id(struct gendisk *disk, char *id_str)
         struct virtio_blk *vblk = disk->private_data;
         struct request *req;
         struct bio *bio;
+        int err;
 
         bio = bio_map_kern(vblk->disk->queue, id_str, VIRTIO_BLK_ID_BYTES,
                            GFP_KERNEL);
@@ -215,11 +215,14 @@ static int virtblk_get_id(struct gendisk *disk, char *id_str)
         }
 
         req->cmd_type = REQ_TYPE_SPECIAL;
-        return blk_execute_rq(vblk->disk->queue, vblk->disk, req, false);
+        err = blk_execute_rq(vblk->disk->queue, vblk->disk, req, false);
+        blk_put_request(req);
+
+        return err;
 }
 
-static int virtblk_locked_ioctl(struct block_device *bdev, fmode_t mode,
-                         unsigned cmd, unsigned long data)
+static int virtblk_ioctl(struct block_device *bdev, fmode_t mode,
+                             unsigned int cmd, unsigned long data)
 {
         struct gendisk *disk = bdev->bd_disk;
         struct virtio_blk *vblk = disk->private_data;
@@ -234,18 +237,6 @@ static int virtblk_locked_ioctl(struct block_device *bdev, fmode_t mode,
                               (void __user *)data);
 }
 
-static int virtblk_ioctl(struct block_device *bdev, fmode_t mode,
-                             unsigned int cmd, unsigned long param)
-{
-        int ret;
-
-        lock_kernel();
-        ret = virtblk_locked_ioctl(bdev, mode, cmd, param);
-        unlock_kernel();
-
-        return ret;
-}
-
 /* We provide getgeo only to please some old bootloader/partitioning tools */
 static int virtblk_getgeo(struct block_device *bd, struct hd_geometry *geo)
 {
diff --git a/drivers/char/agp/Kconfig b/drivers/char/agp/Kconfig
index 4b66c69eaf57..5ddf67e76f8b 100644
--- a/drivers/char/agp/Kconfig
+++ b/drivers/char/agp/Kconfig
@@ -57,7 +57,7 @@ config AGP_AMD
 
 config AGP_AMD64
         tristate "AMD Opteron/Athlon64 on-CPU GART support"
-        depends on AGP && X86 && K8_NB
+        depends on AGP && X86 && AMD_NB
         help
           This option gives you AGP support for the GLX component of
           X using the on-CPU northbridge of the AMD Athlon64/Opteron CPUs.
diff --git a/drivers/char/agp/amd64-agp.c b/drivers/char/agp/amd64-agp.c
index 70312da4c968..42396df55556 100644
--- a/drivers/char/agp/amd64-agp.c
+++ b/drivers/char/agp/amd64-agp.c
@@ -15,7 +15,7 @@
 #include <linux/mmzone.h>
 #include <asm/page.h>           /* PAGE_SIZE */
 #include <asm/e820.h>
-#include <asm/k8.h>
+#include <asm/amd_nb.h>
 #include <asm/gart.h>
 #include "agp.h"
 
@@ -124,7 +124,7 @@ static int amd64_fetch_size(void)
         u32 temp;
         struct aper_size_info_32 *values;
 
-        dev = k8_northbridges[0];
+        dev = k8_northbridges.nb_misc[0];
         if (dev==NULL)
                 return 0;
 
@@ -181,10 +181,14 @@ static int amd_8151_configure(void)
         unsigned long gatt_bus = virt_to_phys(agp_bridge->gatt_table_real);
         int i;
 
+        if (!k8_northbridges.gart_supported)
+                return 0;
+
         /* Configure AGP regs in each x86-64 host bridge. */
-        for (i = 0; i < num_k8_northbridges; i++) {
+        for (i = 0; i < k8_northbridges.num; i++) {
                 agp_bridge->gart_bus_addr =
-                                amd64_configure(k8_northbridges[i], gatt_bus);
+                                amd64_configure(k8_northbridges.nb_misc[i],
+                                                gatt_bus);
         }
         k8_flush_garts();
         return 0;
@@ -195,11 +199,15 @@ static void amd64_cleanup(void)
 {
         u32 tmp;
         int i;
-        for (i = 0; i < num_k8_northbridges; i++) {
-                struct pci_dev *dev = k8_northbridges[i];
+
+        if (!k8_northbridges.gart_supported)
+                return;
+
+        for (i = 0; i < k8_northbridges.num; i++) {
+                struct pci_dev *dev = k8_northbridges.nb_misc[i];
                 /* disable gart translation */
                 pci_read_config_dword(dev, AMD64_GARTAPERTURECTL, &tmp);
-                tmp &= ~AMD64_GARTEN;
+                tmp &= ~GARTEN;
                 pci_write_config_dword(dev, AMD64_GARTAPERTURECTL, tmp);
         }
 }
@@ -313,22 +321,25 @@ static __devinit int fix_northbridge(struct pci_dev *nb, struct pci_dev *agp,
         if (order < 0 || !agp_aperture_valid(aper, (32*1024*1024)<<order))
                 return -1;
 
-        pci_write_config_dword(nb, AMD64_GARTAPERTURECTL, order << 1);
+        gart_set_size_and_enable(nb, order);
         pci_write_config_dword(nb, AMD64_GARTAPERTUREBASE, aper >> 25);
 
         return 0;
 }
 
-static __devinit int cache_nbs (struct pci_dev *pdev, u32 cap_ptr)
+static __devinit int cache_nbs(struct pci_dev *pdev, u32 cap_ptr)
 {
         int i;
 
         if (cache_k8_northbridges() < 0)
                 return -ENODEV;
 
+        if (!k8_northbridges.gart_supported)
+                return -ENODEV;
+
         i = 0;
-        for (i = 0; i < num_k8_northbridges; i++) {
-                struct pci_dev *dev = k8_northbridges[i];
+        for (i = 0; i < k8_northbridges.num; i++) {
+                struct pci_dev *dev = k8_northbridges.nb_misc[i];
                 if (fix_northbridge(dev, pdev, cap_ptr) < 0) {
                         dev_err(&dev->dev, "no usable aperture found\n");
 #ifdef __x86_64__
@@ -405,7 +416,8 @@ static int __devinit uli_agp_init(struct pci_dev *pdev)
         }
 
         /* shadow x86-64 registers into ULi registers */
-        pci_read_config_dword (k8_northbridges[0], AMD64_GARTAPERTUREBASE, &httfea);
+        pci_read_config_dword (k8_northbridges.nb_misc[0], AMD64_GARTAPERTUREBASE,
+                               &httfea);
 
         /* if x86-64 aperture base is beyond 4G, exit here */
         if ((httfea & 0x7fff) >> (32 - 25)) {
@@ -472,7 +484,8 @@ static int nforce3_agp_init(struct pci_dev *pdev)
         pci_write_config_dword(dev1, NVIDIA_X86_64_1_APSIZE, tmp);
 
         /* shadow x86-64 registers into NVIDIA registers */
-        pci_read_config_dword (k8_northbridges[0], AMD64_GARTAPERTUREBASE, &apbase);
+        pci_read_config_dword (k8_northbridges.nb_misc[0], AMD64_GARTAPERTUREBASE,
+                               &apbase);
 
         /* if x86-64 aperture base is beyond 4G, exit here */
         if ( (apbase & 0x7fff) >> (32 - 25) ) {
diff --git a/drivers/char/agp/generic.c b/drivers/char/agp/generic.c
index d2abf5143983..64255cef8a7d 100644
--- a/drivers/char/agp/generic.c
+++ b/drivers/char/agp/generic.c
@@ -984,7 +984,9 @@ int agp_generic_create_gatt_table(struct agp_bridge_data *bridge)
 
         bridge->driver->cache_flush();
 #ifdef CONFIG_X86
-        set_memory_uc((unsigned long)table, 1 << page_order);
+        if (set_memory_uc((unsigned long)table, 1 << page_order))
+                printk(KERN_WARNING "Could not set GATT table memory to UC!");
+
         bridge->gatt_table = (void *)table;
 #else
         bridge->gatt_table = ioremap_nocache(virt_to_phys(table),
diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c
index 05ad4a17a28f..7c4133582dba 100644
--- a/drivers/char/tpm/tpm.c
+++ b/drivers/char/tpm/tpm.c
@@ -47,6 +47,16 @@ enum tpm_duration {
 #define TPM_MAX_PROTECTED_ORDINAL 12
 #define TPM_PROTECTED_ORDINAL_MASK 0xFF
 
+/*
+ * Bug workaround - some TPM's don't flush the most
+ * recently changed pcr on suspend, so force the flush
+ * with an extend to the selected _unused_ non-volatile pcr.
+ */
+static int tpm_suspend_pcr;
+module_param_named(suspend_pcr, tpm_suspend_pcr, uint, 0644);
+MODULE_PARM_DESC(suspend_pcr,
+                 "PCR to use for dummy writes to faciltate flush on suspend.");
+
 static LIST_HEAD(tpm_chip_list);
 static DEFINE_SPINLOCK(driver_lock);
 static DECLARE_BITMAP(dev_mask, TPM_NUM_DEVICES);
@@ -1077,18 +1087,6 @@ static struct tpm_input_header savestate_header = {
         .ordinal = TPM_ORD_SAVESTATE
 };
 
-/* Bug workaround - some TPM's don't flush the most
- * recently changed pcr on suspend, so force the flush
- * with an extend to the selected _unused_ non-volatile pcr.
- */
-static int tpm_suspend_pcr;
-static int __init tpm_suspend_setup(char *str)
-{
-        get_option(&str, &tpm_suspend_pcr);
-        return 1;
-}
-__setup("tpm_suspend_pcr=", tpm_suspend_setup);
-
 /*
  * We are about to suspend. Save the TPM state
  * so that it can be restored.
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index c810481a5bc2..6c1b676643a9 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -48,6 +48,9 @@ struct ports_driver_data {
         /* Used for exporting per-port information to debugfs */
         struct dentry *debugfs_dir;
 
+        /* List of all the devices we're handling */
+        struct list_head portdevs;
+
         /* Number of devices this driver is handling */
         unsigned int index;
 
@@ -108,6 +111,9 @@ struct port_buffer {
  * ports for that device (vdev->priv).
  */
 struct ports_device {
+        /* Next portdev in the list, head is in the pdrvdata struct */
+        struct list_head list;
+
         /*
          * Workqueue handlers where we process deferred work after
          * notification
@@ -178,15 +184,21 @@ struct port {
         struct console cons;
 
         /* Each port associates with a separate char device */
-        struct cdev cdev;
+        struct cdev *cdev;
         struct device *dev;
 
+        /* Reference-counting to handle port hot-unplugs and file operations */
+        struct kref kref;
+
         /* A waitqueue for poll() or blocking read operations */
         wait_queue_head_t waitqueue;
 
         /* The 'name' of the port that we expose via sysfs properties */
         char *name;
 
+        /* We can notify apps of host connect / disconnect events via SIGIO */
+        struct fasync_struct *async_queue;
+
         /* The 'id' to identify the port with the Host */
         u32 id;
 
@@ -221,6 +233,41 @@ out:
         return port;
 }
 
+static struct port *find_port_by_devt_in_portdev(struct ports_device *portdev,
+                                                 dev_t dev)
+{
+        struct port *port;
+        unsigned long flags;
+
+        spin_lock_irqsave(&portdev->ports_lock, flags);
+        list_for_each_entry(port, &portdev->ports, list)
+                if (port->cdev->dev == dev)
+                        goto out;
+        port = NULL;
+out:
+        spin_unlock_irqrestore(&portdev->ports_lock, flags);
+
+        return port;
+}
+
+static struct port *find_port_by_devt(dev_t dev)
+{
+        struct ports_device *portdev;
+        struct port *port;
+        unsigned long flags;
+
+        spin_lock_irqsave(&pdrvdata_lock, flags);
+        list_for_each_entry(portdev, &pdrvdata.portdevs, list) {
+                port = find_port_by_devt_in_portdev(portdev, dev);
+                if (port)
+                        goto out;
+        }
+        port = NULL;
+out:
+        spin_unlock_irqrestore(&pdrvdata_lock, flags);
+        return port;
+}
+
 static struct port *find_port_by_id(struct ports_device *portdev, u32 id)
 {
         struct port *port;
@@ -410,7 +457,10 @@ static ssize_t __send_control_msg(struct ports_device *portdev, u32 port_id,
 static ssize_t send_control_msg(struct port *port, unsigned int event,
                                 unsigned int value)
 {
-        return __send_control_msg(port->portdev, port->id, event, value);
+        /* Did the port get unplugged before userspace closed it? */
+        if (port->portdev)
+                return __send_control_msg(port->portdev, port->id, event, value);
+        return 0;
 }
 
 /* Callers must take the port->outvq_lock */
@@ -459,9 +509,12 @@ static ssize_t send_buf(struct port *port, void *in_buf, size_t in_count,
 
         /*
          * Wait till the host acknowledges it pushed out the data we
-         * sent.  This is done for ports in blocking mode or for data
-         * from the hvc_console; the tty operations are performed with
-         * spinlocks held so we can't sleep here.
+         * sent.  This is done for data from the hvc_console; the tty
+         * operations are performed with spinlocks held so we can't
+         * sleep here.  An alternative would be to copy the data to a
+         * buffer and relax the spinning requirement.  The downside is
+         * we need to kmalloc a GFP_ATOMIC buffer each time the
+         * console driver writes something out.
          */
         while (!virtqueue_get_buf(out_vq, &len))
                 cpu_relax();
@@ -522,6 +575,10 @@ static ssize_t fill_readbuf(struct port *port, char *out_buf, size_t out_count,
 /* The condition that must be true for polling to end */
 static bool will_read_block(struct port *port)
 {
+        if (!port->guest_connected) {
+                /* Port got hot-unplugged. Let's exit. */
+                return false;
+        }
         return !port_has_data(port) && port->host_connected;
 }
 
@@ -572,6 +629,9 @@ static ssize_t port_fops_read(struct file *filp, char __user *ubuf,
                 if (ret < 0)
                         return ret;
         }
+        /* Port got hot-unplugged. */
+        if (!port->guest_connected)
+                return -ENODEV;
         /*
          * We could've received a disconnection message while we were
          * waiting for more data.
@@ -613,6 +673,9 @@ static ssize_t port_fops_write(struct file *filp, const char __user *ubuf,
                 if (ret < 0)
                         return ret;
         }
+        /* Port got hot-unplugged. */
+        if (!port->guest_connected)
+                return -ENODEV;
 
         count = min((size_t)(32 * 1024), count);
 
@@ -626,6 +689,14 @@ static ssize_t port_fops_write(struct file *filp, const char __user *ubuf,
                 goto free_buf;
         }
 
+        /*
+         * We now ask send_buf() to not spin for generic ports -- we
+         * can re-use the same code path that non-blocking file
+         * descriptors take for blocking file descriptors since the
+         * wait is already done and we're certain the write will go
+         * through to the host.
+         */
+        nonblock = true;
         ret = send_buf(port, buf, count, nonblock);
 
         if (nonblock && ret > 0)
@@ -645,6 +716,10 @@ static unsigned int port_fops_poll(struct file *filp, poll_table *wait)
         port = filp->private_data;
         poll_wait(filp, &port->waitqueue, wait);
 
+        if (!port->guest_connected) {
+                /* Port got unplugged */
+                return POLLHUP;
+        }
         ret = 0;
         if (!will_read_block(port))
                 ret |= POLLIN | POLLRDNORM;
@@ -656,6 +731,8 @@ static unsigned int port_fops_poll(struct file *filp, poll_table *wait)
         return ret;
 }
 
+static void remove_port(struct kref *kref);
+
 static int port_fops_release(struct inode *inode, struct file *filp)
 {
         struct port *port;
@@ -676,6 +753,16 @@ static int port_fops_release(struct inode *inode, struct file *filp)
         reclaim_consumed_buffers(port);
         spin_unlock_irq(&port->outvq_lock);
 
+        /*
+         * Locks aren't necessary here as a port can't be opened after
+         * unplug, and if a port isn't unplugged, a kref would already
+         * exist for the port.  Plus, taking ports_lock here would
+         * create a dependency on other locks taken by functions
+         * inside remove_port if we're the last holder of the port,
+         * creating many problems.
+         */
+        kref_put(&port->kref, remove_port);
+
         return 0;
 }
 
@@ -683,22 +770,31 @@ static int port_fops_open(struct inode *inode, struct file *filp)
 {
         struct cdev *cdev = inode->i_cdev;
         struct port *port;
+        int ret;
 
-        port = container_of(cdev, struct port, cdev);
+        port = find_port_by_devt(cdev->dev);
         filp->private_data = port;
 
+        /* Prevent against a port getting hot-unplugged at the same time */
+        spin_lock_irq(&port->portdev->ports_lock);
+        kref_get(&port->kref);
+        spin_unlock_irq(&port->portdev->ports_lock);
+
         /*
          * Don't allow opening of console port devices -- that's done
          * via /dev/hvc
          */
-        if (is_console_port(port))
-                return -ENXIO;
+        if (is_console_port(port)) {
+                ret = -ENXIO;
+                goto out;
+        }
 
         /* Allow only one process to open a particular port at a time */
         spin_lock_irq(&port->inbuf_lock);
         if (port->guest_connected) {
                 spin_unlock_irq(&port->inbuf_lock);
-                return -EMFILE;
+                ret = -EMFILE;
+                goto out;
         }
 
         port->guest_connected = true;
@@ -713,10 +809,23 @@ static int port_fops_open(struct inode *inode, struct file *filp)
         reclaim_consumed_buffers(port);
         spin_unlock_irq(&port->outvq_lock);
 
+        nonseekable_open(inode, filp);
+
         /* Notify host of port being opened */
         send_control_msg(filp->private_data, VIRTIO_CONSOLE_PORT_OPEN, 1);
 
         return 0;
+out:
+        kref_put(&port->kref, remove_port);
+        return ret;
+}
+
+static int port_fops_fasync(int fd, struct file *filp, int mode)
+{
+        struct port *port;
+
+        port = filp->private_data;
+        return fasync_helper(fd, filp, mode, &port->async_queue);
 }
 
 /*
@@ -732,6 +841,8 @@ static const struct file_operations port_fops = {
         .write = port_fops_write,
         .poll  = port_fops_poll,
         .release = port_fops_release,
+        .fasync = port_fops_fasync,
+        .llseek = no_llseek,
 };
 
 /*
@@ -990,6 +1101,12 @@ static unsigned int fill_queue(struct virtqueue *vq, spinlock_t *lock)
         return nr_added_bufs;
 }
 
+static void send_sigio_to_port(struct port *port)
+{
+        if (port->async_queue && port->guest_connected)
+                kill_fasync(&port->async_queue, SIGIO, POLL_OUT);
+}
+
 static int add_port(struct ports_device *portdev, u32 id)
 {
         char debugfs_name[16];
@@ -1004,6 +1121,7 @@ static int add_port(struct ports_device *portdev, u32 id)
                 err = -ENOMEM;
                 goto fail;
         }
+        kref_init(&port->kref);
 
         port->portdev = portdev;
         port->id = id;
@@ -1011,6 +1129,7 @@ static int add_port(struct ports_device *portdev, u32 id)
         port->name = NULL;
         port->inbuf = NULL;
         port->cons.hvc = NULL;
+        port->async_queue = NULL;
 
         port->cons.ws.ws_row = port->cons.ws.ws_col = 0;
 
@@ -1021,14 +1140,20 @@ static int add_port(struct ports_device *portdev, u32 id)
         port->in_vq = portdev->in_vqs[port->id];
         port->out_vq = portdev->out_vqs[port->id];
 
-        cdev_init(&port->cdev, &port_fops);
+        port->cdev = cdev_alloc();
+        if (!port->cdev) {
+                dev_err(&port->portdev->vdev->dev, "Error allocating cdev\n");
+                err = -ENOMEM;
+                goto free_port;
+        }
+        port->cdev->ops = &port_fops;
 
         devt = MKDEV(portdev->chr_major, id);
-        err = cdev_add(&port->cdev, devt, 1);
+        err = cdev_add(port->cdev, devt, 1);
         if (err < 0) {
                 dev_err(&port->portdev->vdev->dev,
                         "Error %d adding cdev for port %u\n", err, id);
-                goto free_port;
+                goto free_cdev;
         }
         port->dev = device_create(pdrvdata.class, &port->portdev->vdev->dev,
                                   devt, port, "vport%up%u",
@@ -1093,7 +1218,7 @@ free_inbufs:
 free_device:
         device_destroy(pdrvdata.class, port->dev->devt);
 free_cdev:
-        cdev_del(&port->cdev);
+        cdev_del(port->cdev);
 free_port:
         kfree(port);
 fail:
@@ -1102,21 +1227,45 @@ fail:
         return err;
 }
 
-/* Remove all port-specific data. */
-static int remove_port(struct port *port)
+/* No users remain, remove all port-specific data. */
+static void remove_port(struct kref *kref)
+{
+        struct port *port;
+
+        port = container_of(kref, struct port, kref);
+
+        sysfs_remove_group(&port->dev->kobj, &port_attribute_group);
+        device_destroy(pdrvdata.class, port->dev->devt);
+        cdev_del(port->cdev);
+
+        kfree(port->name);
+
+        debugfs_remove(port->debugfs_file);
+
+        kfree(port);
+}
+
+/*
+ * Port got unplugged.  Remove port from portdev's list and drop the
+ * kref reference.  If no userspace has this port opened, it will
+ * result in immediate removal the port.
+ */
+static void unplug_port(struct port *port)
 {
         struct port_buffer *buf;
 
+        spin_lock_irq(&port->portdev->ports_lock);
+        list_del(&port->list);
+        spin_unlock_irq(&port->portdev->ports_lock);
+
         if (port->guest_connected) {
                 port->guest_connected = false;
                 port->host_connected = false;
                 wake_up_interruptible(&port->waitqueue);
-                send_control_msg(port, VIRTIO_CONSOLE_PORT_OPEN, 0);
-        }
 
-        spin_lock_irq(&port->portdev->ports_lock);
-        list_del(&port->list);
-        spin_unlock_irq(&port->portdev->ports_lock);
+                /* Let the app know the port is going down. */
+                send_sigio_to_port(port);
+        }
 
         if (is_console_port(port)) {
                 spin_lock_irq(&pdrvdata_lock);
@@ -1135,9 +1284,6 @@ static int remove_port(struct port *port)
                 hvc_remove(port->cons.hvc);
 #endif
         }
-        sysfs_remove_group(&port->dev->kobj, &port_attribute_group);
-        device_destroy(pdrvdata.class, port->dev->devt);
-        cdev_del(&port->cdev);
 
         /* Remove unused data this port might have received. */
         discard_port_data(port);
@@ -1148,12 +1294,19 @@ static int remove_port(struct port *port)
         while ((buf = virtqueue_detach_unused_buf(port->in_vq)))
                 free_buf(buf);
 
-        kfree(port->name);
-
-        debugfs_remove(port->debugfs_file);
+        /*
+         * We should just assume the device itself has gone off --
+         * else a close on an open port later will try to send out a
+         * control message.
+         */
+        port->portdev = NULL;
 
-        kfree(port);
-        return 0;
+        /*
+         * Locks around here are not necessary - a port can't be
+         * opened after we removed the port struct from ports_list
+         * above.
+         */
+        kref_put(&port->kref, remove_port);
 }
 
 /* Any private messages that the Host and Guest want to share */
@@ -1192,7 +1345,7 @@ static void handle_control_message(struct ports_device *portdev,
                 add_port(portdev, cpkt->id);
                 break;
         case VIRTIO_CONSOLE_PORT_REMOVE:
-                remove_port(port);
+                unplug_port(port);
                 break;
         case VIRTIO_CONSOLE_CONSOLE_PORT:
                 if (!cpkt->value)
@@ -1234,6 +1387,12 @@ static void handle_control_message(struct ports_device *portdev,
                 spin_lock_irq(&port->outvq_lock);
                 reclaim_consumed_buffers(port);
                 spin_unlock_irq(&port->outvq_lock);
+
+                /*
+                 * If the guest is connected, it'll be interested in
+                 * knowing the host connection state changed.
+                 */
+                send_sigio_to_port(port);
                 break;
         case VIRTIO_CONSOLE_PORT_NAME:
                 /*
@@ -1330,6 +1489,9 @@ static void in_intr(struct virtqueue *vq)
 
         wake_up_interruptible(&port->waitqueue);
 
+        /* Send a SIGIO indicating new data in case the process asked for it */
+        send_sigio_to_port(port);
+
         if (is_console_port(port) && hvc_poll(port->cons.hvc))
                 hvc_kick();
 }
@@ -1566,6 +1728,10 @@ static int __devinit virtcons_probe(struct virtio_device *vdev)
                 add_port(portdev, 0);
         }
 
+        spin_lock_irq(&pdrvdata_lock);
+        list_add_tail(&portdev->list, &pdrvdata.portdevs);
+        spin_unlock_irq(&pdrvdata_lock);
+
         __send_control_msg(portdev, VIRTIO_CONSOLE_BAD_ID,
                            VIRTIO_CONSOLE_DEVICE_READY, 1);
         return 0;
@@ -1589,23 +1755,41 @@ static void virtcons_remove(struct virtio_device *vdev)
 {
         struct ports_device *portdev;
         struct port *port, *port2;
-        struct port_buffer *buf;
-        unsigned int len;
 
         portdev = vdev->priv;
 
+        spin_lock_irq(&pdrvdata_lock);
+        list_del(&portdev->list);
+        spin_unlock_irq(&pdrvdata_lock);
+
+        /* Disable interrupts for vqs */
+        vdev->config->reset(vdev);
+        /* Finish up work that's lined up */
         cancel_work_sync(&portdev->control_work);
 
         list_for_each_entry_safe(port, port2, &portdev->ports, list)
-                remove_port(port);
+                unplug_port(port);
 
         unregister_chrdev(portdev->chr_major, "virtio-portsdev");
 
-        while ((buf = virtqueue_get_buf(portdev->c_ivq, &len)))
-                free_buf(buf);
+        /*
+         * When yanking out a device, we immediately lose the
+         * (device-side) queues.  So there's no point in keeping the
+         * guest side around till we drop our final reference.  This
+         * also means that any ports which are in an open state will
+         * have to just stop using the port, as the vqs are going
+         * away.
+         */
+        if (use_multiport(portdev)) {
+                struct port_buffer *buf;
+                unsigned int len;
 
-        while ((buf = virtqueue_detach_unused_buf(portdev->c_ivq)))
-                free_buf(buf);
+                while ((buf = virtqueue_get_buf(portdev->c_ivq, &len)))
+                        free_buf(buf);
+
+                while ((buf = virtqueue_detach_unused_buf(portdev->c_ivq)))
+                        free_buf(buf);
+        }
 
         vdev->config->del_vqs(vdev);
         kfree(portdev->in_vqs);
@@ -1652,6 +1836,7 @@ static int __init init(void)
                            PTR_ERR(pdrvdata.debugfs_dir));
         }
         INIT_LIST_HEAD(&pdrvdata.consoles);
+        INIT_LIST_HEAD(&pdrvdata.portdevs);
 
         return register_virtio_driver(&virtio_console);
 }
diff --git a/drivers/dma/ioat/dma_v2.c b/drivers/dma/ioat/dma_v2.c
index 216f9d383b5b..effd140fc042 100644
--- a/drivers/dma/ioat/dma_v2.c
+++ b/drivers/dma/ioat/dma_v2.c
@@ -879,7 +879,7 @@ int __devinit ioat2_dma_probe(struct ioatdma_device *device, int dca)
         dma->device_issue_pending = ioat2_issue_pending;
         dma->device_alloc_chan_resources = ioat2_alloc_chan_resources;
         dma->device_free_chan_resources = ioat2_free_chan_resources;
-        dma->device_tx_status = ioat_tx_status;
+        dma->device_tx_status = ioat_dma_tx_status;
 
         err = ioat_probe(device);
         if (err)
diff --git a/drivers/edac/Kconfig b/drivers/edac/Kconfig
index 70bb350de996..9dbb28b9559f 100644
--- a/drivers/edac/Kconfig
+++ b/drivers/edac/Kconfig
@@ -39,7 +39,7 @@ config EDAC_DEBUG
           there're four debug levels (x=0,1,2,3 from low to high).
           Usually you should select 'N'.
 
- config EDAC_DECODE_MCE
+config EDAC_DECODE_MCE
         tristate "Decode MCEs in human-readable form (only on AMD for now)"
         depends on CPU_SUP_AMD && X86_MCE
         default y
@@ -51,6 +51,16 @@ config EDAC_DEBUG
           which occur really early upon boot, before the module infrastructure
           has been initialized.
 
+config EDAC_MCE_INJ
+        tristate "Simple MCE injection interface over /sysfs"
+        depends on EDAC_DECODE_MCE
+        default n
+        help
+          This is a simple interface to inject MCEs over /sysfs and test
+          the MCE decoding code in EDAC.
+
+          This is currently AMD-only.
+
 config EDAC_MM_EDAC
         tristate "Main Memory EDAC (Error Detection And Correction) reporting"
         help
@@ -66,13 +76,13 @@ config EDAC_MCE
 
 config EDAC_AMD64
         tristate "AMD64 (Opteron, Athlon64) K8, F10h, F11h"
-        depends on EDAC_MM_EDAC && K8_NB && X86_64 && PCI && EDAC_DECODE_MCE
+        depends on EDAC_MM_EDAC && AMD_NB && X86_64 && PCI && EDAC_DECODE_MCE
         help
           Support for error detection and correction on the AMD 64
           Families of Memory Controllers (K8, F10h and F11h)
 
 config EDAC_AMD64_ERROR_INJECTION
-        bool "Sysfs Error Injection facilities"
+        bool "Sysfs HW Error injection facilities"
         depends on EDAC_AMD64
         help
           Recent Opterons (Family 10h and later) provide for Memory Error
diff --git a/drivers/edac/Makefile b/drivers/edac/Makefile
index ca6b1bb24ccc..32c7bc93c525 100644
--- a/drivers/edac/Makefile
+++ b/drivers/edac/Makefile
@@ -17,6 +17,9 @@ ifdef CONFIG_PCI
 edac_core-objs  += edac_pci.o edac_pci_sysfs.o
 endif
 
+obj-$(CONFIG_EDAC_MCE_INJ)              += mce_amd_inj.o
+
+edac_mce_amd-objs                       := mce_amd.o
 obj-$(CONFIG_EDAC_DECODE_MCE)           += edac_mce_amd.o
 
 obj-$(CONFIG_EDAC_AMD76X)               += amd76x_edac.o
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index e7d5d6b5dcf6..8521401bbd75 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -1,5 +1,5 @@
 #include "amd64_edac.h"
-#include <asm/k8.h>
+#include <asm/amd_nb.h>
 
 static struct edac_pci_ctl_info *amd64_ctl_pci;
 
@@ -2073,11 +2073,18 @@ static inline void __amd64_decode_bus_error(struct mem_ctl_info *mci,
                 amd64_handle_ue(mci, info);
 }
 
-void amd64_decode_bus_error(int node_id, struct err_regs *regs)
+void amd64_decode_bus_error(int node_id, struct mce *m, u32 nbcfg)
 {
         struct mem_ctl_info *mci = mci_lookup[node_id];
+        struct err_regs regs;
 
-        __amd64_decode_bus_error(mci, regs);
+        regs.nbsl  = (u32) m->status;
+        regs.nbsh  = (u32)(m->status >> 32);
+        regs.nbeal = (u32) m->addr;
+        regs.nbeah = (u32)(m->addr >> 32);
+        regs.nbcfg = nbcfg;
+
+        __amd64_decode_bus_error(mci, &regs);
 
         /*
          * Check the UE bit of the NB status high register, if set generate some
@@ -2086,7 +2093,7 @@ void amd64_decode_bus_error(int node_id, struct err_regs *regs)
          *
          * FIXME: this should go somewhere else, if at all.
          */
-        if (regs->nbsh & K8_NBSH_UC_ERR && !report_gart_errors)
+        if (regs.nbsh & K8_NBSH_UC_ERR && !report_gart_errors)
                 edac_mc_handle_ue_no_info(mci, "UE bit is set");
 
 }
@@ -2927,7 +2934,7 @@ static int __init amd64_edac_init(void)
          * to finish initialization of the MC instances.
          */
         err = -ENODEV;
-        for (nb = 0; nb < num_k8_northbridges; nb++) {
+        for (nb = 0; nb < k8_northbridges.num; nb++) {
                 if (!pvt_lookup[nb])
                         continue;
 
diff --git a/drivers/edac/amd64_edac.h b/drivers/edac/amd64_edac.h
index 613b9381e71a..044aee4f944d 100644
--- a/drivers/edac/amd64_edac.h
+++ b/drivers/edac/amd64_edac.h
@@ -72,7 +72,7 @@
 #include <linux/edac.h>
 #include <asm/msr.h>
 #include "edac_core.h"
-#include "edac_mce_amd.h"
+#include "mce_amd.h"
 
 #define amd64_printk(level, fmt, arg...) \
         edac_printk(level, "amd64", fmt, ##arg)
@@ -482,11 +482,10 @@ extern const char *rrrr_msgs[16];
 extern const char *to_msgs[2];
 extern const char *pp_msgs[4];
 extern const char *ii_msgs[4];
-extern const char *ext_msgs[32];
 extern const char *htlink_msgs[8];
 
 #ifdef CONFIG_EDAC_DEBUG
-#define NUM_DBG_ATTRS 9
+#define NUM_DBG_ATTRS 5
 #else
 #define NUM_DBG_ATTRS 0
 #endif
diff --git a/drivers/edac/amd64_edac_dbg.c b/drivers/edac/amd64_edac_dbg.c
index 59cf2cf6e11e..e3562288f4ce 100644
--- a/drivers/edac/amd64_edac_dbg.c
+++ b/drivers/edac/amd64_edac_dbg.c
@@ -1,167 +1,16 @@
 #include "amd64_edac.h"
 
-/*
- * accept a hex value and store it into the virtual error register file, field:
- * nbeal and nbeah. Assume virtual error values have already been set for: NBSL,
- * NBSH and NBCFG. Then proceed to map the error values to a MC, CSROW and
- * CHANNEL
- */
-static ssize_t amd64_nbea_store(struct mem_ctl_info *mci, const char *data,
-                                size_t count)
-{
-        struct amd64_pvt *pvt = mci->pvt_info;
-        unsigned long long value;
-        int ret = 0;
-
-        ret = strict_strtoull(data, 16, &value);
-        if (ret != -EINVAL) {
-                debugf0("received NBEA= 0x%llx\n", value);
-
-                /* place the value into the virtual error packet */
-                pvt->ctl_error_info.nbeal = (u32) value;
-                value >>= 32;
-                pvt->ctl_error_info.nbeah = (u32) value;
-
-                /* Process the Mapping request */
-                /* TODO: Add race prevention */
-                amd_decode_nb_mce(pvt->mc_node_id, &pvt->ctl_error_info, 1);
-
-                return count;
-        }
-        return ret;
-}
-
-/* display back what the last NBEA (MCA NB Address (MC4_ADDR)) was written */
-static ssize_t amd64_nbea_show(struct mem_ctl_info *mci, char *data)
-{
-        struct amd64_pvt *pvt = mci->pvt_info;
-        u64 value;
-
-        value = pvt->ctl_error_info.nbeah;
-        value <<= 32;
-        value |= pvt->ctl_error_info.nbeal;
-
-        return sprintf(data, "%llx\n", value);
-}
-
-/* store the NBSL (MCA NB Status Low (MC4_STATUS)) value user desires */
-static ssize_t amd64_nbsl_store(struct mem_ctl_info *mci, const char *data,
-                                size_t count)
-{
-        struct amd64_pvt *pvt = mci->pvt_info;
-        unsigned long value;
-        int ret = 0;
-
-        ret = strict_strtoul(data, 16, &value);
-        if (ret != -EINVAL) {
-                debugf0("received NBSL= 0x%lx\n", value);
-
-                pvt->ctl_error_info.nbsl = (u32) value;
-
-                return count;
-        }
-        return ret;
-}
-
-/* display back what the last NBSL value written */
-static ssize_t amd64_nbsl_show(struct mem_ctl_info *mci, char *data)
-{
-        struct amd64_pvt *pvt = mci->pvt_info;
-        u32 value;
-
-        value = pvt->ctl_error_info.nbsl;
-
-        return sprintf(data, "%x\n", value);
-}
-
-/* store the NBSH (MCA NB Status High) value user desires */
-static ssize_t amd64_nbsh_store(struct mem_ctl_info *mci, const char *data,
-                                size_t count)
-{
-        struct amd64_pvt *pvt = mci->pvt_info;
-        unsigned long value;
-        int ret = 0;
-
-        ret = strict_strtoul(data, 16, &value);
-        if (ret != -EINVAL) {
-                debugf0("received NBSH= 0x%lx\n", value);
-
-                pvt->ctl_error_info.nbsh = (u32) value;
-
-                return count;
-        }
-        return ret;
-}
-
-/* display back what the last NBSH value written */
-static ssize_t amd64_nbsh_show(struct mem_ctl_info *mci, char *data)
-{
-        struct amd64_pvt *pvt = mci->pvt_info;
-        u32 value;
-
-        value = pvt->ctl_error_info.nbsh;
-
-        return sprintf(data, "%x\n", value);
+#define EDAC_DCT_ATTR_SHOW(reg)                                         \
+static ssize_t amd64_##reg##_show(struct mem_ctl_info *mci, char *data) \
+{                                                                       \
+        struct amd64_pvt *pvt = mci->pvt_info;                          \
+                return sprintf(data, "0x%016llx\n", (u64)pvt->reg);     \
 }
 
-/* accept and store the NBCFG (MCA NB Configuration) value user desires */
-static ssize_t amd64_nbcfg_store(struct mem_ctl_info *mci,
-                                        const char *data, size_t count)
-{
-        struct amd64_pvt *pvt = mci->pvt_info;
-        unsigned long value;
-        int ret = 0;
-
-        ret = strict_strtoul(data, 16, &value);
-        if (ret != -EINVAL) {
-                debugf0("received NBCFG= 0x%lx\n", value);
-
-                pvt->ctl_error_info.nbcfg = (u32) value;
-
-                return count;
-        }
-        return ret;
-}
-
-/* various show routines for the controls of a MCI */
-static ssize_t amd64_nbcfg_show(struct mem_ctl_info *mci, char *data)
-{
-        struct amd64_pvt *pvt = mci->pvt_info;
-
-        return sprintf(data, "%x\n", pvt->ctl_error_info.nbcfg);
-}
-
-
-static ssize_t amd64_dhar_show(struct mem_ctl_info *mci, char *data)
-{
-        struct amd64_pvt *pvt = mci->pvt_info;
-
-        return sprintf(data, "%x\n", pvt->dhar);
-}
-
-
-static ssize_t amd64_dbam_show(struct mem_ctl_info *mci, char *data)
-{
-        struct amd64_pvt *pvt = mci->pvt_info;
-
-        return sprintf(data, "%x\n", pvt->dbam0);
-}
-
-
-static ssize_t amd64_topmem_show(struct mem_ctl_info *mci, char *data)
-{
-        struct amd64_pvt *pvt = mci->pvt_info;
-
-        return sprintf(data, "%llx\n", pvt->top_mem);
-}
-
-
-static ssize_t amd64_topmem2_show(struct mem_ctl_info *mci, char *data)
-{
-        struct amd64_pvt *pvt = mci->pvt_info;
-
-        return sprintf(data, "%llx\n", pvt->top_mem2);
-}
+EDAC_DCT_ATTR_SHOW(dhar);
+EDAC_DCT_ATTR_SHOW(dbam0);
+EDAC_DCT_ATTR_SHOW(top_mem);
+EDAC_DCT_ATTR_SHOW(top_mem2);
 
 static ssize_t amd64_hole_show(struct mem_ctl_info *mci, char *data)
 {
@@ -182,38 +31,6 @@ struct mcidev_sysfs_attribute amd64_dbg_attrs[] = {
 
         {
                 .attr = {
-                        .name = "nbea_ctl",
-                        .mode = (S_IRUGO | S_IWUSR)
-                },
-                .show = amd64_nbea_show,
-                .store = amd64_nbea_store,
-        },
-        {
-                .attr = {
-                        .name = "nbsl_ctl",
-                        .mode = (S_IRUGO | S_IWUSR)
-                },
-                .show = amd64_nbsl_show,
-                .store = amd64_nbsl_store,
-        },
-        {
-                .attr = {
-                        .name = "nbsh_ctl",
-                        .mode = (S_IRUGO | S_IWUSR)
-                },
-                .show = amd64_nbsh_show,
-                .store = amd64_nbsh_store,
-        },
-        {
-                .attr = {
-                        .name = "nbcfg_ctl",
-                        .mode = (S_IRUGO | S_IWUSR)
-                },
-                .show = amd64_nbcfg_show,
-                .store = amd64_nbcfg_store,
-        },
-        {
-                .attr = {
                         .name = "dhar",
                         .mode = (S_IRUGO)
                 },
@@ -225,7 +42,7 @@ struct mcidev_sysfs_attribute amd64_dbg_attrs[] = {
                         .name = "dbam",
                         .mode = (S_IRUGO)
                 },
-                .show = amd64_dbam_show,
+                .show = amd64_dbam0_show,
                 .store = NULL,
         },
         {
@@ -233,7 +50,7 @@ struct mcidev_sysfs_attribute amd64_dbg_attrs[] = {
                         .name = "topmem",
                         .mode = (S_IRUGO)
                 },
-                .show = amd64_topmem_show,
+                .show = amd64_top_mem_show,
                 .store = NULL,
         },
         {
@@ -241,7 +58,7 @@ struct mcidev_sysfs_attribute amd64_dbg_attrs[] = {
                         .name = "topmem2",
                         .mode = (S_IRUGO)
                 },
-                .show = amd64_topmem2_show,
+                .show = amd64_top_mem2_show,
                 .store = NULL,
         },
         {
diff --git a/drivers/edac/edac_device_sysfs.c b/drivers/edac/edac_device_sysfs.c
index 070968178a24..2941dca91aae 100644
--- a/drivers/edac/edac_device_sysfs.c
+++ b/drivers/edac/edac_device_sysfs.c
@@ -13,6 +13,7 @@
 #include <linux/ctype.h>
 #include <linux/module.h>
 #include <linux/slab.h>
+#include <linux/edac.h>
 
 #include "edac_core.h"
 #include "edac_module.h"
@@ -235,7 +236,7 @@ int edac_device_register_sysfs_main_kobj(struct edac_device_ctl_info *edac_dev)
         debugf1("%s()\n", __func__);
 
         /* get the /sys/devices/system/edac reference */
-        edac_class = edac_get_edac_class();
+        edac_class = edac_get_sysfs_class();
         if (edac_class == NULL) {
                 debugf1("%s() no edac_class error\n", __func__);
                 err = -ENODEV;
@@ -255,7 +256,7 @@ int edac_device_register_sysfs_main_kobj(struct edac_device_ctl_info *edac_dev)
 
         if (!try_module_get(edac_dev->owner)) {
                 err = -ENODEV;
-                goto err_out;
+                goto err_mod_get;
         }
 
         /* register */
@@ -282,6 +283,9 @@ int edac_device_register_sysfs_main_kobj(struct edac_device_ctl_info *edac_dev)
 err_kobj_reg:
         module_put(edac_dev->owner);
 
+err_mod_get:
+        edac_put_sysfs_class();
+
 err_out:
         return err;
 }
@@ -290,12 +294,11 @@ err_out:
  * edac_device_unregister_sysfs_main_kobj:
  *      the '..../edac/<name>' kobject
  */
-void edac_device_unregister_sysfs_main_kobj(
-                                        struct edac_device_ctl_info *edac_dev)
+void edac_device_unregister_sysfs_main_kobj(struct edac_device_ctl_info *dev)
 {
         debugf0("%s()\n", __func__);
         debugf4("%s() name of kobject is: %s\n",
-                __func__, kobject_name(&edac_dev->kobj));
+                __func__, kobject_name(&dev->kobj));
 
         /*
          * Unregister the edac device's kobject and
@@ -304,7 +307,8 @@ void edac_device_unregister_sysfs_main_kobj(
          *   a) module_put() this module
          *   b) 'kfree' the memory
          */
-        kobject_put(&edac_dev->kobj);
+        kobject_put(&dev->kobj);
+        edac_put_sysfs_class();
 }
 
 /* edac_dev -> instance information */
diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
index 8aad94d10c0c..a4135860149b 100644
--- a/drivers/edac/edac_mc_sysfs.c
+++ b/drivers/edac/edac_mc_sysfs.c
@@ -11,6 +11,7 @@
 
 #include <linux/ctype.h>
 #include <linux/slab.h>
+#include <linux/edac.h>
 #include <linux/bug.h>
 
 #include "edac_core.h"
@@ -1011,13 +1012,13 @@ void edac_remove_sysfs_mci_device(struct mem_ctl_info *mci)
  */
 int edac_sysfs_setup_mc_kset(void)
 {
-        int err = 0;
+        int err = -EINVAL;
         struct sysdev_class *edac_class;
 
         debugf1("%s()\n", __func__);
 
         /* get the /sys/devices/system/edac class reference */
-        edac_class = edac_get_edac_class();
+        edac_class = edac_get_sysfs_class();
         if (edac_class == NULL) {
                 debugf1("%s() no edac_class error=%d\n", __func__, err);
                 goto fail_out;
@@ -1028,15 +1029,16 @@ int edac_sysfs_setup_mc_kset(void)
         if (!mc_kset) {
                 err = -ENOMEM;
                 debugf1("%s() Failed to register '.../edac/mc'\n", __func__);
-                goto fail_out;
+                goto fail_kset;
         }
 
         debugf1("%s() Registered '.../edac/mc' kobject\n", __func__);
 
         return 0;
 
+fail_kset:
+        edac_put_sysfs_class();
 
-        /* error unwind stack */
 fail_out:
         return err;
 }
@@ -1049,5 +1051,6 @@ fail_out:
 void edac_sysfs_teardown_mc_kset(void)
 {
         kset_unregister(mc_kset);
+        edac_put_sysfs_class();
 }
 
diff --git a/drivers/edac/edac_mce_amd.c b/drivers/edac/edac_mce_amd.c
deleted file mode 100644
index 9014df6f605d..000000000000
--- a/drivers/edac/edac_mce_amd.c
+++ /dev/null
@@ -1,452 +0,0 @@
-#include <linux/module.h>
-#include "edac_mce_amd.h"
-
-static bool report_gart_errors;
-static void (*nb_bus_decoder)(int node_id, struct err_regs *regs);
-
-void amd_report_gart_errors(bool v)
-{
-        report_gart_errors = v;
-}
-EXPORT_SYMBOL_GPL(amd_report_gart_errors);
-
-void amd_register_ecc_decoder(void (*f)(int, struct err_regs *))
-{
-        nb_bus_decoder = f;
-}
-EXPORT_SYMBOL_GPL(amd_register_ecc_decoder);
-
-void amd_unregister_ecc_decoder(void (*f)(int, struct err_regs *))
-{
-        if (nb_bus_decoder) {
-                WARN_ON(nb_bus_decoder != f);
-
-                nb_bus_decoder = NULL;
-        }
-}
-EXPORT_SYMBOL_GPL(amd_unregister_ecc_decoder);
-
-/*
- * string representation for the different MCA reported error types, see F3x48
- * or MSR0000_0411.
- */
-const char *tt_msgs[] = {        /* transaction type */
-        "instruction",
-        "data",
-        "generic",
-        "reserved"
-};
-EXPORT_SYMBOL_GPL(tt_msgs);
-
-const char *ll_msgs[] = {       /* cache level */
-        "L0",
-        "L1",
-        "L2",
-        "L3/generic"
-};
-EXPORT_SYMBOL_GPL(ll_msgs);
-
-const char *rrrr_msgs[] = {
-        "generic",
-        "generic read",
-        "generic write",
-        "data read",
-        "data write",
-        "inst fetch",
-        "prefetch",
-        "evict",
-        "snoop",
-        "reserved RRRR= 9",
-        "reserved RRRR= 10",
-        "reserved RRRR= 11",
-        "reserved RRRR= 12",
-        "reserved RRRR= 13",
-        "reserved RRRR= 14",
-        "reserved RRRR= 15"
-};
-EXPORT_SYMBOL_GPL(rrrr_msgs);
-
-const char *pp_msgs[] = {       /* participating processor */
-        "local node originated (SRC)",
-        "local node responded to request (RES)",
-        "local node observed as 3rd party (OBS)",
-        "generic"
-};
-EXPORT_SYMBOL_GPL(pp_msgs);
-
-const char *to_msgs[] = {
-        "no timeout",
-        "timed out"
-};
-EXPORT_SYMBOL_GPL(to_msgs);
-
-const char *ii_msgs[] = {       /* memory or i/o */
-        "mem access",
-        "reserved",
-        "i/o access",
-        "generic"
-};
-EXPORT_SYMBOL_GPL(ii_msgs);
-
-/*
- * Map the 4 or 5 (family-specific) bits of Extended Error code to the
- * string table.
- */
-const char *ext_msgs[] = {
-        "K8 ECC error",                                 /* 0_0000b */
-        "CRC error on link",                            /* 0_0001b */
-        "Sync error packets on link",                   /* 0_0010b */
-        "Master Abort during link operation",           /* 0_0011b */
-        "Target Abort during link operation",           /* 0_0100b */
-        "Invalid GART PTE entry during table walk",     /* 0_0101b */
-        "Unsupported atomic RMW command received",      /* 0_0110b */
-        "WDT error: NB transaction timeout",            /* 0_0111b */
-        "ECC/ChipKill ECC error",                       /* 0_1000b */
-        "SVM DEV Error",                                /* 0_1001b */
-        "Link Data error",                              /* 0_1010b */
-        "Link/L3/Probe Filter Protocol error",          /* 0_1011b */
-        "NB Internal Arrays Parity error",              /* 0_1100b */
-        "DRAM Address/Control Parity error",            /* 0_1101b */
-        "Link Transmission error",                      /* 0_1110b */
-        "GART/DEV Table Walk Data error"                /* 0_1111b */
-        "Res 0x100 error",                              /* 1_0000b */
-        "Res 0x101 error",                              /* 1_0001b */
-        "Res 0x102 error",                              /* 1_0010b */
-        "Res 0x103 error",                              /* 1_0011b */
-        "Res 0x104 error",                              /* 1_0100b */
-        "Res 0x105 error",                              /* 1_0101b */
-        "Res 0x106 error",                              /* 1_0110b */
-        "Res 0x107 error",                              /* 1_0111b */
-        "Res 0x108 error",                              /* 1_1000b */
-        "Res 0x109 error",                              /* 1_1001b */
-        "Res 0x10A error",                              /* 1_1010b */
-        "Res 0x10B error",                              /* 1_1011b */
-        "ECC error in L3 Cache Data",                   /* 1_1100b */
-        "L3 Cache Tag error",                           /* 1_1101b */
-        "L3 Cache LRU Parity error",                    /* 1_1110b */
-        "Probe Filter error"                            /* 1_1111b */
-};
-EXPORT_SYMBOL_GPL(ext_msgs);
-
-static void amd_decode_dc_mce(u64 mc0_status)
-{
-        u32 ec  = mc0_status & 0xffff;
-        u32 xec = (mc0_status >> 16) & 0xf;
-
-        pr_emerg("Data Cache Error");
-
-        if (xec == 1 && TLB_ERROR(ec))
-                pr_cont(": %s TLB multimatch.\n", LL_MSG(ec));
-        else if (xec == 0) {
-                if (mc0_status & (1ULL << 40))
-                        pr_cont(" during Data Scrub.\n");
-                else if (TLB_ERROR(ec))
-                        pr_cont(": %s TLB parity error.\n", LL_MSG(ec));
-                else if (MEM_ERROR(ec)) {
-                        u8 ll   = ec & 0x3;
-                        u8 tt   = (ec >> 2) & 0x3;
-                        u8 rrrr = (ec >> 4) & 0xf;
-
-                        /* see F10h BKDG (31116), Table 92. */
-                        if (ll == 0x1) {
-                                if (tt != 0x1)
-                                        goto wrong_dc_mce;
-
-                                pr_cont(": Data/Tag %s error.\n", RRRR_MSG(ec));
-
-                        } else if (ll == 0x2 && rrrr == 0x3)
-                                pr_cont(" during L1 linefill from L2.\n");
-                        else
-                                goto wrong_dc_mce;
-                } else if (BUS_ERROR(ec) && boot_cpu_data.x86 == 0xf)
-                        pr_cont(" during system linefill.\n");
-                else
-                        goto wrong_dc_mce;
-        } else
-                goto wrong_dc_mce;
-
-        return;
-
-wrong_dc_mce:
-        pr_warning("Corrupted DC MCE info?\n");
-}
-
-static void amd_decode_ic_mce(u64 mc1_status)
-{
-        u32 ec  = mc1_status & 0xffff;
-        u32 xec = (mc1_status >> 16) & 0xf;
-
-        pr_emerg("Instruction Cache Error");
-
-        if (xec == 1 && TLB_ERROR(ec))
-                pr_cont(": %s TLB multimatch.\n", LL_MSG(ec));
-        else if (xec == 0) {
-                if (TLB_ERROR(ec))
-                        pr_cont(": %s TLB Parity error.\n", LL_MSG(ec));
-                else if (BUS_ERROR(ec)) {
-                        if (boot_cpu_data.x86 == 0xf &&
-                            (mc1_status & (1ULL << 58)))
-                                pr_cont(" during system linefill.\n");
-                        else
-                                pr_cont(" during attempted NB data read.\n");
-                } else if (MEM_ERROR(ec)) {
-                        u8 ll   = ec & 0x3;
-                        u8 rrrr = (ec >> 4) & 0xf;
-
-                        if (ll == 0x2)
-                                pr_cont(" during a linefill from L2.\n");
-                        else if (ll == 0x1) {
-
-                                switch (rrrr) {
-                                case 0x5:
-                                        pr_cont(": Parity error during "
-                                               "data load.\n");
-                                        break;
-
-                                case 0x7:
-                                        pr_cont(": Copyback Parity/Victim"
-                                                " error.\n");
-                                        break;
-
-                                case 0x8:
-                                        pr_cont(": Tag Snoop error.\n");
-                                        break;
-
-                                default:
-                                        goto wrong_ic_mce;
-                                        break;
-                                }
-                        }
-                } else
-                        goto wrong_ic_mce;
-        } else
-                goto wrong_ic_mce;
-
-        return;
-
-wrong_ic_mce:
-        pr_warning("Corrupted IC MCE info?\n");
-}
-
-static void amd_decode_bu_mce(u64 mc2_status)
-{
-        u32 ec = mc2_status & 0xffff;
-        u32 xec = (mc2_status >> 16) & 0xf;
-
-        pr_emerg("Bus Unit Error");
-
-        if (xec == 0x1)
-                pr_cont(" in the write data buffers.\n");
-        else if (xec == 0x3)
-                pr_cont(" in the victim data buffers.\n");
-        else if (xec == 0x2 && MEM_ERROR(ec))
-                pr_cont(": %s error in the L2 cache tags.\n", RRRR_MSG(ec));
-        else if (xec == 0x0) {
-                if (TLB_ERROR(ec))
-                        pr_cont(": %s error in a Page Descriptor Cache or "
-                                "Guest TLB.\n", TT_MSG(ec));
-                else if (BUS_ERROR(ec))
-                        pr_cont(": %s/ECC error in data read from NB: %s.\n",
-                                RRRR_MSG(ec), PP_MSG(ec));
-                else if (MEM_ERROR(ec)) {
-                        u8 rrrr = (ec >> 4) & 0xf;
-
-                        if (rrrr >= 0x7)
-                                pr_cont(": %s error during data copyback.\n",
-                                        RRRR_MSG(ec));
-                        else if (rrrr <= 0x1)
-                                pr_cont(": %s parity/ECC error during data "
-                                        "access from L2.\n", RRRR_MSG(ec));
-                        else
-                                goto wrong_bu_mce;
-                } else
-                        goto wrong_bu_mce;
-        } else
-                goto wrong_bu_mce;
-
-        return;
-
-wrong_bu_mce:
-        pr_warning("Corrupted BU MCE info?\n");
-}
-
-static void amd_decode_ls_mce(u64 mc3_status)
-{
-        u32 ec  = mc3_status & 0xffff;
-        u32 xec = (mc3_status >> 16) & 0xf;
-
-        pr_emerg("Load Store Error");
-
-        if (xec == 0x0) {
-                u8 rrrr = (ec >> 4) & 0xf;
-
-                if (!BUS_ERROR(ec) || (rrrr != 0x3 && rrrr != 0x4))
-                        goto wrong_ls_mce;
-
-                pr_cont(" during %s.\n", RRRR_MSG(ec));
-        }
-        return;
-
-wrong_ls_mce:
-        pr_warning("Corrupted LS MCE info?\n");
-}
-
-void amd_decode_nb_mce(int node_id, struct err_regs *regs, int handle_errors)
-{
-        u32 ec  = ERROR_CODE(regs->nbsl);
-
-        if (!handle_errors)
-                return;
-
-        /*
-         * GART TLB error reporting is disabled by default. Bail out early.
-         */
-        if (TLB_ERROR(ec) && !report_gart_errors)
-                return;
-
-        pr_emerg("Northbridge Error, node %d", node_id);
-
-        /*
-         * F10h, revD can disable ErrCpu[3:0] so check that first and also the
-         * value encoding has changed so interpret those differently
-         */
-        if ((boot_cpu_data.x86 == 0x10) &&
-            (boot_cpu_data.x86_model > 7)) {
-                if (regs->nbsh & K8_NBSH_ERR_CPU_VAL)
-                        pr_cont(", core: %u\n", (u8)(regs->nbsh & 0xf));
-        } else {
-                u8 assoc_cpus = regs->nbsh & 0xf;
-
-                if (assoc_cpus > 0)
-                        pr_cont(", core: %d", fls(assoc_cpus) - 1);
-
-                pr_cont("\n");
-        }
-
-        pr_emerg("%s.\n", EXT_ERR_MSG(regs->nbsl));
-
-        if (BUS_ERROR(ec) && nb_bus_decoder)
-                nb_bus_decoder(node_id, regs);
-}
-EXPORT_SYMBOL_GPL(amd_decode_nb_mce);
-
-static void amd_decode_fr_mce(u64 mc5_status)
-{
-        /* we have only one error signature so match all fields at once. */
-        if ((mc5_status & 0xffff) == 0x0f0f)
-                pr_emerg(" FR Error: CPU Watchdog timer expire.\n");
-        else
-                pr_warning("Corrupted FR MCE info?\n");
-}
-
-static inline void amd_decode_err_code(unsigned int ec)
-{
-        if (TLB_ERROR(ec)) {
-                pr_emerg("Transaction: %s, Cache Level %s\n",
-                         TT_MSG(ec), LL_MSG(ec));
-        } else if (MEM_ERROR(ec)) {
-                pr_emerg("Transaction: %s, Type: %s, Cache Level: %s",
-                         RRRR_MSG(ec), TT_MSG(ec), LL_MSG(ec));
-        } else if (BUS_ERROR(ec)) {
-                pr_emerg("Transaction type: %s(%s), %s, Cache Level: %s, "
-                         "Participating Processor: %s\n",
-                          RRRR_MSG(ec), II_MSG(ec), TO_MSG(ec), LL_MSG(ec),
-                          PP_MSG(ec));
-        } else
-                pr_warning("Huh? Unknown MCE error 0x%x\n", ec);
-}
-
-static int amd_decode_mce(struct notifier_block *nb, unsigned long val,
-                           void *data)
-{
-        struct mce *m = (struct mce *)data;
-        struct err_regs regs;
-        int node, ecc;
-
-        pr_emerg("MC%d_STATUS: ", m->bank);
-
-        pr_cont("%sorrected error, other errors lost: %s, "
-                 "CPU context corrupt: %s",
-                 ((m->status & MCI_STATUS_UC) ? "Unc"  : "C"),
-                 ((m->status & MCI_STATUS_OVER) ? "yes"  : "no"),
-                 ((m->status & MCI_STATUS_PCC) ? "yes" : "no"));
-
-        /* do the two bits[14:13] together */
-        ecc = (m->status >> 45) & 0x3;
-        if (ecc)
-                pr_cont(", %sECC Error", ((ecc == 2) ? "C" : "U"));
-
-        pr_cont("\n");
-
-        switch (m->bank) {
-        case 0:
-                amd_decode_dc_mce(m->status);
-                break;
-
-        case 1:
-                amd_decode_ic_mce(m->status);
-                break;
-
-        case 2:
-                amd_decode_bu_mce(m->status);
-                break;
-
-        case 3:
-                amd_decode_ls_mce(m->status);
-                break;
-
-        case 4:
-                regs.nbsl  = (u32) m->status;
-                regs.nbsh  = (u32)(m->status >> 32);
-                regs.nbeal = (u32) m->addr;
-                regs.nbeah = (u32)(m->addr >> 32);
-                node       = amd_get_nb_id(m->extcpu);
-
-                amd_decode_nb_mce(node, &regs, 1);
-                break;
-
-        case 5:
-                amd_decode_fr_mce(m->status);
-                break;
-
-        default:
-                break;
-        }
-
-        amd_decode_err_code(m->status & 0xffff);
-
-        return NOTIFY_STOP;
-}
-
-static struct notifier_block amd_mce_dec_nb = {
-        .notifier_call  = amd_decode_mce,
-};
-
-static int __init mce_amd_init(void)
-{
-        /*
-         * We can decode MCEs for K8, F10h and F11h CPUs:
-         */
-        if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD)
-                return 0;
-
-        if (boot_cpu_data.x86 < 0xf || boot_cpu_data.x86 > 0x11)
-                return 0;
-
-        atomic_notifier_chain_register(&x86_mce_decoder_chain, &amd_mce_dec_nb);
-
-        return 0;
-}
-early_initcall(mce_amd_init);
-
-#ifdef MODULE
-static void __exit mce_amd_exit(void)
-{
-        atomic_notifier_chain_unregister(&x86_mce_decoder_chain, &amd_mce_dec_nb);
-}
-
-MODULE_DESCRIPTION("AMD MCE decoder");
-MODULE_ALIAS("edac-mce-amd");
-MODULE_LICENSE("GPL");
-module_exit(mce_amd_exit);
-#endif
diff --git a/drivers/edac/edac_module.c b/drivers/edac/edac_module.c
index 7e1374afd967..be4b075c3098 100644
--- a/drivers/edac/edac_module.c
+++ b/drivers/edac/edac_module.c
@@ -27,15 +27,6 @@ EXPORT_SYMBOL_GPL(edac_debug_level);
 struct workqueue_struct *edac_workqueue;
 
 /*
- * sysfs object: /sys/devices/system/edac
- *      need to export to other files in this modules
- */
-static struct sysdev_class edac_class = {
-        .name = "edac",
-};
-static int edac_class_valid;
-
-/*
  * edac_op_state_to_string()
  */
 char *edac_op_state_to_string(int opstate)
@@ -55,60 +46,6 @@ char *edac_op_state_to_string(int opstate)
 }
 
 /*
- * edac_get_edac_class()
- *
- *      return pointer to the edac class of 'edac'
- */
-struct sysdev_class *edac_get_edac_class(void)
-{
-        struct sysdev_class *classptr = NULL;
-
-        if (edac_class_valid)
-                classptr = &edac_class;
-
-        return classptr;
-}
-
-/*
- * edac_register_sysfs_edac_name()
- *
- *      register the 'edac' into /sys/devices/system
- *
- * return:
- *      0  success
- *      !0 error
- */
-static int edac_register_sysfs_edac_name(void)
-{
-        int err;
-
-        /* create the /sys/devices/system/edac directory */
-        err = sysdev_class_register(&edac_class);
-
-        if (err) {
-                debugf1("%s() error=%d\n", __func__, err);
-                return err;
-        }
-
-        edac_class_valid = 1;
-        return 0;
-}
-
-/*
- * sysdev_class_unregister()
- *
- *      unregister the 'edac' from /sys/devices/system
- */
-static void edac_unregister_sysfs_edac_name(void)
-{
-        /* only if currently registered, then unregister it */
-        if (edac_class_valid)
-                sysdev_class_unregister(&edac_class);
-
-        edac_class_valid = 0;
-}
-
-/*
  * edac_workqueue_setup
  *      initialize the edac work queue for polling operations
  */
@@ -154,21 +91,11 @@ static int __init edac_init(void)
         edac_pci_clear_parity_errors();
 
         /*
-         * perform the registration of the /sys/devices/system/edac class object
-         */
-        if (edac_register_sysfs_edac_name()) {
-                edac_printk(KERN_ERR, EDAC_MC,
-                        "Error initializing 'edac' kobject\n");
-                err = -ENODEV;
-                goto error;
-        }
-
-        /*
          * now set up the mc_kset under the edac class object
          */
         err = edac_sysfs_setup_mc_kset();
         if (err)
-                goto sysfs_setup_fail;
+                goto error;
 
         /* Setup/Initialize the workq for this core */
         err = edac_workqueue_setup();
@@ -183,9 +110,6 @@ static int __init edac_init(void)
 workq_fail:
         edac_sysfs_teardown_mc_kset();
 
-sysfs_setup_fail:
-        edac_unregister_sysfs_edac_name();
-
 error:
         return err;
 }
@@ -201,7 +125,6 @@ static void __exit edac_exit(void)
         /* tear down the various subsystems */
         edac_workqueue_teardown();
         edac_sysfs_teardown_mc_kset();
-        edac_unregister_sysfs_edac_name();
 }
 
 /*
diff --git a/drivers/edac/edac_module.h b/drivers/edac/edac_module.h
index 233d4798c3aa..17aabb7b90ec 100644
--- a/drivers/edac/edac_module.h
+++ b/drivers/edac/edac_module.h
@@ -42,7 +42,6 @@ extern void edac_device_unregister_sysfs_main_kobj(
                                 struct edac_device_ctl_info *edac_dev);
 extern int edac_device_create_sysfs(struct edac_device_ctl_info *edac_dev);
 extern void edac_device_remove_sysfs(struct edac_device_ctl_info *edac_dev);
-extern struct sysdev_class *edac_get_edac_class(void);
 
 /* edac core workqueue: single CPU mode */
 extern struct workqueue_struct *edac_workqueue;
diff --git a/drivers/edac/edac_pci_sysfs.c b/drivers/edac/edac_pci_sysfs.c
index c39697df9cb4..023b01cb5175 100644
--- a/drivers/edac/edac_pci_sysfs.c
+++ b/drivers/edac/edac_pci_sysfs.c
@@ -7,7 +7,7 @@
  *
  */
 #include <linux/module.h>
-#include <linux/sysdev.h>
+#include <linux/edac.h>
 #include <linux/slab.h>
 #include <linux/ctype.h>
 
@@ -354,7 +354,7 @@ static int edac_pci_main_kobj_setup(void)
         /* First time, so create the main kobject and its
          * controls and atributes
          */
-        edac_class = edac_get_edac_class();
+        edac_class = edac_get_sysfs_class();
         if (edac_class == NULL) {
                 debugf1("%s() no edac_class\n", __func__);
                 err = -ENODEV;
@@ -368,7 +368,7 @@ static int edac_pci_main_kobj_setup(void)
         if (!try_module_get(THIS_MODULE)) {
                 debugf1("%s() try_module_get() failed\n", __func__);
                 err = -ENODEV;
-                goto decrement_count_fail;
+                goto mod_get_fail;
         }
 
         edac_pci_top_main_kobj = kzalloc(sizeof(struct kobject), GFP_KERNEL);
@@ -403,6 +403,9 @@ kobject_init_and_add_fail:
 kzalloc_fail:
         module_put(THIS_MODULE);
 
+mod_get_fail:
+        edac_put_sysfs_class();
+
 decrement_count_fail:
         /* if are on this error exit, nothing to tear down */
         atomic_dec(&edac_pci_sysfs_refcount);
@@ -429,6 +432,7 @@ static void edac_pci_main_kobj_teardown(void)
                         __func__);
                 kobject_put(edac_pci_top_main_kobj);
         }
+        edac_put_sysfs_class();
 }
 
 /*
diff --git a/drivers/edac/edac_stub.c b/drivers/edac/edac_stub.c
index 20b428aa155e..aab970760b75 100644
--- a/drivers/edac/edac_stub.c
+++ b/drivers/edac/edac_stub.c
@@ -3,10 +3,13 @@
  *
  * Author: Dave Jiang <djiang@mvista.com>
  *
- * 2007 (c) MontaVista Software, Inc. This file is licensed under
- * the terms of the GNU General Public License version 2. This program
- * is licensed "as is" without any warranty of any kind, whether express
- * or implied.
+ * 2007 (c) MontaVista Software, Inc.
+ * 2010 (c) Advanced Micro Devices Inc.
+ *          Borislav Petkov <borislav.petkov@amd.com>
+ *
+ * This file is licensed under the terms of the GNU General Public
+ * License version 2. This program is licensed "as is" without any
+ * warranty of any kind, whether express or implied.
  *
  */
 #include <linux/module.h>
@@ -23,6 +26,8 @@ EXPORT_SYMBOL_GPL(edac_handlers);
 int edac_err_assert = 0;
 EXPORT_SYMBOL_GPL(edac_err_assert);
 
+static atomic_t edac_class_valid = ATOMIC_INIT(0);
+
 /*
  * called to determine if there is an EDAC driver interested in
  * knowing an event (such as NMI) occurred
@@ -44,3 +49,41 @@ void edac_atomic_assert_error(void)
         edac_err_assert++;
 }
 EXPORT_SYMBOL_GPL(edac_atomic_assert_error);
+
+/*
+ * sysfs object: /sys/devices/system/edac
+ *      need to export to other files
+ */
+struct sysdev_class edac_class = {
+        .name = "edac",
+};
+EXPORT_SYMBOL_GPL(edac_class);
+
+/* return pointer to the 'edac' node in sysfs */
+struct sysdev_class *edac_get_sysfs_class(void)
+{
+        int err = 0;
+
+        if (atomic_read(&edac_class_valid))
+                goto out;
+
+        /* create the /sys/devices/system/edac directory */
+        err = sysdev_class_register(&edac_class);
+        if (err) {
+                printk(KERN_ERR "Error registering toplevel EDAC sysfs dir\n");
+                return NULL;
+        }
+
+out:
+        atomic_inc(&edac_class_valid);
+        return &edac_class;
+}
+EXPORT_SYMBOL_GPL(edac_get_sysfs_class);
+
+void edac_put_sysfs_class(void)
+{
+        /* last user unregisters it */
+        if (atomic_dec_and_test(&edac_class_valid))
+                sysdev_class_unregister(&edac_class);
+}
+EXPORT_SYMBOL_GPL(edac_put_sysfs_class);
diff --git a/drivers/edac/mce_amd.c b/drivers/edac/mce_amd.c
new file mode 100644
index 000000000000..c0181093b490
--- /dev/null
+++ b/drivers/edac/mce_amd.c
@@ -0,0 +1,680 @@
+#include <linux/module.h>
+#include <linux/slab.h>
+
+#include "mce_amd.h"
+
+static struct amd_decoder_ops *fam_ops;
+
+static u8 nb_err_cpumask = 0xf;
+
+static bool report_gart_errors;
+static void (*nb_bus_decoder)(int node_id, struct mce *m, u32 nbcfg);
+
+void amd_report_gart_errors(bool v)
+{
+        report_gart_errors = v;
+}
+EXPORT_SYMBOL_GPL(amd_report_gart_errors);
+
+void amd_register_ecc_decoder(void (*f)(int, struct mce *, u32))
+{
+        nb_bus_decoder = f;
+}
+EXPORT_SYMBOL_GPL(amd_register_ecc_decoder);
+
+void amd_unregister_ecc_decoder(void (*f)(int, struct mce *, u32))
+{
+        if (nb_bus_decoder) {
+                WARN_ON(nb_bus_decoder != f);
+
+                nb_bus_decoder = NULL;
+        }
+}
+EXPORT_SYMBOL_GPL(amd_unregister_ecc_decoder);
+
+/*
+ * string representation for the different MCA reported error types, see F3x48
+ * or MSR0000_0411.
+ */
+
+/* transaction type */
+const char *tt_msgs[] = { "INSN", "DATA", "GEN", "RESV" };
+EXPORT_SYMBOL_GPL(tt_msgs);
+
+/* cache level */
+const char *ll_msgs[] = { "RESV", "L1", "L2", "L3/GEN" };
+EXPORT_SYMBOL_GPL(ll_msgs);
+
+/* memory transaction type */
+const char *rrrr_msgs[] = {
+       "GEN", "RD", "WR", "DRD", "DWR", "IRD", "PRF", "EV", "SNP"
+};
+EXPORT_SYMBOL_GPL(rrrr_msgs);
+
+/* participating processor */
+const char *pp_msgs[] = { "SRC", "RES", "OBS", "GEN" };
+EXPORT_SYMBOL_GPL(pp_msgs);
+
+/* request timeout */
+const char *to_msgs[] = { "no timeout", "timed out" };
+EXPORT_SYMBOL_GPL(to_msgs);
+
+/* memory or i/o */
+const char *ii_msgs[] = { "MEM", "RESV", "IO", "GEN" };
+EXPORT_SYMBOL_GPL(ii_msgs);
+
+static const char *f10h_nb_mce_desc[] = {
+        "HT link data error",
+        "Protocol error (link, L3, probe filter, etc.)",
+        "Parity error in NB-internal arrays",
+        "Link Retry due to IO link transmission error",
+        "L3 ECC data cache error",
+        "ECC error in L3 cache tag",
+        "L3 LRU parity bits error",
+        "ECC Error in the Probe Filter directory"
+};
+
+static bool f12h_dc_mce(u16 ec)
+{
+        bool ret = false;
+
+        if (MEM_ERROR(ec)) {
+                u8 ll = ec & 0x3;
+                ret = true;
+
+                if (ll == LL_L2)
+                        pr_cont("during L1 linefill from L2.\n");
+                else if (ll == LL_L1)
+                        pr_cont("Data/Tag %s error.\n", RRRR_MSG(ec));
+                else
+                        ret = false;
+        }
+        return ret;
+}
+
+static bool f10h_dc_mce(u16 ec)
+{
+        u8 r4  = (ec >> 4) & 0xf;
+        u8 ll  = ec & 0x3;
+
+        if (r4 == R4_GEN && ll == LL_L1) {
+                pr_cont("during data scrub.\n");
+                return true;
+        }
+        return f12h_dc_mce(ec);
+}
+
+static bool k8_dc_mce(u16 ec)
+{
+        if (BUS_ERROR(ec)) {
+                pr_cont("during system linefill.\n");
+                return true;
+        }
+
+        return f10h_dc_mce(ec);
+}
+
+static bool f14h_dc_mce(u16 ec)
+{
+        u8 r4    = (ec >> 4) & 0xf;
+        u8 ll    = ec & 0x3;
+        u8 tt    = (ec >> 2) & 0x3;
+        u8 ii    = tt;
+        bool ret = true;
+
+        if (MEM_ERROR(ec)) {
+
+                if (tt != TT_DATA || ll != LL_L1)
+                        return false;
+
+                switch (r4) {
+                case R4_DRD:
+                case R4_DWR:
+                        pr_cont("Data/Tag parity error due to %s.\n",
+                                (r4 == R4_DRD ? "load/hw prf" : "store"));
+                        break;
+                case R4_EVICT:
+                        pr_cont("Copyback parity error on a tag miss.\n");
+                        break;
+                case R4_SNOOP:
+                        pr_cont("Tag parity error during snoop.\n");
+                        break;
+                default:
+                        ret = false;
+                }
+        } else if (BUS_ERROR(ec)) {
+
+                if ((ii != II_MEM && ii != II_IO) || ll != LL_LG)
+                        return false;
+
+                pr_cont("System read data error on a ");
+
+                switch (r4) {
+                case R4_RD:
+                        pr_cont("TLB reload.\n");
+                        break;
+                case R4_DWR:
+                        pr_cont("store.\n");
+                        break;
+                case R4_DRD:
+                        pr_cont("load.\n");
+                        break;
+                default:
+                        ret = false;
+                }
+        } else {
+                ret = false;
+        }
+
+        return ret;
+}
+
+static void amd_decode_dc_mce(struct mce *m)
+{
+        u16 ec = m->status & 0xffff;
+        u8 xec = (m->status >> 16) & 0xf;
+
+        pr_emerg(HW_ERR "Data Cache Error: ");
+
+        /* TLB error signatures are the same across families */
+        if (TLB_ERROR(ec)) {
+                u8 tt = (ec >> 2) & 0x3;
+
+                if (tt == TT_DATA) {
+                        pr_cont("%s TLB %s.\n", LL_MSG(ec),
+                                (xec ? "multimatch" : "parity error"));
+                        return;
+                }
+                else
+                        goto wrong_dc_mce;
+        }
+
+        if (!fam_ops->dc_mce(ec))
+                goto wrong_dc_mce;
+
+        return;
+
+wrong_dc_mce:
+        pr_emerg(HW_ERR "Corrupted DC MCE info?\n");
+}
+
+static bool k8_ic_mce(u16 ec)
+{
+        u8 ll    = ec & 0x3;
+        u8 r4    = (ec >> 4) & 0xf;
+        bool ret = true;
+
+        if (!MEM_ERROR(ec))
+                return false;
+
+        if (ll == 0x2)
+                pr_cont("during a linefill from L2.\n");
+        else if (ll == 0x1) {
+                switch (r4) {
+                case R4_IRD:
+                        pr_cont("Parity error during data load.\n");
+                        break;
+
+                case R4_EVICT:
+                        pr_cont("Copyback Parity/Victim error.\n");
+                        break;
+
+                case R4_SNOOP:
+                        pr_cont("Tag Snoop error.\n");
+                        break;
+
+                default:
+                        ret = false;
+                        break;
+                }
+        } else
+                ret = false;
+
+        return ret;
+}
+
+static bool f14h_ic_mce(u16 ec)
+{
+        u8 ll    = ec & 0x3;
+        u8 tt    = (ec >> 2) & 0x3;
+        u8 r4  = (ec >> 4) & 0xf;
+        bool ret = true;
+
+        if (MEM_ERROR(ec)) {
+                if (tt != 0 || ll != 1)
+                        ret = false;
+
+                if (r4 == R4_IRD)
+                        pr_cont("Data/tag array parity error for a tag hit.\n");
+                else if (r4 == R4_SNOOP)
+                        pr_cont("Tag error during snoop/victimization.\n");
+                else
+                        ret = false;
+        }
+        return ret;
+}
+
+static void amd_decode_ic_mce(struct mce *m)
+{
+        u16 ec = m->status & 0xffff;
+        u8 xec = (m->status >> 16) & 0xf;
+
+        pr_emerg(HW_ERR "Instruction Cache Error: ");
+
+        if (TLB_ERROR(ec))
+                pr_cont("%s TLB %s.\n", LL_MSG(ec),
+                        (xec ? "multimatch" : "parity error"));
+        else if (BUS_ERROR(ec)) {
+                bool k8 = (boot_cpu_data.x86 == 0xf && (m->status & BIT_64(58)));
+
+                pr_cont("during %s.\n", (k8 ? "system linefill" : "NB data read"));
+        } else if (fam_ops->ic_mce(ec))
+                ;
+        else
+                pr_emerg(HW_ERR "Corrupted IC MCE info?\n");
+}
+
+static void amd_decode_bu_mce(struct mce *m)
+{
+        u32 ec = m->status & 0xffff;
+        u32 xec = (m->status >> 16) & 0xf;
+
+        pr_emerg(HW_ERR "Bus Unit Error");
+
+        if (xec == 0x1)
+                pr_cont(" in the write data buffers.\n");
+        else if (xec == 0x3)
+                pr_cont(" in the victim data buffers.\n");
+        else if (xec == 0x2 && MEM_ERROR(ec))
+                pr_cont(": %s error in the L2 cache tags.\n", RRRR_MSG(ec));
+        else if (xec == 0x0) {
+                if (TLB_ERROR(ec))
+                        pr_cont(": %s error in a Page Descriptor Cache or "
+                                "Guest TLB.\n", TT_MSG(ec));
+                else if (BUS_ERROR(ec))
+                        pr_cont(": %s/ECC error in data read from NB: %s.\n",
+                                RRRR_MSG(ec), PP_MSG(ec));
+                else if (MEM_ERROR(ec)) {
+                        u8 rrrr = (ec >> 4) & 0xf;
+
+                        if (rrrr >= 0x7)
+                                pr_cont(": %s error during data copyback.\n",
+                                        RRRR_MSG(ec));
+                        else if (rrrr <= 0x1)
+                                pr_cont(": %s parity/ECC error during data "
+                                        "access from L2.\n", RRRR_MSG(ec));
+                        else
+                                goto wrong_bu_mce;
+                } else
+                        goto wrong_bu_mce;
+        } else
+                goto wrong_bu_mce;
+
+        return;
+
+wrong_bu_mce:
+        pr_emerg(HW_ERR "Corrupted BU MCE info?\n");
+}
+
+static void amd_decode_ls_mce(struct mce *m)
+{
+        u16 ec = m->status & 0xffff;
+        u8 xec = (m->status >> 16) & 0xf;
+
+        if (boot_cpu_data.x86 == 0x14) {
+                pr_emerg("You shouldn't be seeing an LS MCE on this cpu family,"
+                         " please report on LKML.\n");
+                return;
+        }
+
+        pr_emerg(HW_ERR "Load Store Error");
+
+        if (xec == 0x0) {
+                u8 r4 = (ec >> 4) & 0xf;
+
+                if (!BUS_ERROR(ec) || (r4 != R4_DRD && r4 != R4_DWR))
+                        goto wrong_ls_mce;
+
+                pr_cont(" during %s.\n", RRRR_MSG(ec));
+        } else
+                goto wrong_ls_mce;
+
+        return;
+
+wrong_ls_mce:
+        pr_emerg(HW_ERR "Corrupted LS MCE info?\n");
+}
+
+static bool k8_nb_mce(u16 ec, u8 xec)
+{
+        bool ret = true;
+
+        switch (xec) {
+        case 0x1:
+                pr_cont("CRC error detected on HT link.\n");
+                break;
+
+        case 0x5:
+                pr_cont("Invalid GART PTE entry during GART table walk.\n");
+                break;
+
+        case 0x6:
+                pr_cont("Unsupported atomic RMW received from an IO link.\n");
+                break;
+
+        case 0x0:
+        case 0x8:
+                if (boot_cpu_data.x86 == 0x11)
+                        return false;
+
+                pr_cont("DRAM ECC error detected on the NB.\n");
+                break;
+
+        case 0xd:
+                pr_cont("Parity error on the DRAM addr/ctl signals.\n");
+                break;
+
+        default:
+                ret = false;
+                break;
+        }
+
+        return ret;
+}
+
+static bool f10h_nb_mce(u16 ec, u8 xec)
+{
+        bool ret = true;
+        u8 offset = 0;
+
+        if (k8_nb_mce(ec, xec))
+                return true;
+
+        switch(xec) {
+        case 0xa ... 0xc:
+                offset = 10;
+                break;
+
+        case 0xe:
+                offset = 11;
+                break;
+
+        case 0xf:
+                if (TLB_ERROR(ec))
+                        pr_cont("GART Table Walk data error.\n");
+                else if (BUS_ERROR(ec))
+                        pr_cont("DMA Exclusion Vector Table Walk error.\n");
+                else
+                        ret = false;
+
+                goto out;
+                break;
+
+        case 0x1c ... 0x1f:
+                offset = 24;
+                break;
+
+        default:
+                ret = false;
+
+                goto out;
+                break;
+        }
+
+        pr_cont("%s.\n", f10h_nb_mce_desc[xec - offset]);
+
+out:
+        return ret;
+}
+
+static bool nb_noop_mce(u16 ec, u8 xec)
+{
+        return false;
+}
+
+void amd_decode_nb_mce(int node_id, struct mce *m, u32 nbcfg)
+{
+        u8 xec   = (m->status >> 16) & 0x1f;
+        u16 ec   = m->status & 0xffff;
+        u32 nbsh = (u32)(m->status >> 32);
+
+        pr_emerg(HW_ERR "Northbridge Error, node %d: ", node_id);
+
+        /*
+         * F10h, revD can disable ErrCpu[3:0] so check that first and also the
+         * value encoding has changed so interpret those differently
+         */
+        if ((boot_cpu_data.x86 == 0x10) &&
+            (boot_cpu_data.x86_model > 7)) {
+                if (nbsh & K8_NBSH_ERR_CPU_VAL)
+                        pr_cont(", core: %u", (u8)(nbsh & nb_err_cpumask));
+        } else {
+                u8 assoc_cpus = nbsh & nb_err_cpumask;
+
+                if (assoc_cpus > 0)
+                        pr_cont(", core: %d", fls(assoc_cpus) - 1);
+        }
+
+        switch (xec) {
+        case 0x2:
+                pr_cont("Sync error (sync packets on HT link detected).\n");
+                return;
+
+        case 0x3:
+                pr_cont("HT Master abort.\n");
+                return;
+
+        case 0x4:
+                pr_cont("HT Target abort.\n");
+                return;
+
+        case 0x7:
+                pr_cont("NB Watchdog timeout.\n");
+                return;
+
+        case 0x9:
+                pr_cont("SVM DMA Exclusion Vector error.\n");
+                return;
+
+        default:
+                break;
+        }
+
+        if (!fam_ops->nb_mce(ec, xec))
+                goto wrong_nb_mce;
+
+        if (boot_cpu_data.x86 == 0xf || boot_cpu_data.x86 == 0x10)
+                if ((xec == 0x8 || xec == 0x0) && nb_bus_decoder)
+                        nb_bus_decoder(node_id, m, nbcfg);
+
+        return;
+
+wrong_nb_mce:
+        pr_emerg(HW_ERR "Corrupted NB MCE info?\n");
+}
+EXPORT_SYMBOL_GPL(amd_decode_nb_mce);
+
+static void amd_decode_fr_mce(struct mce *m)
+{
+        if (boot_cpu_data.x86 == 0xf ||
+            boot_cpu_data.x86 == 0x11)
+                goto wrong_fr_mce;
+
+        /* we have only one error signature so match all fields at once. */
+        if ((m->status & 0xffff) == 0x0f0f) {
+                pr_emerg(HW_ERR "FR Error: CPU Watchdog timer expire.\n");
+                return;
+        }
+
+wrong_fr_mce:
+        pr_emerg(HW_ERR "Corrupted FR MCE info?\n");
+}
+
+static inline void amd_decode_err_code(u16 ec)
+{
+        if (TLB_ERROR(ec)) {
+                pr_emerg(HW_ERR "Transaction: %s, Cache Level: %s\n",
+                         TT_MSG(ec), LL_MSG(ec));
+        } else if (MEM_ERROR(ec)) {
+                pr_emerg(HW_ERR "Transaction: %s, Type: %s, Cache Level: %s\n",
+                         RRRR_MSG(ec), TT_MSG(ec), LL_MSG(ec));
+        } else if (BUS_ERROR(ec)) {
+                pr_emerg(HW_ERR "Transaction: %s (%s), %s, Cache Level: %s, "
+                         "Participating Processor: %s\n",
+                          RRRR_MSG(ec), II_MSG(ec), TO_MSG(ec), LL_MSG(ec),
+                          PP_MSG(ec));
+        } else
+                pr_emerg(HW_ERR "Huh? Unknown MCE error 0x%x\n", ec);
+}
+
+/*
+ * Filter out unwanted MCE signatures here.
+ */
+static bool amd_filter_mce(struct mce *m)
+{
+        u8 xec = (m->status >> 16) & 0x1f;
+
+        /*
+         * NB GART TLB error reporting is disabled by default.
+         */
+        if (m->bank == 4 && xec == 0x5 && !report_gart_errors)
+                return true;
+
+        return false;
+}
+
+int amd_decode_mce(struct notifier_block *nb, unsigned long val, void *data)
+{
+        struct mce *m = (struct mce *)data;
+        int node, ecc;
+
+        if (amd_filter_mce(m))
+                return NOTIFY_STOP;
+
+        pr_emerg(HW_ERR "MC%d_STATUS: ", m->bank);
+
+        pr_cont("%sorrected error, other errors lost: %s, "
+                 "CPU context corrupt: %s",
+                 ((m->status & MCI_STATUS_UC) ? "Unc"  : "C"),
+                 ((m->status & MCI_STATUS_OVER) ? "yes"  : "no"),
+                 ((m->status & MCI_STATUS_PCC) ? "yes" : "no"));
+
+        /* do the two bits[14:13] together */
+        ecc = (m->status >> 45) & 0x3;
+        if (ecc)
+                pr_cont(", %sECC Error", ((ecc == 2) ? "C" : "U"));
+
+        pr_cont("\n");
+
+        switch (m->bank) {
+        case 0:
+                amd_decode_dc_mce(m);
+                break;
+
+        case 1:
+                amd_decode_ic_mce(m);
+                break;
+
+        case 2:
+                amd_decode_bu_mce(m);
+                break;
+
+        case 3:
+                amd_decode_ls_mce(m);
+                break;
+
+        case 4:
+                node = amd_get_nb_id(m->extcpu);
+                amd_decode_nb_mce(node, m, 0);
+                break;
+
+        case 5:
+                amd_decode_fr_mce(m);
+                break;
+
+        default:
+                break;
+        }
+
+        amd_decode_err_code(m->status & 0xffff);
+
+        return NOTIFY_STOP;
+}
+EXPORT_SYMBOL_GPL(amd_decode_mce);
+
+static struct notifier_block amd_mce_dec_nb = {
+        .notifier_call  = amd_decode_mce,
+};
+
+static int __init mce_amd_init(void)
+{
+        if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD)
+                return 0;
+
+        if ((boot_cpu_data.x86 < 0xf || boot_cpu_data.x86 > 0x12) &&
+            (boot_cpu_data.x86 != 0x14 || boot_cpu_data.x86_model > 0xf))
+                return 0;
+
+        fam_ops = kzalloc(sizeof(struct amd_decoder_ops), GFP_KERNEL);
+        if (!fam_ops)
+                return -ENOMEM;
+
+        switch (boot_cpu_data.x86) {
+        case 0xf:
+                fam_ops->dc_mce = k8_dc_mce;
+                fam_ops->ic_mce = k8_ic_mce;
+                fam_ops->nb_mce = k8_nb_mce;
+                break;
+
+        case 0x10:
+                fam_ops->dc_mce = f10h_dc_mce;
+                fam_ops->ic_mce = k8_ic_mce;
+                fam_ops->nb_mce = f10h_nb_mce;
+                break;
+
+        case 0x11:
+                fam_ops->dc_mce = k8_dc_mce;
+                fam_ops->ic_mce = k8_ic_mce;
+                fam_ops->nb_mce = f10h_nb_mce;
+                break;
+
+        case 0x12:
+                fam_ops->dc_mce = f12h_dc_mce;
+                fam_ops->ic_mce = k8_ic_mce;
+                fam_ops->nb_mce = nb_noop_mce;
+                break;
+
+        case 0x14:
+                nb_err_cpumask  = 0x3;
+                fam_ops->dc_mce = f14h_dc_mce;
+                fam_ops->ic_mce = f14h_ic_mce;
+                fam_ops->nb_mce = nb_noop_mce;
+                break;
+
+        default:
+                printk(KERN_WARNING "Huh? What family is that: %d?!\n",
+                                    boot_cpu_data.x86);
+                kfree(fam_ops);
+                return -EINVAL;
+        }
+
+        pr_info("MCE: In-kernel MCE decoding enabled.\n");
+
+        atomic_notifier_chain_register(&x86_mce_decoder_chain, &amd_mce_dec_nb);
+
+        return 0;
+}
+early_initcall(mce_amd_init);
+
+#ifdef MODULE
+static void __exit mce_amd_exit(void)
+{
+        atomic_notifier_chain_unregister(&x86_mce_decoder_chain, &amd_mce_dec_nb);
+        kfree(fam_ops);
+}
+
+MODULE_DESCRIPTION("AMD MCE decoder");
+MODULE_ALIAS("edac-mce-amd");
+MODULE_LICENSE("GPL");
+module_exit(mce_amd_exit);
+#endif
diff --git a/drivers/edac/edac_mce_amd.h b/drivers/edac/mce_amd.h
index df23ee065f79..35f6e0e3b297 100644
--- a/drivers/edac/edac_mce_amd.h
+++ b/drivers/edac/mce_amd.h
@@ -1,11 +1,14 @@
 #ifndef _EDAC_MCE_AMD_H
 #define _EDAC_MCE_AMD_H
 
+#include <linux/notifier.h>
+
 #include <asm/mce.h>
 
+#define BIT_64(n)                       (U64_C(1) << (n))
+
 #define ERROR_CODE(x)                   ((x) & 0xffff)
 #define EXT_ERROR_CODE(x)               (((x) >> 16) & 0x1f)
-#define EXT_ERR_MSG(x)                  ext_msgs[EXT_ERROR_CODE(x)]
 
 #define LOW_SYNDROME(x)                 (((x) >> 15) & 0xff)
 #define HIGH_SYNDROME(x)                (((x) >> 24) & 0xff)
@@ -20,13 +23,14 @@
 #define II_MSG(x)                       ii_msgs[II(x)]
 #define LL(x)                           (((x) >> 0) & 0x3)
 #define LL_MSG(x)                       ll_msgs[LL(x)]
-#define RRRR(x)                         (((x) >> 4) & 0xf)
-#define RRRR_MSG(x)                     rrrr_msgs[RRRR(x)]
 #define TO(x)                           (((x) >> 8) & 0x1)
 #define TO_MSG(x)                       to_msgs[TO(x)]
 #define PP(x)                           (((x) >> 9) & 0x3)
 #define PP_MSG(x)                       pp_msgs[PP(x)]
 
+#define RRRR(x)                         (((x) >> 4) & 0xf)
+#define RRRR_MSG(x)                     ((RRRR(x) < 9) ?  rrrr_msgs[RRRR(x)] : "Wrong R4!")
+
 #define K8_NBSH                         0x4C
 
 #define K8_NBSH_VALID_BIT               BIT(31)
@@ -41,13 +45,45 @@
 #define K8_NBSH_UECC                    BIT(13)
 #define K8_NBSH_ERR_SCRUBER             BIT(8)
 
+enum tt_ids {
+        TT_INSTR = 0,
+        TT_DATA,
+        TT_GEN,
+        TT_RESV,
+};
+
+enum ll_ids {
+        LL_RESV = 0,
+        LL_L1,
+        LL_L2,
+        LL_LG,
+};
+
+enum ii_ids {
+        II_MEM = 0,
+        II_RESV,
+        II_IO,
+        II_GEN,
+};
+
+enum rrrr_ids {
+        R4_GEN  = 0,
+        R4_RD,
+        R4_WR,
+        R4_DRD,
+        R4_DWR,
+        R4_IRD,
+        R4_PREF,
+        R4_EVICT,
+        R4_SNOOP,
+};
+
 extern const char *tt_msgs[];
 extern const char *ll_msgs[];
 extern const char *rrrr_msgs[];
 extern const char *pp_msgs[];
 extern const char *to_msgs[];
 extern const char *ii_msgs[];
-extern const char *ext_msgs[];
 
 /*
  * relevant NB regs
@@ -60,10 +96,19 @@ struct err_regs {
         u32 nbeal;
 };
 
+/*
+ * per-family decoder ops
+ */
+struct amd_decoder_ops {
+        bool (*dc_mce)(u16);
+        bool (*ic_mce)(u16);
+        bool (*nb_mce)(u16, u8);
+};
 
 void amd_report_gart_errors(bool);
-void amd_register_ecc_decoder(void (*f)(int, struct err_regs *));
-void amd_unregister_ecc_decoder(void (*f)(int, struct err_regs *));
-void amd_decode_nb_mce(int, struct err_regs *, int);
+void amd_register_ecc_decoder(void (*f)(int, struct mce *, u32));
+void amd_unregister_ecc_decoder(void (*f)(int, struct mce *, u32));
+void amd_decode_nb_mce(int, struct mce *, u32);
+int amd_decode_mce(struct notifier_block *nb, unsigned long val, void *data);
 
 #endif /* _EDAC_MCE_AMD_H */
diff --git a/drivers/edac/mce_amd_inj.c b/drivers/edac/mce_amd_inj.c
new file mode 100644
index 000000000000..8d0688f36d4c
--- /dev/null
+++ b/drivers/edac/mce_amd_inj.c
@@ -0,0 +1,171 @@
+/*
+ * A simple MCE injection facility for testing the MCE decoding code. This
+ * driver should be built as module so that it can be loaded on production
+ * kernels for testing purposes.
+ *
+ * This file may be distributed under the terms of the GNU General Public
+ * License version 2.
+ *
+ * Copyright (c) 2010:  Borislav Petkov <borislav.petkov@amd.com>
+ *                      Advanced Micro Devices Inc.
+ */
+
+#include <linux/kobject.h>
+#include <linux/sysdev.h>
+#include <linux/edac.h>
+#include <asm/mce.h>
+
+#include "mce_amd.h"
+
+struct edac_mce_attr {
+        struct attribute attr;
+        ssize_t (*show) (struct kobject *kobj, struct edac_mce_attr *attr, char *buf);
+        ssize_t (*store)(struct kobject *kobj, struct edac_mce_attr *attr,
+                         const char *buf, size_t count);
+};
+
+#define EDAC_MCE_ATTR(_name, _mode, _show, _store)                      \
+static struct edac_mce_attr mce_attr_##_name = __ATTR(_name, _mode, _show, _store)
+
+static struct kobject *mce_kobj;
+
+/*
+ * Collect all the MCi_XXX settings
+ */
+static struct mce i_mce;
+
+#define MCE_INJECT_STORE(reg)                                           \
+static ssize_t edac_inject_##reg##_store(struct kobject *kobj,          \
+                                         struct edac_mce_attr *attr,    \
+                                         const char *data, size_t count)\
+{                                                                       \
+        int ret = 0;                                                    \
+        unsigned long value;                                            \
+                                                                        \
+        ret = strict_strtoul(data, 16, &value);                         \
+        if (ret < 0)                                                    \
+                printk(KERN_ERR "Error writing MCE " #reg " field.\n"); \
+                                                                        \
+        i_mce.reg = value;                                              \
+                                                                        \
+        return count;                                                   \
+}
+
+MCE_INJECT_STORE(status);
+MCE_INJECT_STORE(misc);
+MCE_INJECT_STORE(addr);
+
+#define MCE_INJECT_SHOW(reg)                                            \
+static ssize_t edac_inject_##reg##_show(struct kobject *kobj,           \
+                                        struct edac_mce_attr *attr,     \
+                                        char *buf)                      \
+{                                                                       \
+        return sprintf(buf, "0x%016llx\n", i_mce.reg);                  \
+}
+
+MCE_INJECT_SHOW(status);
+MCE_INJECT_SHOW(misc);
+MCE_INJECT_SHOW(addr);
+
+EDAC_MCE_ATTR(status, 0644, edac_inject_status_show, edac_inject_status_store);
+EDAC_MCE_ATTR(misc, 0644, edac_inject_misc_show, edac_inject_misc_store);
+EDAC_MCE_ATTR(addr, 0644, edac_inject_addr_show, edac_inject_addr_store);
+
+/*
+ * This denotes into which bank we're injecting and triggers
+ * the injection, at the same time.
+ */
+static ssize_t edac_inject_bank_store(struct kobject *kobj,
+                                      struct edac_mce_attr *attr,
+                                      const char *data, size_t count)
+{
+        int ret = 0;
+        unsigned long value;
+
+        ret = strict_strtoul(data, 10, &value);
+        if (ret < 0) {
+                printk(KERN_ERR "Invalid bank value!\n");
+                return -EINVAL;
+        }
+
+        if (value > 5) {
+                printk(KERN_ERR "Non-existant MCE bank: %lu\n", value);
+                return -EINVAL;
+        }
+
+        i_mce.bank = value;
+
+        amd_decode_mce(NULL, 0, &i_mce);
+
+        return count;
+}
+
+static ssize_t edac_inject_bank_show(struct kobject *kobj,
+                                     struct edac_mce_attr *attr, char *buf)
+{
+        return sprintf(buf, "%d\n", i_mce.bank);
+}
+
+EDAC_MCE_ATTR(bank, 0644, edac_inject_bank_show, edac_inject_bank_store);
+
+static struct edac_mce_attr *sysfs_attrs[] = { &mce_attr_status, &mce_attr_misc,
+                                               &mce_attr_addr, &mce_attr_bank
+};
+
+static int __init edac_init_mce_inject(void)
+{
+        struct sysdev_class *edac_class = NULL;
+        int i, err = 0;
+
+        edac_class = edac_get_sysfs_class();
+        if (!edac_class)
+                return -EINVAL;
+
+        mce_kobj = kobject_create_and_add("mce", &edac_class->kset.kobj);
+        if (!mce_kobj) {
+                printk(KERN_ERR "Error creating a mce kset.\n");
+                err = -ENOMEM;
+                goto err_mce_kobj;
+        }
+
+        for (i = 0; i < ARRAY_SIZE(sysfs_attrs); i++) {
+                err = sysfs_create_file(mce_kobj, &sysfs_attrs[i]->attr);
+                if (err) {
+                        printk(KERN_ERR "Error creating %s in sysfs.\n",
+                                        sysfs_attrs[i]->attr.name);
+                        goto err_sysfs_create;
+                }
+        }
+        return 0;
+
+err_sysfs_create:
+        while (i-- >= 0)
+                sysfs_remove_file(mce_kobj, &sysfs_attrs[i]->attr);
+
+        kobject_del(mce_kobj);
+
+err_mce_kobj:
+        edac_put_sysfs_class();
+
+        return err;
+}
+
+static void __exit edac_exit_mce_inject(void)
+{
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(sysfs_attrs); i++)
+                sysfs_remove_file(mce_kobj, &sysfs_attrs[i]->attr);
+
+        kobject_del(mce_kobj);
+
+        edac_put_sysfs_class();
+}
+
+module_init(edac_init_mce_inject);
+module_exit(edac_exit_mce_inject);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Borislav Petkov <borislav.petkov@amd.com>");
+MODULE_AUTHOR("AMD Inc.");
+MODULE_DESCRIPTION("MCE injection facility for testing MCE decoding");
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index 1b05896648bc..9dcb17d51aee 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -2840,7 +2840,7 @@ static int __devinit pci_probe(struct pci_dev *dev,
                                const struct pci_device_id *ent)
 {
         struct fw_ohci *ohci;
-        u32 bus_options, max_receive, link_speed, version, link_enh;
+        u32 bus_options, max_receive, link_speed, version;
         u64 guid;
         int i, err, n_ir, n_it;
         size_t size;
@@ -2894,23 +2894,6 @@ static int __devinit pci_probe(struct pci_dev *dev,
         if (param_quirks)
                 ohci->quirks = param_quirks;
 
-        /* TI OHCI-Lynx and compatible: set recommended configuration bits. */
-        if (dev->vendor == PCI_VENDOR_ID_TI) {
-                pci_read_config_dword(dev, PCI_CFG_TI_LinkEnh, &link_enh);
-
-                /* adjust latency of ATx FIFO: use 1.7 KB threshold */
-                link_enh &= ~TI_LinkEnh_atx_thresh_mask;
-                link_enh |= TI_LinkEnh_atx_thresh_1_7K;
-
-                /* use priority arbitration for asynchronous responses */
-                link_enh |= TI_LinkEnh_enab_unfair;
-
-                /* required for aPhyEnhanceEnable to work */
-                link_enh |= TI_LinkEnh_enab_accel;
-
-                pci_write_config_dword(dev, PCI_CFG_TI_LinkEnh, link_enh);
-        }
-
         ar_context_init(&ohci->ar_request_ctx, ohci,
                         OHCI1394_AsReqRcvContextControlSet);
 
diff --git a/drivers/firewire/ohci.h b/drivers/firewire/ohci.h
index 0e6c5a466908..ef5e7336da68 100644
--- a/drivers/firewire/ohci.h
+++ b/drivers/firewire/ohci.h
@@ -155,12 +155,4 @@
 
 #define OHCI1394_phy_tcode              0xe
 
-/* TI extensions */
-
-#define PCI_CFG_TI_LinkEnh              0xf4
-#define  TI_LinkEnh_enab_accel          0x00000002
-#define  TI_LinkEnh_enab_unfair         0x00000080
-#define  TI_LinkEnh_atx_thresh_mask     0x00003000
-#define  TI_LinkEnh_atx_thresh_1_7K     0x00001000
-
 #endif /* _FIREWIRE_OHCI_H */
diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig
index 280c9b5ad9e3..88a3ae6cd023 100644
--- a/drivers/firmware/Kconfig
+++ b/drivers/firmware/Kconfig
@@ -125,7 +125,7 @@ config ISCSI_IBFT_FIND
 config ISCSI_IBFT
         tristate "iSCSI Boot Firmware Table Attributes module"
         select ISCSI_BOOT_SYSFS
-        depends on ISCSI_IBFT_FIND && SCSI
+        depends on ISCSI_IBFT_FIND && SCSI && SCSI_LOWLEVEL
         default n
         help
           This option enables support for detection and exposing of iSCSI
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index c74e4e8006d4..2dd2c93ebfa3 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -2231,6 +2231,9 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
         dev_priv->mchdev_lock = &mchdev_lock;
         spin_unlock(&mchdev_lock);
 
+        /* XXX Prevent module unload due to memory corruption bugs. */
+        __module_get(THIS_MODULE);
+
         return 0;
 
 out_workqueue_free:
diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
index 56ad9df2ccb5..b61966c126d3 100644
--- a/drivers/gpu/drm/i915/intel_fb.c
+++ b/drivers/gpu/drm/i915/intel_fb.c
@@ -238,8 +238,8 @@ int intel_fbdev_destroy(struct drm_device *dev,
 
         drm_framebuffer_cleanup(&ifb->base);
         if (ifb->obj) {
-                drm_gem_object_handle_unreference(ifb->obj);
                 drm_gem_object_unreference(ifb->obj);
+                ifb->obj = NULL;
         }
 
         return 0;
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index d2047713dc59..dbd30b2e43fd 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -352,7 +352,6 @@ nouveau_fbcon_destroy(struct drm_device *dev, struct nouveau_fbdev *nfbdev)
 
         if (nouveau_fb->nvbo) {
                 nouveau_bo_unmap(nouveau_fb->nvbo);
-                drm_gem_object_handle_unreference_unlocked(nouveau_fb->nvbo->gem);
                 drm_gem_object_unreference_unlocked(nouveau_fb->nvbo->gem);
                 nouveau_fb->nvbo = NULL;
         }
diff --git a/drivers/gpu/drm/nouveau/nouveau_notifier.c b/drivers/gpu/drm/nouveau/nouveau_notifier.c
index 3c9964a8fbad..3ec181ff50ce 100644
--- a/drivers/gpu/drm/nouveau/nouveau_notifier.c
+++ b/drivers/gpu/drm/nouveau/nouveau_notifier.c
@@ -79,7 +79,6 @@ nouveau_notifier_takedown_channel(struct nouveau_channel *chan)
         mutex_lock(&dev->struct_mutex);
         nouveau_bo_unpin(chan->notifier_bo);
         mutex_unlock(&dev->struct_mutex);
-        drm_gem_object_handle_unreference_unlocked(chan->notifier_bo->gem);
         drm_gem_object_unreference_unlocked(chan->notifier_bo->gem);
         drm_mm_takedown(&chan->notifier_heap);
 }
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 79082d4398ae..2f93d46ae69a 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -1137,7 +1137,7 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
 
                 WREG32(RCU_IND_INDEX, 0x203);
                 efuse_straps_3 = RREG32(RCU_IND_DATA);
-                efuse_box_bit_127_124 = (u8)(efuse_straps_3 & 0xF0000000) >> 28;
+                efuse_box_bit_127_124 = (u8)((efuse_straps_3 & 0xF0000000) >> 28);
 
                 switch(efuse_box_bit_127_124) {
                 case 0x0:
@@ -1407,6 +1407,7 @@ int evergreen_mc_init(struct radeon_device *rdev)
         rdev->mc.mc_vram_size = RREG32(CONFIG_MEMSIZE) * 1024 * 1024;
         rdev->mc.real_vram_size = RREG32(CONFIG_MEMSIZE) * 1024 * 1024;
         rdev->mc.visible_vram_size = rdev->mc.aper_size;
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         r600_vram_gtt_location(rdev, &rdev->mc);
         radeon_update_bandwidth_info(rdev);
 
@@ -1520,7 +1521,7 @@ void evergreen_disable_interrupt_state(struct radeon_device *rdev)
 {
         u32 tmp;
 
-        WREG32(CP_INT_CNTL, 0);
+        WREG32(CP_INT_CNTL, CNTX_BUSY_INT_ENABLE | CNTX_EMPTY_INT_ENABLE);
         WREG32(GRBM_INT_CNTL, 0);
         WREG32(INT_MASK + EVERGREEN_CRTC0_REGISTER_OFFSET, 0);
         WREG32(INT_MASK + EVERGREEN_CRTC1_REGISTER_OFFSET, 0);
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index e151f16a8f86..e59422320bb6 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -1030,6 +1030,7 @@ int r100_cp_init(struct radeon_device *rdev, unsigned ring_size)
                 return r;
         }
         rdev->cp.ready = true;
+        rdev->mc.active_vram_size = rdev->mc.real_vram_size;
         return 0;
 }
 
@@ -1047,6 +1048,7 @@ void r100_cp_fini(struct radeon_device *rdev)
 void r100_cp_disable(struct radeon_device *rdev)
 {
         /* Disable ring */
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         rdev->cp.ready = false;
         WREG32(RADEON_CP_CSQ_MODE, 0);
         WREG32(RADEON_CP_CSQ_CNTL, 0);
@@ -2295,6 +2297,7 @@ void r100_vram_init_sizes(struct radeon_device *rdev)
         /* FIXME we don't use the second aperture yet when we could use it */
         if (rdev->mc.visible_vram_size > rdev->mc.aper_size)
                 rdev->mc.visible_vram_size = rdev->mc.aper_size;
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         config_aper_size = RREG32(RADEON_CONFIG_APER_SIZE);
         if (rdev->flags & RADEON_IS_IGP) {
                 uint32_t tom;
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 7a04959ba0ee..7b65e4efe8af 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -1248,6 +1248,7 @@ int r600_mc_init(struct radeon_device *rdev)
         rdev->mc.mc_vram_size = RREG32(CONFIG_MEMSIZE);
         rdev->mc.real_vram_size = RREG32(CONFIG_MEMSIZE);
         rdev->mc.visible_vram_size = rdev->mc.aper_size;
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         r600_vram_gtt_location(rdev, &rdev->mc);
 
         if (rdev->flags & RADEON_IS_IGP) {
@@ -1917,6 +1918,7 @@ void r600_pciep_wreg(struct radeon_device *rdev, u32 reg, u32 v)
  */
 void r600_cp_stop(struct radeon_device *rdev)
 {
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         WREG32(R_0086D8_CP_ME_CNTL, S_0086D8_CP_ME_HALT(1));
 }
 
@@ -2910,7 +2912,7 @@ static void r600_disable_interrupt_state(struct radeon_device *rdev)
 {
         u32 tmp;
 
-        WREG32(CP_INT_CNTL, 0);
+        WREG32(CP_INT_CNTL, CNTX_BUSY_INT_ENABLE | CNTX_EMPTY_INT_ENABLE);
         WREG32(GRBM_INT_CNTL, 0);
         WREG32(DxMODE_INT_MASK, 0);
         if (ASIC_IS_DCE3(rdev)) {
diff --git a/drivers/gpu/drm/radeon/r600_blit_kms.c b/drivers/gpu/drm/radeon/r600_blit_kms.c
index 9ceb2a1ce799..3473c00781ff 100644
--- a/drivers/gpu/drm/radeon/r600_blit_kms.c
+++ b/drivers/gpu/drm/radeon/r600_blit_kms.c
@@ -532,6 +532,7 @@ int r600_blit_init(struct radeon_device *rdev)
         memcpy(ptr + rdev->r600_blit.ps_offset, r6xx_ps, r6xx_ps_size * 4);
         radeon_bo_kunmap(rdev->r600_blit.shader_obj);
         radeon_bo_unreserve(rdev->r600_blit.shader_obj);
+        rdev->mc.active_vram_size = rdev->mc.real_vram_size;
         return 0;
 }
 
@@ -539,6 +540,7 @@ void r600_blit_fini(struct radeon_device *rdev)
 {
         int r;
 
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         if (rdev->r600_blit.shader_obj == NULL)
                 return;
         /* If we can't reserve the bo, unref should be enough to destroy
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index a168d644bf9e..9ff38c99a6ea 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -344,6 +344,7 @@ struct radeon_mc {
          * about vram size near mc fb location */
         u64                     mc_vram_size;
         u64                     visible_vram_size;
+        u64                     active_vram_size;
         u64                     gtt_size;
         u64                     gtt_start;
         u64                     gtt_end;
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index 68932ba7b8a4..8e43ddae70cc 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -1558,39 +1558,39 @@ radeon_atombios_get_tv_info(struct radeon_device *rdev)
                 switch (tv_info->ucTV_BootUpDefaultStandard) {
                 case ATOM_TV_NTSC:
                         tv_std = TV_STD_NTSC;
-                        DRM_INFO("Default TV standard: NTSC\n");
+                        DRM_DEBUG_KMS("Default TV standard: NTSC\n");
                         break;
                 case ATOM_TV_NTSCJ:
                         tv_std = TV_STD_NTSC_J;
-                        DRM_INFO("Default TV standard: NTSC-J\n");
+                        DRM_DEBUG_KMS("Default TV standard: NTSC-J\n");
                         break;
                 case ATOM_TV_PAL:
                         tv_std = TV_STD_PAL;
-                        DRM_INFO("Default TV standard: PAL\n");
+                        DRM_DEBUG_KMS("Default TV standard: PAL\n");
                         break;
                 case ATOM_TV_PALM:
                         tv_std = TV_STD_PAL_M;
-                        DRM_INFO("Default TV standard: PAL-M\n");
+                        DRM_DEBUG_KMS("Default TV standard: PAL-M\n");
                         break;
                 case ATOM_TV_PALN:
                         tv_std = TV_STD_PAL_N;
-                        DRM_INFO("Default TV standard: PAL-N\n");
+                        DRM_DEBUG_KMS("Default TV standard: PAL-N\n");
                         break;
                 case ATOM_TV_PALCN:
                         tv_std = TV_STD_PAL_CN;
-                        DRM_INFO("Default TV standard: PAL-CN\n");
+                        DRM_DEBUG_KMS("Default TV standard: PAL-CN\n");
                         break;
                 case ATOM_TV_PAL60:
                         tv_std = TV_STD_PAL_60;
-                        DRM_INFO("Default TV standard: PAL-60\n");
+                        DRM_DEBUG_KMS("Default TV standard: PAL-60\n");
                         break;
                 case ATOM_TV_SECAM:
                         tv_std = TV_STD_SECAM;
-                        DRM_INFO("Default TV standard: SECAM\n");
+                        DRM_DEBUG_KMS("Default TV standard: SECAM\n");
                         break;
                 default:
                         tv_std = TV_STD_NTSC;
-                        DRM_INFO("Unknown TV standard; defaulting to NTSC\n");
+                        DRM_DEBUG_KMS("Unknown TV standard; defaulting to NTSC\n");
                         break;
                 }
         }
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index a04b7a6ad95f..7b7ea269549c 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -913,47 +913,47 @@ radeon_combios_get_tv_info(struct radeon_device *rdev)
                         switch (RBIOS8(tv_info + 7) & 0xf) {
                         case 1:
                                 tv_std = TV_STD_NTSC;
-                                DRM_INFO("Default TV standard: NTSC\n");
+                                DRM_DEBUG_KMS("Default TV standard: NTSC\n");
                                 break;
                         case 2:
                                 tv_std = TV_STD_PAL;
-                                DRM_INFO("Default TV standard: PAL\n");
+                                DRM_DEBUG_KMS("Default TV standard: PAL\n");
                                 break;
                         case 3:
                                 tv_std = TV_STD_PAL_M;
-                                DRM_INFO("Default TV standard: PAL-M\n");
+                                DRM_DEBUG_KMS("Default TV standard: PAL-M\n");
                                 break;
                         case 4:
                                 tv_std = TV_STD_PAL_60;
-                                DRM_INFO("Default TV standard: PAL-60\n");
+                                DRM_DEBUG_KMS("Default TV standard: PAL-60\n");
                                 break;
                         case 5:
                                 tv_std = TV_STD_NTSC_J;
-                                DRM_INFO("Default TV standard: NTSC-J\n");
+                                DRM_DEBUG_KMS("Default TV standard: NTSC-J\n");
                                 break;
                         case 6:
                                 tv_std = TV_STD_SCART_PAL;
-                                DRM_INFO("Default TV standard: SCART-PAL\n");
+                                DRM_DEBUG_KMS("Default TV standard: SCART-PAL\n");
                                 break;
                         default:
                                 tv_std = TV_STD_NTSC;
-                                DRM_INFO
+                                DRM_DEBUG_KMS
                                     ("Unknown TV standard; defaulting to NTSC\n");
                                 break;
                         }
 
                         switch ((RBIOS8(tv_info + 9) >> 2) & 0x3) {
                         case 0:
-                                DRM_INFO("29.498928713 MHz TV ref clk\n");
+                                DRM_DEBUG_KMS("29.498928713 MHz TV ref clk\n");
                                 break;
                         case 1:
-                                DRM_INFO("28.636360000 MHz TV ref clk\n");
+                                DRM_DEBUG_KMS("28.636360000 MHz TV ref clk\n");
                                 break;
                         case 2:
-                                DRM_INFO("14.318180000 MHz TV ref clk\n");
+                                DRM_DEBUG_KMS("14.318180000 MHz TV ref clk\n");
                                 break;
                         case 3:
-                                DRM_INFO("27.000000000 MHz TV ref clk\n");
+                                DRM_DEBUG_KMS("27.000000000 MHz TV ref clk\n");
                                 break;
                         default:
                                 break;
@@ -1324,7 +1324,7 @@ bool radeon_legacy_get_tmds_info_from_combios(struct radeon_encoder *encoder,
 
         if (tmds_info) {
                 ver = RBIOS8(tmds_info);
-                DRM_INFO("DFP table revision: %d\n", ver);
+                DRM_DEBUG_KMS("DFP table revision: %d\n", ver);
                 if (ver == 3) {
                         n = RBIOS8(tmds_info + 5) + 1;
                         if (n > 4)
@@ -1408,7 +1408,7 @@ bool radeon_legacy_get_ext_tmds_info_from_combios(struct radeon_encoder *encoder
                 offset = combios_get_table_offset(dev, COMBIOS_EXT_TMDS_INFO_TABLE);
                 if (offset) {
                         ver = RBIOS8(offset);
-                        DRM_INFO("External TMDS Table revision: %d\n", ver);
+                        DRM_DEBUG_KMS("External TMDS Table revision: %d\n", ver);
                         tmds->slave_addr = RBIOS8(offset + 4 + 2);
                         tmds->slave_addr >>= 1; /* 7 bit addressing */
                         gpio = RBIOS8(offset + 4 + 3);
diff --git a/drivers/gpu/drm/radeon/radeon_cursor.c b/drivers/gpu/drm/radeon/radeon_cursor.c
index 5731fc9b1ae3..3eef567b0421 100644
--- a/drivers/gpu/drm/radeon/radeon_cursor.c
+++ b/drivers/gpu/drm/radeon/radeon_cursor.c
@@ -203,6 +203,7 @@ int radeon_crtc_cursor_move(struct drm_crtc *crtc,
         struct radeon_crtc *radeon_crtc = to_radeon_crtc(crtc);
         struct radeon_device *rdev = crtc->dev->dev_private;
         int xorigin = 0, yorigin = 0;
+        int w = radeon_crtc->cursor_width;
 
         if (x < 0)
                 xorigin = -x + 1;
@@ -213,22 +214,7 @@ int radeon_crtc_cursor_move(struct drm_crtc *crtc,
         if (yorigin >= CURSOR_HEIGHT)
                 yorigin = CURSOR_HEIGHT - 1;
 
-        radeon_lock_cursor(crtc, true);
-        if (ASIC_IS_DCE4(rdev)) {
-                /* cursors are offset into the total surface */
-                x += crtc->x;
-                y += crtc->y;
-                DRM_DEBUG("x %d y %d c->x %d c->y %d\n", x, y, crtc->x, crtc->y);
-
-                /* XXX: check if evergreen has the same issues as avivo chips */
-                WREG32(EVERGREEN_CUR_POSITION + radeon_crtc->crtc_offset,
-                       ((xorigin ? 0 : x) << 16) |
-                       (yorigin ? 0 : y));
-                WREG32(EVERGREEN_CUR_HOT_SPOT + radeon_crtc->crtc_offset, (xorigin << 16) | yorigin);
-                WREG32(EVERGREEN_CUR_SIZE + radeon_crtc->crtc_offset,
-                       ((radeon_crtc->cursor_width - 1) << 16) | (radeon_crtc->cursor_height - 1));
-        } else if (ASIC_IS_AVIVO(rdev)) {
-                int w = radeon_crtc->cursor_width;
+        if (ASIC_IS_AVIVO(rdev)) {
                 int i = 0;
                 struct drm_crtc *crtc_p;
 
@@ -260,7 +246,17 @@ int radeon_crtc_cursor_move(struct drm_crtc *crtc,
                         if (w <= 0)
                                 w = 1;
                 }
+        }
 
+        radeon_lock_cursor(crtc, true);
+        if (ASIC_IS_DCE4(rdev)) {
+                WREG32(EVERGREEN_CUR_POSITION + radeon_crtc->crtc_offset,
+                       ((xorigin ? 0 : x) << 16) |
+                       (yorigin ? 0 : y));
+                WREG32(EVERGREEN_CUR_HOT_SPOT + radeon_crtc->crtc_offset, (xorigin << 16) | yorigin);
+                WREG32(EVERGREEN_CUR_SIZE + radeon_crtc->crtc_offset,
+                       ((w - 1) << 16) | (radeon_crtc->cursor_height - 1));
+        } else if (ASIC_IS_AVIVO(rdev)) {
                 WREG32(AVIVO_D1CUR_POSITION + radeon_crtc->crtc_offset,
                              ((xorigin ? 0 : x) << 16) |
                              (yorigin ? 0 : y));
diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c
index 9cdf6a35bc2c..40b0c087b592 100644
--- a/drivers/gpu/drm/radeon/radeon_fb.c
+++ b/drivers/gpu/drm/radeon/radeon_fb.c
@@ -97,7 +97,6 @@ static void radeonfb_destroy_pinned_object(struct drm_gem_object *gobj)
                 radeon_bo_unpin(rbo);
                 radeon_bo_unreserve(rbo);
         }
-        drm_gem_object_handle_unreference(gobj);
         drm_gem_object_unreference_unlocked(gobj);
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index 0afd1e62347d..b3b5306bb578 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -69,7 +69,7 @@ void radeon_ttm_placement_from_domain(struct radeon_bo *rbo, u32 domain)
         u32 c = 0;
 
         rbo->placement.fpfn = 0;
-        rbo->placement.lpfn = 0;
+        rbo->placement.lpfn = rbo->rdev->mc.active_vram_size >> PAGE_SHIFT;
         rbo->placement.placement = rbo->placements;
         rbo->placement.busy_placement = rbo->placements;
         if (domain & RADEON_GEM_DOMAIN_VRAM)
diff --git a/drivers/gpu/drm/radeon/radeon_object.h b/drivers/gpu/drm/radeon/radeon_object.h
index 353998dc2c03..3481bc7f6f58 100644
--- a/drivers/gpu/drm/radeon/radeon_object.h
+++ b/drivers/gpu/drm/radeon/radeon_object.h
@@ -124,11 +124,8 @@ static inline int radeon_bo_wait(struct radeon_bo *bo, u32 *mem_type,
         int r;
 
         r = ttm_bo_reserve(&bo->tbo, true, no_wait, false, 0);
-        if (unlikely(r != 0)) {
-                if (r != -ERESTARTSYS)
-                        dev_err(bo->rdev->dev, "%p reserve failed for wait\n", bo);
+        if (unlikely(r != 0))
                 return r;
-        }
         spin_lock(&bo->tbo.lock);
         if (mem_type)
                 *mem_type = bo->tbo.mem.mem_type;
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index cc05b230d7ef..51d5f7b5ab21 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -693,6 +693,7 @@ void rs600_mc_init(struct radeon_device *rdev)
         rdev->mc.real_vram_size = RREG32(RADEON_CONFIG_MEMSIZE);
         rdev->mc.mc_vram_size = rdev->mc.real_vram_size;
         rdev->mc.visible_vram_size = rdev->mc.aper_size;
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         rdev->mc.igp_sideport_enabled = radeon_atombios_sideport_present(rdev);
         base = RREG32_MC(R_000004_MC_FB_LOCATION);
         base = G_000004_MC_FB_START(base) << 16;
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index 3e3f75718be3..4dc2a87ea680 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -157,6 +157,7 @@ void rs690_mc_init(struct radeon_device *rdev)
         rdev->mc.aper_base = pci_resource_start(rdev->pdev, 0);
         rdev->mc.aper_size = pci_resource_len(rdev->pdev, 0);
         rdev->mc.visible_vram_size = rdev->mc.aper_size;
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         base = RREG32_MC(R_000100_MCCFG_FB_LOCATION);
         base = G_000100_MC_FB_START(base) << 16;
         rdev->mc.igp_sideport_enabled = radeon_atombios_sideport_present(rdev);
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index bfa59db374d2..9490da700749 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -267,6 +267,7 @@ static void rv770_mc_program(struct radeon_device *rdev)
  */
 void r700_cp_stop(struct radeon_device *rdev)
 {
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         WREG32(CP_ME_CNTL, (CP_ME_HALT | CP_PFP_HALT));
 }
 
@@ -992,6 +993,7 @@ int rv770_mc_init(struct radeon_device *rdev)
         rdev->mc.mc_vram_size = RREG32(CONFIG_MEMSIZE);
         rdev->mc.real_vram_size = RREG32(CONFIG_MEMSIZE);
         rdev->mc.visible_vram_size = rdev->mc.aper_size;
+        rdev->mc.active_vram_size = rdev->mc.visible_vram_size;
         r600_vram_gtt_location(rdev, &rdev->mc);
         radeon_update_bandwidth_info(rdev);
 
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index cb4cf7ef4d1e..db809e034cc4 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -442,6 +442,43 @@ out_err:
 }
 
 /**
+ * Call bo::reserved and with the lru lock held.
+ * Will release GPU memory type usage on destruction.
+ * This is the place to put in driver specific hooks.
+ * Will release the bo::reserved lock and the
+ * lru lock on exit.
+ */
+
+static void ttm_bo_cleanup_memtype_use(struct ttm_buffer_object *bo)
+{
+        struct ttm_bo_global *glob = bo->glob;
+
+        if (bo->ttm) {
+
+                /**
+                 * Release the lru_lock, since we don't want to have
+                 * an atomic requirement on ttm_tt[unbind|destroy].
+                 */
+
+                spin_unlock(&glob->lru_lock);
+                ttm_tt_unbind(bo->ttm);
+                ttm_tt_destroy(bo->ttm);
+                bo->ttm = NULL;
+                spin_lock(&glob->lru_lock);
+        }
+
+        if (bo->mem.mm_node) {
+                drm_mm_put_block(bo->mem.mm_node);
+                bo->mem.mm_node = NULL;
+        }
+
+        atomic_set(&bo->reserved, 0);
+        wake_up_all(&bo->event_queue);
+        spin_unlock(&glob->lru_lock);
+}
+
+
+/**
  * If bo idle, remove from delayed- and lru lists, and unref.
  * If not idle, and already on delayed list, do nothing.
  * If not idle, and not on delayed list, put on delayed list,
@@ -456,6 +493,7 @@ static int ttm_bo_cleanup_refs(struct ttm_buffer_object *bo, bool remove_all)
         int ret;
 
         spin_lock(&bo->lock);
+retry:
         (void) ttm_bo_wait(bo, false, false, !remove_all);
 
         if (!bo->sync_obj) {
@@ -464,31 +502,52 @@ static int ttm_bo_cleanup_refs(struct ttm_buffer_object *bo, bool remove_all)
                 spin_unlock(&bo->lock);
 
                 spin_lock(&glob->lru_lock);
-                put_count = ttm_bo_del_from_lru(bo);
+                ret = ttm_bo_reserve_locked(bo, false, !remove_all, false, 0);
+
+                /**
+                 * Someone else has the object reserved. Bail and retry.
+                 */
 
-                ret = ttm_bo_reserve_locked(bo, false, false, false, 0);
-                BUG_ON(ret);
-                if (bo->ttm)
-                        ttm_tt_unbind(bo->ttm);
+                if (unlikely(ret == -EBUSY)) {
+                        spin_unlock(&glob->lru_lock);
+                        spin_lock(&bo->lock);
+                        goto requeue;
+                }
+
+                /**
+                 * We can re-check for sync object without taking
+                 * the bo::lock since setting the sync object requires
+                 * also bo::reserved. A busy object at this point may
+                 * be caused by another thread starting an accelerated
+                 * eviction.
+                 */
+
+                if (unlikely(bo->sync_obj)) {
+                        atomic_set(&bo->reserved, 0);
+                        wake_up_all(&bo->event_queue);
+                        spin_unlock(&glob->lru_lock);
+                        spin_lock(&bo->lock);
+                        if (remove_all)
+                                goto retry;
+                        else
+                                goto requeue;
+                }
+
+                put_count = ttm_bo_del_from_lru(bo);
 
                 if (!list_empty(&bo->ddestroy)) {
                         list_del_init(&bo->ddestroy);
                         ++put_count;
                 }
-                if (bo->mem.mm_node) {
-                        drm_mm_put_block(bo->mem.mm_node);
-                        bo->mem.mm_node = NULL;
-                }
-                spin_unlock(&glob->lru_lock);
 
-                atomic_set(&bo->reserved, 0);
+                ttm_bo_cleanup_memtype_use(bo);
 
                 while (put_count--)
                         kref_put(&bo->list_kref, ttm_bo_ref_bug);
 
                 return 0;
         }
-
+requeue:
         spin_lock(&glob->lru_lock);
         if (list_empty(&bo->ddestroy)) {
                 void *sync_obj = bo->sync_obj;
diff --git a/drivers/hid/hid-cando.c b/drivers/hid/hid-cando.c
index 4267a6fdc277..5925bdcd417d 100644
--- a/drivers/hid/hid-cando.c
+++ b/drivers/hid/hid-cando.c
@@ -237,6 +237,8 @@ static const struct hid_device_id cando_devices[] = {
                         USB_DEVICE_ID_CANDO_MULTI_TOUCH) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CANDO,
                         USB_DEVICE_ID_CANDO_MULTI_TOUCH_11_6) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_CANDO,
+                USB_DEVICE_ID_CANDO_MULTI_TOUCH_15_6) },
         { }
 };
 MODULE_DEVICE_TABLE(hid, cando_devices);
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 3f7292486024..a0dea3d1296e 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -1292,6 +1292,7 @@ static const struct hid_device_id hid_blacklist[] = {
         { HID_USB_DEVICE(USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_EMPREX_REMOTE_2) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CANDO, USB_DEVICE_ID_CANDO_MULTI_TOUCH) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CANDO, USB_DEVICE_ID_CANDO_MULTI_TOUCH_11_6) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_CANDO, USB_DEVICE_ID_CANDO_MULTI_TOUCH_15_6) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHERRY, USB_DEVICE_ID_CHERRY_CYMOTION_SOLAR) },
         { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_TACTICAL_PAD) },
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 765a4f53eb5c..c5ae5f1545bd 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -134,6 +134,7 @@
 #define USB_VENDOR_ID_CANDO             0x2087
 #define USB_DEVICE_ID_CANDO_MULTI_TOUCH 0x0a01
 #define USB_DEVICE_ID_CANDO_MULTI_TOUCH_11_6 0x0b03
+#define USB_DEVICE_ID_CANDO_MULTI_TOUCH_15_6 0x0f01
 
 #define USB_VENDOR_ID_CH                0x068e
 #define USB_DEVICE_ID_CH_PRO_PEDALS     0x00f2
@@ -503,6 +504,7 @@
 
 #define USB_VENDOR_ID_TURBOX            0x062a
 #define USB_DEVICE_ID_TURBOX_KEYBOARD   0x0201
+#define USB_DEVICE_ID_TURBOX_TOUCHSCREEN_MOSART 0x7100
 
 #define USB_VENDOR_ID_TWINHAN           0x6253
 #define USB_DEVICE_ID_TWINHAN_IR_REMOTE 0x0100
diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c
index 47d70c523d93..a3866b5c0c43 100644
--- a/drivers/hid/hidraw.c
+++ b/drivers/hid/hidraw.c
@@ -109,6 +109,12 @@ static ssize_t hidraw_write(struct file *file, const char __user *buffer, size_t
         int ret = 0;
 
         mutex_lock(&minors_lock);
+
+        if (!hidraw_table[minor]) {
+                ret = -ENODEV;
+                goto out;
+        }
+
         dev = hidraw_table[minor]->hid;
 
         if (!dev->hid_output_raw_report) {
@@ -244,6 +250,10 @@ static long hidraw_ioctl(struct file *file, unsigned int cmd,
 
         mutex_lock(&minors_lock);
         dev = hidraw_table[minor];
+        if (!dev) {
+                ret = -ENODEV;
+                goto out;
+        }
 
         switch (cmd) {
                 case HIDIOCGRDESCSIZE:
@@ -317,6 +327,7 @@ static long hidraw_ioctl(struct file *file, unsigned int cmd,
 
                 ret = -ENOTTY;
         }
+out:
         mutex_unlock(&minors_lock);
         return ret;
 }
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 70da3181c8a0..f0260c699adb 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -36,6 +36,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_DWAV, USB_DEVICE_ID_EGALAX_TOUCHCONTROLLER, HID_QUIRK_MULTI_INPUT | HID_QUIRK_NOGET },
         { USB_VENDOR_ID_DWAV, USB_DEVICE_ID_DWAV_EGALAX_MULTITOUCH, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_MOJO, USB_DEVICE_ID_RETRO_ADAPTER, HID_QUIRK_MULTI_INPUT },
+        { USB_VENDOR_ID_TURBOX, USB_DEVICE_ID_TURBOX_TOUCHSCREEN_MOSART, HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_DRIVING, HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FLYING, HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
         { USB_VENDOR_ID_HAPP, USB_DEVICE_ID_UGCI_FIGHTING, HID_QUIRK_BADPAD | HID_QUIRK_MULTI_INPUT },
diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c
index f7bd2613cecc..f2de3be35df3 100644
--- a/drivers/i2c/busses/i2c-cpm.c
+++ b/drivers/i2c/busses/i2c-cpm.c
@@ -677,6 +677,11 @@ static int __devinit cpm_i2c_probe(struct platform_device *ofdev,
         dev_dbg(&ofdev->dev, "hw routines for %s registered.\n",
                 cpm->adap.name);
 
+        /*
+         * register OF I2C devices
+         */
+        of_i2c_register_devices(&cpm->adap);
+
         return 0;
 out_shut:
         cpm_i2c_shutdown(cpm);
diff --git a/drivers/i2c/busses/i2c-davinci.c b/drivers/i2c/busses/i2c-davinci.c
index b8feac5f2ef4..5795c8398c7c 100644
--- a/drivers/i2c/busses/i2c-davinci.c
+++ b/drivers/i2c/busses/i2c-davinci.c
@@ -331,21 +331,16 @@ i2c_davinci_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg, int stop)
         INIT_COMPLETION(dev->cmd_complete);
         dev->cmd_err = 0;
 
-        /* Take I2C out of reset, configure it as master and set the
-         * start bit */
-        flag = DAVINCI_I2C_MDR_IRS | DAVINCI_I2C_MDR_MST | DAVINCI_I2C_MDR_STT;
+        /* Take I2C out of reset and configure it as master */
+        flag = DAVINCI_I2C_MDR_IRS | DAVINCI_I2C_MDR_MST;
 
         /* if the slave address is ten bit address, enable XA bit */
         if (msg->flags & I2C_M_TEN)
                 flag |= DAVINCI_I2C_MDR_XA;
         if (!(msg->flags & I2C_M_RD))
                 flag |= DAVINCI_I2C_MDR_TRX;
-        if (stop)
-                flag |= DAVINCI_I2C_MDR_STP;
-        if (msg->len == 0) {
+        if (msg->len == 0)
                 flag |= DAVINCI_I2C_MDR_RM;
-                flag &= ~DAVINCI_I2C_MDR_STP;
-        }
 
         /* Enable receive or transmit interrupts */
         w = davinci_i2c_read_reg(dev, DAVINCI_I2C_IMR_REG);
@@ -358,17 +353,28 @@ i2c_davinci_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg, int stop)
         dev->terminate = 0;
 
         /*
+         * Write mode register first as needed for correct behaviour
+         * on OMAP-L138, but don't set STT yet to avoid a race with XRDY
+         * occuring before we have loaded DXR
+         */
+        davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, flag);
+
+        /*
          * First byte should be set here, not after interrupt,
          * because transmit-data-ready interrupt can come before
          * NACK-interrupt during sending of previous message and
          * ICDXR may have wrong data
+         * It also saves us one interrupt, slightly faster
          */
         if ((!(msg->flags & I2C_M_RD)) && dev->buf_len) {
                 davinci_i2c_write_reg(dev, DAVINCI_I2C_DXR_REG, *dev->buf++);
                 dev->buf_len--;
         }
 
-        /* write the data into mode register; start transmitting */
+        /* Set STT to begin transmit now DXR is loaded */
+        flag |= DAVINCI_I2C_MDR_STT;
+        if (stop && msg->len != 0)
+                flag |= DAVINCI_I2C_MDR_STP;
         davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, flag);
 
         r = wait_for_completion_interruptible_timeout(&dev->cmd_complete,
diff --git a/drivers/i2c/busses/i2c-ibm_iic.c b/drivers/i2c/busses/i2c-ibm_iic.c
index 43ca32fddde2..89eedf45d30e 100644
--- a/drivers/i2c/busses/i2c-ibm_iic.c
+++ b/drivers/i2c/busses/i2c-ibm_iic.c
@@ -761,6 +761,9 @@ static int __devinit iic_probe(struct platform_device *ofdev,
         dev_info(&ofdev->dev, "using %s mode\n",
                  dev->fast_mode ? "fast (400 kHz)" : "standard (100 kHz)");
 
+        /* Now register all the child nodes */
+        of_i2c_register_devices(adap);
+
         return 0;
 
 error_cleanup:
diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c
index d1ff9408dc1f..4c2a62b75b5c 100644
--- a/drivers/i2c/busses/i2c-imx.c
+++ b/drivers/i2c/busses/i2c-imx.c
@@ -159,15 +159,9 @@ static int i2c_imx_bus_busy(struct imx_i2c_struct *i2c_imx, int for_busy)
 
 static int i2c_imx_trx_complete(struct imx_i2c_struct *i2c_imx)
 {
-        int result;
-
-        result = wait_event_interruptible_timeout(i2c_imx->queue,
-                i2c_imx->i2csr & I2SR_IIF, HZ / 10);
+        wait_event_timeout(i2c_imx->queue, i2c_imx->i2csr & I2SR_IIF, HZ / 10);
 
-        if (unlikely(result < 0)) {
-                dev_dbg(&i2c_imx->adapter.dev, "<%s> result < 0\n", __func__);
-                return result;
-        } else if (unlikely(!(i2c_imx->i2csr & I2SR_IIF))) {
+        if (unlikely(!(i2c_imx->i2csr & I2SR_IIF))) {
                 dev_dbg(&i2c_imx->adapter.dev, "<%s> Timeout\n", __func__);
                 return -ETIMEDOUT;
         }
@@ -295,7 +289,7 @@ static irqreturn_t i2c_imx_isr(int irq, void *dev_id)
                 i2c_imx->i2csr = temp;
                 temp &= ~I2SR_IIF;
                 writeb(temp, i2c_imx->base + IMX_I2C_I2SR);
-                wake_up_interruptible(&i2c_imx->queue);
+                wake_up(&i2c_imx->queue);
                 return IRQ_HANDLED;
         }
 
diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c
index a1c419a716af..b74e6dc6886c 100644
--- a/drivers/i2c/busses/i2c-mpc.c
+++ b/drivers/i2c/busses/i2c-mpc.c
@@ -632,6 +632,7 @@ static int __devinit fsl_i2c_probe(struct platform_device *op,
                 dev_err(i2c->dev, "failed to add adapter\n");
                 goto fail_add;
         }
+        of_i2c_register_devices(&i2c->adap);
 
         return result;
 
diff --git a/drivers/i2c/busses/i2c-pca-isa.c b/drivers/i2c/busses/i2c-pca-isa.c
index bbd77603a417..29933f87d8fa 100644
--- a/drivers/i2c/busses/i2c-pca-isa.c
+++ b/drivers/i2c/busses/i2c-pca-isa.c
@@ -71,8 +71,8 @@ static int pca_isa_readbyte(void *pd, int reg)
 
 static int pca_isa_waitforcompletion(void *pd)
 {
-        long ret = ~0;
         unsigned long timeout;
+        long ret;
 
         if (irq > -1) {
                 ret = wait_event_timeout(pca_wait,
@@ -81,11 +81,15 @@ static int pca_isa_waitforcompletion(void *pd)
         } else {
                 /* Do polling */
                 timeout = jiffies + pca_isa_ops.timeout;
-                while (((pca_isa_readbyte(pd, I2C_PCA_CON)
-                                & I2C_PCA_CON_SI) == 0)
-                                && (ret = time_before(jiffies, timeout)))
+                do {
+                        ret = time_before(jiffies, timeout);
+                        if (pca_isa_readbyte(pd, I2C_PCA_CON)
+                                        & I2C_PCA_CON_SI)
+                                break;
                         udelay(100);
+                } while (ret);
         }
+
         return ret > 0;
 }
 
diff --git a/drivers/i2c/busses/i2c-pca-platform.c b/drivers/i2c/busses/i2c-pca-platform.c
index ef5c78487eb7..5f6d7f89e225 100644
--- a/drivers/i2c/busses/i2c-pca-platform.c
+++ b/drivers/i2c/busses/i2c-pca-platform.c
@@ -80,8 +80,8 @@ static void i2c_pca_pf_writebyte32(void *pd, int reg, int val)
 static int i2c_pca_pf_waitforcompletion(void *pd)
 {
         struct i2c_pca_pf_data *i2c = pd;
-        long ret = ~0;
         unsigned long timeout;
+        long ret;
 
         if (i2c->irq) {
                 ret = wait_event_timeout(i2c->wait,
@@ -90,10 +90,13 @@ static int i2c_pca_pf_waitforcompletion(void *pd)
         } else {
                 /* Do polling */
                 timeout = jiffies + i2c->adap.timeout;
-                while (((i2c->algo_data.read_byte(i2c, I2C_PCA_CON)
-                                & I2C_PCA_CON_SI) == 0)
-                                && (ret = time_before(jiffies, timeout)))
+                do {
+                        ret = time_before(jiffies, timeout);
+                        if (i2c->algo_data.read_byte(i2c, I2C_PCA_CON)
+                                        & I2C_PCA_CON_SI)
+                                break;
                         udelay(100);
+                } while (ret);
         }
 
         return ret > 0;
diff --git a/drivers/i2c/i2c-core.c b/drivers/i2c/i2c-core.c
index 6649176de940..bea4c5021d26 100644
--- a/drivers/i2c/i2c-core.c
+++ b/drivers/i2c/i2c-core.c
@@ -32,7 +32,6 @@
 #include <linux/init.h>
 #include <linux/idr.h>
 #include <linux/mutex.h>
-#include <linux/of_i2c.h>
 #include <linux/of_device.h>
 #include <linux/completion.h>
 #include <linux/hardirq.h>
@@ -197,11 +196,12 @@ static int i2c_device_pm_suspend(struct device *dev)
 {
         const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
 
-        if (pm_runtime_suspended(dev))
-                return 0;
-
-        if (pm)
-                return pm->suspend ? pm->suspend(dev) : 0;
+        if (pm) {
+                if (pm_runtime_suspended(dev))
+                        return 0;
+                else
+                        return pm->suspend ? pm->suspend(dev) : 0;
+        }
 
         return i2c_legacy_suspend(dev, PMSG_SUSPEND);
 }
@@ -216,12 +216,6 @@ static int i2c_device_pm_resume(struct device *dev)
         else
                 ret = i2c_legacy_resume(dev);
 
-        if (!ret) {
-                pm_runtime_disable(dev);
-                pm_runtime_set_active(dev);
-                pm_runtime_enable(dev);
-        }
-
         return ret;
 }
 
@@ -229,11 +223,12 @@ static int i2c_device_pm_freeze(struct device *dev)
 {
         const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
 
-        if (pm_runtime_suspended(dev))
-                return 0;
-
-        if (pm)
-                return pm->freeze ? pm->freeze(dev) : 0;
+        if (pm) {
+                if (pm_runtime_suspended(dev))
+                        return 0;
+                else
+                        return pm->freeze ? pm->freeze(dev) : 0;
+        }
 
         return i2c_legacy_suspend(dev, PMSG_FREEZE);
 }
@@ -242,11 +237,12 @@ static int i2c_device_pm_thaw(struct device *dev)
 {
         const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
 
-        if (pm_runtime_suspended(dev))
-                return 0;
-
-        if (pm)
-                return pm->thaw ? pm->thaw(dev) : 0;
+        if (pm) {
+                if (pm_runtime_suspended(dev))
+                        return 0;
+                else
+                        return pm->thaw ? pm->thaw(dev) : 0;
+        }
 
         return i2c_legacy_resume(dev);
 }
@@ -255,11 +251,12 @@ static int i2c_device_pm_poweroff(struct device *dev)
 {
         const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
 
-        if (pm_runtime_suspended(dev))
-                return 0;
-
-        if (pm)
-                return pm->poweroff ? pm->poweroff(dev) : 0;
+        if (pm) {
+                if (pm_runtime_suspended(dev))
+                        return 0;
+                else
+                        return pm->poweroff ? pm->poweroff(dev) : 0;
+        }
 
         return i2c_legacy_suspend(dev, PMSG_HIBERNATE);
 }
@@ -876,9 +873,6 @@ static int i2c_register_adapter(struct i2c_adapter *adap)
         if (adap->nr < __i2c_first_dynamic_bus_num)
                 i2c_scan_static_board_info(adap);
 
-        /* Register devices from the device tree */
-        of_i2c_register_devices(adap);
-
         /* Notify drivers */
         mutex_lock(&core_lock);
         bus_for_each_drv(&i2c_bus_type, NULL, adap, __process_new_adapter);
diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
index 0906fc5b69b9..cb3ccf3ed221 100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -59,18 +59,11 @@
 #include <linux/hrtimer.h>      /* ktime_get_real() */
 #include <trace/events/power.h>
 #include <linux/sched.h>
+#include <asm/mwait.h>
 
 #define INTEL_IDLE_VERSION "0.4"
 #define PREFIX "intel_idle: "
 
-#define MWAIT_SUBSTATE_MASK     (0xf)
-#define MWAIT_CSTATE_MASK       (0xf)
-#define MWAIT_SUBSTATE_SIZE     (4)
-#define MWAIT_MAX_NUM_CSTATES   8
-#define CPUID_MWAIT_LEAF (5)
-#define CPUID5_ECX_EXTENSIONS_SUPPORTED (0x1)
-#define CPUID5_ECX_INTERRUPT_BREAK      (0x2)
-
 static struct cpuidle_driver intel_idle_driver = {
         .name = "intel_idle",
         .owner = THIS_MODULE,
@@ -157,13 +150,13 @@ static struct cpuidle_state atom_cstates[MWAIT_MAX_NUM_CSTATES] = {
         { /* MWAIT C5 */ },
         { /* MWAIT C6 */
                 .name = "ATM-C6",
-                .desc = "MWAIT 0x40",
-                .driver_data = (void *) 0x40,
+                .desc = "MWAIT 0x52",
+                .driver_data = (void *) 0x52,
                 .flags = CPUIDLE_FLAG_TIME_VALID | CPUIDLE_FLAG_TLB_FLUSHED,
-                .exit_latency = 200,
+                .exit_latency = 140,
                 .power_usage = 150,
-                .target_residency = 800,
-                .enter = NULL },        /* disabled */
+                .target_residency = 560,
+                .enter = &intel_idle },
 };
 
 /**
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index c908c5f83645..af9ee313c10b 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -28,7 +28,7 @@ struct evdev {
         int minor;
         struct input_handle handle;
         wait_queue_head_t wait;
-        struct evdev_client *grab;
+        struct evdev_client __rcu *grab;
         struct list_head client_list;
         spinlock_t client_lock; /* protects client_list */
         struct mutex mutex;
@@ -669,6 +669,9 @@ static long evdev_do_ioctl(struct file *file, unsigned int cmd,
 
                 if ((_IOC_NR(cmd) & ~ABS_MAX) == _IOC_NR(EVIOCGABS(0))) {
 
+                        if (!dev->absinfo)
+                                return -EINVAL;
+
                         t = _IOC_NR(cmd) & ABS_MAX;
                         abs = dev->absinfo[t];
 
@@ -680,10 +683,13 @@ static long evdev_do_ioctl(struct file *file, unsigned int cmd,
                 }
         }
 
-        if (_IOC_DIR(cmd) == _IOC_READ) {
+        if (_IOC_DIR(cmd) == _IOC_WRITE) {
 
                 if ((_IOC_NR(cmd) & ~ABS_MAX) == _IOC_NR(EVIOCSABS(0))) {
 
+                        if (!dev->absinfo)
+                                return -EINVAL;
+
                         t = _IOC_NR(cmd) & ABS_MAX;
 
                         if (copy_from_user(&abs, p, min_t(size_t,
diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
index d85bd8a7967d..22239e988498 100644
--- a/drivers/input/joydev.c
+++ b/drivers/input/joydev.c
@@ -483,6 +483,9 @@ static int joydev_handle_JSIOCSAXMAP(struct joydev *joydev,
 
         memcpy(joydev->abspam, abspam, len);
 
+        for (i = 0; i < joydev->nabs; i++)
+                joydev->absmap[joydev->abspam[i]] = i;
+
  out:
         kfree(abspam);
         return retval;
diff --git a/drivers/input/misc/hp_sdc_rtc.c b/drivers/input/misc/hp_sdc_rtc.c
index c19066479057..7e2c12a5b839 100644
--- a/drivers/input/misc/hp_sdc_rtc.c
+++ b/drivers/input/misc/hp_sdc_rtc.c
@@ -104,7 +104,7 @@ static int hp_sdc_rtc_do_read_bbrtc (struct rtc_time *rtctm)
         t.endidx =              91;
         t.seq =                 tseq;
         t.act.semaphore =       &tsem;
-        init_MUTEX_LOCKED(&tsem);
+        sema_init(&tsem, 0);
         
         if (hp_sdc_enqueue_transaction(&t)) return -1;
         
@@ -698,7 +698,7 @@ static int __init hp_sdc_rtc_init(void)
                 return -ENODEV;
 #endif
 
-        init_MUTEX(&i8042tregs);
+        sema_init(&i8042tregs, 1);
 
         if ((ret = hp_sdc_request_timer_irq(&hp_sdc_rtc_isr)))
                 return ret;
diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c
index 0d4266a533a5..360698553eb5 100644
--- a/drivers/input/misc/uinput.c
+++ b/drivers/input/misc/uinput.c
@@ -404,6 +404,13 @@ static int uinput_setup_device(struct uinput_device *udev, const char __user *bu
                 retval = uinput_validate_absbits(dev);
                 if (retval < 0)
                         goto exit;
+                if (test_bit(ABS_MT_SLOT, dev->absbit)) {
+                        int nslot = input_abs_get_max(dev, ABS_MT_SLOT) + 1;
+                        input_mt_create_slots(dev, nslot);
+                        input_set_events_per_packet(dev, 6 * nslot);
+                } else if (test_bit(ABS_MT_POSITION_X, dev->absbit)) {
+                        input_set_events_per_packet(dev, 60);
+                }
         }
 
         udev->state = UIST_SETUP_COMPLETE;
diff --git a/drivers/input/serio/hil_mlc.c b/drivers/input/serio/hil_mlc.c
index c92f4edfee7b..e5624d8f1709 100644
--- a/drivers/input/serio/hil_mlc.c
+++ b/drivers/input/serio/hil_mlc.c
@@ -915,15 +915,15 @@ int hil_mlc_register(hil_mlc *mlc)
         mlc->ostarted = 0;
 
         rwlock_init(&mlc->lock);
-        init_MUTEX(&mlc->osem);
+        sema_init(&mlc->osem, 1);
 
-        init_MUTEX(&mlc->isem);
+        sema_init(&mlc->isem, 1);
         mlc->icount = -1;
         mlc->imatch = 0;
 
         mlc->opercnt = 0;
 
-        init_MUTEX_LOCKED(&(mlc->csem));
+        sema_init(&(mlc->csem), 0);
 
         hil_mlc_clear_di_scratch(mlc);
         hil_mlc_clear_di_map(mlc, 0);
diff --git a/drivers/input/serio/hp_sdc.c b/drivers/input/serio/hp_sdc.c
index bcc2d30ec245..8c0b51c31424 100644
--- a/drivers/input/serio/hp_sdc.c
+++ b/drivers/input/serio/hp_sdc.c
@@ -905,7 +905,7 @@ static int __init hp_sdc_init(void)
         ts_sync[1]      = 0x0f;
         ts_sync[2] = ts_sync[3] = ts_sync[4] = ts_sync[5] = 0;
         t_sync.act.semaphore = &s_sync;
-        init_MUTEX_LOCKED(&s_sync);
+        sema_init(&s_sync, 0);
         hp_sdc_enqueue_transaction(&t_sync);
         down(&s_sync); /* Wait for t_sync to complete */
 
@@ -1039,7 +1039,7 @@ static int __init hp_sdc_register(void)
                 return hp_sdc.dev_err;
         }
 
-        init_MUTEX_LOCKED(&tq_init_sem);
+        sema_init(&tq_init_sem, 0);
 
         tq_init.actidx          = 0;
         tq_init.idx             = 1;
diff --git a/drivers/input/tablet/wacom_sys.c b/drivers/input/tablet/wacom_sys.c
index 42ba3691d908..b35876ee6908 100644
--- a/drivers/input/tablet/wacom_sys.c
+++ b/drivers/input/tablet/wacom_sys.c
@@ -103,27 +103,26 @@ static void wacom_sys_irq(struct urb *urb)
 static int wacom_open(struct input_dev *dev)
 {
         struct wacom *wacom = input_get_drvdata(dev);
+        int retval = 0;
 
-        mutex_lock(&wacom->lock);
-
-        wacom->irq->dev = wacom->usbdev;
-
-        if (usb_autopm_get_interface(wacom->intf) < 0) {
-                mutex_unlock(&wacom->lock);
+        if (usb_autopm_get_interface(wacom->intf) < 0)
                 return -EIO;
-        }
+
+        mutex_lock(&wacom->lock);
 
         if (usb_submit_urb(wacom->irq, GFP_KERNEL)) {
-                usb_autopm_put_interface(wacom->intf);
-                mutex_unlock(&wacom->lock);
-                return -EIO;
+                retval = -EIO;
+                goto out;
         }
 
         wacom->open = true;
         wacom->intf->needs_remote_wakeup = 1;
 
+out:
         mutex_unlock(&wacom->lock);
-        return 0;
+        if (retval)
+                usb_autopm_put_interface(wacom->intf);
+        return retval;
 }
 
 static void wacom_close(struct input_dev *dev)
@@ -135,6 +134,8 @@ static void wacom_close(struct input_dev *dev)
         wacom->open = false;
         wacom->intf->needs_remote_wakeup = 0;
         mutex_unlock(&wacom->lock);
+
+        usb_autopm_put_interface(wacom->intf);
 }
 
 static int wacom_parse_hid(struct usb_interface *intf, struct hid_descriptor *hid_desc,
diff --git a/drivers/input/tablet/wacom_wac.c b/drivers/input/tablet/wacom_wac.c
index 6e29badb969e..47fd7a041c52 100644
--- a/drivers/input/tablet/wacom_wac.c
+++ b/drivers/input/tablet/wacom_wac.c
@@ -442,8 +442,10 @@ static void wacom_intuos_general(struct wacom_wac *wacom)
         /* general pen packet */
         if ((data[1] & 0xb8) == 0xa0) {
                 t = (data[6] << 2) | ((data[7] >> 6) & 3);
-                if (features->type >= INTUOS4S && features->type <= INTUOS4L)
+                if ((features->type >= INTUOS4S && features->type <= INTUOS4L) ||
+                    features->type == WACOM_21UX2) {
                         t = (t << 1) | (data[1] & 1);
+                }
                 input_report_abs(input, ABS_PRESSURE, t);
                 input_report_abs(input, ABS_TILT_X,
                                 ((data[7] << 1) & 0x7e) | (data[8] >> 7));
diff --git a/drivers/isdn/act2000/act2000.h b/drivers/isdn/act2000/act2000.h
index d4c50512a1ff..88c9423500d8 100644
--- a/drivers/isdn/act2000/act2000.h
+++ b/drivers/isdn/act2000/act2000.h
@@ -141,9 +141,9 @@ typedef struct irq_data_isa {
         __u8            rcvhdr[8];
 } irq_data_isa;
 
-typedef union irq_data {
+typedef union act2000_irq_data {
         irq_data_isa isa;
-} irq_data;
+} act2000_irq_data;
 
 /*
  * Per card driver data
@@ -176,7 +176,7 @@ typedef struct act2000_card {
         char   *status_buf_read;
         char   *status_buf_write;
         char   *status_buf_end;
-        irq_data idat;                  /* Data used for IRQ handler        */
+        act2000_irq_data idat;          /* Data used for IRQ handler        */
         isdn_if interface;              /* Interface to upper layer         */
         char regname[35];               /* Name used for request_region     */
 } act2000_card;
diff --git a/drivers/isdn/hisax/config.c b/drivers/isdn/hisax/config.c
index 6f9afcd5ca4e..b133378d4dc9 100644
--- a/drivers/isdn/hisax/config.c
+++ b/drivers/isdn/hisax/config.c
@@ -801,6 +801,16 @@ static void closecard(int cardnr)
         ll_unload(csta);
 }
 
+static irqreturn_t card_irq(int intno, void *dev_id)
+{
+        struct IsdnCardState *cs = dev_id;
+        irqreturn_t ret = cs->irq_func(intno, cs);
+
+        if (ret == IRQ_HANDLED)
+                cs->irq_cnt++;
+        return ret;
+}
+
 static int init_card(struct IsdnCardState *cs)
 {
         int     irq_cnt, cnt = 3, ret;
@@ -809,10 +819,10 @@ static int init_card(struct IsdnCardState *cs)
                 ret = cs->cardmsg(cs, CARD_INIT, NULL);
                 return(ret);
         }
-        irq_cnt = kstat_irqs(cs->irq);
+        irq_cnt = cs->irq_cnt = 0;
         printk(KERN_INFO "%s: IRQ %d count %d\n", CardType[cs->typ],
                cs->irq, irq_cnt);
-        if (request_irq(cs->irq, cs->irq_func, cs->irq_flags, "HiSax", cs)) {
+        if (request_irq(cs->irq, card_irq, cs->irq_flags, "HiSax", cs)) {
                 printk(KERN_WARNING "HiSax: couldn't get interrupt %d\n",
                        cs->irq);
                 return 1;
@@ -822,8 +832,8 @@ static int init_card(struct IsdnCardState *cs)
                 /* Timeout 10ms */
                 msleep(10);
                 printk(KERN_INFO "%s: IRQ %d count %d\n",
-                       CardType[cs->typ], cs->irq, kstat_irqs(cs->irq));
-                if (kstat_irqs(cs->irq) == irq_cnt) {
+                       CardType[cs->typ], cs->irq, cs->irq_cnt);
+                if (cs->irq_cnt == irq_cnt) {
                         printk(KERN_WARNING
                                "%s: IRQ(%d) getting no interrupts during init %d\n",
                                CardType[cs->typ], cs->irq, 4 - cnt);
diff --git a/drivers/isdn/hisax/hisax.h b/drivers/isdn/hisax/hisax.h
index 832a87855ffb..32ab3924aa73 100644
--- a/drivers/isdn/hisax/hisax.h
+++ b/drivers/isdn/hisax/hisax.h
@@ -959,6 +959,7 @@ struct IsdnCardState {
         u_long          event;
         struct work_struct tqueue;
         struct timer_list dbusytimer;
+        unsigned int    irq_cnt;
 #ifdef ERROR_STATISTIC
         int             err_crc;
         int             err_tx;
diff --git a/drivers/isdn/sc/interrupt.c b/drivers/isdn/sc/interrupt.c
index 485be8b1e1b3..f0225bc0f267 100644
--- a/drivers/isdn/sc/interrupt.c
+++ b/drivers/isdn/sc/interrupt.c
@@ -112,11 +112,19 @@ irqreturn_t interrupt_handler(int dummy, void *card_inst)
                         }
                         else if(callid>=0x0000 && callid<=0x7FFF)
                         {
+                                int len;
+
                                 pr_debug("%s: Got Incoming Call\n",
                                                 sc_adapter[card]->devicename);
-                                strcpy(setup.phone,&(rcvmsg.msg_data.byte_array[4]));
-                                strcpy(setup.eazmsn,
-                                        sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn);
+                                len = strlcpy(setup.phone, &(rcvmsg.msg_data.byte_array[4]),
+                                                sizeof(setup.phone));
+                                if (len >= sizeof(setup.phone))
+                                        continue;
+                                len = strlcpy(setup.eazmsn,
+                                                sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn,
+                                                sizeof(setup.eazmsn));
+                                if (len >= sizeof(setup.eazmsn))
+                                        continue;
                                 setup.si1 = 7;
                                 setup.si2 = 0;
                                 setup.plan = 0;
@@ -176,7 +184,9 @@ irqreturn_t interrupt_handler(int dummy, void *card_inst)
                  * Handle a GetMyNumber Rsp
                  */
                 if (IS_CE_MESSAGE(rcvmsg,Call,0,GetMyNumber)){
-                        strcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn,rcvmsg.msg_data.byte_array);
+                        strlcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn,
+                                rcvmsg.msg_data.byte_array,
+                                sizeof(rcvmsg.msg_data.byte_array));
                         continue;
                 }
                         
diff --git a/drivers/macintosh/adb.c b/drivers/macintosh/adb.c
index 1c4ee6e77937..bf64e49d996a 100644
--- a/drivers/macintosh/adb.c
+++ b/drivers/macintosh/adb.c
@@ -83,7 +83,7 @@ static struct adb_driver *adb_controller;
 BLOCKING_NOTIFIER_HEAD(adb_client_list);
 static int adb_got_sleep;
 static int adb_inited;
-static DECLARE_MUTEX(adb_probe_mutex);
+static DEFINE_SEMAPHORE(adb_probe_mutex);
 static int sleepy_trackpad;
 static int autopoll_devs;
 int __adb_probe_sync;
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index ed4900ade93a..e4fb58db5454 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -1000,10 +1000,11 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, sector_t start)
                                 page = bitmap->sb_page;
                                 offset = sizeof(bitmap_super_t);
                                 if (!file)
-                                        read_sb_page(bitmap->mddev,
-                                                     bitmap->mddev->bitmap_info.offset,
-                                                     page,
-                                                     index, count);
+                                        page = read_sb_page(
+                                                bitmap->mddev,
+                                                bitmap->mddev->bitmap_info.offset,
+                                                page,
+                                                index, count);
                         } else if (file) {
                                 page = read_page(file, index, bitmap, count);
                                 offset = 0;
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index ad83a4dcadc3..0b830bbe1d8b 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1839,7 +1839,9 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
 
                 /* take from bio_init */
                 bio->bi_next = NULL;
+                bio->bi_flags &= ~(BIO_POOL_MASK-1);
                 bio->bi_flags |= 1 << BIO_UPTODATE;
+                bio->bi_comp_cpu = -1;
                 bio->bi_rw = READ;
                 bio->bi_vcnt = 0;
                 bio->bi_idx = 0;
@@ -1912,7 +1914,7 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
                             !test_bit(MD_RECOVERY_REQUESTED, &mddev->recovery))
                                 break;
                         BUG_ON(sync_blocks < (PAGE_SIZE>>9));
-                        if (len > (sync_blocks<<9))
+                        if ((len >> 9) > sync_blocks)
                                 len = sync_blocks<<9;
                 }
 
diff --git a/drivers/media/IR/ir-keytable.c b/drivers/media/IR/ir-keytable.c
index 7e82a9df726b..7961d59f5cac 100644
--- a/drivers/media/IR/ir-keytable.c
+++ b/drivers/media/IR/ir-keytable.c
@@ -319,7 +319,7 @@ static void ir_timer_keyup(unsigned long cookie)
          * a keyup event might follow immediately after the keydown.
          */
         spin_lock_irqsave(&ir->keylock, flags);
-        if (time_is_after_eq_jiffies(ir->keyup_jiffies))
+        if (time_is_before_eq_jiffies(ir->keyup_jiffies))
                 ir_keyup(ir);
         spin_unlock_irqrestore(&ir->keylock, flags);
 }
@@ -510,6 +510,13 @@ int __ir_input_register(struct input_dev *input_dev,
                    (ir_dev->props && ir_dev->props->driver_type == RC_DRIVER_IR_RAW) ?
                         " in raw mode" : "");
 
+        /*
+         * Default delay of 250ms is too short for some protocols, expecially
+         * since the timeout is currently set to 250ms. Increase it to 500ms,
+         * to avoid wrong repetition of the keycodes.
+         */
+        input_dev->rep[REP_DELAY] = 500;
+
         return 0;
 
 out_event:
diff --git a/drivers/media/IR/ir-lirc-codec.c b/drivers/media/IR/ir-lirc-codec.c
index 77b5946413c0..e63f757d5d72 100644
--- a/drivers/media/IR/ir-lirc-codec.c
+++ b/drivers/media/IR/ir-lirc-codec.c
@@ -267,7 +267,7 @@ static int ir_lirc_register(struct input_dev *input_dev)
                         features |= LIRC_CAN_SET_SEND_CARRIER;
 
                 if (ir_dev->props->s_tx_duty_cycle)
-                        features |= LIRC_CAN_SET_REC_DUTY_CYCLE;
+                        features |= LIRC_CAN_SET_SEND_DUTY_CYCLE;
         }
 
         if (ir_dev->props->s_rx_carrier_range)
diff --git a/drivers/media/IR/ir-raw-event.c b/drivers/media/IR/ir-raw-event.c
index 43094e7eccfa..8e0e1b1f8c87 100644
--- a/drivers/media/IR/ir-raw-event.c
+++ b/drivers/media/IR/ir-raw-event.c
@@ -279,9 +279,11 @@ int ir_raw_event_register(struct input_dev *input_dev)
                         "rc%u",  (unsigned int)ir->devno);
 
         if (IS_ERR(ir->raw->thread)) {
+                int ret = PTR_ERR(ir->raw->thread);
+
                 kfree(ir->raw);
                 ir->raw = NULL;
-                return PTR_ERR(ir->raw->thread);
+                return ret;
         }
 
         mutex_lock(&ir_raw_handler_lock);
diff --git a/drivers/media/IR/ir-sysfs.c b/drivers/media/IR/ir-sysfs.c
index 96dafc425c8e..46d42467f9b4 100644
--- a/drivers/media/IR/ir-sysfs.c
+++ b/drivers/media/IR/ir-sysfs.c
@@ -67,13 +67,14 @@ static ssize_t show_protocols(struct device *d,
         char *tmp = buf;
         int i;
 
-        if (ir_dev->props->driver_type == RC_DRIVER_SCANCODE) {
+        if (ir_dev->props && ir_dev->props->driver_type == RC_DRIVER_SCANCODE) {
                 enabled = ir_dev->rc_tab.ir_type;
                 allowed = ir_dev->props->allowed_protos;
-        } else {
+        } else if (ir_dev->raw) {
                 enabled = ir_dev->raw->enabled_protocols;
                 allowed = ir_raw_get_allowed_protocols();
-        }
+        } else
+                return sprintf(tmp, "[builtin]\n");
 
         IR_dprintk(1, "allowed - 0x%llx, enabled - 0x%llx\n",
                    (long long)allowed,
@@ -121,10 +122,14 @@ static ssize_t store_protocols(struct device *d,
         int rc, i, count = 0;
         unsigned long flags;
 
-        if (ir_dev->props->driver_type == RC_DRIVER_SCANCODE)
+        if (ir_dev->props && ir_dev->props->driver_type == RC_DRIVER_SCANCODE)
                 type = ir_dev->rc_tab.ir_type;
-        else
+        else if (ir_dev->raw)
                 type = ir_dev->raw->enabled_protocols;
+        else {
+                IR_dprintk(1, "Protocol switching not supported\n");
+                return -EINVAL;
+        }
 
         while ((tmp = strsep((char **) &data, " \n")) != NULL) {
                 if (!*tmp)
@@ -185,7 +190,7 @@ static ssize_t store_protocols(struct device *d,
                 }
         }
 
-        if (ir_dev->props->driver_type == RC_DRIVER_SCANCODE) {
+        if (ir_dev->props && ir_dev->props->driver_type == RC_DRIVER_SCANCODE) {
                 spin_lock_irqsave(&ir_dev->rc_tab.lock, flags);
                 ir_dev->rc_tab.ir_type = type;
                 spin_unlock_irqrestore(&ir_dev->rc_tab.lock, flags);
diff --git a/drivers/media/IR/keymaps/rc-rc6-mce.c b/drivers/media/IR/keymaps/rc-rc6-mce.c
index 64264f7f838f..39557ad401b6 100644
--- a/drivers/media/IR/keymaps/rc-rc6-mce.c
+++ b/drivers/media/IR/keymaps/rc-rc6-mce.c
@@ -19,6 +19,7 @@ static struct ir_scancode rc6_mce[] = {
 
         { 0x800f0416, KEY_PLAY },
         { 0x800f0418, KEY_PAUSE },
+        { 0x800f046e, KEY_PLAYPAUSE },
         { 0x800f0419, KEY_STOP },
         { 0x800f0417, KEY_RECORD },
 
@@ -37,6 +38,8 @@ static struct ir_scancode rc6_mce[] = {
         { 0x800f0411, KEY_VOLUMEDOWN },
         { 0x800f0412, KEY_CHANNELUP },
         { 0x800f0413, KEY_CHANNELDOWN },
+        { 0x800f043a, KEY_BRIGHTNESSUP },
+        { 0x800f0480, KEY_BRIGHTNESSDOWN },
 
         { 0x800f0401, KEY_NUMERIC_1 },
         { 0x800f0402, KEY_NUMERIC_2 },
diff --git a/drivers/media/IR/mceusb.c b/drivers/media/IR/mceusb.c
index ac6bb2c01a48..bc620e10ef77 100644
--- a/drivers/media/IR/mceusb.c
+++ b/drivers/media/IR/mceusb.c
@@ -120,6 +120,10 @@ static struct usb_device_id mceusb_dev_table[] = {
         { USB_DEVICE(VENDOR_PHILIPS, 0x0613) },
         /* Philips eHome Infrared Transceiver */
         { USB_DEVICE(VENDOR_PHILIPS, 0x0815) },
+        /* Philips/Spinel plus IR transceiver for ASUS */
+        { USB_DEVICE(VENDOR_PHILIPS, 0x206c) },
+        /* Philips/Spinel plus IR transceiver for ASUS */
+        { USB_DEVICE(VENDOR_PHILIPS, 0x2088) },
         /* Realtek MCE IR Receiver */
         { USB_DEVICE(VENDOR_REALTEK, 0x0161) },
         /* SMK/Toshiba G83C0004D410 */
diff --git a/drivers/media/dvb/dvb-usb/dib0700_core.c b/drivers/media/dvb/dvb-usb/dib0700_core.c
index fe818348b8a3..48397f103d32 100644
--- a/drivers/media/dvb/dvb-usb/dib0700_core.c
+++ b/drivers/media/dvb/dvb-usb/dib0700_core.c
@@ -673,9 +673,6 @@ static int dib0700_probe(struct usb_interface *intf,
                         else
                                 dev->props.rc.core.bulk_mode = false;
 
-                        /* Need a higher delay, to avoid wrong repeat */
-                        dev->rc_input_dev->rep[REP_DELAY] = 500;
-
                         dib0700_rc_setup(dev);
 
                         return 0;
diff --git a/drivers/media/dvb/dvb-usb/dib0700_devices.c b/drivers/media/dvb/dvb-usb/dib0700_devices.c
index f634d2e784b2..e06acd1fecb6 100644
--- a/drivers/media/dvb/dvb-usb/dib0700_devices.c
+++ b/drivers/media/dvb/dvb-usb/dib0700_devices.c
@@ -940,6 +940,58 @@ static int stk7070p_frontend_attach(struct dvb_usb_adapter *adap)
         return adap->fe == NULL ? -ENODEV : 0;
 }
 
+/* STK7770P */
+static struct dib7000p_config dib7770p_dib7000p_config = {
+        .output_mpeg2_in_188_bytes = 1,
+
+        .agc_config_count = 1,
+        .agc = &dib7070_agc_config,
+        .bw  = &dib7070_bw_config_12_mhz,
+        .tuner_is_baseband = 1,
+        .spur_protect = 1,
+
+        .gpio_dir = DIB7000P_GPIO_DEFAULT_DIRECTIONS,
+        .gpio_val = DIB7000P_GPIO_DEFAULT_VALUES,
+        .gpio_pwm_pos = DIB7000P_GPIO_DEFAULT_PWM_POS,
+
+        .hostbus_diversity = 1,
+        .enable_current_mirror = 1,
+        .disable_sample_and_hold = 0,
+};
+
+static int stk7770p_frontend_attach(struct dvb_usb_adapter *adap)
+{
+        struct usb_device_descriptor *p = &adap->dev->udev->descriptor;
+        if (p->idVendor  == cpu_to_le16(USB_VID_PINNACLE) &&
+            p->idProduct == cpu_to_le16(USB_PID_PINNACLE_PCTV72E))
+                dib0700_set_gpio(adap->dev, GPIO6, GPIO_OUT, 0);
+        else
+                dib0700_set_gpio(adap->dev, GPIO6, GPIO_OUT, 1);
+        msleep(10);
+        dib0700_set_gpio(adap->dev, GPIO9, GPIO_OUT, 1);
+        dib0700_set_gpio(adap->dev, GPIO4, GPIO_OUT, 1);
+        dib0700_set_gpio(adap->dev, GPIO7, GPIO_OUT, 1);
+        dib0700_set_gpio(adap->dev, GPIO10, GPIO_OUT, 0);
+
+        dib0700_ctrl_clock(adap->dev, 72, 1);
+
+        msleep(10);
+        dib0700_set_gpio(adap->dev, GPIO10, GPIO_OUT, 1);
+        msleep(10);
+        dib0700_set_gpio(adap->dev, GPIO0, GPIO_OUT, 1);
+
+        if (dib7000p_i2c_enumeration(&adap->dev->i2c_adap, 1, 18,
+                                     &dib7770p_dib7000p_config) != 0) {
+                err("%s: dib7000p_i2c_enumeration failed.  Cannot continue\n",
+                    __func__);
+                return -ENODEV;
+        }
+
+        adap->fe = dvb_attach(dib7000p_attach, &adap->dev->i2c_adap, 0x80,
+                &dib7770p_dib7000p_config);
+        return adap->fe == NULL ? -ENODEV : 0;
+}
+
 /* DIB807x generic */
 static struct dibx000_agc_config dib807x_agc_config[2] = {
         {
@@ -1781,7 +1833,7 @@ struct usb_device_id dib0700_usb_id_table[] = {
 /* 60 */{ USB_DEVICE(USB_VID_TERRATEC,  USB_PID_TERRATEC_CINERGY_T_XXS_2) },
         { USB_DEVICE(USB_VID_DIBCOM,    USB_PID_DIBCOM_STK807XPVR) },
         { USB_DEVICE(USB_VID_DIBCOM,    USB_PID_DIBCOM_STK807XP) },
-        { USB_DEVICE(USB_VID_PIXELVIEW, USB_PID_PIXELVIEW_SBTVD) },
+        { USB_DEVICE_VER(USB_VID_PIXELVIEW, USB_PID_PIXELVIEW_SBTVD, 0x000, 0x3f00) },
         { USB_DEVICE(USB_VID_EVOLUTEPC, USB_PID_TVWAY_PLUS) },
 /* 65 */{ USB_DEVICE(USB_VID_PINNACLE,  USB_PID_PINNACLE_PCTV73ESE) },
         { USB_DEVICE(USB_VID_PINNACLE,  USB_PID_PINNACLE_PCTV282E) },
@@ -2406,7 +2458,7 @@ struct dvb_usb_device_properties dib0700_devices[] = {
                                 .pid_filter_count = 32,
                                 .pid_filter       = stk70x0p_pid_filter,
                                 .pid_filter_ctrl  = stk70x0p_pid_filter_ctrl,
-                                .frontend_attach  = stk7070p_frontend_attach,
+                                .frontend_attach  = stk7770p_frontend_attach,
                                 .tuner_attach     = dib7770p_tuner_attach,
 
                                 DIB0700_DEFAULT_STREAMING_CONFIG(0x02),
diff --git a/drivers/media/dvb/dvb-usb/opera1.c b/drivers/media/dvb/dvb-usb/opera1.c
index 6b22ec64ab0c..f896337b4535 100644
--- a/drivers/media/dvb/dvb-usb/opera1.c
+++ b/drivers/media/dvb/dvb-usb/opera1.c
@@ -483,9 +483,7 @@ static int opera1_xilinx_load_firmware(struct usb_device *dev,
                 }
         }
         kfree(p);
-        if (fw) {
-                release_firmware(fw);
-        }
+        release_firmware(fw);
         return ret;
 }
 
diff --git a/drivers/media/dvb/frontends/dib7000p.c b/drivers/media/dvb/frontends/dib7000p.c
index 2e28b973dfd3..3aed0d433921 100644
--- a/drivers/media/dvb/frontends/dib7000p.c
+++ b/drivers/media/dvb/frontends/dib7000p.c
@@ -260,6 +260,9 @@ static void dib7000p_set_adc_state(struct dib7000p_state *state, enum dibx000_ad
 
 //      dprintk( "908: %x, 909: %x\n", reg_908, reg_909);
 
+        reg_909 |= (state->cfg.disable_sample_and_hold & 1) << 4;
+        reg_908 |= (state->cfg.enable_current_mirror & 1) << 7;
+
         dib7000p_write_word(state, 908, reg_908);
         dib7000p_write_word(state, 909, reg_909);
 }
@@ -778,7 +781,10 @@ static void dib7000p_set_channel(struct dib7000p_state *state, struct dvb_fronte
                 default:
                 case GUARD_INTERVAL_1_32: value *= 1; break;
         }
-        state->div_sync_wait = (value * 3) / 2 + 32; // add 50% SFN margin + compensate for one DVSY-fifo TODO
+        if (state->cfg.diversity_delay == 0)
+                state->div_sync_wait = (value * 3) / 2 + 48; // add 50% SFN margin + compensate for one DVSY-fifo
+        else
+                state->div_sync_wait = (value * 3) / 2 + state->cfg.diversity_delay; // add 50% SFN margin + compensate for one DVSY-fifo
 
         /* deactive the possibility of diversity reception if extended interleaver */
         state->div_force_off = !1 && ch->u.ofdm.transmission_mode != TRANSMISSION_MODE_8K;
diff --git a/drivers/media/dvb/frontends/dib7000p.h b/drivers/media/dvb/frontends/dib7000p.h
index 805dd13a97ee..da17345bf5bd 100644
--- a/drivers/media/dvb/frontends/dib7000p.h
+++ b/drivers/media/dvb/frontends/dib7000p.h
@@ -33,6 +33,11 @@ struct dib7000p_config {
         int (*agc_control) (struct dvb_frontend *, u8 before);
 
         u8 output_mode;
+        u8 disable_sample_and_hold : 1;
+
+        u8 enable_current_mirror : 1;
+        u8 diversity_delay;
+
 };
 
 #define DEFAULT_DIB7000P_I2C_ADDRESS 18
diff --git a/drivers/media/dvb/siano/smscoreapi.c b/drivers/media/dvb/siano/smscoreapi.c
index d93468cd3a85..ff3b0fa901b3 100644
--- a/drivers/media/dvb/siano/smscoreapi.c
+++ b/drivers/media/dvb/siano/smscoreapi.c
@@ -1098,33 +1098,26 @@ EXPORT_SYMBOL_GPL(smscore_onresponse);
  *
  * @return pointer to descriptor on success, NULL on error.
  */
-struct smscore_buffer_t *smscore_getbuffer(struct smscore_device_t *coredev)
+
+struct smscore_buffer_t *get_entry(struct smscore_device_t *coredev)
 {
         struct smscore_buffer_t *cb = NULL;
         unsigned long flags;
 
-        DEFINE_WAIT(wait);
-
         spin_lock_irqsave(&coredev->bufferslock, flags);
-
-        /* This function must return a valid buffer, since the buffer list is
-         * finite, we check that there is an available buffer, if not, we wait
-         * until such buffer become available.
-         */
-
-        prepare_to_wait(&coredev->buffer_mng_waitq, &wait, TASK_INTERRUPTIBLE);
-        if (list_empty(&coredev->buffers)) {
-                spin_unlock_irqrestore(&coredev->bufferslock, flags);
-                schedule();
-                spin_lock_irqsave(&coredev->bufferslock, flags);
+        if (!list_empty(&coredev->buffers)) {
+                cb = (struct smscore_buffer_t *) coredev->buffers.next;
+                list_del(&cb->entry);
         }
+        spin_unlock_irqrestore(&coredev->bufferslock, flags);
+        return cb;
+}
 
-        finish_wait(&coredev->buffer_mng_waitq, &wait);
-
-        cb = (struct smscore_buffer_t *) coredev->buffers.next;
-        list_del(&cb->entry);
+struct smscore_buffer_t *smscore_getbuffer(struct smscore_device_t *coredev)
+{
+        struct smscore_buffer_t *cb = NULL;
 
-        spin_unlock_irqrestore(&coredev->bufferslock, flags);
+        wait_event(coredev->buffer_mng_waitq, (cb = get_entry(coredev)));
 
         return cb;
 }
diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c
index 67a4ec8768a6..4ce541a5eb47 100644
--- a/drivers/media/radio/si470x/radio-si470x-i2c.c
+++ b/drivers/media/radio/si470x/radio-si470x-i2c.c
@@ -395,7 +395,7 @@ static int __devinit si470x_i2c_probe(struct i2c_client *client,
         radio->registers[POWERCFG] = POWERCFG_ENABLE;
         if (si470x_set_register(radio, POWERCFG) < 0) {
                 retval = -EIO;
-                goto err_all;
+                goto err_video;
         }
         msleep(110);
 
diff --git a/drivers/media/video/cx231xx/Makefile b/drivers/media/video/cx231xx/Makefile
index 755dd0ce65ff..6f2b57384488 100644
--- a/drivers/media/video/cx231xx/Makefile
+++ b/drivers/media/video/cx231xx/Makefile
@@ -11,4 +11,5 @@ EXTRA_CFLAGS += -Idrivers/media/video
 EXTRA_CFLAGS += -Idrivers/media/common/tuners
 EXTRA_CFLAGS += -Idrivers/media/dvb/dvb-core
 EXTRA_CFLAGS += -Idrivers/media/dvb/frontends
+EXTRA_CFLAGS += -Idrivers/media/dvb/dvb-usb
 
diff --git a/drivers/media/video/cx231xx/cx231xx-cards.c b/drivers/media/video/cx231xx/cx231xx-cards.c
index 6bdc0ef18119..f2a4900014bc 100644
--- a/drivers/media/video/cx231xx/cx231xx-cards.c
+++ b/drivers/media/video/cx231xx/cx231xx-cards.c
@@ -32,6 +32,7 @@
 #include <media/v4l2-chip-ident.h>
 
 #include <media/cx25840.h>
+#include "dvb-usb-ids.h"
 #include "xc5000.h"
 
 #include "cx231xx.h"
@@ -175,6 +176,8 @@ struct usb_device_id cx231xx_id_table[] = {
          .driver_info = CX231XX_BOARD_CNXT_RDE_250},
         {USB_DEVICE(0x0572, 0x58A1),
          .driver_info = CX231XX_BOARD_CNXT_RDU_250},
+        {USB_DEVICE_VER(USB_VID_PIXELVIEW, USB_PID_PIXELVIEW_SBTVD, 0x4000,0x4fff),
+         .driver_info = CX231XX_BOARD_UNKNOWN},
         {},
 };
 
@@ -226,14 +229,16 @@ void cx231xx_pre_card_setup(struct cx231xx *dev)
                      dev->board.name, dev->model);
 
         /* set the direction for GPIO pins */
-        cx231xx_set_gpio_direction(dev, dev->board.tuner_gpio->bit, 1);
-        cx231xx_set_gpio_value(dev, dev->board.tuner_gpio->bit, 1);
-        cx231xx_set_gpio_direction(dev, dev->board.tuner_sif_gpio, 1);
+        if (dev->board.tuner_gpio) {
+                cx231xx_set_gpio_direction(dev, dev->board.tuner_gpio->bit, 1);
+                cx231xx_set_gpio_value(dev, dev->board.tuner_gpio->bit, 1);
+                cx231xx_set_gpio_direction(dev, dev->board.tuner_sif_gpio, 1);
 
-        /* request some modules if any required */
+                /* request some modules if any required */
 
-        /* reset the Tuner */
-        cx231xx_gpio_set(dev, dev->board.tuner_gpio);
+                /* reset the Tuner */
+                cx231xx_gpio_set(dev, dev->board.tuner_gpio);
+        }
 
         /* set the mode to Analog mode initially */
         cx231xx_set_mode(dev, CX231XX_ANALOG_MODE);
diff --git a/drivers/media/video/cx25840/cx25840-core.c b/drivers/media/video/cx25840/cx25840-core.c
index 86ca8c2359dd..f5a3e74c3c7c 100644
--- a/drivers/media/video/cx25840/cx25840-core.c
+++ b/drivers/media/video/cx25840/cx25840-core.c
@@ -1996,7 +1996,7 @@ static int cx25840_probe(struct i2c_client *client,
 
                 state->volume = v4l2_ctrl_new_std(&state->hdl,
                         &cx25840_audio_ctrl_ops, V4L2_CID_AUDIO_VOLUME,
-                        0, 65335, 65535 / 100, default_volume);
+                        0, 65535, 65535 / 100, default_volume);
                 state->mute = v4l2_ctrl_new_std(&state->hdl,
                         &cx25840_audio_ctrl_ops, V4L2_CID_AUDIO_MUTE,
                         0, 1, 1, 0);
diff --git a/drivers/media/video/cx88/Kconfig b/drivers/media/video/cx88/Kconfig
index 99dbae117591..0fa85cbefbb1 100644
--- a/drivers/media/video/cx88/Kconfig
+++ b/drivers/media/video/cx88/Kconfig
@@ -17,7 +17,7 @@ config VIDEO_CX88
 
 config VIDEO_CX88_ALSA
         tristate "Conexant 2388x DMA audio support"
-        depends on VIDEO_CX88 && SND && EXPERIMENTAL
+        depends on VIDEO_CX88 && SND
         select SND_PCM
         ---help---
           This is a video4linux driver for direct (DMA) audio on
diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c
index b9846106913e..78abc1c1f9d5 100644
--- a/drivers/media/video/gspca/gspca.c
+++ b/drivers/media/video/gspca/gspca.c
@@ -223,6 +223,7 @@ static int alloc_and_submit_int_urb(struct gspca_dev *gspca_dev,
                 usb_rcvintpipe(dev, ep->bEndpointAddress),
                 buffer, buffer_len,
                 int_irq, (void *)gspca_dev, interval);
+        urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
         gspca_dev->int_urb = urb;
         ret = usb_submit_urb(urb, GFP_KERNEL);
         if (ret < 0) {
diff --git a/drivers/media/video/gspca/sn9c20x.c b/drivers/media/video/gspca/sn9c20x.c
index 83a718f0f3f9..9052d5702556 100644
--- a/drivers/media/video/gspca/sn9c20x.c
+++ b/drivers/media/video/gspca/sn9c20x.c
@@ -2357,8 +2357,7 @@ static void sd_pkt_scan(struct gspca_dev *gspca_dev,
                             (data[33] << 10);
                 avg_lum >>= 9;
                 atomic_set(&sd->avg_lum, avg_lum);
-                gspca_frame_add(gspca_dev, LAST_PACKET,
-                                data, len);
+                gspca_frame_add(gspca_dev, LAST_PACKET, NULL, 0);
                 return;
         }
         if (gspca_dev->last_packet_type == LAST_PACKET) {
diff --git a/drivers/media/video/ivtv/ivtvfb.c b/drivers/media/video/ivtv/ivtvfb.c
index be03a712731c..f0316d02f09f 100644
--- a/drivers/media/video/ivtv/ivtvfb.c
+++ b/drivers/media/video/ivtv/ivtvfb.c
@@ -466,6 +466,8 @@ static int ivtvfb_ioctl(struct fb_info *info, unsigned int cmd, unsigned long ar
                         struct fb_vblank vblank;
                         u32 trace;
 
+                        memset(&vblank, 0, sizeof(struct fb_vblank));
+
                         vblank.flags = FB_VBLANK_HAVE_COUNT |FB_VBLANK_HAVE_VCOUNT |
                                         FB_VBLANK_HAVE_VSYNC;
                         trace = read_reg(IVTV_REG_DEC_LINE_FIELD) >> 16;
diff --git a/drivers/media/video/mem2mem_testdev.c b/drivers/media/video/mem2mem_testdev.c
index 4525335f9bd4..a7210d981388 100644
--- a/drivers/media/video/mem2mem_testdev.c
+++ b/drivers/media/video/mem2mem_testdev.c
@@ -239,7 +239,7 @@ static int device_process(struct m2mtest_ctx *ctx,
                 return -EFAULT;
         }
 
-        if (in_buf->vb.size < out_buf->vb.size) {
+        if (in_buf->vb.size > out_buf->vb.size) {
                 v4l2_err(&dev->v4l2_dev, "Output buffer is too small\n");
                 return -EINVAL;
         }
@@ -1014,6 +1014,7 @@ static int m2mtest_remove(struct platform_device *pdev)
         v4l2_m2m_release(dev->m2m_dev);
         del_timer_sync(&dev->timer);
         video_unregister_device(dev->vfd);
+        video_device_release(dev->vfd);
         v4l2_device_unregister(&dev->v4l2_dev);
         kfree(dev);
 
diff --git a/drivers/media/video/mt9m111.c b/drivers/media/video/mt9m111.c
index 758a4db27d65..c71af4e0e517 100644
--- a/drivers/media/video/mt9m111.c
+++ b/drivers/media/video/mt9m111.c
@@ -447,6 +447,9 @@ static int mt9m111_s_crop(struct v4l2_subdev *sd, struct v4l2_crop *a)
         dev_dbg(&client->dev, "%s left=%d, top=%d, width=%d, height=%d\n",
                 __func__, rect.left, rect.top, rect.width, rect.height);
 
+        if (a->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                return -EINVAL;
+
         ret = mt9m111_make_rect(client, &rect);
         if (!ret)
                 mt9m111->rect = rect;
@@ -466,12 +469,14 @@ static int mt9m111_g_crop(struct v4l2_subdev *sd, struct v4l2_crop *a)
 
 static int mt9m111_cropcap(struct v4l2_subdev *sd, struct v4l2_cropcap *a)
 {
+        if (a->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+                return -EINVAL;
+
         a->bounds.left                  = MT9M111_MIN_DARK_COLS;
         a->bounds.top                   = MT9M111_MIN_DARK_ROWS;
         a->bounds.width                 = MT9M111_MAX_WIDTH;
         a->bounds.height                = MT9M111_MAX_HEIGHT;
         a->defrect                      = a->bounds;
-        a->type                         = V4L2_BUF_TYPE_VIDEO_CAPTURE;
         a->pixelaspect.numerator        = 1;
         a->pixelaspect.denominator      = 1;
 
@@ -487,6 +492,7 @@ static int mt9m111_g_fmt(struct v4l2_subdev *sd,
         mf->width       = mt9m111->rect.width;
         mf->height      = mt9m111->rect.height;
         mf->code        = mt9m111->fmt->code;
+        mf->colorspace  = mt9m111->fmt->colorspace;
         mf->field       = V4L2_FIELD_NONE;
 
         return 0;
diff --git a/drivers/media/video/mt9v022.c b/drivers/media/video/mt9v022.c
index e7cd23cd6394..b48473c7896b 100644
--- a/drivers/media/video/mt9v022.c
+++ b/drivers/media/video/mt9v022.c
@@ -402,9 +402,6 @@ static int mt9v022_s_fmt(struct v4l2_subdev *sd,
                 if (mt9v022->model != V4L2_IDENT_MT9V022IX7ATC)
                         return -EINVAL;
                 break;
-        case 0:
-                /* No format change, only geometry */
-                break;
         default:
                 return -EINVAL;
         }
diff --git a/drivers/media/video/mx2_camera.c b/drivers/media/video/mx2_camera.c
index 66ff174151b5..b6ea67221d1d 100644
--- a/drivers/media/video/mx2_camera.c
+++ b/drivers/media/video/mx2_camera.c
@@ -378,6 +378,9 @@ static void mx25_camera_frame_done(struct mx2_camera_dev *pcdev, int fb,
 
         spin_lock_irqsave(&pcdev->lock, flags);
 
+        if (*fb_active == NULL)
+                goto out;
+
         vb = &(*fb_active)->vb;
         dev_dbg(pcdev->dev, "%s (vb=0x%p) 0x%08lx %d\n", __func__,
                 vb, vb->baddr, vb->bsize);
@@ -402,6 +405,7 @@ static void mx25_camera_frame_done(struct mx2_camera_dev *pcdev, int fb,
 
         *fb_active = buf;
 
+out:
         spin_unlock_irqrestore(&pcdev->lock, flags);
 }
 
diff --git a/drivers/media/video/pvrusb2/pvrusb2-ctrl.c b/drivers/media/video/pvrusb2/pvrusb2-ctrl.c
index 1b992b847198..55ea914c7fcd 100644
--- a/drivers/media/video/pvrusb2/pvrusb2-ctrl.c
+++ b/drivers/media/video/pvrusb2/pvrusb2-ctrl.c
@@ -513,7 +513,7 @@ int pvr2_ctrl_sym_to_value(struct pvr2_ctrl *cptr,
                         if (ret >= 0) {
                                 ret = pvr2_ctrl_range_check(cptr,*valptr);
                         }
-                        if (maskptr) *maskptr = ~0;
+                        *maskptr = ~0;
                 } else if (cptr->info->type == pvr2_ctl_bool) {
                         ret = parse_token(ptr,len,valptr,boolNames,
                                           ARRAY_SIZE(boolNames));
@@ -522,7 +522,7 @@ int pvr2_ctrl_sym_to_value(struct pvr2_ctrl *cptr,
                         } else if (ret == 0) {
                                 *valptr = (*valptr & 1) ? !0 : 0;
                         }
-                        if (maskptr) *maskptr = 1;
+                        *maskptr = 1;
                 } else if (cptr->info->type == pvr2_ctl_enum) {
                         ret = parse_token(
                                 ptr,len,valptr,
@@ -531,7 +531,7 @@ int pvr2_ctrl_sym_to_value(struct pvr2_ctrl *cptr,
                         if (ret >= 0) {
                                 ret = pvr2_ctrl_range_check(cptr,*valptr);
                         }
-                        if (maskptr) *maskptr = ~0;
+                        *maskptr = ~0;
                 } else if (cptr->info->type == pvr2_ctl_bitmask) {
                         ret = parse_tlist(
                                 ptr,len,maskptr,valptr,
diff --git a/drivers/media/video/s5p-fimc/fimc-core.c b/drivers/media/video/s5p-fimc/fimc-core.c
index b151c7be8a50..6961c55baf9b 100644
--- a/drivers/media/video/s5p-fimc/fimc-core.c
+++ b/drivers/media/video/s5p-fimc/fimc-core.c
@@ -393,6 +393,37 @@ static void fimc_set_yuv_order(struct fimc_ctx *ctx)
         dbg("ctx->out_order_1p= %d", ctx->out_order_1p);
 }
 
+static void fimc_prepare_dma_offset(struct fimc_ctx *ctx, struct fimc_frame *f)
+{
+        struct samsung_fimc_variant *variant = ctx->fimc_dev->variant;
+
+        f->dma_offset.y_h = f->offs_h;
+        if (!variant->pix_hoff)
+                f->dma_offset.y_h *= (f->fmt->depth >> 3);
+
+        f->dma_offset.y_v = f->offs_v;
+
+        f->dma_offset.cb_h = f->offs_h;
+        f->dma_offset.cb_v = f->offs_v;
+
+        f->dma_offset.cr_h = f->offs_h;
+        f->dma_offset.cr_v = f->offs_v;
+
+        if (!variant->pix_hoff) {
+                if (f->fmt->planes_cnt == 3) {
+                        f->dma_offset.cb_h >>= 1;
+                        f->dma_offset.cr_h >>= 1;
+                }
+                if (f->fmt->color == S5P_FIMC_YCBCR420) {
+                        f->dma_offset.cb_v >>= 1;
+                        f->dma_offset.cr_v >>= 1;
+                }
+        }
+
+        dbg("in_offset: color= %d, y_h= %d, y_v= %d",
+            f->fmt->color, f->dma_offset.y_h, f->dma_offset.y_v);
+}
+
 /**
  * fimc_prepare_config - check dimensions, operation and color mode
  *                       and pre-calculate offset and the scaling coefficients.
@@ -406,7 +437,6 @@ static int fimc_prepare_config(struct fimc_ctx *ctx, u32 flags)
 {
         struct fimc_frame *s_frame, *d_frame;
         struct fimc_vid_buffer *buf = NULL;
-        struct samsung_fimc_variant *variant = ctx->fimc_dev->variant;
         int ret = 0;
 
         s_frame = &ctx->s_frame;
@@ -419,61 +449,16 @@ static int fimc_prepare_config(struct fimc_ctx *ctx, u32 flags)
                         swap(d_frame->width, d_frame->height);
                 }
 
-                /* Prepare the output offset ratios for scaler. */
-                d_frame->dma_offset.y_h = d_frame->offs_h;
-                if (!variant->pix_hoff)
-                        d_frame->dma_offset.y_h *= (d_frame->fmt->depth >> 3);
-
-                d_frame->dma_offset.y_v = d_frame->offs_v;
-
-                d_frame->dma_offset.cb_h = d_frame->offs_h;
-                d_frame->dma_offset.cb_v = d_frame->offs_v;
-
-                d_frame->dma_offset.cr_h = d_frame->offs_h;
-                d_frame->dma_offset.cr_v = d_frame->offs_v;
+                /* Prepare the DMA offset ratios for scaler. */
+                fimc_prepare_dma_offset(ctx, &ctx->s_frame);
+                fimc_prepare_dma_offset(ctx, &ctx->d_frame);
 
-                if (!variant->pix_hoff && d_frame->fmt->planes_cnt == 3) {
-                        d_frame->dma_offset.cb_h >>= 1;
-                        d_frame->dma_offset.cb_v >>= 1;
-                        d_frame->dma_offset.cr_h >>= 1;
-                        d_frame->dma_offset.cr_v >>= 1;
-                }
-
-                dbg("out offset: color= %d, y_h= %d, y_v= %d",
-                        d_frame->fmt->color,
-                        d_frame->dma_offset.y_h, d_frame->dma_offset.y_v);
-
-                /* Prepare the input offset ratios for scaler. */
-                s_frame->dma_offset.y_h = s_frame->offs_h;
-                if (!variant->pix_hoff)
-                        s_frame->dma_offset.y_h *= (s_frame->fmt->depth >> 3);
-                s_frame->dma_offset.y_v = s_frame->offs_v;
-
-                s_frame->dma_offset.cb_h = s_frame->offs_h;
-                s_frame->dma_offset.cb_v = s_frame->offs_v;
-
-                s_frame->dma_offset.cr_h = s_frame->offs_h;
-                s_frame->dma_offset.cr_v = s_frame->offs_v;
-
-                if (!variant->pix_hoff && s_frame->fmt->planes_cnt == 3) {
-                        s_frame->dma_offset.cb_h >>= 1;
-                        s_frame->dma_offset.cb_v >>= 1;
-                        s_frame->dma_offset.cr_h >>= 1;
-                        s_frame->dma_offset.cr_v >>= 1;
-                }
-
-                dbg("in offset: color= %d, y_h= %d, y_v= %d",
-                        s_frame->fmt->color, s_frame->dma_offset.y_h,
-                        s_frame->dma_offset.y_v);
-
-                fimc_set_yuv_order(ctx);
-
-                /* Check against the scaler ratio. */
                 if (s_frame->height > (SCALER_MAX_VRATIO * d_frame->height) ||
                     s_frame->width > (SCALER_MAX_HRATIO * d_frame->width)) {
                         err("out of scaler range");
                         return -EINVAL;
                 }
+                fimc_set_yuv_order(ctx);
         }
 
         /* Input DMA mode is not allowed when the scaler is disabled. */
@@ -822,7 +807,8 @@ static int fimc_m2m_s_fmt(struct file *file, void *priv, struct v4l2_format *f)
         } else {
                 v4l2_err(&ctx->fimc_dev->m2m.v4l2_dev,
                          "Wrong buffer/video queue type (%d)\n", f->type);
-                return -EINVAL;
+                ret = -EINVAL;
+                goto s_fmt_out;
         }
 
         pix = &f->fmt.pix;
@@ -1414,8 +1400,10 @@ static int fimc_probe(struct platform_device *pdev)
         }
 
         fimc->work_queue = create_workqueue(dev_name(&fimc->pdev->dev));
-        if (!fimc->work_queue)
+        if (!fimc->work_queue) {
+                ret = -ENOMEM;
                 goto err_irq;
+        }
 
         ret = fimc_register_m2m_device(fimc);
         if (ret)
@@ -1492,6 +1480,7 @@ static struct samsung_fimc_variant fimc2_variant_s5p = {
 };
 
 static struct samsung_fimc_variant fimc01_variant_s5pv210 = {
+        .pix_hoff       = 1,
         .has_inp_rot    = 1,
         .has_out_rot    = 1,
         .min_inp_pixsize = 16,
@@ -1506,6 +1495,7 @@ static struct samsung_fimc_variant fimc01_variant_s5pv210 = {
 };
 
 static struct samsung_fimc_variant fimc2_variant_s5pv210 = {
+        .pix_hoff        = 1,
         .min_inp_pixsize = 16,
         .min_out_pixsize = 32,
 
diff --git a/drivers/media/video/saa7134/saa7134-cards.c b/drivers/media/video/saa7134/saa7134-cards.c
index ec697fcd406e..bb8d83d8ddaf 100644
--- a/drivers/media/video/saa7134/saa7134-cards.c
+++ b/drivers/media/video/saa7134/saa7134-cards.c
@@ -4323,13 +4323,13 @@ struct saa7134_board saa7134_boards[] = {
         },
         [SAA7134_BOARD_BEHOLD_COLUMBUS_TVFM] = {
                 /*       Beholder Intl. Ltd. 2008      */
-                /*Dmitry Belimov <d.belimov@gmail.com> */
-                .name           = "Beholder BeholdTV Columbus TVFM",
+                /* Dmitry Belimov <d.belimov@gmail.com> */
+                .name           = "Beholder BeholdTV Columbus TV/FM",
                 .audio_clock    = 0x00187de7,
                 .tuner_type     = TUNER_ALPS_TSBE5_PAL,
-                .radio_type     = UNSET,
-                .tuner_addr     = ADDR_UNSET,
-                .radio_addr     = ADDR_UNSET,
+                .radio_type     = TUNER_TEA5767,
+                .tuner_addr     = 0xc2 >> 1,
+                .radio_addr     = 0xc0 >> 1,
                 .tda9887_conf   = TDA9887_PRESENT,
                 .gpiomask       = 0x000A8004,
                 .inputs         = {{
diff --git a/drivers/media/video/saa7164/saa7164-buffer.c b/drivers/media/video/saa7164/saa7164-buffer.c
index 5713f3a4b76c..ddd25d32723d 100644
--- a/drivers/media/video/saa7164/saa7164-buffer.c
+++ b/drivers/media/video/saa7164/saa7164-buffer.c
@@ -136,10 +136,11 @@ ret:
 int saa7164_buffer_dealloc(struct saa7164_tsport *port,
         struct saa7164_buffer *buf)
 {
-        struct saa7164_dev *dev = port->dev;
+        struct saa7164_dev *dev;
 
-        if ((buf == 0) || (port == 0))
+        if (!buf || !port)
                 return SAA_ERR_BAD_PARAMETER;
+        dev = port->dev;
 
         dprintk(DBGLVL_BUF, "%s() deallocating buffer @ 0x%p\n", __func__, buf);
 
diff --git a/drivers/media/video/uvc/uvc_driver.c b/drivers/media/video/uvc/uvc_driver.c
index 8bdd940f32e6..2ac85d8984f0 100644
--- a/drivers/media/video/uvc/uvc_driver.c
+++ b/drivers/media/video/uvc/uvc_driver.c
@@ -486,6 +486,12 @@ static int uvc_parse_format(struct uvc_device *dev,
                             max(frame->dwFrameInterval[0],
                                 frame->dwDefaultFrameInterval));
 
+                if (dev->quirks & UVC_QUIRK_RESTRICT_FRAME_RATE) {
+                        frame->bFrameIntervalType = 1;
+                        frame->dwFrameInterval[0] =
+                                frame->dwDefaultFrameInterval;
+                }
+
                 uvc_trace(UVC_TRACE_DESCR, "- %ux%u (%u.%u fps)\n",
                         frame->wWidth, frame->wHeight,
                         10000000/frame->dwDefaultFrameInterval,
@@ -2026,6 +2032,15 @@ static struct usb_device_id uvc_ids[] = {
           .bInterfaceClass      = USB_CLASS_VENDOR_SPEC,
           .bInterfaceSubClass   = 1,
           .bInterfaceProtocol   = 0 },
+        /* Chicony CNF7129 (Asus EEE 100HE) */
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+                                | USB_DEVICE_ID_MATCH_INT_INFO,
+          .idVendor             = 0x04f2,
+          .idProduct            = 0xb071,
+          .bInterfaceClass      = USB_CLASS_VIDEO,
+          .bInterfaceSubClass   = 1,
+          .bInterfaceProtocol   = 0,
+          .driver_info          = UVC_QUIRK_RESTRICT_FRAME_RATE },
         /* Alcor Micro AU3820 (Future Boy PC USB Webcam) */
         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
                                 | USB_DEVICE_ID_MATCH_INT_INFO,
@@ -2091,6 +2106,15 @@ static struct usb_device_id uvc_ids[] = {
           .bInterfaceProtocol   = 0,
           .driver_info          = UVC_QUIRK_PROBE_MINMAX
                                 | UVC_QUIRK_PROBE_DEF },
+        /* IMC Networks (Medion Akoya) */
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+                                | USB_DEVICE_ID_MATCH_INT_INFO,
+          .idVendor             = 0x13d3,
+          .idProduct            = 0x5103,
+          .bInterfaceClass      = USB_CLASS_VIDEO,
+          .bInterfaceSubClass   = 1,
+          .bInterfaceProtocol   = 0,
+          .driver_info          = UVC_QUIRK_STREAM_NO_FID },
         /* Syntek (HP Spartan) */
         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
                                 | USB_DEVICE_ID_MATCH_INT_INFO,
diff --git a/drivers/media/video/uvc/uvcvideo.h b/drivers/media/video/uvc/uvcvideo.h
index bdacf3beabf5..892e0e51916c 100644
--- a/drivers/media/video/uvc/uvcvideo.h
+++ b/drivers/media/video/uvc/uvcvideo.h
@@ -182,6 +182,7 @@ struct uvc_xu_control {
 #define UVC_QUIRK_IGNORE_SELECTOR_UNIT  0x00000020
 #define UVC_QUIRK_FIX_BANDWIDTH         0x00000080
 #define UVC_QUIRK_PROBE_DEF             0x00000100
+#define UVC_QUIRK_RESTRICT_FRAME_RATE   0x00000200
 
 /* Format flags */
 #define UVC_FMT_FLAG_COMPRESSED         0x00000001
diff --git a/drivers/media/video/v4l2-compat-ioctl32.c b/drivers/media/video/v4l2-compat-ioctl32.c
index 073f01390cdd..86294ed35c9b 100644
--- a/drivers/media/video/v4l2-compat-ioctl32.c
+++ b/drivers/media/video/v4l2-compat-ioctl32.c
@@ -193,17 +193,24 @@ static int put_video_window32(struct video_window *kp, struct video_window32 __u
 struct video_code32 {
         char            loadwhat[16];   /* name or tag of file being passed */
         compat_int_t    datasize;
-        unsigned char   *data;
+        compat_uptr_t   data;
 };
 
-static int get_microcode32(struct video_code *kp, struct video_code32 __user *up)
+static struct video_code __user *get_microcode32(struct video_code32 *kp)
 {
-        if (!access_ok(VERIFY_READ, up, sizeof(struct video_code32)) ||
-                copy_from_user(kp->loadwhat, up->loadwhat, sizeof(up->loadwhat)) ||
-                get_user(kp->datasize, &up->datasize) ||
-                copy_from_user(kp->data, up->data, up->datasize))
-                        return -EFAULT;
-        return 0;
+        struct video_code __user *up;
+
+        up = compat_alloc_user_space(sizeof(*up));
+
+        /*
+         * NOTE! We don't actually care if these fail. If the
+         * user address is invalid, the native ioctl will do
+         * the error handling for us
+         */
+        (void) copy_to_user(up->loadwhat, kp->loadwhat, sizeof(up->loadwhat));
+        (void) put_user(kp->datasize, &up->datasize);
+        (void) put_user(compat_ptr(kp->data), &up->data);
+        return up;
 }
 
 #define VIDIOCGTUNER32          _IOWR('v', 4, struct video_tuner32)
@@ -739,7 +746,7 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
                 struct video_tuner vt;
                 struct video_buffer vb;
                 struct video_window vw;
-                struct video_code vc;
+                struct video_code32 vc;
                 struct video_audio va;
 #endif
                 struct v4l2_format v2f;
@@ -818,8 +825,11 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar
                 break;
 
         case VIDIOCSMICROCODE:
-                err = get_microcode32(&karg.vc, up);
-                compatible_arg = 0;
+                /* Copy the 32-bit "video_code32" to kernel space */
+                if (copy_from_user(&karg.vc, up, sizeof(karg.vc)))
+                        return -EFAULT;
+                /* Convert the 32-bit version to a 64-bit version in user space */
+                up = get_microcode32(&karg.vc);
                 break;
 
         case VIDIOCSFREQ:
diff --git a/drivers/media/video/videobuf-dma-contig.c b/drivers/media/video/videobuf-dma-contig.c
index 372b87efcd05..6ff9e4bac3ea 100644
--- a/drivers/media/video/videobuf-dma-contig.c
+++ b/drivers/media/video/videobuf-dma-contig.c
@@ -393,8 +393,10 @@ void videobuf_dma_contig_free(struct videobuf_queue *q,
         }
 
         /* read() method */
-        dma_free_coherent(q->dev, mem->size, mem->vaddr, mem->dma_handle);
-        mem->vaddr = NULL;
+        if (mem->vaddr) {
+                dma_free_coherent(q->dev, mem->size, mem->vaddr, mem->dma_handle);
+                mem->vaddr = NULL;
+        }
 }
 EXPORT_SYMBOL_GPL(videobuf_dma_contig_free);
 
diff --git a/drivers/media/video/videobuf-dma-sg.c b/drivers/media/video/videobuf-dma-sg.c
index 06f9a9c2a39a..2ad0bc252b0e 100644
--- a/drivers/media/video/videobuf-dma-sg.c
+++ b/drivers/media/video/videobuf-dma-sg.c
@@ -94,7 +94,7 @@ err:
  * must free the memory.
  */
 static struct scatterlist *videobuf_pages_to_sg(struct page **pages,
-                                                int nr_pages, int offset)
+                                        int nr_pages, int offset, size_t size)
 {
         struct scatterlist *sglist;
         int i;
@@ -110,12 +110,14 @@ static struct scatterlist *videobuf_pages_to_sg(struct page **pages,
                 /* DMA to highmem pages might not work */
                 goto highmem;
         sg_set_page(&sglist[0], pages[0], PAGE_SIZE - offset, offset);
+        size -= PAGE_SIZE - offset;
         for (i = 1; i < nr_pages; i++) {
                 if (NULL == pages[i])
                         goto nopage;
                 if (PageHighMem(pages[i]))
                         goto highmem;
-                sg_set_page(&sglist[i], pages[i], PAGE_SIZE, 0);
+                sg_set_page(&sglist[i], pages[i], min(PAGE_SIZE, size), 0);
+                size -= min(PAGE_SIZE, size);
         }
         return sglist;
 
@@ -170,7 +172,8 @@ static int videobuf_dma_init_user_locked(struct videobuf_dmabuf *dma,
 
         first = (data          & PAGE_MASK) >> PAGE_SHIFT;
         last  = ((data+size-1) & PAGE_MASK) >> PAGE_SHIFT;
-        dma->offset   = data & ~PAGE_MASK;
+        dma->offset = data & ~PAGE_MASK;
+        dma->size = size;
         dma->nr_pages = last-first+1;
         dma->pages = kmalloc(dma->nr_pages * sizeof(struct page *), GFP_KERNEL);
         if (NULL == dma->pages)
@@ -252,7 +255,7 @@ int videobuf_dma_map(struct device *dev, struct videobuf_dmabuf *dma)
 
         if (dma->pages) {
                 dma->sglist = videobuf_pages_to_sg(dma->pages, dma->nr_pages,
-                                                   dma->offset);
+                                                   dma->offset, dma->size);
         }
         if (dma->vaddr) {
                 dma->sglist = videobuf_vmalloc_to_sg(dma->vaddr,
diff --git a/drivers/mfd/twl4030-irq.c b/drivers/mfd/twl4030-irq.c
index 097f24d8bceb..b9fda7018cef 100644
--- a/drivers/mfd/twl4030-irq.c
+++ b/drivers/mfd/twl4030-irq.c
@@ -78,7 +78,7 @@ struct sih {
         u8      irq_lines;              /* number of supported irq lines */
 
         /* SIR ignored -- set interrupt, for testing only */
-        struct irq_data {
+        struct sih_irq_data {
                 u8      isr_offset;
                 u8      imr_offset;
         } mask[2];
@@ -810,7 +810,7 @@ int twl4030_init_irq(int irq_num, unsigned irq_base, unsigned irq_end)
         twl4030_irq_chip = dummy_irq_chip;
         twl4030_irq_chip.name = "twl4030";
 
-        twl4030_sih_irq_chip.ack = dummy_irq_chip.ack;
+        twl4030_sih_irq_chip.irq_ack = dummy_irq_chip.irq_ack;
 
         for (i = irq_base; i < irq_end; i++) {
                 set_irq_chip_and_handler(i, &twl4030_irq_chip,
diff --git a/drivers/misc/bh1780gli.c b/drivers/misc/bh1780gli.c
index 714c6b487313..d5f3a3fd2319 100644
--- a/drivers/misc/bh1780gli.c
+++ b/drivers/misc/bh1780gli.c
@@ -190,7 +190,6 @@ static int __devexit bh1780_remove(struct i2c_client *client)
 
         ddata = i2c_get_clientdata(client);
         sysfs_remove_group(&client->dev.kobj, &bh1780_attr_group);
-        i2c_set_clientdata(client, NULL);
         kfree(ddata);
 
         return 0;
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index 5db49b124ffa..09eee6df0653 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -1631,6 +1631,19 @@ int mmc_suspend_host(struct mmc_host *host)
         if (host->bus_ops && !host->bus_dead) {
                 if (host->bus_ops->suspend)
                         err = host->bus_ops->suspend(host);
+                if (err == -ENOSYS || !host->bus_ops->resume) {
+                        /*
+                         * We simply "remove" the card in this case.
+                         * It will be redetected on resume.
+                         */
+                        if (host->bus_ops->remove)
+                                host->bus_ops->remove(host);
+                        mmc_claim_host(host);
+                        mmc_detach_bus(host);
+                        mmc_release_host(host);
+                        host->pm_flags = 0;
+                        err = 0;
+                }
         }
         mmc_bus_put(host);
 
diff --git a/drivers/mtd/nand/mxc_nand.c b/drivers/mtd/nand/mxc_nand.c
index b2828e84d243..214b03afdd48 100644
--- a/drivers/mtd/nand/mxc_nand.c
+++ b/drivers/mtd/nand/mxc_nand.c
@@ -30,6 +30,8 @@
 #include <linux/clk.h>
 #include <linux/err.h>
 #include <linux/io.h>
+#include <linux/irq.h>
+#include <linux/completion.h>
 
 #include <asm/mach/flash.h>
 #include <mach/mxc_nand.h>
@@ -151,7 +153,7 @@ struct mxc_nand_host {
         int                     irq;
         int                     eccsize;
 
-        wait_queue_head_t       irq_waitq;
+        struct completion       op_completion;
 
         uint8_t                 *data_buf;
         unsigned int            buf_start;
@@ -164,6 +166,7 @@ struct mxc_nand_host {
         void                    (*send_read_id)(struct mxc_nand_host *);
         uint16_t                (*get_dev_status)(struct mxc_nand_host *);
         int                     (*check_int)(struct mxc_nand_host *);
+        void                    (*irq_control)(struct mxc_nand_host *, int);
 };
 
 /* OOB placement block for use with hardware ecc generation */
@@ -216,9 +219,12 @@ static irqreturn_t mxc_nfc_irq(int irq, void *dev_id)
 {
         struct mxc_nand_host *host = dev_id;
 
-        disable_irq_nosync(irq);
+        if (!host->check_int(host))
+                return IRQ_NONE;
 
-        wake_up(&host->irq_waitq);
+        host->irq_control(host, 0);
+
+        complete(&host->op_completion);
 
         return IRQ_HANDLED;
 }
@@ -245,11 +251,54 @@ static int check_int_v1_v2(struct mxc_nand_host *host)
         if (!(tmp & NFC_V1_V2_CONFIG2_INT))
                 return 0;
 
-        writew(tmp & ~NFC_V1_V2_CONFIG2_INT, NFC_V1_V2_CONFIG2);
+        if (!cpu_is_mx21())
+                writew(tmp & ~NFC_V1_V2_CONFIG2_INT, NFC_V1_V2_CONFIG2);
 
         return 1;
 }
 
+/*
+ * It has been observed that the i.MX21 cannot read the CONFIG2:INT bit
+ * if interrupts are masked (CONFIG1:INT_MSK is set). To handle this, the
+ * driver can enable/disable the irq line rather than simply masking the
+ * interrupts.
+ */
+static void irq_control_mx21(struct mxc_nand_host *host, int activate)
+{
+        if (activate)
+                enable_irq(host->irq);
+        else
+                disable_irq_nosync(host->irq);
+}
+
+static void irq_control_v1_v2(struct mxc_nand_host *host, int activate)
+{
+        uint16_t tmp;
+
+        tmp = readw(NFC_V1_V2_CONFIG1);
+
+        if (activate)
+                tmp &= ~NFC_V1_V2_CONFIG1_INT_MSK;
+        else
+                tmp |= NFC_V1_V2_CONFIG1_INT_MSK;
+
+        writew(tmp, NFC_V1_V2_CONFIG1);
+}
+
+static void irq_control_v3(struct mxc_nand_host *host, int activate)
+{
+        uint32_t tmp;
+
+        tmp = readl(NFC_V3_CONFIG2);
+
+        if (activate)
+                tmp &= ~NFC_V3_CONFIG2_INT_MSK;
+        else
+                tmp |= NFC_V3_CONFIG2_INT_MSK;
+
+        writel(tmp, NFC_V3_CONFIG2);
+}
+
 /* This function polls the NANDFC to wait for the basic operation to
  * complete by checking the INT bit of config2 register.
  */
@@ -259,10 +308,9 @@ static void wait_op_done(struct mxc_nand_host *host, int useirq)
 
         if (useirq) {
                 if (!host->check_int(host)) {
-
-                        enable_irq(host->irq);
-
-                        wait_event(host->irq_waitq, host->check_int(host));
+                        INIT_COMPLETION(host->op_completion);
+                        host->irq_control(host, 1);
+                        wait_for_completion(&host->op_completion);
                 }
         } else {
                 while (max_retries-- > 0) {
@@ -799,6 +847,7 @@ static void preset_v3(struct mtd_info *mtd)
                 NFC_V3_CONFIG2_2CMD_PHASES |
                 NFC_V3_CONFIG2_SPAS(mtd->oobsize >> 1) |
                 NFC_V3_CONFIG2_ST_CMD(0x70) |
+                NFC_V3_CONFIG2_INT_MSK |
                 NFC_V3_CONFIG2_NUM_ADDR_PHASE0;
 
         if (chip->ecc.mode == NAND_ECC_HW)
@@ -1024,6 +1073,10 @@ static int __init mxcnd_probe(struct platform_device *pdev)
                 host->send_read_id = send_read_id_v1_v2;
                 host->get_dev_status = get_dev_status_v1_v2;
                 host->check_int = check_int_v1_v2;
+                if (cpu_is_mx21())
+                        host->irq_control = irq_control_mx21;
+                else
+                        host->irq_control = irq_control_v1_v2;
         }
 
         if (nfc_is_v21()) {
@@ -1062,6 +1115,7 @@ static int __init mxcnd_probe(struct platform_device *pdev)
                 host->send_read_id = send_read_id_v3;
                 host->check_int = check_int_v3;
                 host->get_dev_status = get_dev_status_v3;
+                host->irq_control = irq_control_v3;
                 oob_smallpage = &nandv2_hw_eccoob_smallpage;
                 oob_largepage = &nandv2_hw_eccoob_largepage;
         } else
@@ -1093,14 +1147,34 @@ static int __init mxcnd_probe(struct platform_device *pdev)
                 this->options |= NAND_USE_FLASH_BBT;
         }
 
-        init_waitqueue_head(&host->irq_waitq);
+        init_completion(&host->op_completion);
 
         host->irq = platform_get_irq(pdev, 0);
 
+        /*
+         * mask the interrupt. For i.MX21 explicitely call
+         * irq_control_v1_v2 to use the mask bit. We can't call
+         * disable_irq_nosync() for an interrupt we do not own yet.
+         */
+        if (cpu_is_mx21())
+                irq_control_v1_v2(host, 0);
+        else
+                host->irq_control(host, 0);
+
         err = request_irq(host->irq, mxc_nfc_irq, IRQF_DISABLED, DRIVER_NAME, host);
         if (err)
                 goto eirq;
 
+        host->irq_control(host, 0);
+
+        /*
+         * Now that the interrupt is disabled make sure the interrupt
+         * mask bit is cleared on i.MX21. Otherwise we can't read
+         * the interrupt status bit on this machine.
+         */
+        if (cpu_is_mx21())
+                irq_control_v1_v2(host, 1);
+
         /* first scan to find the device and get the page size */
         if (nand_scan_ident(mtd, 1, NULL)) {
                 err = -ENXIO;
diff --git a/drivers/net/3c527.c b/drivers/net/3c527.c
index 70705d1306b9..eca55c52bdfd 100644
--- a/drivers/net/3c527.c
+++ b/drivers/net/3c527.c
@@ -522,7 +522,7 @@ static int __init mc32_probe1(struct net_device *dev, int slot)
         lp->tx_len              = lp->exec_box->data[9];   /* Transmit list count */
         lp->rx_len              = lp->exec_box->data[11];  /* Receive list count */
 
-        init_MUTEX_LOCKED(&lp->cmd_mutex);
+        sema_init(&lp->cmd_mutex, 0);
         init_completion(&lp->execution_cmd);
         init_completion(&lp->xceiver_cmd);
 
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 2cc81a54cbf3..5db667c0b371 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -2428,7 +2428,7 @@ config UGETH_TX_ON_DEMAND
 
 config MV643XX_ETH
         tristate "Marvell Discovery (643XX) and Orion ethernet support"
-        depends on MV64X60 || PPC32 || PLAT_ORION
+        depends on (MV64X60 || PPC32 || PLAT_ORION) && INET
         select INET_LRO
         select PHYLIB
         help
@@ -2803,7 +2803,7 @@ config NIU
 
 config PASEMI_MAC
         tristate "PA Semi 1/10Gbit MAC"
-        depends on PPC_PASEMI && PCI
+        depends on PPC_PASEMI && PCI && INET
         select PHYLIB
         select INET_LRO
         help
diff --git a/drivers/net/b44.c b/drivers/net/b44.c
index 1e620e287ae0..efeffdf9e5fa 100644
--- a/drivers/net/b44.c
+++ b/drivers/net/b44.c
@@ -2170,8 +2170,6 @@ static int __devinit b44_init_one(struct ssb_device *sdev,
         dev->irq = sdev->irq;
         SET_ETHTOOL_OPS(dev, &b44_ethtool_ops);
 
-        netif_carrier_off(dev);
-
         err = ssb_bus_powerup(sdev->bus, 0);
         if (err) {
                 dev_err(sdev->dev,
@@ -2213,6 +2211,8 @@ static int __devinit b44_init_one(struct ssb_device *sdev,
                 goto err_out_powerdown;
         }
 
+        netif_carrier_off(dev);
+
         ssb_set_drvdata(sdev, dev);
 
         /* Chip reset provides power to the b44 MAC & PCI cores, which
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 3b16f62d5606..e953c6ad6e6d 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -5164,6 +5164,15 @@ int bond_create(struct net *net, const char *name)
                 res = dev_alloc_name(bond_dev, "bond%d");
                 if (res < 0)
                         goto out;
+        } else {
+                /*
+                 * If we're given a name to register
+                 * we need to ensure that its not already
+                 * registered
+                 */
+                res = -EEXIST;
+                if (__dev_get_by_name(net, name) != NULL)
+                        goto out;
         }
 
         res = register_netdevice(bond_dev);
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index a333b42111b8..6372610ed240 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -533,8 +533,15 @@ static inline void ehea_fill_skb(struct net_device *dev,
         int length = cqe->num_bytes_transfered - 4;     /*remove CRC */
 
         skb_put(skb, length);
-        skb->ip_summed = CHECKSUM_UNNECESSARY;
         skb->protocol = eth_type_trans(skb, dev);
+
+        /* The packet was not an IPV4 packet so a complemented checksum was
+           calculated. The value is found in the Internet Checksum field. */
+        if (cqe->status & EHEA_CQE_BLIND_CKSUM) {
+                skb->ip_summed = CHECKSUM_COMPLETE;
+                skb->csum = csum_unfold(~cqe->inet_checksum_value);
+        } else
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
 }
 
 static inline struct sk_buff *get_skb_by_index(struct sk_buff **skb_array,
diff --git a/drivers/net/ehea/ehea_qmr.h b/drivers/net/ehea/ehea_qmr.h
index f608a6c54af5..38104734a3be 100644
--- a/drivers/net/ehea/ehea_qmr.h
+++ b/drivers/net/ehea/ehea_qmr.h
@@ -150,6 +150,7 @@ struct ehea_rwqe {
 #define EHEA_CQE_TYPE_RQ           0x60
 #define EHEA_CQE_STAT_ERR_MASK     0x700F
 #define EHEA_CQE_STAT_FAT_ERR_MASK 0xF
+#define EHEA_CQE_BLIND_CKSUM       0x8000
 #define EHEA_CQE_STAT_ERR_TCP      0x4000
 #define EHEA_CQE_STAT_ERR_IP       0x2000
 #define EHEA_CQE_STAT_ERR_CRC      0x1000
diff --git a/drivers/net/fec.c b/drivers/net/fec.c
index 768b840aeb6b..cce32d43175f 100644
--- a/drivers/net/fec.c
+++ b/drivers/net/fec.c
@@ -678,24 +678,37 @@ static int fec_enet_mii_probe(struct net_device *dev)
 {
         struct fec_enet_private *fep = netdev_priv(dev);
         struct phy_device *phy_dev = NULL;
-        int ret;
+        char mdio_bus_id[MII_BUS_ID_SIZE];
+        char phy_name[MII_BUS_ID_SIZE + 3];
+        int phy_id;
 
         fep->phy_dev = NULL;
 
-        /* find the first phy */
-        phy_dev = phy_find_first(fep->mii_bus);
-        if (!phy_dev) {
-                printk(KERN_ERR "%s: no PHY found\n", dev->name);
-                return -ENODEV;
+        /* check for attached phy */
+        for (phy_id = 0; (phy_id < PHY_MAX_ADDR); phy_id++) {
+                if ((fep->mii_bus->phy_mask & (1 << phy_id)))
+                        continue;
+                if (fep->mii_bus->phy_map[phy_id] == NULL)
+                        continue;
+                if (fep->mii_bus->phy_map[phy_id]->phy_id == 0)
+                        continue;
+                strncpy(mdio_bus_id, fep->mii_bus->id, MII_BUS_ID_SIZE);
+                break;
         }
 
-        /* attach the mac to the phy */
-        ret = phy_connect_direct(dev, phy_dev,
-                             &fec_enet_adjust_link, 0,
-                             PHY_INTERFACE_MODE_MII);
-        if (ret) {
-                printk(KERN_ERR "%s: Could not attach to PHY\n", dev->name);
-                return ret;
+        if (phy_id >= PHY_MAX_ADDR) {
+                printk(KERN_INFO "%s: no PHY, assuming direct connection "
+                        "to switch\n", dev->name);
+                strncpy(mdio_bus_id, "0", MII_BUS_ID_SIZE);
+                phy_id = 0;
+        }
+
+        snprintf(phy_name, MII_BUS_ID_SIZE, PHY_ID_FMT, mdio_bus_id, phy_id);
+        phy_dev = phy_connect(dev, phy_name, &fec_enet_adjust_link, 0,
+                PHY_INTERFACE_MODE_MII);
+        if (IS_ERR(phy_dev)) {
+                printk(KERN_ERR "%s: could not attach to PHY\n", dev->name);
+                return PTR_ERR(phy_dev);
         }
 
         /* mask with MAC supported features */
@@ -738,7 +751,7 @@ static int fec_enet_mii_init(struct platform_device *pdev)
         fep->mii_bus->read = fec_enet_mdio_read;
         fep->mii_bus->write = fec_enet_mdio_write;
         fep->mii_bus->reset = fec_enet_mdio_reset;
-        snprintf(fep->mii_bus->id, MII_BUS_ID_SIZE, "%x", pdev->id);
+        snprintf(fep->mii_bus->id, MII_BUS_ID_SIZE, "%x", pdev->id + 1);
         fep->mii_bus->priv = fep;
         fep->mii_bus->parent = &pdev->dev;
 
@@ -1311,6 +1324,9 @@ fec_probe(struct platform_device *pdev)
         if (ret)
                 goto failed_mii_init;
 
+        /* Carrier starts down, phylib will bring it up */
+        netif_carrier_off(ndev);
+
         ret = register_netdev(ndev);
         if (ret)
                 goto failed_register;
diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
index 4b52c767ad05..3e5d0b6b6516 100644
--- a/drivers/net/hamradio/6pack.c
+++ b/drivers/net/hamradio/6pack.c
@@ -608,7 +608,7 @@ static int sixpack_open(struct tty_struct *tty)
 
         spin_lock_init(&sp->lock);
         atomic_set(&sp->refcnt, 1);
-        init_MUTEX_LOCKED(&sp->dead_sem);
+        sema_init(&sp->dead_sem, 0);
 
         /* !!! length of the buffers. MTU is IP MTU, not PACLEN!  */
 
diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c
index 66e88bd59caa..4c628393c8b1 100644
--- a/drivers/net/hamradio/mkiss.c
+++ b/drivers/net/hamradio/mkiss.c
@@ -747,7 +747,7 @@ static int mkiss_open(struct tty_struct *tty)
 
         spin_lock_init(&ax->buflock);
         atomic_set(&ax->refcnt, 1);
-        init_MUTEX_LOCKED(&ax->dead_sem);
+        sema_init(&ax->dead_sem, 0);
 
         ax->tty = tty;
         tty->disc_data = ax;
diff --git a/drivers/net/irda/sir_dev.c b/drivers/net/irda/sir_dev.c
index 1b051dab7b29..51d74447f8f8 100644
--- a/drivers/net/irda/sir_dev.c
+++ b/drivers/net/irda/sir_dev.c
@@ -909,7 +909,7 @@ struct sir_dev * sirdev_get_instance(const struct sir_driver *drv, const char *n
         dev->tx_skb = NULL;
 
         spin_lock_init(&dev->tx_lock);
-        init_MUTEX(&dev->fsm.sem);
+        sema_init(&dev->fsm.sem, 1);
 
         dev->drv = drv;
         dev->netdev = ndev;
diff --git a/drivers/net/ppp_async.c b/drivers/net/ppp_async.c
index af50a530daee..78d70a6481bf 100644
--- a/drivers/net/ppp_async.c
+++ b/drivers/net/ppp_async.c
@@ -184,7 +184,7 @@ ppp_asynctty_open(struct tty_struct *tty)
         tasklet_init(&ap->tsk, ppp_async_process, (unsigned long) ap);
 
         atomic_set(&ap->refcnt, 1);
-        init_MUTEX_LOCKED(&ap->dead_sem);
+        sema_init(&ap->dead_sem, 0);
 
         ap->chan.private = ap;
         ap->chan.ops = &async_ops;
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index a0da4a17b025..992db2fa136e 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -1212,7 +1212,8 @@ static void rtl8169_update_counters(struct net_device *dev)
         if ((RTL_R8(ChipCmd) & CmdRxEnb) == 0)
                 return;
 
-        counters = pci_alloc_consistent(tp->pci_dev, sizeof(*counters), &paddr);
+        counters = dma_alloc_coherent(&tp->pci_dev->dev, sizeof(*counters),
+                                      &paddr, GFP_KERNEL);
         if (!counters)
                 return;
 
@@ -1233,7 +1234,8 @@ static void rtl8169_update_counters(struct net_device *dev)
         RTL_W32(CounterAddrLow, 0);
         RTL_W32(CounterAddrHigh, 0);
 
-        pci_free_consistent(tp->pci_dev, sizeof(*counters), counters, paddr);
+        dma_free_coherent(&tp->pci_dev->dev, sizeof(*counters), counters,
+                          paddr);
 }
 
 static void rtl8169_get_ethtool_stats(struct net_device *dev,
@@ -3292,15 +3294,15 @@ static int rtl8169_open(struct net_device *dev)
 
         /*
          * Rx and Tx desscriptors needs 256 bytes alignment.
-         * pci_alloc_consistent provides more.
+         * dma_alloc_coherent provides more.
          */
-        tp->TxDescArray = pci_alloc_consistent(pdev, R8169_TX_RING_BYTES,
-                                               &tp->TxPhyAddr);
+        tp->TxDescArray = dma_alloc_coherent(&pdev->dev, R8169_TX_RING_BYTES,
+                                             &tp->TxPhyAddr, GFP_KERNEL);
         if (!tp->TxDescArray)
                 goto err_pm_runtime_put;
 
-        tp->RxDescArray = pci_alloc_consistent(pdev, R8169_RX_RING_BYTES,
-                                               &tp->RxPhyAddr);
+        tp->RxDescArray = dma_alloc_coherent(&pdev->dev, R8169_RX_RING_BYTES,
+                                             &tp->RxPhyAddr, GFP_KERNEL);
         if (!tp->RxDescArray)
                 goto err_free_tx_0;
 
@@ -3334,12 +3336,12 @@ out:
 err_release_ring_2:
         rtl8169_rx_clear(tp);
 err_free_rx_1:
-        pci_free_consistent(pdev, R8169_RX_RING_BYTES, tp->RxDescArray,
-                            tp->RxPhyAddr);
+        dma_free_coherent(&pdev->dev, R8169_RX_RING_BYTES, tp->RxDescArray,
+                          tp->RxPhyAddr);
         tp->RxDescArray = NULL;
 err_free_tx_0:
-        pci_free_consistent(pdev, R8169_TX_RING_BYTES, tp->TxDescArray,
-                            tp->TxPhyAddr);
+        dma_free_coherent(&pdev->dev, R8169_TX_RING_BYTES, tp->TxDescArray,
+                          tp->TxPhyAddr);
         tp->TxDescArray = NULL;
 err_pm_runtime_put:
         pm_runtime_put_noidle(&pdev->dev);
@@ -3975,7 +3977,7 @@ static void rtl8169_free_rx_skb(struct rtl8169_private *tp,
 {
         struct pci_dev *pdev = tp->pci_dev;
 
-        pci_unmap_single(pdev, le64_to_cpu(desc->addr), tp->rx_buf_sz,
+        dma_unmap_single(&pdev->dev, le64_to_cpu(desc->addr), tp->rx_buf_sz,
                          PCI_DMA_FROMDEVICE);
         dev_kfree_skb(*sk_buff);
         *sk_buff = NULL;
@@ -4000,7 +4002,7 @@ static inline void rtl8169_map_to_asic(struct RxDesc *desc, dma_addr_t mapping,
 static struct sk_buff *rtl8169_alloc_rx_skb(struct pci_dev *pdev,
                                             struct net_device *dev,
                                             struct RxDesc *desc, int rx_buf_sz,
-                                            unsigned int align)
+                                            unsigned int align, gfp_t gfp)
 {
         struct sk_buff *skb;
         dma_addr_t mapping;
@@ -4008,13 +4010,13 @@ static struct sk_buff *rtl8169_alloc_rx_skb(struct pci_dev *pdev,
 
         pad = align ? align : NET_IP_ALIGN;
 
-        skb = netdev_alloc_skb(dev, rx_buf_sz + pad);
+        skb = __netdev_alloc_skb(dev, rx_buf_sz + pad, gfp);
         if (!skb)
                 goto err_out;
 
         skb_reserve(skb, align ? ((pad - 1) & (unsigned long)skb->data) : pad);
 
-        mapping = pci_map_single(pdev, skb->data, rx_buf_sz,
+        mapping = dma_map_single(&pdev->dev, skb->data, rx_buf_sz,
                                  PCI_DMA_FROMDEVICE);
 
         rtl8169_map_to_asic(desc, mapping, rx_buf_sz);
@@ -4039,7 +4041,7 @@ static void rtl8169_rx_clear(struct rtl8169_private *tp)
 }
 
 static u32 rtl8169_rx_fill(struct rtl8169_private *tp, struct net_device *dev,
-                           u32 start, u32 end)
+                           u32 start, u32 end, gfp_t gfp)
 {
         u32 cur;
 
@@ -4054,7 +4056,7 @@ static u32 rtl8169_rx_fill(struct rtl8169_private *tp, struct net_device *dev,
 
                 skb = rtl8169_alloc_rx_skb(tp->pci_dev, dev,
                                            tp->RxDescArray + i,
-                                           tp->rx_buf_sz, tp->align);
+                                           tp->rx_buf_sz, tp->align, gfp);
                 if (!skb)
                         break;
 
@@ -4082,7 +4084,7 @@ static int rtl8169_init_ring(struct net_device *dev)
         memset(tp->tx_skb, 0x0, NUM_TX_DESC * sizeof(struct ring_info));
         memset(tp->Rx_skbuff, 0x0, NUM_RX_DESC * sizeof(struct sk_buff *));
 
-        if (rtl8169_rx_fill(tp, dev, 0, NUM_RX_DESC) != NUM_RX_DESC)
+        if (rtl8169_rx_fill(tp, dev, 0, NUM_RX_DESC, GFP_KERNEL) != NUM_RX_DESC)
                 goto err_out;
 
         rtl8169_mark_as_last_descriptor(tp->RxDescArray + NUM_RX_DESC - 1);
@@ -4099,7 +4101,8 @@ static void rtl8169_unmap_tx_skb(struct pci_dev *pdev, struct ring_info *tx_skb,
 {
         unsigned int len = tx_skb->len;
 
-        pci_unmap_single(pdev, le64_to_cpu(desc->addr), len, PCI_DMA_TODEVICE);
+        dma_unmap_single(&pdev->dev, le64_to_cpu(desc->addr), len,
+                         PCI_DMA_TODEVICE);
         desc->opts1 = 0x00;
         desc->opts2 = 0x00;
         desc->addr = 0x00;
@@ -4243,7 +4246,8 @@ static int rtl8169_xmit_frags(struct rtl8169_private *tp, struct sk_buff *skb,
                 txd = tp->TxDescArray + entry;
                 len = frag->size;
                 addr = ((void *) page_address(frag->page)) + frag->page_offset;
-                mapping = pci_map_single(tp->pci_dev, addr, len, PCI_DMA_TODEVICE);
+                mapping = dma_map_single(&tp->pci_dev->dev, addr, len,
+                                         PCI_DMA_TODEVICE);
 
                 /* anti gcc 2.95.3 bugware (sic) */
                 status = opts1 | len | (RingEnd * !((entry + 1) % NUM_TX_DESC));
@@ -4313,7 +4317,8 @@ static netdev_tx_t rtl8169_start_xmit(struct sk_buff *skb,
                 tp->tx_skb[entry].skb = skb;
         }
 
-        mapping = pci_map_single(tp->pci_dev, skb->data, len, PCI_DMA_TODEVICE);
+        mapping = dma_map_single(&tp->pci_dev->dev, skb->data, len,
+                                 PCI_DMA_TODEVICE);
 
         tp->tx_skb[entry].len = len;
         txd->addr = cpu_to_le64(mapping);
@@ -4477,8 +4482,8 @@ static inline bool rtl8169_try_rx_copy(struct sk_buff **sk_buff,
         if (!skb)
                 goto out;
 
-        pci_dma_sync_single_for_cpu(tp->pci_dev, addr, pkt_size,
-                                    PCI_DMA_FROMDEVICE);
+        dma_sync_single_for_cpu(&tp->pci_dev->dev, addr, pkt_size,
+                                PCI_DMA_FROMDEVICE);
         skb_copy_from_linear_data(*sk_buff, skb->data, pkt_size);
         *sk_buff = skb;
         done = true;
@@ -4549,11 +4554,11 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
                         rtl8169_rx_csum(skb, desc);
 
                         if (rtl8169_try_rx_copy(&skb, tp, pkt_size, addr)) {
-                                pci_dma_sync_single_for_device(pdev, addr,
+                                dma_sync_single_for_device(&pdev->dev, addr,
                                         pkt_size, PCI_DMA_FROMDEVICE);
                                 rtl8169_mark_to_asic(desc, tp->rx_buf_sz);
                         } else {
-                                pci_unmap_single(pdev, addr, tp->rx_buf_sz,
+                                dma_unmap_single(&pdev->dev, addr, tp->rx_buf_sz,
                                                  PCI_DMA_FROMDEVICE);
                                 tp->Rx_skbuff[entry] = NULL;
                         }
@@ -4583,7 +4588,7 @@ static int rtl8169_rx_interrupt(struct net_device *dev,
         count = cur_rx - tp->cur_rx;
         tp->cur_rx = cur_rx;
 
-        delta = rtl8169_rx_fill(tp, dev, tp->dirty_rx, tp->cur_rx);
+        delta = rtl8169_rx_fill(tp, dev, tp->dirty_rx, tp->cur_rx, GFP_ATOMIC);
         if (!delta && count)
                 netif_info(tp, intr, dev, "no Rx buffer allocated\n");
         tp->dirty_rx += delta;
@@ -4769,10 +4774,10 @@ static int rtl8169_close(struct net_device *dev)
 
         free_irq(dev->irq, dev);
 
-        pci_free_consistent(pdev, R8169_RX_RING_BYTES, tp->RxDescArray,
-                            tp->RxPhyAddr);
-        pci_free_consistent(pdev, R8169_TX_RING_BYTES, tp->TxDescArray,
-                            tp->TxPhyAddr);
+        dma_free_coherent(&pdev->dev, R8169_RX_RING_BYTES, tp->RxDescArray,
+                          tp->RxPhyAddr);
+        dma_free_coherent(&pdev->dev, R8169_TX_RING_BYTES, tp->TxDescArray,
+                          tp->TxPhyAddr);
         tp->TxDescArray = NULL;
         tp->RxDescArray = NULL;
 
diff --git a/drivers/net/skge.c b/drivers/net/skge.c
index 40e5c46e7571..465ae7e84507 100644
--- a/drivers/net/skge.c
+++ b/drivers/net/skge.c
@@ -43,6 +43,7 @@
 #include <linux/seq_file.h>
 #include <linux/mii.h>
 #include <linux/slab.h>
+#include <linux/dmi.h>
 #include <asm/irq.h>
 
 #include "skge.h"
@@ -3868,6 +3869,8 @@ static void __devinit skge_show_addr(struct net_device *dev)
         netif_info(skge, probe, skge->netdev, "addr %pM\n", dev->dev_addr);
 }
 
+static int only_32bit_dma;
+
 static int __devinit skge_probe(struct pci_dev *pdev,
                                 const struct pci_device_id *ent)
 {
@@ -3889,7 +3892,7 @@ static int __devinit skge_probe(struct pci_dev *pdev,
 
         pci_set_master(pdev);
 
-        if (!pci_set_dma_mask(pdev, DMA_BIT_MASK(64))) {
+        if (!only_32bit_dma && !pci_set_dma_mask(pdev, DMA_BIT_MASK(64))) {
                 using_dac = 1;
                 err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64));
         } else if (!(err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32)))) {
@@ -4147,8 +4150,21 @@ static struct pci_driver skge_driver = {
         .shutdown =     skge_shutdown,
 };
 
+static struct dmi_system_id skge_32bit_dma_boards[] = {
+        {
+                .ident = "Gigabyte nForce boards",
+                .matches = {
+                        DMI_MATCH(DMI_BOARD_VENDOR, "Gigabyte Technology Co"),
+                        DMI_MATCH(DMI_BOARD_NAME, "nForce"),
+                },
+        },
+        {}
+};
+
 static int __init skge_init_module(void)
 {
+        if (dmi_check_system(skge_32bit_dma_boards))
+                only_32bit_dma = 1;
         skge_debug_init();
         return pci_register_driver(&skge_driver);
 }
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index bc3af78a869f..1ec4b9e0239a 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -4666,7 +4666,7 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget)
                                        desc_idx, *post_ptr);
                 drop_it_no_recycle:
                         /* Other statistics kept track of by card. */
-                        tp->net_stats.rx_dropped++;
+                        tp->rx_dropped++;
                         goto next_pkt;
                 }
 
@@ -4726,7 +4726,7 @@ static int tg3_rx(struct tg3_napi *tnapi, int budget)
                 if (len > (tp->dev->mtu + ETH_HLEN) &&
                     skb->protocol != htons(ETH_P_8021Q)) {
                         dev_kfree_skb(skb);
-                        goto next_pkt;
+                        goto drop_it_no_recycle;
                 }
 
                 if (desc->type_flags & RXD_FLAG_VLAN &&
@@ -9240,6 +9240,8 @@ static struct rtnl_link_stats64 *tg3_get_stats64(struct net_device *dev,
         stats->rx_missed_errors = old_stats->rx_missed_errors +
                 get_stat64(&hw_stats->rx_discards);
 
+        stats->rx_dropped = tp->rx_dropped;
+
         return stats;
 }
 
diff --git a/drivers/net/tg3.h b/drivers/net/tg3.h
index 4937bd190964..be7ff138a7f9 100644
--- a/drivers/net/tg3.h
+++ b/drivers/net/tg3.h
@@ -2759,7 +2759,7 @@ struct tg3 {
 
 
         /* begin "everything else" cacheline(s) section */
-        struct rtnl_link_stats64        net_stats;
+        unsigned long                   rx_dropped;
         struct rtnl_link_stats64        net_stats_prev;
         struct tg3_ethtool_stats        estats;
         struct tg3_ethtool_stats        estats_prev;
diff --git a/drivers/net/wan/cosa.c b/drivers/net/wan/cosa.c
index 04c6cd4333f1..10bafd59f9c3 100644
--- a/drivers/net/wan/cosa.c
+++ b/drivers/net/wan/cosa.c
@@ -575,7 +575,7 @@ static int cosa_probe(int base, int irq, int dma)
 
                 /* Initialize the chardev data structures */
                 mutex_init(&chan->rlock);
-                init_MUTEX(&chan->wsem);
+                sema_init(&chan->wsem, 1);
 
                 /* Register the network interface */
                 if (!(chan->netdev = alloc_hdlcdev(chan))) {
diff --git a/drivers/net/wimax/i2400m/rx.c b/drivers/net/wimax/i2400m/rx.c
index 8cc9e319f435..1737d1488b35 100644
--- a/drivers/net/wimax/i2400m/rx.c
+++ b/drivers/net/wimax/i2400m/rx.c
@@ -1244,16 +1244,16 @@ int i2400m_rx(struct i2400m *i2400m, struct sk_buff *skb)
         int i, result;
         struct device *dev = i2400m_dev(i2400m);
         const struct i2400m_msg_hdr *msg_hdr;
-        size_t pl_itr, pl_size, skb_len;
+        size_t pl_itr, pl_size;
         unsigned long flags;
-        unsigned num_pls, single_last;
+        unsigned num_pls, single_last, skb_len;
 
         skb_len = skb->len;
-        d_fnstart(4, dev, "(i2400m %p skb %p [size %zu])\n",
+        d_fnstart(4, dev, "(i2400m %p skb %p [size %u])\n",
                   i2400m, skb, skb_len);
         result = -EIO;
         msg_hdr = (void *) skb->data;
-        result = i2400m_rx_msg_hdr_check(i2400m, msg_hdr, skb->len);
+        result = i2400m_rx_msg_hdr_check(i2400m, msg_hdr, skb_len);
         if (result < 0)
                 goto error_msg_hdr_check;
         result = -EIO;
@@ -1261,10 +1261,10 @@ int i2400m_rx(struct i2400m *i2400m, struct sk_buff *skb)
         pl_itr = sizeof(*msg_hdr) +     /* Check payload descriptor(s) */
                 num_pls * sizeof(msg_hdr->pld[0]);
         pl_itr = ALIGN(pl_itr, I2400M_PL_ALIGN);
-        if (pl_itr > skb->len) {        /* got all the payload descriptors? */
+        if (pl_itr > skb_len) { /* got all the payload descriptors? */
                 dev_err(dev, "RX: HW BUG? message too short (%u bytes) for "
                         "%u payload descriptors (%zu each, total %zu)\n",
-                        skb->len, num_pls, sizeof(msg_hdr->pld[0]), pl_itr);
+                        skb_len, num_pls, sizeof(msg_hdr->pld[0]), pl_itr);
                 goto error_pl_descr_short;
         }
         /* Walk each payload payload--check we really got it */
@@ -1272,7 +1272,7 @@ int i2400m_rx(struct i2400m *i2400m, struct sk_buff *skb)
                 /* work around old gcc warnings */
                 pl_size = i2400m_pld_size(&msg_hdr->pld[i]);
                 result = i2400m_rx_pl_descr_check(i2400m, &msg_hdr->pld[i],
-                                                  pl_itr, skb->len);
+                                                  pl_itr, skb_len);
                 if (result < 0)
                         goto error_pl_descr_check;
                 single_last = num_pls == 1 || i == num_pls - 1;
@@ -1290,16 +1290,16 @@ int i2400m_rx(struct i2400m *i2400m, struct sk_buff *skb)
         if (i < i2400m->rx_pl_min)
                 i2400m->rx_pl_min = i;
         i2400m->rx_num++;
-        i2400m->rx_size_acc += skb->len;
-        if (skb->len < i2400m->rx_size_min)
-                i2400m->rx_size_min = skb->len;
-        if (skb->len > i2400m->rx_size_max)
-                i2400m->rx_size_max = skb->len;
+        i2400m->rx_size_acc += skb_len;
+        if (skb_len < i2400m->rx_size_min)
+                i2400m->rx_size_min = skb_len;
+        if (skb_len > i2400m->rx_size_max)
+                i2400m->rx_size_max = skb_len;
         spin_unlock_irqrestore(&i2400m->rx_lock, flags);
 error_pl_descr_check:
 error_pl_descr_short:
 error_msg_hdr_check:
-        d_fnend(4, dev, "(i2400m %p skb %p [size %zu]) = %d\n",
+        d_fnend(4, dev, "(i2400m %p skb %p [size %u]) = %d\n",
                 i2400m, skb, skb_len, result);
         return result;
 }
diff --git a/drivers/net/wireless/ath/ath9k/ani.c b/drivers/net/wireless/ath/ath9k/ani.c
index cc648b6ae31c..a3d95cca8f0c 100644
--- a/drivers/net/wireless/ath/ath9k/ani.c
+++ b/drivers/net/wireless/ath/ath9k/ani.c
@@ -543,7 +543,7 @@ static u8 ath9k_hw_chan_2_clockrate_mhz(struct ath_hw *ah)
         if (conf_is_ht40(conf))
                 return clockrate * 2;
 
-        return clockrate * 2;
+        return clockrate;
 }
 
 static int32_t ath9k_hw_ani_get_listen_time(struct ath_hw *ah)
diff --git a/drivers/parport/share.c b/drivers/parport/share.c
index dffa5d4fb298..a2d9d1e59260 100644
--- a/drivers/parport/share.c
+++ b/drivers/parport/share.c
@@ -306,7 +306,7 @@ struct parport *parport_register_port(unsigned long base, int irq, int dma,
         spin_lock_init(&tmp->pardevice_lock);
         tmp->ieee1284.mode = IEEE1284_MODE_COMPAT;
         tmp->ieee1284.phase = IEEE1284_PH_FWD_IDLE;
-        init_MUTEX_LOCKED (&tmp->ieee1284.irq); /* actually a semaphore at 0 */
+        sema_init(&tmp->ieee1284.irq, 0);
         tmp->spintime = parport_default_spintime;
         atomic_set (&tmp->ref_count, 1);
         INIT_LIST_HEAD(&tmp->full_list);
diff --git a/drivers/pci/dmar.c b/drivers/pci/dmar.c
index 0a19708074c2..3de3a436a432 100644
--- a/drivers/pci/dmar.c
+++ b/drivers/pci/dmar.c
@@ -1221,9 +1221,9 @@ const char *dmar_get_fault_reason(u8 fault_reason, int *fault_type)
         }
 }
 
-void dmar_msi_unmask(unsigned int irq)
+void dmar_msi_unmask(struct irq_data *data)
 {
-        struct intel_iommu *iommu = get_irq_data(irq);
+        struct intel_iommu *iommu = irq_data_get_irq_data(data);
         unsigned long flag;
 
         /* unmask it */
@@ -1234,10 +1234,10 @@ void dmar_msi_unmask(unsigned int irq)
         spin_unlock_irqrestore(&iommu->register_lock, flag);
 }
 
-void dmar_msi_mask(unsigned int irq)
+void dmar_msi_mask(struct irq_data *data)
 {
         unsigned long flag;
-        struct intel_iommu *iommu = get_irq_data(irq);
+        struct intel_iommu *iommu = irq_data_get_irq_data(data);
 
         /* mask it */
         spin_lock_irqsave(&iommu->register_lock, flag);
diff --git a/drivers/pci/htirq.c b/drivers/pci/htirq.c
index 98abf8b91294..834842aa5bbf 100644
--- a/drivers/pci/htirq.c
+++ b/drivers/pci/htirq.c
@@ -57,28 +57,22 @@ void fetch_ht_irq_msg(unsigned int irq, struct ht_irq_msg *msg)
         *msg = cfg->msg;
 }
 
-void mask_ht_irq(unsigned int irq)
+void mask_ht_irq(struct irq_data *data)
 {
-        struct ht_irq_cfg *cfg;
-        struct ht_irq_msg msg;
-
-        cfg = get_irq_data(irq);
+        struct ht_irq_cfg *cfg = irq_data_get_irq_data(data);
+        struct ht_irq_msg msg = cfg->msg;
 
-        msg = cfg->msg;
         msg.address_lo |= 1;
-        write_ht_irq_msg(irq, &msg);
+        write_ht_irq_msg(data->irq, &msg);
 }
 
-void unmask_ht_irq(unsigned int irq)
+void unmask_ht_irq(struct irq_data *data)
 {
-        struct ht_irq_cfg *cfg;
-        struct ht_irq_msg msg;
-
-        cfg = get_irq_data(irq);
+        struct ht_irq_cfg *cfg = irq_data_get_irq_data(data);
+        struct ht_irq_msg msg = cfg->msg;
 
-        msg = cfg->msg;
         msg.address_lo &= ~1;
-        write_ht_irq_msg(irq, &msg);
+        write_ht_irq_msg(data->irq, &msg);
 }
 
 /**
diff --git a/drivers/pci/intr_remapping.c b/drivers/pci/intr_remapping.c
index fd1d2867cdcc..ec87cd66f3eb 100644
--- a/drivers/pci/intr_remapping.c
+++ b/drivers/pci/intr_remapping.c
@@ -46,109 +46,24 @@ static __init int setup_intremap(char *str)
 }
 early_param("intremap", setup_intremap);
 
-struct irq_2_iommu {
-        struct intel_iommu *iommu;
-        u16 irte_index;
-        u16 sub_handle;
-        u8  irte_mask;
-};
-
-#ifdef CONFIG_GENERIC_HARDIRQS
-static struct irq_2_iommu *get_one_free_irq_2_iommu(int node)
-{
-        struct irq_2_iommu *iommu;
-
-        iommu = kzalloc_node(sizeof(*iommu), GFP_ATOMIC, node);
-        printk(KERN_DEBUG "alloc irq_2_iommu on node %d\n", node);
-
-        return iommu;
-}
-
-static struct irq_2_iommu *irq_2_iommu(unsigned int irq)
-{
-        struct irq_desc *desc;
-
-        desc = irq_to_desc(irq);
-
-        if (WARN_ON_ONCE(!desc))
-                return NULL;
-
-        return desc->irq_2_iommu;
-}
-
-static struct irq_2_iommu *irq_2_iommu_alloc(unsigned int irq)
-{
-        struct irq_desc *desc;
-        struct irq_2_iommu *irq_iommu;
-
-        desc = irq_to_desc(irq);
-        if (!desc) {
-                printk(KERN_INFO "can not get irq_desc for %d\n", irq);
-                return NULL;
-        }
-
-        irq_iommu = desc->irq_2_iommu;
-
-        if (!irq_iommu)
-                desc->irq_2_iommu = get_one_free_irq_2_iommu(irq_node(irq));
-
-        return desc->irq_2_iommu;
-}
-
-#else /* !CONFIG_SPARSE_IRQ */
-
-static struct irq_2_iommu irq_2_iommuX[NR_IRQS];
-
-static struct irq_2_iommu *irq_2_iommu(unsigned int irq)
-{
-        if (irq < nr_irqs)
-                return &irq_2_iommuX[irq];
-
-        return NULL;
-}
-static struct irq_2_iommu *irq_2_iommu_alloc(unsigned int irq)
-{
-        return irq_2_iommu(irq);
-}
-#endif
-
 static DEFINE_SPINLOCK(irq_2_ir_lock);
 
-static struct irq_2_iommu *valid_irq_2_iommu(unsigned int irq)
-{
-        struct irq_2_iommu *irq_iommu;
-
-        irq_iommu = irq_2_iommu(irq);
-
-        if (!irq_iommu)
-                return NULL;
-
-        if (!irq_iommu->iommu)
-                return NULL;
-
-        return irq_iommu;
-}
-
-int irq_remapped(int irq)
+static struct irq_2_iommu *irq_2_iommu(unsigned int irq)
 {
-        return valid_irq_2_iommu(irq) != NULL;
+        struct irq_cfg *cfg = get_irq_chip_data(irq);
+        return cfg ? &cfg->irq_2_iommu : NULL;
 }
 
 int get_irte(int irq, struct irte *entry)
 {
-        int index;
-        struct irq_2_iommu *irq_iommu;
+        struct irq_2_iommu *irq_iommu = irq_2_iommu(irq);
         unsigned long flags;
+        int index;
 
-        if (!entry)
+        if (!entry || !irq_iommu)
                 return -1;
 
         spin_lock_irqsave(&irq_2_ir_lock, flags);
-        irq_iommu = valid_irq_2_iommu(irq);
-        if (!irq_iommu) {
-                spin_unlock_irqrestore(&irq_2_ir_lock, flags);
-                return -1;
-        }
 
         index = irq_iommu->irte_index + irq_iommu->sub_handle;
         *entry = *(irq_iommu->iommu->ir_table->base + index);
@@ -160,20 +75,14 @@ int get_irte(int irq, struct irte *entry)
 int alloc_irte(struct intel_iommu *iommu, int irq, u16 count)
 {
         struct ir_table *table = iommu->ir_table;
-        struct irq_2_iommu *irq_iommu;
+        struct irq_2_iommu *irq_iommu = irq_2_iommu(irq);
         u16 index, start_index;
         unsigned int mask = 0;
         unsigned long flags;
         int i;
 
-        if (!count)
-                return -1;
-
-#ifndef CONFIG_SPARSE_IRQ
-        /* protect irq_2_iommu_alloc later */
-        if (irq >= nr_irqs)
+        if (!count || !irq_iommu)
                 return -1;
-#endif
 
         /*
          * start the IRTE search from index 0.
@@ -214,13 +123,6 @@ int alloc_irte(struct intel_iommu *iommu, int irq, u16 count)
         for (i = index; i < index + count; i++)
                 table->base[i].present = 1;
 
-        irq_iommu = irq_2_iommu_alloc(irq);
-        if (!irq_iommu) {
-                spin_unlock_irqrestore(&irq_2_ir_lock, flags);
-                printk(KERN_ERR "can't allocate irq_2_iommu\n");
-                return -1;
-        }
-
         irq_iommu->iommu = iommu;
         irq_iommu->irte_index =  index;
         irq_iommu->sub_handle = 0;
@@ -244,17 +146,14 @@ static int qi_flush_iec(struct intel_iommu *iommu, int index, int mask)
 
 int map_irq_to_irte_handle(int irq, u16 *sub_handle)
 {
-        int index;
-        struct irq_2_iommu *irq_iommu;
+        struct irq_2_iommu *irq_iommu = irq_2_iommu(irq);
         unsigned long flags;
+        int index;
 
-        spin_lock_irqsave(&irq_2_ir_lock, flags);
-        irq_iommu = valid_irq_2_iommu(irq);
-        if (!irq_iommu) {
-                spin_unlock_irqrestore(&irq_2_ir_lock, flags);
+        if (!irq_iommu)
                 return -1;
-        }
 
+        spin_lock_irqsave(&irq_2_ir_lock, flags);
         *sub_handle = irq_iommu->sub_handle;
         index = irq_iommu->irte_index;
         spin_unlock_irqrestore(&irq_2_ir_lock, flags);
@@ -263,18 +162,13 @@ int map_irq_to_irte_handle(int irq, u16 *sub_handle)
 
 int set_irte_irq(int irq, struct intel_iommu *iommu, u16 index, u16 subhandle)
 {
-        struct irq_2_iommu *irq_iommu;
+        struct irq_2_iommu *irq_iommu = irq_2_iommu(irq);
         unsigned long flags;
 
-        spin_lock_irqsave(&irq_2_ir_lock, flags);
-
-        irq_iommu = irq_2_iommu_alloc(irq);
-
-        if (!irq_iommu) {
-                spin_unlock_irqrestore(&irq_2_ir_lock, flags);
-                printk(KERN_ERR "can't allocate irq_2_iommu\n");
+        if (!irq_iommu)
                 return -1;
-        }
+
+        spin_lock_irqsave(&irq_2_ir_lock, flags);
 
         irq_iommu->iommu = iommu;
         irq_iommu->irte_index = index;
@@ -286,43 +180,18 @@ int set_irte_irq(int irq, struct intel_iommu *iommu, u16 index, u16 subhandle)
         return 0;
 }
 
-int clear_irte_irq(int irq, struct intel_iommu *iommu, u16 index)
-{
-        struct irq_2_iommu *irq_iommu;
-        unsigned long flags;
-
-        spin_lock_irqsave(&irq_2_ir_lock, flags);
-        irq_iommu = valid_irq_2_iommu(irq);
-        if (!irq_iommu) {
-                spin_unlock_irqrestore(&irq_2_ir_lock, flags);
-                return -1;
-        }
-
-        irq_iommu->iommu = NULL;
-        irq_iommu->irte_index = 0;
-        irq_iommu->sub_handle = 0;
-        irq_2_iommu(irq)->irte_mask = 0;
-
-        spin_unlock_irqrestore(&irq_2_ir_lock, flags);
-
-        return 0;
-}
-
 int modify_irte(int irq, struct irte *irte_modified)
 {
-        int rc;
-        int index;
-        struct irte *irte;
+        struct irq_2_iommu *irq_iommu = irq_2_iommu(irq);
         struct intel_iommu *iommu;
-        struct irq_2_iommu *irq_iommu;
         unsigned long flags;
+        struct irte *irte;
+        int rc, index;
 
-        spin_lock_irqsave(&irq_2_ir_lock, flags);
-        irq_iommu = valid_irq_2_iommu(irq);
-        if (!irq_iommu) {
-                spin_unlock_irqrestore(&irq_2_ir_lock, flags);
+        if (!irq_iommu)
                 return -1;
-        }
+
+        spin_lock_irqsave(&irq_2_ir_lock, flags);
 
         iommu = irq_iommu->iommu;
 
@@ -339,31 +208,6 @@ int modify_irte(int irq, struct irte *irte_modified)
         return rc;
 }
 
-int flush_irte(int irq)
-{
-        int rc;
-        int index;
-        struct intel_iommu *iommu;
-        struct irq_2_iommu *irq_iommu;
-        unsigned long flags;
-
-        spin_lock_irqsave(&irq_2_ir_lock, flags);
-        irq_iommu = valid_irq_2_iommu(irq);
-        if (!irq_iommu) {
-                spin_unlock_irqrestore(&irq_2_ir_lock, flags);
-                return -1;
-        }
-
-        iommu = irq_iommu->iommu;
-
-        index = irq_iommu->irte_index + irq_iommu->sub_handle;
-
-        rc = qi_flush_iec(iommu, index, irq_iommu->irte_mask);
-        spin_unlock_irqrestore(&irq_2_ir_lock, flags);
-
-        return rc;
-}
-
 struct intel_iommu *map_hpet_to_ir(u8 hpet_id)
 {
         int i;
@@ -420,16 +264,14 @@ static int clear_entries(struct irq_2_iommu *irq_iommu)
 
 int free_irte(int irq)
 {
-        int rc = 0;
-        struct irq_2_iommu *irq_iommu;
+        struct irq_2_iommu *irq_iommu = irq_2_iommu(irq);
         unsigned long flags;
+        int rc;
 
-        spin_lock_irqsave(&irq_2_ir_lock, flags);
-        irq_iommu = valid_irq_2_iommu(irq);
-        if (!irq_iommu) {
-                spin_unlock_irqrestore(&irq_2_ir_lock, flags);
+        if (!irq_iommu)
                 return -1;
-        }
+
+        spin_lock_irqsave(&irq_2_ir_lock, flags);
 
         rc = clear_entries(irq_iommu);
 
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 69b7be33b3a2..5fcf5aec680f 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -170,33 +170,31 @@ static void msix_mask_irq(struct msi_desc *desc, u32 flag)
         desc->masked = __msix_mask_irq(desc, flag);
 }
 
-static void msi_set_mask_bit(unsigned irq, u32 flag)
+static void msi_set_mask_bit(struct irq_data *data, u32 flag)
 {
-        struct msi_desc *desc = get_irq_msi(irq);
+        struct msi_desc *desc = irq_data_get_msi(data);
 
         if (desc->msi_attrib.is_msix) {
                 msix_mask_irq(desc, flag);
                 readl(desc->mask_base);         /* Flush write to device */
         } else {
-                unsigned offset = irq - desc->dev->irq;
+                unsigned offset = data->irq - desc->dev->irq;
                 msi_mask_irq(desc, 1 << offset, flag << offset);
         }
 }
 
-void mask_msi_irq(unsigned int irq)
+void mask_msi_irq(struct irq_data *data)
 {
-        msi_set_mask_bit(irq, 1);
+        msi_set_mask_bit(data, 1);
 }
 
-void unmask_msi_irq(unsigned int irq)
+void unmask_msi_irq(struct irq_data *data)
 {
-        msi_set_mask_bit(irq, 0);
+        msi_set_mask_bit(data, 0);
 }
 
-void read_msi_msg_desc(struct irq_desc *desc, struct msi_msg *msg)
+void __read_msi_msg(struct msi_desc *entry, struct msi_msg *msg)
 {
-        struct msi_desc *entry = get_irq_desc_msi(desc);
-
         BUG_ON(entry->dev->current_state != PCI_D0);
 
         if (entry->msi_attrib.is_msix) {
@@ -227,15 +225,13 @@ void read_msi_msg_desc(struct irq_desc *desc, struct msi_msg *msg)
 
 void read_msi_msg(unsigned int irq, struct msi_msg *msg)
 {
-        struct irq_desc *desc = irq_to_desc(irq);
+        struct msi_desc *entry = get_irq_msi(irq);
 
-        read_msi_msg_desc(desc, msg);
+        __read_msi_msg(entry, msg);
 }
 
-void get_cached_msi_msg_desc(struct irq_desc *desc, struct msi_msg *msg)
+void __get_cached_msi_msg(struct msi_desc *entry, struct msi_msg *msg)
 {
-        struct msi_desc *entry = get_irq_desc_msi(desc);
-
         /* Assert that the cache is valid, assuming that
          * valid messages are not all-zeroes. */
         BUG_ON(!(entry->msg.address_hi | entry->msg.address_lo |
@@ -246,15 +242,13 @@ void get_cached_msi_msg_desc(struct irq_desc *desc, struct msi_msg *msg)
 
 void get_cached_msi_msg(unsigned int irq, struct msi_msg *msg)
 {
-        struct irq_desc *desc = irq_to_desc(irq);
+        struct msi_desc *entry = get_irq_msi(irq);
 
-        get_cached_msi_msg_desc(desc, msg);
+        __get_cached_msi_msg(entry, msg);
 }
 
-void write_msi_msg_desc(struct irq_desc *desc, struct msi_msg *msg)
+void __write_msi_msg(struct msi_desc *entry, struct msi_msg *msg)
 {
-        struct msi_desc *entry = get_irq_desc_msi(desc);
-
         if (entry->dev->current_state != PCI_D0) {
                 /* Don't touch the hardware now */
         } else if (entry->msi_attrib.is_msix) {
@@ -292,9 +286,9 @@ void write_msi_msg_desc(struct irq_desc *desc, struct msi_msg *msg)
 
 void write_msi_msg(unsigned int irq, struct msi_msg *msg)
 {
-        struct irq_desc *desc = irq_to_desc(irq);
+        struct msi_desc *entry = get_irq_msi(irq);
 
-        write_msi_msg_desc(desc, msg);
+        __write_msi_msg(entry, msg);
 }
 
 static void free_msi_irqs(struct pci_dev *dev)
diff --git a/drivers/platform/x86/intel_ips.c b/drivers/platform/x86/intel_ips.c
index 9024480a8228..c44a5e8b8b82 100644
--- a/drivers/platform/x86/intel_ips.c
+++ b/drivers/platform/x86/intel_ips.c
@@ -51,7 +51,6 @@
  * TODO:
  *   - handle CPU hotplug
  *   - provide turbo enable/disable api
- *   - make sure we can write turbo enable/disable reg based on MISC_EN
  *
  * Related documents:
  *   - CDI 403777, 403778 - Auburndale EDS vol 1 & 2
@@ -230,7 +229,7 @@
 #define THM_TC2         0xac
 #define THM_DTV         0xb0
 #define THM_ITV         0xd8
-#define   ITV_ME_SEQNO_MASK 0x000f0000 /* ME should update every ~200ms */
+#define   ITV_ME_SEQNO_MASK 0x00ff0000 /* ME should update every ~200ms */
 #define   ITV_ME_SEQNO_SHIFT (16)
 #define   ITV_MCH_TEMP_MASK 0x0000ff00
 #define   ITV_MCH_TEMP_SHIFT (8)
@@ -325,6 +324,7 @@ struct ips_driver {
         bool gpu_preferred;
         bool poll_turbo_status;
         bool second_cpu;
+        bool turbo_toggle_allowed;
         struct ips_mcp_limits *limits;
 
         /* Optional MCH interfaces for if i915 is in use */
@@ -415,7 +415,7 @@ static void ips_cpu_lower(struct ips_driver *ips)
         new_limit = cur_limit - 8; /* 1W decrease */
 
         /* Clamp to SKU TDP limit */
-        if (((new_limit * 10) / 8) < (ips->orig_turbo_limit & TURBO_TDP_MASK))
+        if (new_limit  < (ips->orig_turbo_limit & TURBO_TDP_MASK))
                 new_limit = ips->orig_turbo_limit & TURBO_TDP_MASK;
 
         thm_writew(THM_MPCPC, (new_limit * 10) / 8);
@@ -461,7 +461,8 @@ static void ips_enable_cpu_turbo(struct ips_driver *ips)
         if (ips->__cpu_turbo_on)
                 return;
 
-        on_each_cpu(do_enable_cpu_turbo, ips, 1);
+        if (ips->turbo_toggle_allowed)
+                on_each_cpu(do_enable_cpu_turbo, ips, 1);
 
         ips->__cpu_turbo_on = true;
 }
@@ -498,7 +499,8 @@ static void ips_disable_cpu_turbo(struct ips_driver *ips)
         if (!ips->__cpu_turbo_on)
                 return;
 
-        on_each_cpu(do_disable_cpu_turbo, ips, 1);
+        if (ips->turbo_toggle_allowed)
+                on_each_cpu(do_disable_cpu_turbo, ips, 1);
 
         ips->__cpu_turbo_on = false;
 }
@@ -598,17 +600,29 @@ static bool mcp_exceeded(struct ips_driver *ips)
 {
         unsigned long flags;
         bool ret = false;
+        u32 temp_limit;
+        u32 avg_power;
+        const char *msg = "MCP limit exceeded: ";
 
         spin_lock_irqsave(&ips->turbo_status_lock, flags);
-        if (ips->mcp_avg_temp > (ips->mcp_temp_limit * 100))
-                ret = true;
-        if (ips->cpu_avg_power + ips->mch_avg_power > ips->mcp_power_limit)
+
+        temp_limit = ips->mcp_temp_limit * 100;
+        if (ips->mcp_avg_temp > temp_limit) {
+                dev_info(&ips->dev->dev,
+                        "%sAvg temp %u, limit %u\n", msg, ips->mcp_avg_temp,
+                        temp_limit);
                 ret = true;
-        spin_unlock_irqrestore(&ips->turbo_status_lock, flags);
+        }
 
-        if (ret)
+        avg_power = ips->cpu_avg_power + ips->mch_avg_power;
+        if (avg_power > ips->mcp_power_limit) {
                 dev_info(&ips->dev->dev,
-                         "MCP power or thermal limit exceeded\n");
+                        "%sAvg power %u, limit %u\n", msg, avg_power,
+                        ips->mcp_power_limit);
+                ret = true;
+        }
+
+        spin_unlock_irqrestore(&ips->turbo_status_lock, flags);
 
         return ret;
 }
@@ -663,6 +677,27 @@ static bool mch_exceeded(struct ips_driver *ips)
 }
 
 /**
+ * verify_limits - verify BIOS provided limits
+ * @ips: IPS structure
+ *
+ * BIOS can optionally provide non-default limits for power and temp.  Check
+ * them here and use the defaults if the BIOS values are not provided or
+ * are otherwise unusable.
+ */
+static void verify_limits(struct ips_driver *ips)
+{
+        if (ips->mcp_power_limit < ips->limits->mcp_power_limit ||
+            ips->mcp_power_limit > 35000)
+                ips->mcp_power_limit = ips->limits->mcp_power_limit;
+
+        if (ips->mcp_temp_limit < ips->limits->core_temp_limit ||
+            ips->mcp_temp_limit < ips->limits->mch_temp_limit ||
+            ips->mcp_temp_limit > 150)
+                ips->mcp_temp_limit = min(ips->limits->core_temp_limit,
+                                          ips->limits->mch_temp_limit);
+}
+
+/**
  * update_turbo_limits - get various limits & settings from regs
  * @ips: IPS driver struct
  *
@@ -680,12 +715,21 @@ static void update_turbo_limits(struct ips_driver *ips)
         u32 hts = thm_readl(THM_HTS);
 
         ips->cpu_turbo_enabled = !(hts & HTS_PCTD_DIS);
-        ips->gpu_turbo_enabled = !(hts & HTS_GTD_DIS);
+        /* 
+         * Disable turbo for now, until we can figure out why the power figures
+         * are wrong
+         */
+        ips->cpu_turbo_enabled = false;
+
+        if (ips->gpu_busy)
+                ips->gpu_turbo_enabled = !(hts & HTS_GTD_DIS);
+
         ips->core_power_limit = thm_readw(THM_MPCPC);
         ips->mch_power_limit = thm_readw(THM_MMGPC);
         ips->mcp_temp_limit = thm_readw(THM_PTL);
         ips->mcp_power_limit = thm_readw(THM_MPPC);
 
+        verify_limits(ips);
         /* Ignore BIOS CPU vs GPU pref */
 }
 
@@ -858,7 +902,7 @@ static u32 get_cpu_power(struct ips_driver *ips, u32 *last, int period)
         ret = (ret * 1000) / 65535;
         *last = val;
 
-        return ret;
+        return 0;
 }
 
 static const u16 temp_decay_factor = 2;
@@ -940,7 +984,6 @@ static int ips_monitor(void *data)
                 kfree(mch_samples);
                 kfree(cpu_samples);
                 kfree(mchp_samples);
-                kthread_stop(ips->adjust);
                 return -ENOMEM;
         }
 
@@ -948,7 +991,7 @@ static int ips_monitor(void *data)
                 ITV_ME_SEQNO_SHIFT;
         seqno_timestamp = get_jiffies_64();
 
-        old_cpu_power = thm_readl(THM_CEC) / 65535;
+        old_cpu_power = thm_readl(THM_CEC);
         schedule_timeout_interruptible(msecs_to_jiffies(IPS_SAMPLE_PERIOD));
 
         /* Collect an initial average */
@@ -1150,11 +1193,18 @@ static irqreturn_t ips_irq_handler(int irq, void *arg)
                                 STS_GPL_SHIFT;
                         /* ignore EC CPU vs GPU pref */
                         ips->cpu_turbo_enabled = !(sts & STS_PCTD_DIS);
-                        ips->gpu_turbo_enabled = !(sts & STS_GTD_DIS);
+                        /* 
+                         * Disable turbo for now, until we can figure
+                         * out why the power figures are wrong
+                         */
+                        ips->cpu_turbo_enabled = false;
+                        if (ips->gpu_busy)
+                                ips->gpu_turbo_enabled = !(sts & STS_GTD_DIS);
                         ips->mcp_temp_limit = (sts & STS_PTL_MASK) >>
                                 STS_PTL_SHIFT;
                         ips->mcp_power_limit = (tc1 & STS_PPL_MASK) >>
                                 STS_PPL_SHIFT;
+                        verify_limits(ips);
                         spin_unlock(&ips->turbo_status_lock);
 
                         thm_writeb(THM_SEC, SEC_ACK);
@@ -1333,8 +1383,10 @@ static struct ips_mcp_limits *ips_detect_cpu(struct ips_driver *ips)
          * turbo manually or we'll get an illegal MSR access, even though
          * turbo will still be available.
          */
-        if (!(misc_en & IA32_MISC_TURBO_EN))
-                ; /* add turbo MSR write allowed flag if necessary */
+        if (misc_en & IA32_MISC_TURBO_EN)
+                ips->turbo_toggle_allowed = true;
+        else
+                ips->turbo_toggle_allowed = false;
 
         if (strstr(boot_cpu_data.x86_model_id, "CPU       M"))
                 limits = &ips_sv_limits;
@@ -1351,9 +1403,10 @@ static struct ips_mcp_limits *ips_detect_cpu(struct ips_driver *ips)
         tdp = turbo_power & TURBO_TDP_MASK;
 
         /* Sanity check TDP against CPU */
-        if (limits->mcp_power_limit != (tdp / 8) * 1000) {
-                dev_warn(&ips->dev->dev, "Warning: CPU TDP doesn't match expected value (found %d, expected %d)\n",
-                         tdp / 8, limits->mcp_power_limit / 1000);
+        if (limits->core_power_limit != (tdp / 8) * 1000) {
+                dev_info(&ips->dev->dev, "CPU TDP doesn't match expected value (found %d, expected %d)\n",
+                         tdp / 8, limits->core_power_limit / 1000);
+                limits->core_power_limit = (tdp / 8) * 1000;
         }
 
 out:
@@ -1390,7 +1443,7 @@ static bool ips_get_i915_syms(struct ips_driver *ips)
         return true;
 
 out_put_busy:
-        symbol_put(i915_gpu_turbo_disable);
+        symbol_put(i915_gpu_busy);
 out_put_lower:
         symbol_put(i915_gpu_lower);
 out_put_raise:
@@ -1532,22 +1585,27 @@ static int ips_probe(struct pci_dev *dev, const struct pci_device_id *id)
         /* Save turbo limits & ratios */
         rdmsrl(TURBO_POWER_CURRENT_LIMIT, ips->orig_turbo_limit);
 
-        ips_enable_cpu_turbo(ips);
-        ips->cpu_turbo_enabled = true;
+        ips_disable_cpu_turbo(ips);
+        ips->cpu_turbo_enabled = false;
 
-        /* Set up the work queue and monitor/adjust threads */
-        ips->monitor = kthread_run(ips_monitor, ips, "ips-monitor");
-        if (IS_ERR(ips->monitor)) {
+        /* Create thermal adjust thread */
+        ips->adjust = kthread_create(ips_adjust, ips, "ips-adjust");
+        if (IS_ERR(ips->adjust)) {
                 dev_err(&dev->dev,
-                        "failed to create thermal monitor thread, aborting\n");
+                        "failed to create thermal adjust thread, aborting\n");
                 ret = -ENOMEM;
                 goto error_free_irq;
+
         }
 
-        ips->adjust = kthread_create(ips_adjust, ips, "ips-adjust");
-        if (IS_ERR(ips->adjust)) {
+        /*
+         * Set up the work queue and monitor thread. The monitor thread
+         * will wake up ips_adjust thread.
+         */
+        ips->monitor = kthread_run(ips_monitor, ips, "ips-monitor");
+        if (IS_ERR(ips->monitor)) {
                 dev_err(&dev->dev,
-                        "failed to create thermal adjust thread, aborting\n");
+                        "failed to create thermal monitor thread, aborting\n");
                 ret = -ENOMEM;
                 goto error_thread_cleanup;
         }
@@ -1566,7 +1624,7 @@ static int ips_probe(struct pci_dev *dev, const struct pci_device_id *id)
         return ret;
 
 error_thread_cleanup:
-        kthread_stop(ips->monitor);
+        kthread_stop(ips->adjust);
 error_free_irq:
         free_irq(ips->dev->irq, ips);
 error_unmap:
diff --git a/drivers/regulator/ad5398.c b/drivers/regulator/ad5398.c
index df1fb53c09d2..a4be41614eeb 100644
--- a/drivers/regulator/ad5398.c
+++ b/drivers/regulator/ad5398.c
@@ -256,7 +256,6 @@ static int __devexit ad5398_remove(struct i2c_client *client)
 
         regulator_unregister(chip->rdev);
         kfree(chip);
-        i2c_set_clientdata(client, NULL);
 
         return 0;
 }
diff --git a/drivers/regulator/isl6271a-regulator.c b/drivers/regulator/isl6271a-regulator.c
index d61ecb885a8c..b8cc6389a541 100644
--- a/drivers/regulator/isl6271a-regulator.c
+++ b/drivers/regulator/isl6271a-regulator.c
@@ -191,8 +191,6 @@ static int __devexit isl6271a_remove(struct i2c_client *i2c)
         struct isl_pmic *pmic = i2c_get_clientdata(i2c);
         int i;
 
-        i2c_set_clientdata(i2c, NULL);
-
         for (i = 0; i < 3; i++)
                 regulator_unregister(pmic->rdev[i]);
 
diff --git a/drivers/rtc/rtc-ds3232.c b/drivers/rtc/rtc-ds3232.c
index 9daed8db83d3..9de8516e3531 100644
--- a/drivers/rtc/rtc-ds3232.c
+++ b/drivers/rtc/rtc-ds3232.c
@@ -268,7 +268,6 @@ out_irq:
                 free_irq(client->irq, client);
 
 out_free:
-        i2c_set_clientdata(client, NULL);
         kfree(ds3232);
         return ret;
 }
@@ -287,7 +286,6 @@ static int __devexit ds3232_remove(struct i2c_client *client)
         }
 
         rtc_device_unregister(ds3232->rtc);
-        i2c_set_clientdata(client, NULL);
         kfree(ds3232);
         return 0;
 }
diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
index ad0ed212db4a..348fba0a8976 100644
--- a/drivers/scsi/scsi.c
+++ b/drivers/scsi/scsi.c
@@ -1046,13 +1046,13 @@ int scsi_get_vpd_page(struct scsi_device *sdev, u8 page, unsigned char *buf,
 
         /* If the user actually wanted this page, we can skip the rest */
         if (page == 0)
-                return -EINVAL;
+                return 0;
 
         for (i = 0; i < min((int)buf[3], buf_len - 4); i++)
                 if (buf[i + 4] == page)
                         goto found;
 
-        if (i < buf[3] && i > buf_len)
+        if (i < buf[3] && i >= buf_len - 4)
                 /* ran off the end of the buffer, give us benefit of doubt */
                 goto found;
         /* The device claims it doesn't support the requested page */
diff --git a/drivers/serial/ioc3_serial.c b/drivers/serial/ioc3_serial.c
index 93de907b1208..800c54602339 100644
--- a/drivers/serial/ioc3_serial.c
+++ b/drivers/serial/ioc3_serial.c
@@ -2044,6 +2044,7 @@ ioc3uart_probe(struct ioc3_submodule *is, struct ioc3_driver_data *idd)
                 if (!port) {
                         printk(KERN_WARNING
                                "IOC3 serial memory not available for port\n");
+                        ret = -ENOMEM;
                         goto out4;
                 }
                 spin_lock_init(&port->ip_lock);
diff --git a/drivers/staging/tm6000/Kconfig b/drivers/staging/tm6000/Kconfig
index c725356cc346..de7ebb99d8f6 100644
--- a/drivers/staging/tm6000/Kconfig
+++ b/drivers/staging/tm6000/Kconfig
@@ -1,6 +1,6 @@
 config VIDEO_TM6000
         tristate "TV Master TM5600/6000/6010 driver"
-        depends on VIDEO_DEV && I2C && INPUT && USB && EXPERIMENTAL
+        depends on VIDEO_DEV && I2C && INPUT && IR_CORE && USB && EXPERIMENTAL
         select VIDEO_TUNER
         select MEDIA_TUNER_XC2028
         select MEDIA_TUNER_XC5000
diff --git a/drivers/staging/tm6000/tm6000-input.c b/drivers/staging/tm6000/tm6000-input.c
index 32f7a0af6938..54f7667cc706 100644
--- a/drivers/staging/tm6000/tm6000-input.c
+++ b/drivers/staging/tm6000/tm6000-input.c
@@ -46,7 +46,7 @@ MODULE_PARM_DESC(enable_ir, "enable ir (default is enable");
         }
 
 struct tm6000_ir_poll_result {
-        u8 rc_data[4];
+        u16 rc_data;
 };
 
 struct tm6000_IR {
@@ -60,9 +60,9 @@ struct tm6000_IR {
         int                     polling;
         struct delayed_work     work;
         u8                      wait:1;
+        u8                      key:1;
         struct urb              *int_urb;
         u8                      *urb_data;
-        u8                      key:1;
 
         int (*get_key) (struct tm6000_IR *, struct tm6000_ir_poll_result *);
 
@@ -122,13 +122,14 @@ static void tm6000_ir_urb_received(struct urb *urb)
 
         if (urb->status != 0)
                 printk(KERN_INFO "not ready\n");
-        else if (urb->actual_length > 0)
+        else if (urb->actual_length > 0) {
                 memcpy(ir->urb_data, urb->transfer_buffer, urb->actual_length);
 
-        dprintk("data %02x %02x %02x %02x\n", ir->urb_data[0],
-        ir->urb_data[1], ir->urb_data[2], ir->urb_data[3]);
+                dprintk("data %02x %02x %02x %02x\n", ir->urb_data[0],
+                        ir->urb_data[1], ir->urb_data[2], ir->urb_data[3]);
 
-        ir->key = 1;
+                ir->key = 1;
+        }
 
         rc = usb_submit_urb(urb, GFP_ATOMIC);
 }
@@ -140,30 +141,47 @@ static int default_polling_getkey(struct tm6000_IR *ir,
         int rc;
         u8 buf[2];
 
-        if (ir->wait && !&dev->int_in) {
-                poll_result->rc_data[0] = 0xff;
+        if (ir->wait && !&dev->int_in)
                 return 0;
-        }
 
         if (&dev->int_in) {
-                poll_result->rc_data[0] = ir->urb_data[0];
-                poll_result->rc_data[1] = ir->urb_data[1];
+                if (ir->ir.ir_type == IR_TYPE_RC5)
+                        poll_result->rc_data = ir->urb_data[0];
+                else
+                        poll_result->rc_data = ir->urb_data[0] | ir->urb_data[1] << 8;
         } else {
                 tm6000_set_reg(dev, REQ_04_EN_DISABLE_MCU_INT, 2, 0);
                 msleep(10);
                 tm6000_set_reg(dev, REQ_04_EN_DISABLE_MCU_INT, 2, 1);
                 msleep(10);
 
-                rc = tm6000_read_write_usb(dev, USB_DIR_IN | USB_TYPE_VENDOR |
-                 USB_RECIP_DEVICE, REQ_02_GET_IR_CODE, 0, 0, buf, 1);
+                if (ir->ir.ir_type == IR_TYPE_RC5) {
+                        rc = tm6000_read_write_usb(dev, USB_DIR_IN |
+                                USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+                                REQ_02_GET_IR_CODE, 0, 0, buf, 1);
 
-                msleep(10);
+                        msleep(10);
 
-                dprintk("read data=%02x\n", buf[0]);
-                if (rc < 0)
-                        return rc;
+                        dprintk("read data=%02x\n", buf[0]);
+                        if (rc < 0)
+                                return rc;
 
-                poll_result->rc_data[0] = buf[0];
+                        poll_result->rc_data = buf[0];
+                } else {
+                        rc = tm6000_read_write_usb(dev, USB_DIR_IN |
+                                USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+                                REQ_02_GET_IR_CODE, 0, 0, buf, 2);
+
+                        msleep(10);
+
+                        dprintk("read data=%04x\n", buf[0] | buf[1] << 8);
+                        if (rc < 0)
+                                return rc;
+
+                        poll_result->rc_data = buf[0] | buf[1] << 8;
+                }
+                if ((poll_result->rc_data & 0x00ff) != 0xff)
+                        ir->key = 1;
         }
         return 0;
 }
@@ -180,12 +198,11 @@ static void tm6000_ir_handle_key(struct tm6000_IR *ir)
                 return;
         }
 
-        dprintk("ir->get_key result data=%02x %02x\n",
-                poll_result.rc_data[0], poll_result.rc_data[1]);
+        dprintk("ir->get_key result data=%04x\n", poll_result.rc_data);
 
-        if (poll_result.rc_data[0] != 0xff && ir->key == 1) {
+        if (ir->key) {
                 ir_input_keydown(ir->input->input_dev, &ir->ir,
-                        poll_result.rc_data[0] | poll_result.rc_data[1] << 8);
+                                (u32)poll_result.rc_data);
 
                 ir_input_nokey(ir->input->input_dev, &ir->ir);
                 ir->key = 0;
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 7c8008225ee3..17927b1f9334 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -127,7 +127,10 @@ static void handle_tx(struct vhost_net *net)
         size_t len, total_len = 0;
         int err, wmem;
         size_t hdr_size;
-        struct socket *sock = rcu_dereference(vq->private_data);
+        struct socket *sock;
+
+        sock = rcu_dereference_check(vq->private_data,
+                                     lockdep_is_held(&vq->mutex));
         if (!sock)
                 return;
 
@@ -582,7 +585,10 @@ static void vhost_net_disable_vq(struct vhost_net *n,
 static void vhost_net_enable_vq(struct vhost_net *n,
                                 struct vhost_virtqueue *vq)
 {
-        struct socket *sock = vq->private_data;
+        struct socket *sock;
+
+        sock = rcu_dereference_protected(vq->private_data,
+                                         lockdep_is_held(&vq->mutex));
         if (!sock)
                 return;
         if (vq == n->vqs + VHOST_NET_VQ_TX) {
@@ -598,7 +604,8 @@ static struct socket *vhost_net_stop_vq(struct vhost_net *n,
         struct socket *sock;
 
         mutex_lock(&vq->mutex);
-        sock = vq->private_data;
+        sock = rcu_dereference_protected(vq->private_data,
+                                         lockdep_is_held(&vq->mutex));
         vhost_net_disable_vq(n, vq);
         rcu_assign_pointer(vq->private_data, NULL);
         mutex_unlock(&vq->mutex);
@@ -736,7 +743,8 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd)
         }
 
         /* start polling new socket */
-        oldsock = vq->private_data;
+        oldsock = rcu_dereference_protected(vq->private_data,
+                                            lockdep_is_held(&vq->mutex));
         if (sock != oldsock) {
                 vhost_net_disable_vq(n, vq);
                 rcu_assign_pointer(vq->private_data, sock);
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index dd3d6f7406f8..8b5a1b33d0fe 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -320,7 +320,7 @@ long vhost_dev_reset_owner(struct vhost_dev *dev)
         vhost_dev_cleanup(dev);
 
         memory->nregions = 0;
-        dev->memory = memory;
+        RCU_INIT_POINTER(dev->memory, memory);
         return 0;
 }
 
@@ -352,8 +352,9 @@ void vhost_dev_cleanup(struct vhost_dev *dev)
                 fput(dev->log_file);
         dev->log_file = NULL;
         /* No one will access memory at this point */
-        kfree(dev->memory);
-        dev->memory = NULL;
+        kfree(rcu_dereference_protected(dev->memory,
+                                        lockdep_is_held(&dev->mutex)));
+        RCU_INIT_POINTER(dev->memory, NULL);
         if (dev->mm)
                 mmput(dev->mm);
         dev->mm = NULL;
@@ -440,14 +441,22 @@ static int vq_access_ok(unsigned int num,
 /* Caller should have device mutex but not vq mutex */
 int vhost_log_access_ok(struct vhost_dev *dev)
 {
-        return memory_access_ok(dev, dev->memory, 1);
+        struct vhost_memory *mp;
+
+        mp = rcu_dereference_protected(dev->memory,
+                                       lockdep_is_held(&dev->mutex));
+        return memory_access_ok(dev, mp, 1);
 }
 
 /* Verify access for write logging. */
 /* Caller should have vq mutex and device mutex */
 static int vq_log_access_ok(struct vhost_virtqueue *vq, void __user *log_base)
 {
-        return vq_memory_access_ok(log_base, vq->dev->memory,
+        struct vhost_memory *mp;
+
+        mp = rcu_dereference_protected(vq->dev->memory,
+                                       lockdep_is_held(&vq->mutex));
+        return vq_memory_access_ok(log_base, mp,
                             vhost_has_feature(vq->dev, VHOST_F_LOG_ALL)) &&
                 (!vq->log_used || log_access_ok(log_base, vq->log_addr,
                                         sizeof *vq->used +
@@ -487,7 +496,8 @@ static long vhost_set_memory(struct vhost_dev *d, struct vhost_memory __user *m)
                 kfree(newmem);
                 return -EFAULT;
         }
-        oldmem = d->memory;
+        oldmem = rcu_dereference_protected(d->memory,
+                                           lockdep_is_held(&d->mutex));
         rcu_assign_pointer(d->memory, newmem);
         synchronize_rcu();
         kfree(oldmem);
diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
index afd77295971c..af3c11ded5fd 100644
--- a/drivers/vhost/vhost.h
+++ b/drivers/vhost/vhost.h
@@ -106,7 +106,7 @@ struct vhost_virtqueue {
          * vhost_work execution acts instead of rcu_read_lock() and the end of
          * vhost_work execution acts instead of rcu_read_lock().
          * Writers use virtqueue mutex. */
-        void *private_data;
+        void __rcu *private_data;
         /* Log write descriptors */
         void __user *log_base;
         struct vhost_log log[VHOST_NET_MAX_SG];
@@ -116,7 +116,7 @@ struct vhost_dev {
         /* Readers use RCU to access memory table pointer
          * log base pointer and features.
          * Writers use mutex below.*/
-        struct vhost_memory *memory;
+        struct vhost_memory __rcu *memory;
         struct mm_struct *mm;
         struct mutex mutex;
         unsigned acked_features;
@@ -173,7 +173,11 @@ enum {
 
 static inline int vhost_has_feature(struct vhost_dev *dev, int bit)
 {
-        unsigned acked_features = rcu_dereference(dev->acked_features);
+        unsigned acked_features;
+
+        acked_features =
+                rcu_dereference_index_check(dev->acked_features,
+                                            lockdep_is_held(&dev->mutex));
         return acked_features & (1 << bit);
 }
 
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
index 13365ba35218..7d24b0d94ed4 100644
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
@@ -338,30 +338,29 @@ static void unmask_evtchn(int port)
 
 static int find_unbound_irq(void)
 {
-        int irq;
-        struct irq_desc *desc;
+        struct irq_data *data;
+        int irq, res;
 
         for (irq = 0; irq < nr_irqs; irq++) {
-                desc = irq_to_desc(irq);
+                data = irq_get_irq_data(irq);
                 /* only 0->15 have init'd desc; handle irq > 16 */
-                if (desc == NULL)
+                if (!data)
                         break;
-                if (desc->chip == &no_irq_chip)
+                if (data->chip == &no_irq_chip)
                         break;
-                if (desc->chip != &xen_dynamic_chip)
+                if (data->chip != &xen_dynamic_chip)
                         continue;
                 if (irq_info[irq].type == IRQT_UNBOUND)
-                        break;
+                        return irq;
         }
 
         if (irq == nr_irqs)
                 panic("No available IRQ to bind to: increase nr_irqs!\n");
 
-        desc = irq_to_desc_alloc_node(irq, 0);
-        if (WARN_ON(desc == NULL))
-                return -1;
+        res = irq_alloc_desc_at(irq, 0);
 
-        dynamic_irq_init_keep_chip_data(irq);
+        if (WARN_ON(res != irq))
+                return -1;
 
         return irq;
 }
@@ -495,7 +494,7 @@ static void unbind_from_irq(unsigned int irq)
         if (irq_info[irq].type != IRQT_UNBOUND) {
                 irq_info[irq] = mk_unbound_info();
 
-                dynamic_irq_cleanup(irq);
+                irq_free_desc(irq);
         }
 
         spin_unlock(&irq_mapping_update_lock);