70 files changed, 697 insertions, 555 deletions

diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index da3a08fa9e4f..ce9dead0f499 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -60,6 +60,7 @@ config ACPI_PROCFS
           /proc/acpi/info (/sys/modules/acpi/parameters/acpica_version)
           /proc/acpi/dsdt (/sys/firmware/acpi/tables/DSDT)
           /proc/acpi/fadt (/sys/firmware/acpi/tables/FACP)
+          /proc/acpi/battery (/sys/class/power_supply)
           /proc/acpi/debug_layer (/sys/module/acpi/parameters/debug_layer)
           /proc/acpi/debug_level (/sys/module/acpi/parameters/debug_level)
 
diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index f08cca21702c..328ce8a08426 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -960,6 +960,13 @@ static int piix_broken_suspend(void)
                         },
                 },
                 {
+                        .ident = "Satellite Pro U200",
+                        .matches = {
+                                DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
+                                DMI_MATCH(DMI_PRODUCT_NAME, "SATELLITE PRO U200"),
+                        },
+                },
+                {
                         .ident = "Satellite U205",
                         .matches = {
                                 DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
diff --git a/drivers/ata/libata-acpi.c b/drivers/ata/libata-acpi.c
index 08a52dd45fb6..545ea865ceb5 100644
--- a/drivers/ata/libata-acpi.c
+++ b/drivers/ata/libata-acpi.c
@@ -312,7 +312,7 @@ EXPORT_SYMBOL_GPL(ata_acpi_stm);
  *
  * RETURNS:
  * Number of taskfiles on success, 0 if _GTF doesn't exist or doesn't
- * contain valid data.  -errno on other errors.
+ * contain valid data.
  */
 static int ata_dev_get_GTF(struct ata_device *dev, struct ata_acpi_gtf **gtf,
                            void **ptr_to_free)
@@ -339,7 +339,6 @@ static int ata_dev_get_GTF(struct ata_device *dev, struct ata_acpi_gtf **gtf,
                         ata_dev_printk(dev, KERN_WARNING,
                                        "_GTF evaluation failed (AE 0x%x)\n",
                                        status);
-                        rc = -EIO;
                 }
                 goto out_free;
         }
@@ -359,7 +358,6 @@ static int ata_dev_get_GTF(struct ata_device *dev, struct ata_acpi_gtf **gtf,
                 ata_dev_printk(dev, KERN_WARNING,
                                "_GTF unexpected object type 0x%x\n",
                                out_obj->type);
-                rc = -EINVAL;
                 goto out_free;
         }
 
@@ -367,7 +365,6 @@ static int ata_dev_get_GTF(struct ata_device *dev, struct ata_acpi_gtf **gtf,
                 ata_dev_printk(dev, KERN_WARNING,
                                "unexpected _GTF length (%d)\n",
                                out_obj->buffer.length);
-                rc = -EINVAL;
                 goto out_free;
         }
 
@@ -511,10 +508,7 @@ static int ata_acpi_exec_tfs(struct ata_device *dev)
         int gtf_count, i, rc;
 
         /* get taskfiles */
-        rc = ata_dev_get_GTF(dev, &gtf, &ptr_to_free);
-        if (rc < 0)
-                return rc;
-        gtf_count = rc;
+        gtf_count = ata_dev_get_GTF(dev, &gtf, &ptr_to_free);
 
         /* execute them */
         for (i = 0, rc = 0; i < gtf_count; i++) {
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index ec3ce120a517..81898036dbca 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -3373,14 +3373,20 @@ void ata_wait_after_reset(struct ata_port *ap, unsigned long deadline)
          * to clear 0xff after reset.  For example, HHD424020F7SV00
          * iVDR needs >= 800ms while.  Quantum GoVault needs even more
          * than that.
+         *
+         * Note that some PATA controllers (pata_ali) explode if
+         * status register is read more than once when there's no
+         * device attached.
          */
-        while (1) {
-                u8 status = ata_chk_status(ap);
+        if (ap->flags & ATA_FLAG_SATA) {
+                while (1) {
+                        u8 status = ata_chk_status(ap);
 
-                if (status != 0xff || time_after(jiffies, deadline))
-                        return;
+                        if (status != 0xff || time_after(jiffies, deadline))
+                                return;
 
-                msleep(50);
+                        msleep(50);
+                }
         }
 }
 
@@ -6821,19 +6827,6 @@ static void ata_host_release(struct device *gendev, void *res)
                 if (!ap)
                         continue;
 
-                if ((host->flags & ATA_HOST_STARTED) && ap->ops->port_stop)
-                        ap->ops->port_stop(ap);
-        }
-
-        if ((host->flags & ATA_HOST_STARTED) && host->ops->host_stop)
-                host->ops->host_stop(host);
-
-        for (i = 0; i < host->n_ports; i++) {
-                struct ata_port *ap = host->ports[i];
-
-                if (!ap)
-                        continue;
-
                 if (ap->scsi_host)
                         scsi_host_put(ap->scsi_host);
 
@@ -6960,6 +6953,24 @@ struct ata_host *ata_host_alloc_pinfo(struct device *dev,
         return host;
 }
 
+static void ata_host_stop(struct device *gendev, void *res)
+{
+        struct ata_host *host = dev_get_drvdata(gendev);
+        int i;
+
+        WARN_ON(!(host->flags & ATA_HOST_STARTED));
+
+        for (i = 0; i < host->n_ports; i++) {
+                struct ata_port *ap = host->ports[i];
+
+                if (ap->ops->port_stop)
+                        ap->ops->port_stop(ap);
+        }
+
+        if (host->ops->host_stop)
+                host->ops->host_stop(host);
+}
+
 /**
  *      ata_host_start - start and freeze ports of an ATA host
  *      @host: ATA host to start ports for
@@ -6978,6 +6989,8 @@ struct ata_host *ata_host_alloc_pinfo(struct device *dev,
  */
 int ata_host_start(struct ata_host *host)
 {
+        int have_stop = 0;
+        void *start_dr = NULL;
         int i, rc;
 
         if (host->flags & ATA_HOST_STARTED)
@@ -6989,6 +7002,22 @@ int ata_host_start(struct ata_host *host)
                 if (!host->ops && !ata_port_is_dummy(ap))
                         host->ops = ap->ops;
 
+                if (ap->ops->port_stop)
+                        have_stop = 1;
+        }
+
+        if (host->ops->host_stop)
+                have_stop = 1;
+
+        if (have_stop) {
+                start_dr = devres_alloc(ata_host_stop, 0, GFP_KERNEL);
+                if (!start_dr)
+                        return -ENOMEM;
+        }
+
+        for (i = 0; i < host->n_ports; i++) {
+                struct ata_port *ap = host->ports[i];
+
                 if (ap->ops->port_start) {
                         rc = ap->ops->port_start(ap);
                         if (rc) {
@@ -7001,6 +7030,8 @@ int ata_host_start(struct ata_host *host)
                 ata_eh_freeze_port(ap);
         }
 
+        if (start_dr)
+                devres_add(host->dev, start_dr);
         host->flags |= ATA_HOST_STARTED;
         return 0;
 
@@ -7011,6 +7042,7 @@ int ata_host_start(struct ata_host *host)
                 if (ap->ops->port_stop)
                         ap->ops->port_stop(ap);
         }
+        devres_free(start_dr);
         return rc;
 }
 
@@ -7178,6 +7210,10 @@ int ata_host_register(struct ata_host *host, struct scsi_host_template *sht)
  *      request IRQ and register it.  This helper takes necessasry
  *      arguments and performs the three steps in one go.
  *
+ *      An invalid IRQ skips the IRQ registration and expects the host to
+ *      have set polling mode on the port. In this case, @irq_handler
+ *      should be NULL.
+ *
  *      LOCKING:
  *      Inherited from calling layer (may sleep).
  *
@@ -7194,6 +7230,12 @@ int ata_host_activate(struct ata_host *host, int irq,
         if (rc)
                 return rc;
 
+        /* Special case for polling mode */
+        if (!irq) {
+                WARN_ON(irq_handler);
+                return ata_host_register(host, sht);
+        }
+
         rc = devm_request_irq(host->dev, irq, irq_handler, irq_flags,
                               dev_driver_string(host->dev), host);
         if (rc)
diff --git a/drivers/ata/pata_platform.c b/drivers/ata/pata_platform.c
index fc72a965643d..ac03a90a6168 100644
--- a/drivers/ata/pata_platform.c
+++ b/drivers/ata/pata_platform.c
@@ -1,7 +1,7 @@
 /*
  * Generic platform device PATA driver
  *
- * Copyright (C) 2006  Paul Mundt
+ * Copyright (C) 2006 - 2007  Paul Mundt
  *
  * Based on pata_pcmcia:
  *
@@ -22,7 +22,7 @@
 #include <linux/pata_platform.h>
 
 #define DRV_NAME "pata_platform"
-#define DRV_VERSION "1.1"
+#define DRV_VERSION "1.2"
 
 static int pio_mask = 1;
 
@@ -120,15 +120,20 @@ static void pata_platform_setup_port(struct ata_ioports *ioaddr,
  *      Register a platform bus IDE interface. Such interfaces are PIO and we
  *      assume do not support IRQ sharing.
  *
- *      Platform devices are expected to contain 3 resources per port:
+ *      Platform devices are expected to contain at least 2 resources per port:
  *
  *              - I/O Base (IORESOURCE_IO or IORESOURCE_MEM)
  *              - CTL Base (IORESOURCE_IO or IORESOURCE_MEM)
+ *
+ *      and optionally:
+ *
  *              - IRQ      (IORESOURCE_IRQ)
  *
  *      If the base resources are both mem types, the ioremap() is handled
  *      here. For IORESOURCE_IO, it's assumed that there's no remapping
  *      necessary.
+ *
+ *      If no IRQ resource is present, PIO polling mode is used instead.
  */
 static int __devinit pata_platform_probe(struct platform_device *pdev)
 {
@@ -137,11 +142,12 @@ static int __devinit pata_platform_probe(struct platform_device *pdev)
         struct ata_port *ap;
         struct pata_platform_info *pp_info;
         unsigned int mmio;
+        int irq;
 
         /*
          * Simple resource validation ..
          */
-        if (unlikely(pdev->num_resources != 3)) {
+        if ((pdev->num_resources != 3) && (pdev->num_resources != 2)) {
                 dev_err(&pdev->dev, "invalid number of resources\n");
                 return -EINVAL;
         }
@@ -173,6 +179,13 @@ static int __devinit pata_platform_probe(struct platform_device *pdev)
                 (ctl_res->flags == IORESOURCE_MEM));
 
         /*
+         * And the IRQ
+         */
+        irq = platform_get_irq(pdev, 0);
+        if (irq < 0)
+                irq = 0;        /* no irq */
+
+        /*
          * Now that that's out of the way, wire up the port..
          */
         host = ata_host_alloc(&pdev->dev, 1);
@@ -185,6 +198,14 @@ static int __devinit pata_platform_probe(struct platform_device *pdev)
         ap->flags |= ATA_FLAG_SLAVE_POSS;
 
         /*
+         * Use polling mode if there's no IRQ
+         */
+        if (!irq) {
+                ap->flags |= ATA_FLAG_PIO_POLLING;
+                ata_port_desc(ap, "no IRQ, using PIO polling");
+        }
+
+        /*
          * Handle the MMIO case
          */
         if (mmio) {
@@ -213,9 +234,9 @@ static int __devinit pata_platform_probe(struct platform_device *pdev)
                       (unsigned long long)ctl_res->start);
 
         /* activate */
-        return ata_host_activate(host, platform_get_irq(pdev, 0),
-                                 ata_interrupt, pp_info ? pp_info->irq_flags
-                                 : 0, &pata_platform_sht);
+        return ata_host_activate(host, irq, irq ? ata_interrupt : NULL,
+                                 pp_info ? pp_info->irq_flags : 0,
+                                 &pata_platform_sht);
 }
 
 /**
diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
index 35b2df297527..44f9e5d9e362 100644
--- a/drivers/ata/sata_nv.c
+++ b/drivers/ata/sata_nv.c
@@ -1629,7 +1629,7 @@ static int nv_hardreset(struct ata_link *link, unsigned int *class,
 
         /* SATA hardreset fails to retrieve proper device signature on
          * some controllers.  Don't classify on hardreset.  For more
-         * info, see http://bugme.osdl.org/show_bug.cgi?id=3352
+         * info, see http://bugzilla.kernel.org/show_bug.cgi?id=3352
          */
         return sata_std_hardreset(link, &dummy, deadline);
 }
diff --git a/drivers/ata/sata_qstor.c b/drivers/ata/sata_qstor.c
index 6d43ba79e154..2f1de6ec044c 100644
--- a/drivers/ata/sata_qstor.c
+++ b/drivers/ata/sata_qstor.c
@@ -103,7 +103,7 @@ enum {
         QS_DMA_BOUNDARY         = ~0UL
 };
 
-typedef enum { qs_state_idle, qs_state_pkt, qs_state_mmio } qs_state_t;
+typedef enum { qs_state_mmio, qs_state_pkt } qs_state_t;
 
 struct qs_port_priv {
         u8                      *pkt;
@@ -116,14 +116,15 @@ static int qs_scr_write(struct ata_port *ap, unsigned int sc_reg, u32 val);
 static int qs_ata_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
 static int qs_port_start(struct ata_port *ap);
 static void qs_host_stop(struct ata_host *host);
-static void qs_phy_reset(struct ata_port *ap);
 static void qs_qc_prep(struct ata_queued_cmd *qc);
 static unsigned int qs_qc_issue(struct ata_queued_cmd *qc);
 static int qs_check_atapi_dma(struct ata_queued_cmd *qc);
 static void qs_bmdma_stop(struct ata_queued_cmd *qc);
 static u8 qs_bmdma_status(struct ata_port *ap);
 static void qs_irq_clear(struct ata_port *ap);
-static void qs_eng_timeout(struct ata_port *ap);
+static void qs_freeze(struct ata_port *ap);
+static void qs_thaw(struct ata_port *ap);
+static void qs_error_handler(struct ata_port *ap);
 
 static struct scsi_host_template qs_ata_sht = {
         .module                 = THIS_MODULE,
@@ -150,11 +151,12 @@ static const struct ata_port_operations qs_ata_ops = {
         .check_atapi_dma        = qs_check_atapi_dma,
         .exec_command           = ata_exec_command,
         .dev_select             = ata_std_dev_select,
-        .phy_reset              = qs_phy_reset,
         .qc_prep                = qs_qc_prep,
         .qc_issue               = qs_qc_issue,
         .data_xfer              = ata_data_xfer,
-        .eng_timeout            = qs_eng_timeout,
+        .freeze                 = qs_freeze,
+        .thaw                   = qs_thaw,
+        .error_handler          = qs_error_handler,
         .irq_clear              = qs_irq_clear,
         .irq_on                 = ata_irq_on,
         .scr_read               = qs_scr_read,
@@ -169,8 +171,6 @@ static const struct ata_port_info qs_port_info[] = {
         /* board_2068_idx */
         {
                 .flags          = ATA_FLAG_SATA | ATA_FLAG_NO_LEGACY |
-                                  ATA_FLAG_SATA_RESET |
-                                  //FIXME ATA_FLAG_SRST |
                                   ATA_FLAG_MMIO | ATA_FLAG_PIO_POLLING,
                 .pio_mask       = 0x10, /* pio4 */
                 .udma_mask      = ATA_UDMA6,
@@ -219,7 +219,9 @@ static void qs_irq_clear(struct ata_port *ap)
 static inline void qs_enter_reg_mode(struct ata_port *ap)
 {
         u8 __iomem *chan = qs_mmio_base(ap->host) + (ap->port_no * 0x4000);
+        struct qs_port_priv *pp = ap->private_data;
 
+        pp->state = qs_state_mmio;
         writeb(QS_CTR0_REG, chan + QS_CCT_CTR0);
         readb(chan + QS_CCT_CTR0);        /* flush */
 }
@@ -233,23 +235,28 @@ static inline void qs_reset_channel_logic(struct ata_port *ap)
         qs_enter_reg_mode(ap);
 }
 
-static void qs_phy_reset(struct ata_port *ap)
+static void qs_freeze(struct ata_port *ap)
 {
-        struct qs_port_priv *pp = ap->private_data;
+        u8 __iomem *mmio_base = qs_mmio_base(ap->host);
 
-        pp->state = qs_state_idle;
-        qs_reset_channel_logic(ap);
-        sata_phy_reset(ap);
+        writeb(0, mmio_base + QS_HCT_CTRL); /* disable host interrupts */
+        qs_enter_reg_mode(ap);
 }
 
-static void qs_eng_timeout(struct ata_port *ap)
+static void qs_thaw(struct ata_port *ap)
 {
-        struct qs_port_priv *pp = ap->private_data;
+        u8 __iomem *mmio_base = qs_mmio_base(ap->host);
+
+        qs_enter_reg_mode(ap);
+        writeb(1, mmio_base + QS_HCT_CTRL); /* enable host interrupts */
+}
+
+static int qs_prereset(struct ata_link *link, unsigned long deadline)
+{
+        struct ata_port *ap = link->ap;
 
-        if (pp->state != qs_state_idle) /* healthy paranoia */
-                pp->state = qs_state_mmio;
         qs_reset_channel_logic(ap);
-        ata_eng_timeout(ap);
+        return ata_std_prereset(link, deadline);
 }
 
 static int qs_scr_read(struct ata_port *ap, unsigned int sc_reg, u32 *val)
@@ -260,6 +267,13 @@ static int qs_scr_read(struct ata_port *ap, unsigned int sc_reg, u32 *val)
         return 0;
 }
 
+static void qs_error_handler(struct ata_port *ap)
+{
+        qs_enter_reg_mode(ap);
+        ata_do_eh(ap, qs_prereset, ata_std_softreset, NULL,
+                  ata_std_postreset);
+}
+
 static int qs_scr_write(struct ata_port *ap, unsigned int sc_reg, u32 val)
 {
         if (sc_reg > SCR_CONTROL)
@@ -358,7 +372,6 @@ static unsigned int qs_qc_issue(struct ata_queued_cmd *qc)
 
         switch (qc->tf.protocol) {
         case ATA_PROT_DMA:
-
                 pp->state = qs_state_pkt;
                 qs_packet_start(qc);
                 return 0;
@@ -375,6 +388,26 @@ static unsigned int qs_qc_issue(struct ata_queued_cmd *qc)
         return ata_qc_issue_prot(qc);
 }
 
+static void qs_do_or_die(struct ata_queued_cmd *qc, u8 status)
+{
+        qc->err_mask |= ac_err_mask(status);
+
+        if (!qc->err_mask) {
+                ata_qc_complete(qc);
+        } else {
+                struct ata_port    *ap  = qc->ap;
+                struct ata_eh_info *ehi = &ap->link.eh_info;
+
+                ata_ehi_clear_desc(ehi);
+                ata_ehi_push_desc(ehi, "status 0x%02X", status);
+
+                if (qc->err_mask == AC_ERR_DEV)
+                        ata_port_abort(ap);
+                else
+                        ata_port_freeze(ap);
+        }
+}
+
 static inline unsigned int qs_intr_pkt(struct ata_host *host)
 {
         unsigned int handled = 0;
@@ -406,10 +439,8 @@ static inline unsigned int qs_intr_pkt(struct ata_host *host)
                                         switch (sHST) {
                                         case 0: /* successful CPB */
                                         case 3: /* device error */
-                                                pp->state = qs_state_idle;
                                                 qs_enter_reg_mode(qc->ap);
-                                                qc->err_mask |= ac_err_mask(sDST);
-                                                ata_qc_complete(qc);
+                                                qs_do_or_die(qc, sDST);
                                                 break;
                                         default:
                                                 break;
@@ -431,25 +462,27 @@ static inline unsigned int qs_intr_mmio(struct ata_host *host)
                 if (ap &&
                     !(ap->flags & ATA_FLAG_DISABLED)) {
                         struct ata_queued_cmd *qc;
-                        struct qs_port_priv *pp = ap->private_data;
-                        if (!pp || pp->state != qs_state_mmio)
-                                continue;
+                        struct qs_port_priv *pp;
                         qc = ata_qc_from_tag(ap, ap->link.active_tag);
-                        if (qc && (!(qc->tf.flags & ATA_TFLAG_POLLING))) {
-
-                                /* check main status, clearing INTRQ */
-                                u8 status = ata_check_status(ap);
-                                if ((status & ATA_BUSY))
-                                        continue;
-                                DPRINTK("ata%u: protocol %d (dev_stat 0x%X)\n",
-                                        ap->print_id, qc->tf.protocol, status);
-
-                                /* complete taskfile transaction */
-                                pp->state = qs_state_idle;
-                                qc->err_mask |= ac_err_mask(status);
-                                ata_qc_complete(qc);
+                        if (!qc || !(qc->flags & ATA_QCFLAG_ACTIVE)) {
+                                /*
+                                 * The qstor hardware generates spurious
+                                 * interrupts from time to time when switching
+                                 * in and out of packet mode.
+                                 * There's no obvious way to know if we're
+                                 * here now due to that, so just ack the irq
+                                 * and pretend we knew it was ours.. (ugh).
+                                 * This does not affect packet mode.
+                                 */
+                                ata_check_status(ap);
                                 handled = 1;
+                                continue;
                         }
+                        pp = ap->private_data;
+                        if (!pp || pp->state != qs_state_mmio)
+                                continue;
+                        if (!(qc->tf.flags & ATA_TFLAG_POLLING))
+                                handled |= ata_host_intr(ap, qc);
                 }
         }
         return handled;
@@ -459,12 +492,13 @@ static irqreturn_t qs_intr(int irq, void *dev_instance)
 {
         struct ata_host *host = dev_instance;
         unsigned int handled = 0;
+        unsigned long flags;
 
         VPRINTK("ENTER\n");
 
-        spin_lock(&host->lock);
+        spin_lock_irqsave(&host->lock, flags);
         handled  = qs_intr_pkt(host) | qs_intr_mmio(host);
-        spin_unlock(&host->lock);
+        spin_unlock_irqrestore(&host->lock, flags);
 
         VPRINTK("EXIT\n");
 
@@ -501,7 +535,6 @@ static int qs_port_start(struct ata_port *ap)
         rc = ata_port_start(ap);
         if (rc)
                 return rc;
-        qs_enter_reg_mode(ap);
         pp = devm_kzalloc(dev, sizeof(*pp), GFP_KERNEL);
         if (!pp)
                 return -ENOMEM;
@@ -512,6 +545,7 @@ static int qs_port_start(struct ata_port *ap)
         memset(pp->pkt, 0, QS_PKT_BYTES);
         ap->private_data = pp;
 
+        qs_enter_reg_mode(ap);
         addr = (u64)pp->pkt_dma;
         writel((u32) addr,        chan + QS_CCF_CPBA);
         writel((u32)(addr >> 32), chan + QS_CCF_CPBA + 4);
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index a8130a4ad6d4..a5ee21319d37 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -358,10 +358,19 @@ static ssize_t class_pktcdvd_store_add(struct class *c, const char *buf,
                                         size_t count)
 {
         unsigned int major, minor;
+
         if (sscanf(buf, "%u:%u", &major, &minor) == 2) {
+                /* pkt_setup_dev() expects caller to hold reference to self */
+                if (!try_module_get(THIS_MODULE))
+                        return -ENODEV;
+
                 pkt_setup_dev(MKDEV(major, minor), NULL);
+
+                module_put(THIS_MODULE);
+
                 return count;
         }
+
         return -EINVAL;
 }
 
diff --git a/drivers/char/tty_ioctl.c b/drivers/char/tty_ioctl.c
index 7a003504c265..1bdd2bf4f37d 100644
--- a/drivers/char/tty_ioctl.c
+++ b/drivers/char/tty_ioctl.c
@@ -730,13 +730,23 @@ static int send_prio_char(struct tty_struct *tty, char ch)
         return 0;
 }
 
-int n_tty_ioctl(struct tty_struct * tty, struct file * file,
-                       unsigned int cmd, unsigned long arg)
+/**
+ *      tty_mode_ioctl          -       mode related ioctls
+ *      @tty: tty for the ioctl
+ *      @file: file pointer for the tty
+ *      @cmd: command
+ *      @arg: ioctl argument
+ *
+ *      Perform non line discipline specific mode control ioctls. This
+ *      is designed to be called by line disciplines to ensure they provide
+ *      consistent mode setting.
+ */
+
+int tty_mode_ioctl(struct tty_struct * tty, struct file *file,
+                        unsigned int cmd, unsigned long arg)
 {
         struct tty_struct * real_tty;
         void __user *p = (void __user *)arg;
-        int retval;
-        struct tty_ldisc *ld;
 
         if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
             tty->driver->subtype == PTY_TYPE_MASTER)
@@ -799,6 +809,93 @@ int n_tty_ioctl(struct tty_struct * tty, struct file * file,
                         return set_termios(real_tty, p, TERMIOS_WAIT | TERMIOS_TERMIO);
                 case TCSETA:
                         return set_termios(real_tty, p, TERMIOS_TERMIO);
+#ifndef TCGETS2
+                case TIOCGLCKTRMIOS:
+                        if (kernel_termios_to_user_termios((struct termios __user *)arg, real_tty->termios_locked))
+                                return -EFAULT;
+                        return 0;
+
+                case TIOCSLCKTRMIOS:
+                        if (!capable(CAP_SYS_ADMIN))
+                                return -EPERM;
+                        if (user_termios_to_kernel_termios(real_tty->termios_locked, (struct termios __user *) arg))
+                                return -EFAULT;
+                        return 0;
+#else
+                case TIOCGLCKTRMIOS:
+                        if (kernel_termios_to_user_termios_1((struct termios __user *)arg, real_tty->termios_locked))
+                                return -EFAULT;
+                        return 0;
+
+                case TIOCSLCKTRMIOS:
+                        if (!capable(CAP_SYS_ADMIN))
+                                return -EPERM;
+                        if (user_termios_to_kernel_termios_1(real_tty->termios_locked, (struct termios __user *) arg))
+                                return -EFAULT;
+                        return 0;
+#endif
+                case TIOCGSOFTCAR:
+                        return put_user(C_CLOCAL(tty) ? 1 : 0, (int __user *)arg);
+                case TIOCSSOFTCAR:
+                        if (get_user(arg, (unsigned int __user *) arg))
+                                return -EFAULT;
+                        mutex_lock(&tty->termios_mutex);
+                        tty->termios->c_cflag =
+                                ((tty->termios->c_cflag & ~CLOCAL) |
+                                 (arg ? CLOCAL : 0));
+                        mutex_unlock(&tty->termios_mutex);
+                        return 0;
+                default:
+                        return -ENOIOCTLCMD;
+        }
+}
+
+EXPORT_SYMBOL_GPL(tty_mode_ioctl);
+
+int tty_perform_flush(struct tty_struct *tty, unsigned long arg)
+{
+        struct tty_ldisc *ld;
+        int retval = tty_check_change(tty);
+        if (retval)
+                return retval;
+
+        ld = tty_ldisc_ref(tty);
+        switch (arg) {
+        case TCIFLUSH:
+                if (ld && ld->flush_buffer)
+                        ld->flush_buffer(tty);
+                break;
+        case TCIOFLUSH:
+                if (ld && ld->flush_buffer)
+                        ld->flush_buffer(tty);
+                /* fall through */
+        case TCOFLUSH:
+                if (tty->driver->flush_buffer)
+                        tty->driver->flush_buffer(tty);
+                break;
+        default:
+                tty_ldisc_deref(ld);
+                return -EINVAL;
+        }
+        tty_ldisc_deref(ld);
+        return 0;
+}
+
+EXPORT_SYMBOL_GPL(tty_perform_flush);
+
+int n_tty_ioctl(struct tty_struct * tty, struct file * file,
+                       unsigned int cmd, unsigned long arg)
+{
+        struct tty_struct * real_tty;
+        int retval;
+
+        if (tty->driver->type == TTY_DRIVER_TYPE_PTY &&
+            tty->driver->subtype == PTY_TYPE_MASTER)
+                real_tty = tty->link;
+        else
+                real_tty = tty;
+
+        switch (cmd) {
                 case TCXONC:
                         retval = tty_check_change(tty);
                         if (retval)
@@ -829,30 +926,7 @@ int n_tty_ioctl(struct tty_struct * tty, struct file * file,
                         }
                         return 0;
                 case TCFLSH:
-                        retval = tty_check_change(tty);
-                        if (retval)
-                                return retval;
-                                
-                        ld = tty_ldisc_ref(tty);
-                        switch (arg) {
-                        case TCIFLUSH:
-                                if (ld && ld->flush_buffer)
-                                        ld->flush_buffer(tty);
-                                break;
-                        case TCIOFLUSH:
-                                if (ld && ld->flush_buffer)
-                                        ld->flush_buffer(tty);
-                                /* fall through */
-                        case TCOFLUSH:
-                                if (tty->driver->flush_buffer)
-                                        tty->driver->flush_buffer(tty);
-                                break;
-                        default:
-                                tty_ldisc_deref(ld);
-                                return -EINVAL;
-                        }
-                        tty_ldisc_deref(ld);
-                        return 0;
+                        return tty_perform_flush(tty, arg);
                 case TIOCOUTQ:
                         return put_user(tty->driver->chars_in_buffer ?
                                         tty->driver->chars_in_buffer(tty) : 0,
@@ -862,32 +936,6 @@ int n_tty_ioctl(struct tty_struct * tty, struct file * file,
                         if (L_ICANON(tty))
                                 retval = inq_canon(tty);
                         return put_user(retval, (unsigned int __user *) arg);
-#ifndef TCGETS2
-                case TIOCGLCKTRMIOS:
-                        if (kernel_termios_to_user_termios((struct termios __user *)arg, real_tty->termios_locked))
-                                return -EFAULT;
-                        return 0;
-
-                case TIOCSLCKTRMIOS:
-                        if (!capable(CAP_SYS_ADMIN))
-                                return -EPERM;
-                        if (user_termios_to_kernel_termios(real_tty->termios_locked, (struct termios __user *) arg))
-                                return -EFAULT;
-                        return 0;
-#else
-                case TIOCGLCKTRMIOS:
-                        if (kernel_termios_to_user_termios_1((struct termios __user *)arg, real_tty->termios_locked))
-                                return -EFAULT;
-                        return 0;
-
-                case TIOCSLCKTRMIOS:
-                        if (!capable(CAP_SYS_ADMIN))
-                                return -EPERM;
-                        if (user_termios_to_kernel_termios_1(real_tty->termios_locked, (struct termios __user *) arg))
-                                return -EFAULT;
-                        return 0;
-#endif
-
                 case TIOCPKT:
                 {
                         int pktmode;
@@ -906,19 +954,9 @@ int n_tty_ioctl(struct tty_struct * tty, struct file * file,
                                 tty->packet = 0;
                         return 0;
                 }
-                case TIOCGSOFTCAR:
-                        return put_user(C_CLOCAL(tty) ? 1 : 0, (int __user *)arg);
-                case TIOCSSOFTCAR:
-                        if (get_user(arg, (unsigned int __user *) arg))
-                                return -EFAULT;
-                        mutex_lock(&tty->termios_mutex);
-                        tty->termios->c_cflag =
-                                ((tty->termios->c_cflag & ~CLOCAL) |
-                                 (arg ? CLOCAL : 0));
-                        mutex_unlock(&tty->termios_mutex);
-                        return 0;
                 default:
-                        return -ENOIOCTLCMD;
+                        /* Try the mode commands */
+                        return tty_mode_ioctl(tty, file, cmd, arg);
                 }
 }
 
diff --git a/drivers/firewire/fw-sbp2.c b/drivers/firewire/fw-sbp2.c
index 5596df65c8ed..624ff3e082f6 100644
--- a/drivers/firewire/fw-sbp2.c
+++ b/drivers/firewire/fw-sbp2.c
@@ -650,13 +650,14 @@ static void sbp2_login(struct work_struct *work)
         if (sbp2_send_management_orb(lu, node_id, generation,
                                 SBP2_LOGIN_REQUEST, lu->lun, &response) < 0) {
                 if (lu->retries++ < 5) {
-                        queue_delayed_work(sbp2_wq, &lu->work,
-                                           DIV_ROUND_UP(HZ, 5));
+                        if (queue_delayed_work(sbp2_wq, &lu->work,
+                                               DIV_ROUND_UP(HZ, 5)))
+                                kref_get(&lu->tgt->kref);
                 } else {
                         fw_error("failed to login to %s LUN %04x\n",
                                  unit->device.bus_id, lu->lun);
-                        kref_put(&lu->tgt->kref, sbp2_release_target);
                 }
+                kref_put(&lu->tgt->kref, sbp2_release_target);
                 return;
         }
 
@@ -914,7 +915,9 @@ static void sbp2_reconnect(struct work_struct *work)
                         lu->retries = 0;
                         PREPARE_DELAYED_WORK(&lu->work, sbp2_login);
                 }
-                queue_delayed_work(sbp2_wq, &lu->work, DIV_ROUND_UP(HZ, 5));
+                if (queue_delayed_work(sbp2_wq, &lu->work, DIV_ROUND_UP(HZ, 5)))
+                        kref_get(&lu->tgt->kref);
+                kref_put(&lu->tgt->kref, sbp2_release_target);
                 return;
         }
 
diff --git a/drivers/lguest/lguest_device.c b/drivers/lguest/lguest_device.c
index 8904f72f97c6..66f38722253a 100644
--- a/drivers/lguest/lguest_device.c
+++ b/drivers/lguest/lguest_device.c
@@ -200,7 +200,8 @@ static struct virtqueue *lg_find_vq(struct virtio_device *vdev,
 
         /* Figure out how many pages the ring will take, and map that memory */
         lvq->pages = lguest_map((unsigned long)lvq->config.pfn << PAGE_SHIFT,
-                                DIV_ROUND_UP(vring_size(lvq->config.num),
+                                DIV_ROUND_UP(vring_size(lvq->config.num,
+                                                        PAGE_SIZE),
                                              PAGE_SIZE));
         if (!lvq->pages) {
                 err = -ENOMEM;
diff --git a/drivers/macintosh/windfarm_core.c b/drivers/macintosh/windfarm_core.c
index 516d943227e2..075b4d99e354 100644
--- a/drivers/macintosh/windfarm_core.c
+++ b/drivers/macintosh/windfarm_core.c
@@ -94,7 +94,9 @@ static int wf_thread_func(void *data)
         DBG("wf: thread started\n");
 
         set_freezable();
-        while(!kthread_should_stop()) {
+        while (!kthread_should_stop()) {
+                try_to_freeze();
+
                 if (time_after_eq(jiffies, next)) {
                         wf_notify(WF_EVENT_TICK, NULL);
                         if (wf_overtemp) {
@@ -116,12 +118,6 @@ static int wf_thread_func(void *data)
                 delay = next - jiffies;
                 if (delay <= HZ)
                         schedule_timeout_interruptible(delay);
-
-                /* there should be no non-suspend signal, but oh well */
-                if (signal_pending(current) && !try_to_freeze()) {
-                        printk(KERN_WARNING "windfarm: thread got sigl !\n");
-                        break;
-                }
         }
 
         DBG("wf: thread stopped\n");
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index 7c426d07a555..1b1ef3130e6e 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -1207,8 +1207,7 @@ int bitmap_startwrite(struct bitmap *bitmap, sector_t offset, unsigned long sect
                         prepare_to_wait(&bitmap->overflow_wait, &__wait,
                                         TASK_UNINTERRUPTIBLE);
                         spin_unlock_irq(&bitmap->lock);
-                        bitmap->mddev->queue
-                                ->unplug_fn(bitmap->mddev->queue);
+                        blk_unplug(bitmap->mddev->queue);
                         schedule();
                         finish_wait(&bitmap->overflow_wait, &__wait);
                         continue;
diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 5a7eb650181e..e298d8d11f24 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c
@@ -1000,8 +1000,7 @@ void dm_table_unplug_all(struct dm_table *t)
                 struct dm_dev *dd = list_entry(d, struct dm_dev, list);
                 struct request_queue *q = bdev_get_queue(dd->bdev);
 
-                if (q->unplug_fn)
-                        q->unplug_fn(q);
+                blk_unplug(q);
         }
 }
 
diff --git a/drivers/md/linear.c b/drivers/md/linear.c
index 56a11f6c127b..3dac1cfb8189 100644
--- a/drivers/md/linear.c
+++ b/drivers/md/linear.c
@@ -87,8 +87,7 @@ static void linear_unplug(struct request_queue *q)
 
         for (i=0; i < mddev->raid_disks; i++) {
                 struct request_queue *r_queue = bdev_get_queue(conf->disks[i].rdev->bdev);
-                if (r_queue->unplug_fn)
-                        r_queue->unplug_fn(r_queue);
+                blk_unplug(r_queue);
         }
 }
 
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 808cd9549456..cef9ebd5a046 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -5445,7 +5445,7 @@ void md_do_sync(mddev_t *mddev)
                  * about not overloading the IO subsystem. (things like an
                  * e2fsck being done on the RAID array should execute fast)
                  */
-                mddev->queue->unplug_fn(mddev->queue);
+                blk_unplug(mddev->queue);
                 cond_resched();
 
                 currspeed = ((unsigned long)(io_sectors-mddev->resync_mark_cnt))/2
@@ -5464,7 +5464,7 @@ void md_do_sync(mddev_t *mddev)
          * this also signals 'finished resyncing' to md_stop
          */
  out:
-        mddev->queue->unplug_fn(mddev->queue);
+        blk_unplug(mddev->queue);
 
         wait_event(mddev->recovery_wait, !atomic_read(&mddev->recovery_active));
 
diff --git a/drivers/md/multipath.c b/drivers/md/multipath.c
index b35731cceac6..eb631ebed686 100644
--- a/drivers/md/multipath.c
+++ b/drivers/md/multipath.c
@@ -125,8 +125,7 @@ static void unplug_slaves(mddev_t *mddev)
                         atomic_inc(&rdev->nr_pending);
                         rcu_read_unlock();
 
-                        if (r_queue->unplug_fn)
-                                r_queue->unplug_fn(r_queue);
+                        blk_unplug(r_queue);
 
                         rdev_dec_pending(rdev, mddev);
                         rcu_read_lock();
diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index c111105fc2dc..f8e591708d1f 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c
@@ -35,8 +35,7 @@ static void raid0_unplug(struct request_queue *q)
         for (i=0; i<mddev->raid_disks; i++) {
                 struct request_queue *r_queue = bdev_get_queue(devlist[i]->bdev);
 
-                if (r_queue->unplug_fn)
-                        r_queue->unplug_fn(r_queue);
+                blk_unplug(r_queue);
         }
 }
 
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 85478d6a9c1a..4a69c416e045 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -549,8 +549,7 @@ static void unplug_slaves(mddev_t *mddev)
                         atomic_inc(&rdev->nr_pending);
                         rcu_read_unlock();
 
-                        if (r_queue->unplug_fn)
-                                r_queue->unplug_fn(r_queue);
+                        blk_unplug(r_queue);
 
                         rdev_dec_pending(rdev, mddev);
                         rcu_read_lock();
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index fc6607acb6e4..5cdcc9386200 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -593,8 +593,7 @@ static void unplug_slaves(mddev_t *mddev)
                         atomic_inc(&rdev->nr_pending);
                         rcu_read_unlock();
 
-                        if (r_queue->unplug_fn)
-                                r_queue->unplug_fn(r_queue);
+                        blk_unplug(r_queue);
 
                         rdev_dec_pending(rdev, mddev);
                         rcu_read_lock();
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index 82af3465a900..1cfc984cc7b7 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -3186,8 +3186,7 @@ static void unplug_slaves(mddev_t *mddev)
                         atomic_inc(&rdev->nr_pending);
                         rcu_read_unlock();
 
-                        if (r_queue->unplug_fn)
-                                r_queue->unplug_fn(r_queue);
+                        blk_unplug(r_queue);
 
                         rdev_dec_pending(rdev, mddev);
                         rcu_read_lock();
diff --git a/drivers/mmc/card/queue.c b/drivers/mmc/card/queue.c
index 9203a0b221b3..1b9c9b6da5b7 100644
--- a/drivers/mmc/card/queue.c
+++ b/drivers/mmc/card/queue.c
@@ -310,7 +310,7 @@ static void copy_sg(struct scatterlist *dst, unsigned int dst_len,
                 }
 
                 if (src_size == 0) {
-                        src_buf = sg_virt(dst);
+                        src_buf = sg_virt(src);
                         src_size = src->length;
                 }
 
diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
index 6b80bf77a4ef..ff59d2e0475b 100644
--- a/drivers/mmc/host/sdhci.c
+++ b/drivers/mmc/host/sdhci.c
@@ -1301,7 +1301,7 @@ static int __devinit sdhci_probe_slot(struct pci_dev *pdev, int slot)
 
         if ((chip->quirks & SDHCI_QUIRK_BROKEN_DMA) &&
                 (host->flags & SDHCI_USE_DMA)) {
-                DBG("Disabling DMA as it is marked broken");
+                DBG("Disabling DMA as it is marked broken\n");
                 host->flags &= ~SDHCI_USE_DMA;
         }
 
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index 5f800a6dd978..bf8890ebbc4c 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -136,10 +136,11 @@ config TUN
           If you don't know what to use this for, you don't need it.
 
 config VETH
-        tristate "Virtual ethernet device"
+        tristate "Virtual ethernet pair device"
         ---help---
-          The device is an ethernet tunnel. Devices are created in pairs. When
-          one end receives the packet it appears on its pair and vice versa.
+          This device is a local ethernet tunnel. Devices are created in pairs.
+          When one end receives the packet it appears on its pair and vice
+          versa.
 
 config NET_SB1000
         tristate "General Instruments Surfboard 1000"
@@ -234,7 +235,7 @@ source "drivers/net/arm/Kconfig"
 
 config AX88796
         tristate "ASIX AX88796 NE2000 clone support"
-        depends on ARM || MIPS
+        depends on ARM || MIPS || SUPERH
         select CRC32
         select MII
         help
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 6937ef0e7275..a198404a3e36 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -4405,6 +4405,7 @@ static int bond_init(struct net_device *bond_dev, struct bond_params *params)
         bond_dev->set_multicast_list = bond_set_multicast_list;
         bond_dev->change_mtu = bond_change_mtu;
         bond_dev->set_mac_address = bond_set_mac_address;
+        bond_dev->validate_addr = NULL;
 
         bond_set_mode_ops(bond, bond->params.mode);
 
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index 7a06ade85b02..b29330d8e309 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -1193,8 +1193,6 @@ static ssize_t bonding_show_active_slave(struct device *d,
         struct bonding *bond = to_bond(d);
         int count;
 
-        rtnl_lock();
-
         read_lock(&bond->curr_slave_lock);
         curr = bond->curr_active_slave;
         read_unlock(&bond->curr_slave_lock);
@@ -1216,7 +1214,9 @@ static ssize_t bonding_store_active_slave(struct device *d,
         struct slave *new_active = NULL;
         struct bonding *bond = to_bond(d);
 
+        rtnl_lock();
         write_lock_bh(&bond->lock);
+
         if (!USES_PRIMARY(bond->params.mode)) {
                 printk(KERN_INFO DRV_NAME
                        ": %s: Unable to change active slave; %s is in mode %d\n",
diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
index e0119f6a3319..580cb4ab2af1 100644
--- a/drivers/net/hamradio/6pack.c
+++ b/drivers/net/hamradio/6pack.c
@@ -762,26 +762,20 @@ static int sixpack_ioctl(struct tty_struct *tty, struct file *file,
 
                 if (copy_from_user(&addr,
                                    (void __user *) arg, AX25_ADDR_LEN)) {
-                        err = -EFAULT;
-                        break;
-                }
+                                err = -EFAULT;
+                                break;
+                        }
 
-                netif_tx_lock_bh(dev);
-                memcpy(dev->dev_addr, &addr, AX25_ADDR_LEN);
-                netif_tx_unlock_bh(dev);
+                        netif_tx_lock_bh(dev);
+                        memcpy(dev->dev_addr, &addr, AX25_ADDR_LEN);
+                        netif_tx_unlock_bh(dev);
 
-                err = 0;
-                break;
-        }
-
-        /* Allow stty to read, but not set, the serial port */
-        case TCGETS:
-        case TCGETA:
-                err = n_tty_ioctl(tty, (struct file *) file, cmd, arg);
-                break;
+                        err = 0;
+                        break;
+                }
 
         default:
-                err = -ENOIOCTLCMD;
+                err = tty_mode_ioctl(tty, file, cmd, arg);
         }
 
         sp_put(sp);
diff --git a/drivers/net/irda/irtty-sir.c b/drivers/net/irda/irtty-sir.c
index 2c6f7be36e8a..fc753d7f674e 100644
--- a/drivers/net/irda/irtty-sir.c
+++ b/drivers/net/irda/irtty-sir.c
@@ -434,11 +434,6 @@ static int irtty_ioctl(struct tty_struct *tty, struct file *file, unsigned int c
         IRDA_ASSERT(dev != NULL, return -1;);
 
         switch (cmd) {
-        case TCGETS:
-        case TCGETA:
-                err = n_tty_ioctl(tty, file, cmd, arg);
-                break;
-
         case IRTTY_IOCTDONGLE:
                 /* this call blocks for completion */
                 err = sirdev_set_dongle(dev, (IRDA_DONGLE) arg);
@@ -454,7 +449,7 @@ static int irtty_ioctl(struct tty_struct *tty, struct file *file, unsigned int c
                         err = -EFAULT;
                 break;
         default:
-                err = -ENOIOCTLCMD;
+                err = tty_mode_ioctl(tty, file, cmd, arg);
                 break;
         }
         return err;
diff --git a/drivers/net/pasemi_mac.c b/drivers/net/pasemi_mac.c
index ab4d309a858f..09b4fde8d924 100644
--- a/drivers/net/pasemi_mac.c
+++ b/drivers/net/pasemi_mac.c
@@ -580,6 +580,16 @@ static int pasemi_mac_clean_rx(struct pasemi_mac *mac, int limit)
 
                 len = (macrx & XCT_MACRX_LLEN_M) >> XCT_MACRX_LLEN_S;
 
+                pci_unmap_single(mac->dma_pdev, dma, len, PCI_DMA_FROMDEVICE);
+
+                if (macrx & XCT_MACRX_CRC) {
+                        /* CRC error flagged */
+                        mac->netdev->stats.rx_errors++;
+                        mac->netdev->stats.rx_crc_errors++;
+                        dev_kfree_skb_irq(skb);
+                        goto next;
+                }
+
                 if (len < 256) {
                         struct sk_buff *new_skb;
 
@@ -595,11 +605,10 @@ static int pasemi_mac_clean_rx(struct pasemi_mac *mac, int limit)
                 } else
                         info->skb = NULL;
 
-                pci_unmap_single(mac->dma_pdev, dma, len, PCI_DMA_FROMDEVICE);
-
                 info->dma = 0;
 
-                skb_put(skb, len);
+                /* Don't include CRC */
+                skb_put(skb, len-4);
 
                 if (likely((macrx & XCT_MACRX_HTY_M) == XCT_MACRX_HTY_IPV4_OK)) {
                         skb->ip_summed = CHECKSUM_UNNECESSARY;
@@ -614,6 +623,7 @@ static int pasemi_mac_clean_rx(struct pasemi_mac *mac, int limit)
                 skb->protocol = eth_type_trans(skb, mac->netdev);
                 netif_receive_skb(skb);
 
+next:
                 RX_RING(mac, n) = 0;
                 RX_RING(mac, n+1) = 0;
 
@@ -1126,7 +1136,7 @@ static int pasemi_mac_start_tx(struct sk_buff *skb, struct net_device *dev)
         unsigned long flags;
         int i, nfrags;
 
-        dflags = XCT_MACTX_O | XCT_MACTX_ST | XCT_MACTX_SS | XCT_MACTX_CRC_PAD;
+        dflags = XCT_MACTX_O | XCT_MACTX_ST | XCT_MACTX_CRC_PAD;
 
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
                 const unsigned char *nh = skb_network_header(skb);
diff --git a/drivers/net/ppp_async.c b/drivers/net/ppp_async.c
index 27f5b904f48e..8d278c87ba48 100644
--- a/drivers/net/ppp_async.c
+++ b/drivers/net/ppp_async.c
@@ -309,16 +309,11 @@ ppp_asynctty_ioctl(struct tty_struct *tty, struct file *file,
                 err = 0;
                 break;
 
-        case TCGETS:
-        case TCGETA:
-                err = n_tty_ioctl(tty, file, cmd, arg);
-                break;
-
         case TCFLSH:
                 /* flush our buffers and the serial port's buffer */
                 if (arg == TCIOFLUSH || arg == TCOFLUSH)
                         ppp_async_flush_output(ap);
-                err = n_tty_ioctl(tty, file, cmd, arg);
+                err = tty_perform_flush(tty, arg);
                 break;
 
         case FIONREAD:
@@ -329,7 +324,8 @@ ppp_asynctty_ioctl(struct tty_struct *tty, struct file *file,
                 break;
 
         default:
-                err = -ENOIOCTLCMD;
+                /* Try the various mode ioctls */
+                err = tty_mode_ioctl(tty, file, cmd, arg);
         }
 
         ap_put(ap);
diff --git a/drivers/net/ppp_synctty.c b/drivers/net/ppp_synctty.c
index ce64032a465a..00e2fb48b4ae 100644
--- a/drivers/net/ppp_synctty.c
+++ b/drivers/net/ppp_synctty.c
@@ -349,16 +349,11 @@ ppp_synctty_ioctl(struct tty_struct *tty, struct file *file,
                 err = 0;
                 break;
 
-        case TCGETS:
-        case TCGETA:
-                err = n_tty_ioctl(tty, file, cmd, arg);
-                break;
-
         case TCFLSH:
                 /* flush our buffers and the serial port's buffer */
                 if (arg == TCIOFLUSH || arg == TCOFLUSH)
                         ppp_sync_flush_output(ap);
-                err = n_tty_ioctl(tty, file, cmd, arg);
+                err = tty_perform_flush(tty, arg);
                 break;
 
         case FIONREAD:
@@ -369,7 +364,8 @@ ppp_synctty_ioctl(struct tty_struct *tty, struct file *file,
                 break;
 
         default:
-                err = -ENOIOCTLCMD;
+                err = tty_mode_ioctl(tty, file, cmd, arg);
+                break;
         }
 
         sp_put(ap);
diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c
index f8904fd92369..a7556cd2df79 100644
--- a/drivers/net/pppol2tp.c
+++ b/drivers/net/pppol2tp.c
@@ -488,7 +488,7 @@ static int pppol2tp_recv_core(struct sock *sock, struct sk_buff *skb)
 {
         struct pppol2tp_session *session = NULL;
         struct pppol2tp_tunnel *tunnel;
-        unsigned char *ptr;
+        unsigned char *ptr, *optr;
         u16 hdrflags;
         u16 tunnel_id, session_id;
         int length;
@@ -496,7 +496,7 @@ static int pppol2tp_recv_core(struct sock *sock, struct sk_buff *skb)
 
         tunnel = pppol2tp_sock_to_tunnel(sock);
         if (tunnel == NULL)
-                goto error;
+                goto no_tunnel;
 
         /* UDP always verifies the packet length. */
         __skb_pull(skb, sizeof(struct udphdr));
@@ -509,7 +509,7 @@ static int pppol2tp_recv_core(struct sock *sock, struct sk_buff *skb)
         }
 
         /* Point to L2TP header */
-        ptr = skb->data;
+        optr = ptr = skb->data;
 
         /* Get L2TP header flags */
         hdrflags = ntohs(*(__be16*)ptr);
@@ -637,12 +637,14 @@ static int pppol2tp_recv_core(struct sock *sock, struct sk_buff *skb)
         /* If offset bit set, skip it. */
         if (hdrflags & L2TP_HDRFLAG_O) {
                 offset = ntohs(*(__be16 *)ptr);
-                skb->transport_header += 2 + offset;
-                if (!pskb_may_pull(skb, skb_transport_offset(skb) + 2))
-                        goto discard;
+                ptr += 2 + offset;
         }
 
-        __skb_pull(skb, skb_transport_offset(skb));
+        offset = ptr - optr;
+        if (!pskb_may_pull(skb, offset))
+                goto discard;
+
+        __skb_pull(skb, offset);
 
         /* Skip PPP header, if present.  In testing, Microsoft L2TP clients
          * don't send the PPP header (PPP header compression enabled), but
@@ -652,6 +654,9 @@ static int pppol2tp_recv_core(struct sock *sock, struct sk_buff *skb)
          * Note that skb->data[] isn't dereferenced from a u16 ptr here since
          * the field may be unaligned.
          */
+        if (!pskb_may_pull(skb, 2))
+                goto discard;
+
         if ((skb->data[0] == 0xff) && (skb->data[1] == 0x03))
                 skb_pull(skb, 2);
 
@@ -709,6 +714,10 @@ discard:
         return 0;
 
 error:
+        /* Put UDP header back */
+        __skb_push(skb, sizeof(struct udphdr));
+
+no_tunnel:
         return 1;
 }
 
@@ -1050,6 +1059,8 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
         /* Get routing info from the tunnel socket */
         dst_release(skb->dst);
         skb->dst = sk_dst_get(sk_tun);
+        skb_orphan(skb);
+        skb->sk = sk_tun;
 
         /* Queue the packet to IP for output */
         len = skb->len;
diff --git a/drivers/net/qla3xxx.c b/drivers/net/qla3xxx.c
index 30adf726743c..a5791114b7bd 100644
--- a/drivers/net/qla3xxx.c
+++ b/drivers/net/qla3xxx.c
@@ -1456,16 +1456,11 @@ static void ql_phy_start_neg_ex(struct ql3_adapter *qdev)
                            PHYAddr[qdev->mac_index]);
         reg &= ~PHY_GIG_ALL_PARAMS;
 
-        if(portConfiguration &
-           PORT_CONFIG_FULL_DUPLEX_ENABLED &
-           PORT_CONFIG_1000MB_SPEED) {
-                reg |= PHY_GIG_ADV_1000F;
-        }
-
-        if(portConfiguration &
-           PORT_CONFIG_HALF_DUPLEX_ENABLED &
-           PORT_CONFIG_1000MB_SPEED) {
-                reg |= PHY_GIG_ADV_1000H;
+        if(portConfiguration & PORT_CONFIG_1000MB_SPEED) {
+                if(portConfiguration & PORT_CONFIG_FULL_DUPLEX_ENABLED) 
+                        reg |= PHY_GIG_ADV_1000F;
+                else 
+                        reg |= PHY_GIG_ADV_1000H;
         }
 
         ql_mii_write_reg_ex(qdev, PHY_GIG_CONTROL, reg,
@@ -1645,8 +1640,11 @@ static int ql_finish_auto_neg(struct ql3_adapter *qdev)
         return 0;
 }
 
-static void ql_link_state_machine(struct ql3_adapter *qdev)
+static void ql_link_state_machine_work(struct work_struct *work)
 {
+        struct ql3_adapter *qdev =
+                container_of(work, struct ql3_adapter, link_state_work.work);
+
         u32 curr_link_state;
         unsigned long hw_flags;
 
@@ -1661,6 +1659,10 @@ static void ql_link_state_machine(struct ql3_adapter *qdev)
                                "state.\n", qdev->ndev->name);
 
                 spin_unlock_irqrestore(&qdev->hw_lock, hw_flags);
+
+                /* Restart timer on 2 second interval. */
+                mod_timer(&qdev->adapter_timer, jiffies + HZ * 1);\
+
                 return;
         }
 
@@ -1705,6 +1707,9 @@ static void ql_link_state_machine(struct ql3_adapter *qdev)
                 break;
         }
         spin_unlock_irqrestore(&qdev->hw_lock, hw_flags);
+
+        /* Restart timer on 2 second interval. */
+        mod_timer(&qdev->adapter_timer, jiffies + HZ * 1);
 }
 
 /*
@@ -3941,19 +3946,7 @@ static void ql_get_board_info(struct ql3_adapter *qdev)
 static void ql3xxx_timer(unsigned long ptr)
 {
         struct ql3_adapter *qdev = (struct ql3_adapter *)ptr;
-
-        if (test_bit(QL_RESET_ACTIVE,&qdev->flags)) {
-                printk(KERN_DEBUG PFX
-                       "%s: Reset in progress.\n",
-                       qdev->ndev->name);
-                goto end;
-        }
-
-        ql_link_state_machine(qdev);
-
-        /* Restart timer on 2 second interval. */
-end:
-        mod_timer(&qdev->adapter_timer, jiffies + HZ * 1);
+        queue_delayed_work(qdev->workqueue, &qdev->link_state_work, 0);
 }
 
 static int __devinit ql3xxx_probe(struct pci_dev *pdev,
@@ -4103,6 +4096,7 @@ static int __devinit ql3xxx_probe(struct pci_dev *pdev,
         qdev->workqueue = create_singlethread_workqueue(ndev->name);
         INIT_DELAYED_WORK(&qdev->reset_work, ql_reset_work);
         INIT_DELAYED_WORK(&qdev->tx_timeout_work, ql_tx_timeout_work);
+        INIT_DELAYED_WORK(&qdev->link_state_work, ql_link_state_machine_work);
 
         init_timer(&qdev->adapter_timer);
         qdev->adapter_timer.function = ql3xxx_timer;
diff --git a/drivers/net/qla3xxx.h b/drivers/net/qla3xxx.h
index fbcb0b949639..d0ffb30ef371 100644
--- a/drivers/net/qla3xxx.h
+++ b/drivers/net/qla3xxx.h
@@ -1286,6 +1286,7 @@ struct ql3_adapter {
         struct workqueue_struct *workqueue;
         struct delayed_work reset_work;
         struct delayed_work tx_timeout_work;
+        struct delayed_work link_state_work;
         u32 max_frame_size;
         u32 device_id;
         u16 phyType;
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index b94fa7ef1955..1f647b9ce352 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -171,6 +171,8 @@ static struct pci_device_id rtl8169_pci_tbl[] = {
         { PCI_DEVICE(0x16ec,                    0x0116), 0, 0, RTL_CFG_0 },
         { PCI_VENDOR_ID_LINKSYS,                0x1032,
                 PCI_ANY_ID, 0x0024, 0, 0, RTL_CFG_0 },
+        { 0x0001,                               0x8168,
+                PCI_ANY_ID, 0x2410, 0, 0, RTL_CFG_2 },
         {0,},
 };
 
@@ -468,7 +470,7 @@ static void mdio_write(void __iomem *ioaddr, int reg_addr, int value)
 {
         int i;
 
-        RTL_W32(PHYAR, 0x80000000 | (reg_addr & 0xFF) << 16 | value);
+        RTL_W32(PHYAR, 0x80000000 | (reg_addr & 0x1f) << 16 | (value & 0xffff));
 
         for (i = 20; i > 0; i--) {
                 /*
@@ -485,7 +487,7 @@ static int mdio_read(void __iomem *ioaddr, int reg_addr)
 {
         int i, value = -1;
 
-        RTL_W32(PHYAR, 0x0 | (reg_addr & 0xFF) << 16);
+        RTL_W32(PHYAR, 0x0 | (reg_addr & 0x1f) << 16);
 
         for (i = 20; i > 0; i--) {
                 /*
@@ -493,7 +495,7 @@ static int mdio_read(void __iomem *ioaddr, int reg_addr)
                  * the specified MII register.
                  */
                 if (RTL_R32(PHYAR) & 0x80000000) {
-                        value = (int) (RTL_R32(PHYAR) & 0xFFFF);
+                        value = RTL_R32(PHYAR) & 0xffff;
                         break;
                 }
                 udelay(25);
@@ -1245,16 +1247,6 @@ static void rtl8169sb_hw_phy_config(void __iomem *ioaddr)
 
         rtl_phy_write(ioaddr, phy_reg_init, ARRAY_SIZE(phy_reg_init));
 }
-static void rtl8168b_hw_phy_config(void __iomem *ioaddr)
-{
-        struct phy_reg phy_reg_init[] = {
-                { 0x1f, 0x0000 },
-                { 0x10, 0xf41b },
-                { 0x1f, 0x0000 }
-        };
-
-        rtl_phy_write(ioaddr, phy_reg_init, ARRAY_SIZE(phy_reg_init));
-}
 
 static void rtl8168cp_hw_phy_config(void __iomem *ioaddr)
 {
@@ -1324,11 +1316,6 @@ static void rtl_hw_phy_config(struct net_device *dev)
         case RTL_GIGA_MAC_VER_04:
                 rtl8169sb_hw_phy_config(ioaddr);
                 break;
-        case RTL_GIGA_MAC_VER_11:
-        case RTL_GIGA_MAC_VER_12:
-        case RTL_GIGA_MAC_VER_17:
-                rtl8168b_hw_phy_config(ioaddr);
-                break;
         case RTL_GIGA_MAC_VER_18:
                 rtl8168cp_hw_phy_config(ioaddr);
                 break;
@@ -1739,7 +1726,8 @@ rtl8169_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         tp->features |= rtl_try_msi(pdev, ioaddr, cfg);
         RTL_W8(Cfg9346, Cfg9346_Lock);
 
-        if (RTL_R8(PHYstatus) & TBI_Enable) {
+        if ((tp->mac_version <= RTL_GIGA_MAC_VER_06) &&
+            (RTL_R8(PHYstatus) & TBI_Enable)) {
                 tp->set_speed = rtl8169_set_speed_tbi;
                 tp->get_settings = rtl8169_gset_tbi;
                 tp->phy_reset_enable = rtl8169_tbi_reset_enable;
diff --git a/drivers/net/rrunner.c b/drivers/net/rrunner.c
index b822859c8de3..73a7e6529ee0 100644
--- a/drivers/net/rrunner.c
+++ b/drivers/net/rrunner.c
@@ -78,12 +78,6 @@ static char version[] __devinitdata = "rrunner.c: v0.50 11/11/2002  Jes Sorensen
  * stack will need to know about I/O vectors or something similar.
  */
 
-/*
- * sysctl_[wr]mem_max are checked at init time to see if they are at
- * least 256KB and increased to 256KB if they are not. This is done to
- * avoid ending up with socket buffers smaller than the MTU size,
- */
-
 static int __devinit rr_init_one(struct pci_dev *pdev,
         const struct pci_device_id *ent)
 {
@@ -561,18 +555,6 @@ static int __devinit rr_init(struct net_device *dev)
         sram_size = rr_read_eeprom_word(rrpriv, (void *)8);
         printk("  SRAM size 0x%06x\n", sram_size);
 
-        if (sysctl_rmem_max < 262144){
-                printk("  Receive socket buffer limit too low (%i), "
-                       "setting to 262144\n", sysctl_rmem_max);
-                sysctl_rmem_max = 262144;
-        }
-
-        if (sysctl_wmem_max < 262144){
-                printk("  Transmit socket buffer limit too low (%i), "
-                       "setting to 262144\n", sysctl_wmem_max);
-                sysctl_wmem_max = 262144;
-        }
-
         return 0;
 }
 
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index c27c7d63b6a5..a2070db725c9 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -52,7 +52,7 @@
 #include "sky2.h"
 
 #define DRV_NAME                "sky2"
-#define DRV_VERSION             "1.19"
+#define DRV_VERSION             "1.20"
 #define PFX                     DRV_NAME " "
 
 /*
@@ -121,6 +121,7 @@ static const struct pci_device_id sky2_id_table[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4353) }, /* 88E8039 */
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4354) }, /* 88E8040 */
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4356) }, /* 88EC033 */
+        { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4357) }, /* 88E8042 */
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x435A) }, /* 88E8048 */
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4360) }, /* 88E8052 */
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4361) }, /* 88E8050 */
@@ -134,6 +135,7 @@ static const struct pci_device_id sky2_id_table[] = {
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x4369) }, /* 88EC042 */
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x436A) }, /* 88E8058 */
         { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x436B) }, /* 88E8071 */
+        { PCI_DEVICE(PCI_VENDOR_ID_MARVELL, 0x436C) }, /* 88E8072 */
         { 0 }
 };
 
@@ -156,7 +158,7 @@ static const char *yukon2_name[] = {
 
 static void sky2_set_multicast(struct net_device *dev);
 
-/* Access to external PHY */
+/* Access to PHY via serial interconnect */
 static int gm_phy_write(struct sky2_hw *hw, unsigned port, u16 reg, u16 val)
 {
         int i;
@@ -166,13 +168,22 @@ static int gm_phy_write(struct sky2_hw *hw, unsigned port, u16 reg, u16 val)
                     GM_SMI_CT_PHY_AD(PHY_ADDR_MARV) | GM_SMI_CT_REG_AD(reg));
 
         for (i = 0; i < PHY_RETRIES; i++) {
-                if (!(gma_read16(hw, port, GM_SMI_CTRL) & GM_SMI_CT_BUSY))
+                u16 ctrl = gma_read16(hw, port, GM_SMI_CTRL);
+                if (ctrl == 0xffff)
+                        goto io_error;
+
+                if (!(ctrl & GM_SMI_CT_BUSY))
                         return 0;
-                udelay(1);
+
+                udelay(10);
         }
 
-        printk(KERN_WARNING PFX "%s: phy write timeout\n", hw->dev[port]->name);
+        dev_warn(&hw->pdev->dev,"%s: phy write timeout\n", hw->dev[port]->name);
         return -ETIMEDOUT;
+
+io_error:
+        dev_err(&hw->pdev->dev, "%s: phy I/O error\n", hw->dev[port]->name);
+        return -EIO;
 }
 
 static int __gm_phy_read(struct sky2_hw *hw, unsigned port, u16 reg, u16 *val)
@@ -183,23 +194,29 @@ static int __gm_phy_read(struct sky2_hw *hw, unsigned port, u16 reg, u16 *val)
                     | GM_SMI_CT_REG_AD(reg) | GM_SMI_CT_OP_RD);
 
         for (i = 0; i < PHY_RETRIES; i++) {
-                if (gma_read16(hw, port, GM_SMI_CTRL) & GM_SMI_CT_RD_VAL) {
+                u16 ctrl = gma_read16(hw, port, GM_SMI_CTRL);
+                if (ctrl == 0xffff)
+                        goto io_error;
+
+                if (ctrl & GM_SMI_CT_RD_VAL) {
                         *val = gma_read16(hw, port, GM_SMI_DATA);
                         return 0;
                 }
 
-                udelay(1);
+                udelay(10);
         }
 
+        dev_warn(&hw->pdev->dev, "%s: phy read timeout\n", hw->dev[port]->name);
         return -ETIMEDOUT;
+io_error:
+        dev_err(&hw->pdev->dev, "%s: phy I/O error\n", hw->dev[port]->name);
+        return -EIO;
 }
 
-static u16 gm_phy_read(struct sky2_hw *hw, unsigned port, u16 reg)
+static inline u16 gm_phy_read(struct sky2_hw *hw, unsigned port, u16 reg)
 {
         u16 v;
-
-        if (__gm_phy_read(hw, port, reg, &v) != 0)
-                printk(KERN_WARNING PFX "%s: phy read timeout\n", hw->dev[port]->name);
+        __gm_phy_read(hw, port, reg, &v);
         return v;
 }
 
@@ -273,8 +290,6 @@ static void sky2_gmac_reset(struct sky2_hw *hw, unsigned port)
 
         /* disable all GMAC IRQ's */
         sky2_write8(hw, SK_REG(port, GMAC_IRQ_MSK), 0);
-        /* disable PHY IRQs */
-        gm_phy_write(hw, port, PHY_MARV_INT_MASK, 0);
 
         gma_write16(hw, port, GM_MC_ADDR_H1, 0);        /* clear MC hash */
         gma_write16(hw, port, GM_MC_ADDR_H2, 0);
@@ -1805,29 +1820,6 @@ static void sky2_link_up(struct sky2_port *sky2)
         sky2_write8(hw, SK_REG(port, LNK_LED_REG),
                     LINKLED_ON | LINKLED_BLINK_OFF | LINKLED_LINKSYNC_OFF);
 
-        if (hw->flags & SKY2_HW_NEWER_PHY) {
-                u16 pg = gm_phy_read(hw, port, PHY_MARV_EXT_ADR);
-                u16 led = PHY_M_LEDC_LOS_CTRL(1);       /* link active */
-
-                switch(sky2->speed) {
-                case SPEED_10:
-                        led |= PHY_M_LEDC_INIT_CTRL(7);
-                        break;
-
-                case SPEED_100:
-                        led |= PHY_M_LEDC_STA1_CTRL(7);
-                        break;
-
-                case SPEED_1000:
-                        led |= PHY_M_LEDC_STA0_CTRL(7);
-                        break;
-                }
-
-                gm_phy_write(hw, port, PHY_MARV_EXT_ADR, 3);
-                gm_phy_write(hw, port, PHY_MARV_PHY_CTRL, led);
-                gm_phy_write(hw, port, PHY_MARV_EXT_ADR, pg);
-        }
-
         if (netif_msg_link(sky2))
                 printk(KERN_INFO PFX
                        "%s: Link is up at %d Mbps, %s duplex, flow control %s\n",
@@ -2247,20 +2239,26 @@ static int sky2_status_intr(struct sky2_hw *hw, int to_do, u16 idx)
         do {
                 struct sky2_port *sky2;
                 struct sky2_status_le *le  = hw->st_le + hw->st_idx;
-                unsigned port = le->css & CSS_LINK_BIT;
+                unsigned port;
                 struct net_device *dev;
                 struct sk_buff *skb;
                 u32 status;
                 u16 length;
+                u8 opcode = le->opcode;
+
+                if (!(opcode & HW_OWNER))
+                        break;
 
                 hw->st_idx = RING_NEXT(hw->st_idx, STATUS_RING_SIZE);
 
+                port = le->css & CSS_LINK_BIT;
                 dev = hw->dev[port];
                 sky2 = netdev_priv(dev);
                 length = le16_to_cpu(le->length);
                 status = le32_to_cpu(le->status);
 
-                switch (le->opcode & ~HW_OWNER) {
+                le->opcode = 0;
+                switch (opcode & ~HW_OWNER) {
                 case OP_RXSTAT:
                         ++rx[port];
                         skb = sky2_receive(dev, length, status);
@@ -2353,7 +2351,7 @@ static int sky2_status_intr(struct sky2_hw *hw, int to_do, u16 idx)
                 default:
                         if (net_ratelimit())
                                 printk(KERN_WARNING PFX
-                                       "unknown status opcode 0x%x\n", le->opcode);
+                                       "unknown status opcode 0x%x\n", opcode);
                 }
         } while (hw->st_idx != idx);
 
@@ -2439,13 +2437,26 @@ static void sky2_hw_intr(struct sky2_hw *hw)
 
         if (status & Y2_IS_PCI_EXP) {
                 /* PCI-Express uncorrectable Error occurred */
-                int pos = pci_find_aer_capability(hw->pdev);
+                int aer = pci_find_aer_capability(hw->pdev);
                 u32 err;
 
-                pci_read_config_dword(pdev, pos + PCI_ERR_UNCOR_STATUS, &err);
+                if (aer) {
+                        pci_read_config_dword(pdev, aer + PCI_ERR_UNCOR_STATUS,
+                                              &err);
+                        pci_cleanup_aer_uncorrect_error_status(pdev);
+                } else {
+                        /* Either AER not configured, or not working
+                         * because of bad MMCONFIG, so just do recover
+                         * manually.
+                         */
+                        err = sky2_read32(hw, Y2_CFG_AER + PCI_ERR_UNCOR_STATUS);
+                        sky2_write32(hw, Y2_CFG_AER + PCI_ERR_UNCOR_STATUS,
+                                     0xfffffffful);
+                }
+
                 if (net_ratelimit())
                         dev_err(&pdev->dev, "PCI Express error (0x%x)\n", err);
-                pci_cleanup_aer_uncorrect_error_status(pdev);
+
         }
 
         if (status & Y2_HWE_L1_MASK)
@@ -2791,6 +2802,9 @@ static void sky2_reset(struct sky2_hw *hw)
         sky2_write8(hw, B0_CTST, CS_RST_SET);
         sky2_write8(hw, B0_CTST, CS_RST_CLR);
 
+        /* allow writes to PCI config */
+        sky2_write8(hw, B2_TST_CTRL1, TST_CFG_WRITE_ON);
+
         /* clear PCI errors, if any */
         pci_read_config_word(pdev, PCI_STATUS, &status);
         status |= PCI_STATUS_ERROR_BITS;
@@ -2800,9 +2814,18 @@ static void sky2_reset(struct sky2_hw *hw)
 
         cap = pci_find_capability(pdev, PCI_CAP_ID_EXP);
         if (cap) {
-                /* Check for advanced error reporting */
-                pci_cleanup_aer_uncorrect_error_status(pdev);
-                pci_cleanup_aer_correct_error_status(pdev);
+                if (pci_find_aer_capability(pdev)) {
+                        /* Check for advanced error reporting */
+                        pci_cleanup_aer_uncorrect_error_status(pdev);
+                        pci_cleanup_aer_correct_error_status(pdev);
+                } else {
+                        dev_warn(&pdev->dev,
+                                "PCI Express Advanced Error Reporting"
+                                " not configured or MMCONFIG problem?\n");
+
+                        sky2_write32(hw, Y2_CFG_AER + PCI_ERR_UNCOR_STATUS,
+                                     0xfffffffful);
+                }
 
                 /* If error bit is stuck on ignore it */
                 if (sky2_read32(hw, B0_HWE_ISRC) & Y2_IS_PCI_EXP)
@@ -3974,7 +3997,8 @@ static __devinit struct net_device *sky2_init_netdev(struct sky2_hw *hw,
         dev->tx_timeout = sky2_tx_timeout;
         dev->watchdog_timeo = TX_WATCHDOG;
 #ifdef CONFIG_NET_POLL_CONTROLLER
-        dev->poll_controller = sky2_netpoll;
+        if (port == 0)
+                dev->poll_controller = sky2_netpoll;
 #endif
 
         sky2 = netdev_priv(dev);
diff --git a/drivers/net/sky2.h b/drivers/net/sky2.h
index 49ee264064ab..69525fd7908d 100644
--- a/drivers/net/sky2.h
+++ b/drivers/net/sky2.h
@@ -247,7 +247,8 @@ enum csr_regs {
         B3_PA_CTRL      = 0x01f0,
         B3_PA_TEST      = 0x01f2,
 
-        Y2_CFG_SPC      = 0x1c00,
+        Y2_CFG_SPC      = 0x1c00,       /* PCI config space region */
+        Y2_CFG_AER      = 0x1d00,       /* PCI Advanced Error Report region */
 };
 
 /*      B0_CTST                 16 bit  Control/Status register */
diff --git a/drivers/net/slip.c b/drivers/net/slip.c
index 335b7cc80eba..251a3ce376ac 100644
--- a/drivers/net/slip.c
+++ b/drivers/net/slip.c
@@ -1218,14 +1218,8 @@ static int slip_ioctl(struct tty_struct *tty, struct file *file, unsigned int cm
                 return 0;
         /* VSV changes end */
 #endif
-
-        /* Allow stty to read, but not set, the serial port */
-        case TCGETS:
-        case TCGETA:
-                return n_tty_ioctl(tty, file, cmd, arg);
-
         default:
-                return -ENOIOCTLCMD;
+                return tty_mode_ioctl(tty, file, cmd, arg);
         }
 }
 
diff --git a/drivers/net/smc91x.h b/drivers/net/smc91x.h
index 729fd28c08b5..db34e1eb67e9 100644
--- a/drivers/net/smc91x.h
+++ b/drivers/net/smc91x.h
@@ -224,6 +224,21 @@ SMC_outw(u16 val, void __iomem *ioaddr, int reg)
         }
 }
 
+#elif defined(CONFIG_MACH_ZYLONITE)
+
+#define SMC_CAN_USE_8BIT        1
+#define SMC_CAN_USE_16BIT       1
+#define SMC_CAN_USE_32BIT       0
+#define SMC_IO_SHIFT            0
+#define SMC_NOWAIT              1
+#define SMC_USE_PXA_DMA         1
+#define SMC_inb(a, r)           readb((a) + (r))
+#define SMC_inw(a, r)           readw((a) + (r))
+#define SMC_insw(a, r, p, l)    insw((a) + (r), p, l)
+#define SMC_outsw(a, r, p, l)   outsw((a) + (r), p, l)
+#define SMC_outb(v, a, r)       writeb(v, (a) + (r))
+#define SMC_outw(v, a, r)       writew(v, (a) + (r))
+
 #elif   defined(CONFIG_ARCH_OMAP)
 
 /* We can only do 16-bit reads and writes in the static memory space. */
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 5a96d74e4ce8..a12c9c41b217 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -93,13 +93,9 @@ config USB_RTL8150
           To compile this driver as a module, choose M here: the
           module will be called rtl8150.
 
-config USB_USBNET_MII
-        tristate
-        default n
-
 config USB_USBNET
         tristate "Multi-purpose USB Networking Framework"
-        select MII if USB_USBNET_MII != n
+        select MII
         ---help---
           This driver supports several kinds of network links over USB,
           with "minidrivers" built around a common network driver core
@@ -135,7 +131,6 @@ config USB_NET_AX8817X
         tristate "ASIX AX88xxx Based USB 2.0 Ethernet Adapters"
         depends on USB_USBNET && NET_ETHERNET
         select CRC32
-        select USB_USBNET_MII
         default y
         help
           This option adds support for ASIX AX88xxx based USB 2.0
@@ -190,7 +185,6 @@ config USB_NET_DM9601
         tristate "Davicom DM9601 based USB 1.1 10/100 ethernet devices"
         depends on USB_USBNET
         select CRC32
-        select USB_USBNET_MII
         help
           This option adds support for Davicom DM9601 based USB 1.1
           10/100 Ethernet adapters.
@@ -225,7 +219,6 @@ config USB_NET_PLUSB
 config USB_NET_MCS7830
         tristate "MosChip MCS7830 based Ethernet adapters"
         depends on USB_USBNET
-        select USB_USBNET_MII
         help
           Choose this option if you're using a 10/100 Ethernet USB2
           adapter based on the MosChip 7830 controller. This includes
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index acd5f1c0e63a..8ed1fc5cbc70 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -683,9 +683,6 @@ done_nopm:
  * they'll probably want to use this base set.
  */
 
-#if defined(CONFIG_MII) || defined(CONFIG_MII_MODULE)
-#define HAVE_MII
-
 int usbnet_get_settings (struct net_device *net, struct ethtool_cmd *cmd)
 {
         struct usbnet *dev = netdev_priv(net);
@@ -744,8 +741,6 @@ int usbnet_nway_reset(struct net_device *net)
 }
 EXPORT_SYMBOL_GPL(usbnet_nway_reset);
 
-#endif  /* HAVE_MII */
-
 void usbnet_get_drvinfo (struct net_device *net, struct ethtool_drvinfo *info)
 {
         struct usbnet *dev = netdev_priv(net);
@@ -776,12 +771,10 @@ EXPORT_SYMBOL_GPL(usbnet_set_msglevel);
 
 /* drivers may override default ethtool_ops in their bind() routine */
 static struct ethtool_ops usbnet_ethtool_ops = {
-#ifdef  HAVE_MII
         .get_settings           = usbnet_get_settings,
         .set_settings           = usbnet_set_settings,
         .get_link               = usbnet_get_link,
         .nway_reset             = usbnet_nway_reset,
-#endif
         .get_drvinfo            = usbnet_get_drvinfo,
         .get_msglevel           = usbnet_get_msglevel,
         .set_msglevel           = usbnet_set_msglevel,
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index e396c9d2af8d..a75be57fb209 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -146,6 +146,7 @@ static void try_fill_recv(struct virtnet_info *vi)
         struct scatterlist sg[1+MAX_SKB_FRAGS];
         int num, err;
 
+        sg_init_table(sg, 1+MAX_SKB_FRAGS);
         for (;;) {
                 skb = netdev_alloc_skb(vi->dev, MAX_PACKET_LEN);
                 if (unlikely(!skb))
@@ -231,6 +232,8 @@ static int start_xmit(struct sk_buff *skb, struct net_device *dev)
         const unsigned char *dest = ((struct ethhdr *)skb->data)->h_dest;
         DECLARE_MAC_BUF(mac);
 
+        sg_init_table(sg, 1+MAX_SKB_FRAGS);
+
         pr_debug("%s: xmit %p %s\n", dev->name, skb, print_mac(mac, dest));
 
         free_old_xmit_skbs(vi);
diff --git a/drivers/net/wan/x25_asy.c b/drivers/net/wan/x25_asy.c
index c48b1cc63fd5..1e89d4de1bb7 100644
--- a/drivers/net/wan/x25_asy.c
+++ b/drivers/net/wan/x25_asy.c
@@ -719,12 +719,8 @@ static int x25_asy_ioctl(struct tty_struct *tty, struct file *file,
                 return 0;
         case SIOCSIFHWADDR:
                 return -EINVAL;
-        /* Allow stty to read, but not set, the serial port */
-        case TCGETS:
-        case TCGETA:
-                return n_tty_ioctl(tty, file, cmd, arg);
         default:
-                return -ENOIOCTLCMD;
+                return tty_mode_ioctl(tty, file, cmd, arg);
         }
 }
 
diff --git a/drivers/net/wireless/Kconfig b/drivers/net/wireless/Kconfig
index dae5c8d5a318..2b733c582915 100644
--- a/drivers/net/wireless/Kconfig
+++ b/drivers/net/wireless/Kconfig
@@ -325,7 +325,7 @@ config HERMES
           Cabletron/EnteraSys Roamabout, ELSA AirLancer, MELCO Buffalo, Avaya,
           IBM High Rate Wireless, Farralon Syyline, Samsung MagicLAN, Netgear
           MA401, LinkSys WPC-11, D-Link DWL-650, 3Com AirConnect, Intel
-          PRO/Wireless, and Symbol Spectrum24 High Rate amongst others.
+          IPW2011, and Symbol Spectrum24 High Rate amongst others.
 
           This option includes the guts of the driver, but in order to
           actually use a card you will also need to enable support for PCMCIA
diff --git a/drivers/net/wireless/b43/Kconfig b/drivers/net/wireless/b43/Kconfig
index e3c573e56b63..fdbc351ac333 100644
--- a/drivers/net/wireless/b43/Kconfig
+++ b/drivers/net/wireless/b43/Kconfig
@@ -61,16 +61,18 @@ config B43_PCMCIA
 
           If unsure, say N.
 
-# LED support
+# This config option automatically enables b43 LEDS support,
+# if it's possible.
 config B43_LEDS
         bool
-        depends on B43 && MAC80211_LEDS
+        depends on B43 && MAC80211_LEDS && (LEDS_CLASS = y || LEDS_CLASS = B43)
         default y
 
-# RFKILL support
+# This config option automatically enables b43 RFKILL support,
+# if it's possible.
 config B43_RFKILL
         bool
-        depends on B43 && RFKILL && RFKILL_INPUT && INPUT_POLLDEV
+        depends on B43 && (RFKILL = y || RFKILL = B43) && RFKILL_INPUT && (INPUT_POLLDEV = y || INPUT_POLLDEV = B43)
         default y
 
 config B43_DEBUG
diff --git a/drivers/net/wireless/b43/debugfs.c b/drivers/net/wireless/b43/debugfs.c
index 734e70e1a06d..ef0075d9f9cb 100644
--- a/drivers/net/wireless/b43/debugfs.c
+++ b/drivers/net/wireless/b43/debugfs.c
@@ -128,7 +128,7 @@ static ssize_t shm_read_file(struct b43_wldev *dev,
         __le16 *le16buf = (__le16 *)buf;
 
         for (i = 0; i < 0x1000; i++) {
-                if (bufsize <= 0)
+                if (bufsize < sizeof(tmp))
                         break;
                 tmp = b43_shm_read16(dev, B43_SHM_SHARED, 2 * i);
                 le16buf[i] = cpu_to_le16(tmp);
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 5058e60e5703..2b17c1dc46f1 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -2985,6 +2985,16 @@ static void b43_wireless_core_stop(struct b43_wldev *dev)
 
         if (b43_status(dev) < B43_STAT_STARTED)
                 return;
+
+        /* Disable and sync interrupts. We must do this before than
+         * setting the status to INITIALIZED, as the interrupt handler
+         * won't care about IRQs then. */
+        spin_lock_irqsave(&wl->irq_lock, flags);
+        dev->irq_savedstate = b43_interrupt_disable(dev, B43_IRQ_ALL);
+        b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* flush */
+        spin_unlock_irqrestore(&wl->irq_lock, flags);
+        b43_synchronize_irq(dev);
+
         b43_set_status(dev, B43_STAT_INITIALIZED);
 
         mutex_unlock(&wl->mutex);
@@ -2995,13 +3005,6 @@ static void b43_wireless_core_stop(struct b43_wldev *dev)
 
         ieee80211_stop_queues(wl->hw);  //FIXME this could cause a deadlock, as mac80211 seems buggy.
 
-        /* Disable and sync interrupts. */
-        spin_lock_irqsave(&wl->irq_lock, flags);
-        dev->irq_savedstate = b43_interrupt_disable(dev, B43_IRQ_ALL);
-        b43_read32(dev, B43_MMIO_GEN_IRQ_MASK); /* flush */
-        spin_unlock_irqrestore(&wl->irq_lock, flags);
-        b43_synchronize_irq(dev);
-
         b43_mac_suspend(dev);
         free_irq(dev->dev->irq, dev);
         b43dbg(wl, "Wireless interface stopped\n");
@@ -3661,7 +3664,6 @@ static int b43_setup_modes(struct b43_wldev *dev,
 
 static void b43_wireless_core_detach(struct b43_wldev *dev)
 {
-        b43_rfkill_free(dev);
         /* We release firmware that late to not be required to re-request
          * is all the time when we reinit the core. */
         b43_release_firmware(dev);
@@ -3747,7 +3749,6 @@ static int b43_wireless_core_attach(struct b43_wldev *dev)
         if (!wl->current_dev)
                 wl->current_dev = dev;
         INIT_WORK(&dev->restart_work, b43_chip_reset);
-        b43_rfkill_alloc(dev);
 
         b43_radio_turn_off(dev, 1);
         b43_switch_analog(dev, 0);
diff --git a/drivers/net/wireless/b43/pcmcia.c b/drivers/net/wireless/b43/pcmcia.c
index b242a9a90dd2..b79a6bd5396d 100644
--- a/drivers/net/wireless/b43/pcmcia.c
+++ b/drivers/net/wireless/b43/pcmcia.c
@@ -65,12 +65,12 @@ static int __devinit b43_pcmcia_probe(struct pcmcia_device *dev)
         tuple_t tuple;
         cisparse_t parse;
         int err = -ENOMEM;
-        int res;
+        int res = 0;
         unsigned char buf[64];
 
         ssb = kzalloc(sizeof(*ssb), GFP_KERNEL);
         if (!ssb)
-                goto out;
+                goto out_error;
 
         err = -ENODEV;
         tuple.DesiredTuple = CISTPL_CONFIG;
@@ -96,10 +96,12 @@ static int __devinit b43_pcmcia_probe(struct pcmcia_device *dev)
         dev->io.NumPorts2 = 0;
         dev->io.Attributes2 = 0;
 
-        win.Attributes = WIN_MEMORY_TYPE_CM | WIN_ENABLE | WIN_USE_WAIT;
+        win.Attributes = WIN_ADDR_SPACE_MEM | WIN_MEMORY_TYPE_CM |
+                         WIN_ENABLE | WIN_DATA_WIDTH_16 |
+                         WIN_USE_WAIT;
         win.Base = 0;
         win.Size = SSB_CORE_SIZE;
-        win.AccessSpeed = 1000;
+        win.AccessSpeed = 250;
         res = pcmcia_request_window(&dev, &win, &dev->win);
         if (res != CS_SUCCESS)
                 goto err_kfree_ssb;
@@ -108,21 +110,34 @@ static int __devinit b43_pcmcia_probe(struct pcmcia_device *dev)
         mem.Page = 0;
         res = pcmcia_map_mem_page(dev->win, &mem);
         if (res != CS_SUCCESS)
-                goto err_kfree_ssb;
+                goto err_disable;
+
+        dev->irq.Attributes = IRQ_TYPE_DYNAMIC_SHARING | IRQ_FIRST_SHARED;
+        dev->irq.IRQInfo1 = IRQ_LEVEL_ID | IRQ_SHARE_ID;
+        dev->irq.Handler = NULL; /* The handler is registered later. */
+        dev->irq.Instance = NULL;
+        res = pcmcia_request_irq(dev, &dev->irq);
+        if (res != CS_SUCCESS)
+                goto err_disable;
 
         res = pcmcia_request_configuration(dev, &dev->conf);
         if (res != CS_SUCCESS)
                 goto err_disable;
 
         err = ssb_bus_pcmciabus_register(ssb, dev, win.Base);
+        if (err)
+                goto err_disable;
         dev->priv = ssb;
 
-      out:
-        return err;
-      err_disable:
+        return 0;
+
+err_disable:
         pcmcia_disable_device(dev);
-      err_kfree_ssb:
+err_kfree_ssb:
         kfree(ssb);
+out_error:
+        printk(KERN_ERR "b43-pcmcia: Initialization failed (%d, %d)\n",
+               res, err);
         return err;
 }
 
@@ -131,22 +146,21 @@ static void __devexit b43_pcmcia_remove(struct pcmcia_device *dev)
         struct ssb_bus *ssb = dev->priv;
 
         ssb_bus_unregister(ssb);
-        pcmcia_release_window(dev->win);
         pcmcia_disable_device(dev);
         kfree(ssb);
         dev->priv = NULL;
 }
 
 static struct pcmcia_driver b43_pcmcia_driver = {
-        .owner = THIS_MODULE,
-        .drv = {
-                .name = "b43-pcmcia",
-                },
-        .id_table = b43_pcmcia_tbl,
-        .probe = b43_pcmcia_probe,
-        .remove = b43_pcmcia_remove,
-        .suspend = b43_pcmcia_suspend,
-        .resume = b43_pcmcia_resume,
+        .owner          = THIS_MODULE,
+        .drv            = {
+                                .name = "b43-pcmcia",
+                        },
+        .id_table       = b43_pcmcia_tbl,
+        .probe          = b43_pcmcia_probe,
+        .remove         = __devexit_p(b43_pcmcia_remove),
+        .suspend        = b43_pcmcia_suspend,
+        .resume         = b43_pcmcia_resume,
 };
 
 int b43_pcmcia_init(void)
diff --git a/drivers/net/wireless/b43/rfkill.c b/drivers/net/wireless/b43/rfkill.c
index 800e0a61a7f5..9b1f905ffbf4 100644
--- a/drivers/net/wireless/b43/rfkill.c
+++ b/drivers/net/wireless/b43/rfkill.c
@@ -47,32 +47,35 @@ static void b43_rfkill_poll(struct input_polled_dev *poll_dev)
         struct b43_wldev *dev = poll_dev->private;
         struct b43_wl *wl = dev->wl;
         bool enabled;
+        bool report_change = 0;
 
         mutex_lock(&wl->mutex);
         B43_WARN_ON(b43_status(dev) < B43_STAT_INITIALIZED);
         enabled = b43_is_hw_radio_enabled(dev);
         if (unlikely(enabled != dev->radio_hw_enable)) {
                 dev->radio_hw_enable = enabled;
+                report_change = 1;
                 b43info(wl, "Radio hardware status changed to %s\n",
                         enabled ? "ENABLED" : "DISABLED");
-                mutex_unlock(&wl->mutex);
+        }
+        mutex_unlock(&wl->mutex);
+
+        if (unlikely(report_change))
                 input_report_key(poll_dev->input, KEY_WLAN, enabled);
-        } else
-                mutex_unlock(&wl->mutex);
 }
 
-/* Called when the RFKILL toggled in software.
- * This is called without locking. */
+/* Called when the RFKILL toggled in software. */
 static int b43_rfkill_soft_toggle(void *data, enum rfkill_state state)
 {
         struct b43_wldev *dev = data;
         struct b43_wl *wl = dev->wl;
         int err = 0;
 
-        mutex_lock(&wl->mutex);
-        if (b43_status(dev) < B43_STAT_INITIALIZED)
-                goto out_unlock;
+        if (!wl->rfkill.registered)
+                return 0;
 
+        mutex_lock(&wl->mutex);
+        B43_WARN_ON(b43_status(dev) < B43_STAT_INITIALIZED);
         switch (state) {
         case RFKILL_STATE_ON:
                 if (!dev->radio_hw_enable) {
@@ -89,7 +92,6 @@ static int b43_rfkill_soft_toggle(void *data, enum rfkill_state state)
                         b43_radio_turn_off(dev, 0);
                 break;
         }
-
 out_unlock:
         mutex_unlock(&wl->mutex);
 
@@ -98,11 +100,11 @@ out_unlock:
 
 char * b43_rfkill_led_name(struct b43_wldev *dev)
 {
-        struct b43_wl *wl = dev->wl;
+        struct b43_rfkill *rfk = &(dev->wl->rfkill);
 
-        if (!wl->rfkill.rfkill)
+        if (!rfk->registered)
                 return NULL;
-        return rfkill_get_led_name(wl->rfkill.rfkill);
+        return rfkill_get_led_name(rfk->rfkill);
 }
 
 void b43_rfkill_init(struct b43_wldev *dev)
@@ -111,53 +113,13 @@ void b43_rfkill_init(struct b43_wldev *dev)
         struct b43_rfkill *rfk = &(wl->rfkill);
         int err;
 
-        if (rfk->rfkill) {
-                err = rfkill_register(rfk->rfkill);
-                if (err) {
-                        b43warn(wl, "Failed to register RF-kill button\n");
-                        goto err_free_rfk;
-                }
-        }
-        if (rfk->poll_dev) {
-                err = input_register_polled_device(rfk->poll_dev);
-                if (err) {
-                        b43warn(wl, "Failed to register RF-kill polldev\n");
-                        goto err_free_polldev;
-                }
-        }
-
-        return;
-err_free_rfk:
-        rfkill_free(rfk->rfkill);
-        rfk->rfkill = NULL;
-err_free_polldev:
-        input_free_polled_device(rfk->poll_dev);
-        rfk->poll_dev = NULL;
-}
-
-void b43_rfkill_exit(struct b43_wldev *dev)
-{
-        struct b43_rfkill *rfk = &(dev->wl->rfkill);
-
-        if (rfk->poll_dev)
-                input_unregister_polled_device(rfk->poll_dev);
-        if (rfk->rfkill)
-                rfkill_unregister(rfk->rfkill);
-}
-
-void b43_rfkill_alloc(struct b43_wldev *dev)
-{
-        struct b43_wl *wl = dev->wl;
-        struct b43_rfkill *rfk = &(wl->rfkill);
+        rfk->registered = 0;
 
+        rfk->rfkill = rfkill_allocate(dev->dev->dev, RFKILL_TYPE_WLAN);
+        if (!rfk->rfkill)
+                goto out_error;
         snprintf(rfk->name, sizeof(rfk->name),
                  "b43-%s", wiphy_name(wl->hw->wiphy));
-
-        rfk->rfkill = rfkill_allocate(dev->dev->dev, RFKILL_TYPE_WLAN);
-        if (!rfk->rfkill) {
-                b43warn(wl, "Failed to allocate RF-kill button\n");
-                return;
-        }
         rfk->rfkill->name = rfk->name;
         rfk->rfkill->state = RFKILL_STATE_ON;
         rfk->rfkill->data = dev;
@@ -165,18 +127,45 @@ void b43_rfkill_alloc(struct b43_wldev *dev)
         rfk->rfkill->user_claim_unsupported = 1;
 
         rfk->poll_dev = input_allocate_polled_device();
-        if (rfk->poll_dev) {
-                rfk->poll_dev->private = dev;
-                rfk->poll_dev->poll = b43_rfkill_poll;
-                rfk->poll_dev->poll_interval = 1000; /* msecs */
-        } else
-                b43warn(wl, "Failed to allocate RF-kill polldev\n");
+        if (!rfk->poll_dev)
+                goto err_free_rfk;
+        rfk->poll_dev->private = dev;
+        rfk->poll_dev->poll = b43_rfkill_poll;
+        rfk->poll_dev->poll_interval = 1000; /* msecs */
+
+        err = rfkill_register(rfk->rfkill);
+        if (err)
+                goto err_free_polldev;
+        err = input_register_polled_device(rfk->poll_dev);
+        if (err)
+                goto err_unreg_rfk;
+
+        rfk->registered = 1;
+
+        return;
+err_unreg_rfk:
+        rfkill_unregister(rfk->rfkill);
+err_free_polldev:
+        input_free_polled_device(rfk->poll_dev);
+        rfk->poll_dev = NULL;
+err_free_rfk:
+        rfkill_free(rfk->rfkill);
+        rfk->rfkill = NULL;
+out_error:
+        rfk->registered = 0;
+        b43warn(wl, "RF-kill button init failed\n");
 }
 
-void b43_rfkill_free(struct b43_wldev *dev)
+void b43_rfkill_exit(struct b43_wldev *dev)
 {
         struct b43_rfkill *rfk = &(dev->wl->rfkill);
 
+        if (!rfk->registered)
+                return;
+        rfk->registered = 0;
+
+        input_unregister_polled_device(rfk->poll_dev);
+        rfkill_unregister(rfk->rfkill);
         input_free_polled_device(rfk->poll_dev);
         rfk->poll_dev = NULL;
         rfkill_free(rfk->rfkill);
diff --git a/drivers/net/wireless/b43/rfkill.h b/drivers/net/wireless/b43/rfkill.h
index 29544e8c9e5f..adacf936d815 100644
--- a/drivers/net/wireless/b43/rfkill.h
+++ b/drivers/net/wireless/b43/rfkill.h
@@ -15,14 +15,14 @@ struct b43_rfkill {
         struct rfkill *rfkill;
         /* The poll device for the RFKILL input button */
         struct input_polled_dev *poll_dev;
+        /* Did initialization succeed? Used for freeing. */
+        bool registered;
         /* The unique name of this rfkill switch */
-        char name[32];
+        char name[sizeof("b43-phy4294967295")];
 };
 
-/* All the init functions return void, because we are not interested
+/* The init function returns void, because we are not interested
  * in failing the b43 init process when rfkill init failed. */
-void b43_rfkill_alloc(struct b43_wldev *dev);
-void b43_rfkill_free(struct b43_wldev *dev);
 void b43_rfkill_init(struct b43_wldev *dev);
 void b43_rfkill_exit(struct b43_wldev *dev);
 
@@ -36,12 +36,6 @@ struct b43_rfkill {
         /* empty */
 };
 
-static inline void b43_rfkill_alloc(struct b43_wldev *dev)
-{
-}
-static inline void b43_rfkill_free(struct b43_wldev *dev)
-{
-}
 static inline void b43_rfkill_init(struct b43_wldev *dev)
 {
 }
diff --git a/drivers/net/wireless/b43legacy/debugfs.c b/drivers/net/wireless/b43legacy/debugfs.c
index eefa6fb79685..619b4534ef09 100644
--- a/drivers/net/wireless/b43legacy/debugfs.c
+++ b/drivers/net/wireless/b43legacy/debugfs.c
@@ -124,7 +124,7 @@ static ssize_t shm_read_file(struct b43legacy_wldev *dev, char *buf, size_t bufs
         __le16 *le16buf = (__le16 *)buf;
 
         for (i = 0; i < 0x1000; i++) {
-                if (bufsize <= 0)
+                if (bufsize < sizeof(tmp))
                         break;
                 tmp = b43legacy_shm_read16(dev, B43legacy_SHM_SHARED, 2 * i);
                 le16buf[i] = cpu_to_le16(tmp);
diff --git a/drivers/net/wireless/b43legacy/main.c b/drivers/net/wireless/b43legacy/main.c
index f0e56dfc9ecf..3bde1e9ab428 100644
--- a/drivers/net/wireless/b43legacy/main.c
+++ b/drivers/net/wireless/b43legacy/main.c
@@ -2781,6 +2781,17 @@ static void b43legacy_wireless_core_stop(struct b43legacy_wldev *dev)
 
         if (b43legacy_status(dev) < B43legacy_STAT_STARTED)
                 return;
+
+        /* Disable and sync interrupts. We must do this before than
+         * setting the status to INITIALIZED, as the interrupt handler
+         * won't care about IRQs then. */
+        spin_lock_irqsave(&wl->irq_lock, flags);
+        dev->irq_savedstate = b43legacy_interrupt_disable(dev,
+                                                          B43legacy_IRQ_ALL);
+        b43legacy_read32(dev, B43legacy_MMIO_GEN_IRQ_MASK); /* flush */
+        spin_unlock_irqrestore(&wl->irq_lock, flags);
+        b43legacy_synchronize_irq(dev);
+
         b43legacy_set_status(dev, B43legacy_STAT_INITIALIZED);
 
         mutex_unlock(&wl->mutex);
@@ -2791,14 +2802,6 @@ static void b43legacy_wireless_core_stop(struct b43legacy_wldev *dev)
 
         ieee80211_stop_queues(wl->hw); /* FIXME this could cause a deadlock */
 
-        /* Disable and sync interrupts. */
-        spin_lock_irqsave(&wl->irq_lock, flags);
-        dev->irq_savedstate = b43legacy_interrupt_disable(dev,
-                                                          B43legacy_IRQ_ALL);
-        b43legacy_read32(dev, B43legacy_MMIO_GEN_IRQ_MASK); /* flush */
-        spin_unlock_irqrestore(&wl->irq_lock, flags);
-        b43legacy_synchronize_irq(dev);
-
         b43legacy_mac_suspend(dev);
         free_irq(dev->dev->irq, dev);
         b43legacydbg(wl, "Wireless interface stopped\n");
@@ -3332,7 +3335,7 @@ out_mutex_unlock:
         return err;
 }
 
-void b43legacy_stop(struct ieee80211_hw *hw)
+static void b43legacy_stop(struct ieee80211_hw *hw)
 {
         struct b43legacy_wl *wl = hw_to_b43legacy_wl(hw);
         struct b43legacy_wldev *dev = wl->current_dev;
diff --git a/drivers/net/wireless/hostap/hostap_pci.c b/drivers/net/wireless/hostap/hostap_pci.c
index 7da3664b8515..fc876ba18572 100644
--- a/drivers/net/wireless/hostap/hostap_pci.c
+++ b/drivers/net/wireless/hostap/hostap_pci.c
@@ -444,7 +444,7 @@ static int prism2_pci_resume(struct pci_dev *pdev)
 
 MODULE_DEVICE_TABLE(pci, prism2_pci_id_table);
 
-static struct pci_driver prism2_pci_drv_id = {
+static struct pci_driver prism2_pci_driver = {
         .name           = "hostap_pci",
         .id_table       = prism2_pci_id_table,
         .probe          = prism2_pci_probe,
@@ -458,13 +458,13 @@ static struct pci_driver prism2_pci_drv_id = {
 
 static int __init init_prism2_pci(void)
 {
-        return pci_register_driver(&prism2_pci_drv_id);
+        return pci_register_driver(&prism2_pci_driver);
 }
 
 
 static void __exit exit_prism2_pci(void)
 {
-        pci_unregister_driver(&prism2_pci_drv_id);
+        pci_unregister_driver(&prism2_pci_driver);
 }
 
 
diff --git a/drivers/net/wireless/ipw2100.c b/drivers/net/wireless/ipw2100.c
index 8d53d08b9691..fc6cdd8086c1 100644
--- a/drivers/net/wireless/ipw2100.c
+++ b/drivers/net/wireless/ipw2100.c
@@ -1267,7 +1267,7 @@ static int ipw2100_start_adapter(struct ipw2100_priv *priv)
                                        IPW2100_INTA_FATAL_ERROR |
                                        IPW2100_INTA_PARITY_ERROR);
                 }
-        } while (i--);
+        } while (--i);
 
         /* Clear out any pending INTAs since we aren't supposed to have
          * interrupts enabled at this point... */
@@ -1339,7 +1339,7 @@ static int ipw2100_power_cycle_adapter(struct ipw2100_priv *priv)
 
                 if (reg & IPW_AUX_HOST_RESET_REG_MASTER_DISABLED)
                         break;
-        } while (i--);
+        } while (--i);
 
         priv->status &= ~STATUS_RESET_PENDING;
 
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 4f22a7174caf..be7c9f42a340 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -8354,6 +8354,8 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         }
         SET_IEEE80211_DEV(hw, &pdev->dev);
 
+        hw->rate_control_algorithm = "iwl-3945-rs";
+
         IWL_DEBUG_INFO("*** LOAD DRIVER ***\n");
         priv = hw->priv;
         priv->hw = hw;
diff --git a/drivers/net/wireless/iwlwifi/iwl4965-base.c b/drivers/net/wireless/iwlwifi/iwl4965-base.c
index d60adcb9bd4a..6757c6c1b25a 100644
--- a/drivers/net/wireless/iwlwifi/iwl4965-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl4965-base.c
@@ -8955,6 +8955,8 @@ static int iwl_pci_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
         }
         SET_IEEE80211_DEV(hw, &pdev->dev);
 
+        hw->rate_control_algorithm = "iwl-4965-rs";
+
         IWL_DEBUG_INFO("*** LOAD DRIVER ***\n");
         priv = hw->priv;
         priv->hw = hw;
diff --git a/drivers/net/wireless/libertas/cmd.c b/drivers/net/wireless/libertas/cmd.c
index 1cbbd96fdbde..be5cfd8402c7 100644
--- a/drivers/net/wireless/libertas/cmd.c
+++ b/drivers/net/wireless/libertas/cmd.c
@@ -912,6 +912,10 @@ static int wlan_cmd_set_boot2_ver(wlan_private * priv,
         return 0;
 }
 
+/*
+ * Note: NEVER use libertas_queue_cmd() with addtail==0 other than for
+ * the command timer, because it does not account for queued commands.
+ */
 void libertas_queue_cmd(wlan_adapter * adapter, struct cmd_ctrl_node *cmdnode, u8 addtail)
 {
         unsigned long flags;
@@ -941,10 +945,11 @@ void libertas_queue_cmd(wlan_adapter * adapter, struct cmd_ctrl_node *cmdnode, u
 
         spin_lock_irqsave(&adapter->driver_lock, flags);
 
-        if (addtail)
+        if (addtail) {
                 list_add_tail((struct list_head *)cmdnode,
                               &adapter->cmdpendingq);
-        else
+                adapter->nr_cmd_pending++;
+        } else
                 list_add((struct list_head *)cmdnode, &adapter->cmdpendingq);
 
         spin_unlock_irqrestore(&adapter->driver_lock, flags);
@@ -1412,7 +1417,6 @@ int libertas_prepare_and_send_command(wlan_private * priv,
         cmdnode->cmdwaitqwoken = 0;
 
         libertas_queue_cmd(adapter, cmdnode, 1);
-        adapter->nr_cmd_pending++;
         wake_up_interruptible(&priv->waitq);
 
         if (wait_option & CMD_OPTION_WAITFORRSP) {
diff --git a/drivers/net/wireless/libertas/if_cs.c b/drivers/net/wireless/libertas/if_cs.c
index 0360cad363a8..ec89dabc412c 100644
--- a/drivers/net/wireless/libertas/if_cs.c
+++ b/drivers/net/wireless/libertas/if_cs.c
@@ -148,11 +148,11 @@ static int if_cs_poll_while_fw_download(struct if_cs_card *card, uint addr, u8 r
 {
         int i;
 
-        for (i = 0; i < 500; i++) {
+        for (i = 0; i < 1000; i++) {
                 u8 val = if_cs_read8(card, addr);
                 if (val == reg)
                         return i;
-                udelay(100);
+                udelay(500);
         }
         return -ETIME;
 }
@@ -878,6 +878,9 @@ static int if_cs_probe(struct pcmcia_device *p_dev)
                 goto out3;
         }
 
+        /* Clear any interrupt cause that happend while sending
+         * firmware/initializing card */
+        if_cs_write16(card, IF_CS_C_INT_CAUSE, IF_CS_C_IC_MASK);
         if_cs_enable_ints(card);
 
         /* And finally bring the card up */
diff --git a/drivers/net/wireless/libertas/if_sdio.c b/drivers/net/wireless/libertas/if_sdio.c
index a8e17076e7de..b24425f74883 100644
--- a/drivers/net/wireless/libertas/if_sdio.c
+++ b/drivers/net/wireless/libertas/if_sdio.c
@@ -182,12 +182,14 @@ static int if_sdio_handle_data(struct if_sdio_card *card,
                 goto out;
         }
 
-        skb = dev_alloc_skb(MRVDRV_ETH_RX_PACKET_BUFFER_SIZE);
+        skb = dev_alloc_skb(MRVDRV_ETH_RX_PACKET_BUFFER_SIZE + NET_IP_ALIGN);
         if (!skb) {
                 ret = -ENOMEM;
                 goto out;
         }
 
+        skb_reserve(skb, NET_IP_ALIGN);
+
         data = skb_put(skb, size);
 
         memcpy(data, buffer, size);
diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
index 4a6a0bd01ff1..85ea8a8e658e 100644
--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
+++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
@@ -196,6 +196,14 @@ int rt2x00mac_add_interface(struct ieee80211_hw *hw,
         struct rt2x00_dev *rt2x00dev = hw->priv;
         struct interface *intf = &rt2x00dev->interface;
 
+        /* FIXME: Beaconing is broken in rt2x00. */
+        if (conf->type == IEEE80211_IF_TYPE_IBSS ||
+            conf->type == IEEE80211_IF_TYPE_AP) {
+                ERROR(rt2x00dev,
+                      "rt2x00 does not support Adhoc or Master mode");
+                return -EOPNOTSUPP;
+        }
+
         /*
          * Don't allow interfaces to be added while
          * either the device has disappeared or when
diff --git a/drivers/net/wireless/strip.c b/drivers/net/wireless/strip.c
index 4bd14b331862..88efe1bae58f 100644
--- a/drivers/net/wireless/strip.c
+++ b/drivers/net/wireless/strip.c
@@ -2735,16 +2735,8 @@ static int strip_ioctl(struct tty_struct *tty, struct file *file,
                         return -EFAULT;
                 return set_mac_address(strip_info, &addr);
         }
-        /*
-         * Allow stty to read, but not set, the serial port
-         */
-
-        case TCGETS:
-        case TCGETA:
-                return n_tty_ioctl(tty, file, cmd, arg);
-                break;
         default:
-                return -ENOIOCTLCMD;
+                return tty_mode_ioctl(tty, file, cmd, arg);
                 break;
         }
         return 0;
diff --git a/drivers/rtc/rtc-sh.c b/drivers/rtc/rtc-sh.c
index 78277a118b67..8e8c8b8e81ee 100644
--- a/drivers/rtc/rtc-sh.c
+++ b/drivers/rtc/rtc-sh.c
@@ -351,8 +351,10 @@ static int sh_rtc_read_time(struct device *dev, struct rtc_time *tm)
                 tm->tm_sec, tm->tm_min, tm->tm_hour,
                 tm->tm_mday, tm->tm_mon + 1, tm->tm_year, tm->tm_wday);
 
-        if (rtc_valid_tm(tm) < 0)
+        if (rtc_valid_tm(tm) < 0) {
                 dev_err(dev, "invalid date\n");
+                rtc_time_to_tm(0, tm);
+        }
 
         return 0;
 }
@@ -588,7 +590,7 @@ static int __devinit sh_rtc_probe(struct platform_device *pdev)
 
         rtc->rtc_dev = rtc_device_register("sh", &pdev->dev,
                                            &sh_rtc_ops, THIS_MODULE);
-        if (IS_ERR(rtc)) {
+        if (IS_ERR(rtc->rtc_dev)) {
                 ret = PTR_ERR(rtc->rtc_dev);
                 goto err_badmap;
         }
diff --git a/drivers/serial/sh-sci.h b/drivers/serial/sh-sci.h
index e89ae29645d6..d24621ce799a 100644
--- a/drivers/serial/sh-sci.h
+++ b/drivers/serial/sh-sci.h
@@ -77,7 +77,6 @@
 # define SCIF_ONLY
 #elif defined(CONFIG_CPU_SUBTYPE_SH7710) || defined(CONFIG_CPU_SUBTYPE_SH7712)
 # define SCSPTR0 0xA4400000       /* 16 bit SCIF */
-# define SCI_NPORTS 2
 # define SCIF_ORER 0x0001   /* overrun error bit */
 # define PACR 0xa4050100
 # define PBCR 0xa4050102
@@ -102,12 +101,6 @@
 # define SCIF_ORER 0x0001   /* overrun error bit */
 # define SCSCR_INIT(port) 0x38 /* TIE=0,RIE=0,TE=1,RE=1,REIE=1 */
 # define SCIF_ONLY
-#elif defined(CONFIG_CPU_SUBTYPE_ST40STB1)
-# define SCSPTR1 0xffe00020 /* 16 bit SCIF */
-# define SCSPTR2 0xffe80020 /* 16 bit SCIF */
-# define SCIF_ORER 0x0001   /* overrun error bit */
-# define SCSCR_INIT(port)          0x38 /* TIE=0,RIE=0,TE=1,RE=1,REIE=1 */
-# define SCIF_ONLY
 #elif defined(CONFIG_CPU_SUBTYPE_SH5_101) || defined(CONFIG_CPU_SUBTYPE_SH5_103)
 # include <asm/hardware.h>
 # define SCIF_BASE_ADDR    0x01030000
@@ -116,8 +109,7 @@
 # define SCIF_LSR2_OFFS    0x0000024
 # define SCSPTR2           ((port->mapbase)+SCIF_PTR2_OFFS) /* 16 bit SCIF */
 # define SCLSR2            ((port->mapbase)+SCIF_LSR2_OFFS) /* 16 bit SCIF */
-# define SCSCR_INIT(port)  0x38                           /* TIE=0,RIE=0,
-                                                             TE=1,RE=1,REIE=1 */
+# define SCSCR_INIT(port)  0x38         /* TIE=0,RIE=0, TE=1,RE=1,REIE=1 */
 # define SCIF_ONLY
 #elif defined(CONFIG_H83007) || defined(CONFIG_H83068)
 # define SCSCR_INIT(port)          0x30 /* TIE=0,RIE=0,TE=1,RE=1 */
@@ -577,15 +569,6 @@ static inline int sci_rxd_in(struct uart_port *port)
                 return ctrl_inb(SCPDR0) & 0x0001 ? 1 : 0; /* SCIF0 */
         return 1;
 }
-#elif defined(CONFIG_CPU_SUBTYPE_ST40STB1)
-static inline int sci_rxd_in(struct uart_port *port)
-{
-        if (port->mapbase == 0xffe00000)
-                return ctrl_inw(SCSPTR1)&0x0001 ? 1 : 0; /* SCIF */
-        else
-                return ctrl_inw(SCSPTR2)&0x0001 ? 1 : 0; /* SCIF */
-
-}
 #elif defined(CONFIG_CPU_SUBTYPE_SH5_101) || defined(CONFIG_CPU_SUBTYPE_SH5_103)
 static inline int sci_rxd_in(struct uart_port *port)
 {
diff --git a/drivers/serial/uartlite.c b/drivers/serial/uartlite.c
index dfef83f14960..a85f2d31a686 100644
--- a/drivers/serial/uartlite.c
+++ b/drivers/serial/uartlite.c
@@ -329,12 +329,14 @@ static struct uart_ops ulite_ops = {
 static void ulite_console_wait_tx(struct uart_port *port)
 {
         int i;
+        u8 val;
 
-        /* wait up to 10ms for the character(s) to be sent */
-        for (i = 0; i < 10000; i++) {
-                if (readb(port->membase + ULITE_STATUS) & ULITE_STATUS_TXEMPTY)
+        /* Spin waiting for TX fifo to have space available */
+        for (i = 0; i < 100000; i++) {
+                val = readb(port->membase + ULITE_STATUS);
+                if ((val & ULITE_STATUS_TXFULL) == 0)
                         break;
-                udelay(1);
+                cpu_relax();
         }
 }
 
diff --git a/drivers/sh/superhyway/superhyway.c b/drivers/sh/superhyway/superhyway.c
index 7d873b3b0513..4d0282b821b5 100644
--- a/drivers/sh/superhyway/superhyway.c
+++ b/drivers/sh/superhyway/superhyway.c
@@ -107,16 +107,17 @@ int superhyway_add_devices(struct superhyway_bus *bus,
 static int __init superhyway_init(void)
 {
         struct superhyway_bus *bus;
-        int ret = 0;
+        int ret;
 
-        device_register(&superhyway_bus_device);
+        ret = device_register(&superhyway_bus_device);
+        if (unlikely(ret))
+                return ret;
 
         for (bus = superhyway_channels; bus->ops; bus++)
                 ret |= superhyway_scan_bus(bus);
 
         return ret;
 }
-
 postcore_initcall(superhyway_init);
 
 static const struct superhyway_device_id *
diff --git a/drivers/ssb/main.c b/drivers/ssb/main.c
index c12a741b5574..85a20546e827 100644
--- a/drivers/ssb/main.c
+++ b/drivers/ssb/main.c
@@ -440,6 +440,7 @@ static int ssb_devices_register(struct ssb_bus *bus)
                         break;
                 case SSB_BUSTYPE_PCMCIA:
 #ifdef CONFIG_SSB_PCMCIAHOST
+                        sdev->irq = bus->host_pcmcia->irq.AssignedIRQ;
                         dev->parent = &bus->host_pcmcia->dev;
 #endif
                         break;
@@ -1147,7 +1148,10 @@ static int __init ssb_modinit(void)
 
         return err;
 }
-subsys_initcall(ssb_modinit);
+/* ssb must be initialized after PCI but before the ssb drivers.
+ * That means we must use some initcall between subsys_initcall
+ * and device_initcall. */
+fs_initcall(ssb_modinit);
 
 static void __exit ssb_modexit(void)
 {
diff --git a/drivers/ssb/pcmcia.c b/drivers/ssb/pcmcia.c
index b6abee846f02..bb44a76b3eb5 100644
--- a/drivers/ssb/pcmcia.c
+++ b/drivers/ssb/pcmcia.c
@@ -63,17 +63,17 @@ int ssb_pcmcia_switch_coreidx(struct ssb_bus *bus,
                 err = pcmcia_access_configuration_register(pdev, &reg);
                 if (err != CS_SUCCESS)
                         goto error;
-                read_addr |= (reg.Value & 0xF) << 12;
+                read_addr |= ((u32)(reg.Value & 0x0F)) << 12;
                 reg.Offset = 0x30;
                 err = pcmcia_access_configuration_register(pdev, &reg);
                 if (err != CS_SUCCESS)
                         goto error;
-                read_addr |= reg.Value << 16;
+                read_addr |= ((u32)reg.Value) << 16;
                 reg.Offset = 0x32;
                 err = pcmcia_access_configuration_register(pdev, &reg);
                 if (err != CS_SUCCESS)
                         goto error;
-                read_addr |= reg.Value << 24;
+                read_addr |= ((u32)reg.Value) << 24;
 
                 cur_core = (read_addr - SSB_ENUM_BASE) / SSB_CORE_SIZE;
                 if (cur_core == coreidx)
@@ -152,28 +152,29 @@ error:
         goto out_unlock;
 }
 
-/* These are the main device register access functions.
- * do_select_core is inline to have the likely hotpath inline.
- * All unlikely codepaths are out-of-line. */
-static inline int do_select_core(struct ssb_bus *bus,
-                                 struct ssb_device *dev,
-                                 u16 *offset)
+static int select_core_and_segment(struct ssb_device *dev,
+                                   u16 *offset)
 {
+        struct ssb_bus *bus = dev->bus;
         int err;
-        u8 need_seg = (*offset >= 0x800) ? 1 : 0;
+        u8 need_segment;
+
+        if (*offset >= 0x800) {
+                *offset -= 0x800;
+                need_segment = 1;
+        } else
+                need_segment = 0;
 
         if (unlikely(dev != bus->mapped_device)) {
                 err = ssb_pcmcia_switch_core(bus, dev);
                 if (unlikely(err))
                         return err;
         }
-        if (unlikely(need_seg != bus->mapped_pcmcia_seg)) {
-                err = ssb_pcmcia_switch_segment(bus, need_seg);
+        if (unlikely(need_segment != bus->mapped_pcmcia_seg)) {
+                err = ssb_pcmcia_switch_segment(bus, need_segment);
                 if (unlikely(err))
                         return err;
         }
-        if (need_seg == 1)
-                *offset -= 0x800;
 
         return 0;
 }
@@ -181,32 +182,31 @@ static inline int do_select_core(struct ssb_bus *bus,
 static u16 ssb_pcmcia_read16(struct ssb_device *dev, u16 offset)
 {
         struct ssb_bus *bus = dev->bus;
-        u16 x;
 
-        if (unlikely(do_select_core(bus, dev, &offset)))
+        if (unlikely(select_core_and_segment(dev, &offset)))
                 return 0xFFFF;
-        x = readw(bus->mmio + offset);
 
-        return x;
+        return readw(bus->mmio + offset);
 }
 
 static u32 ssb_pcmcia_read32(struct ssb_device *dev, u16 offset)
 {
         struct ssb_bus *bus = dev->bus;
-        u32 x;
+        u32 lo, hi;
 
-        if (unlikely(do_select_core(bus, dev, &offset)))
+        if (unlikely(select_core_and_segment(dev, &offset)))
                 return 0xFFFFFFFF;
-        x = readl(bus->mmio + offset);
+        lo = readw(bus->mmio + offset);
+        hi = readw(bus->mmio + offset + 2);
 
-        return x;
+        return (lo | (hi << 16));
 }
 
 static void ssb_pcmcia_write16(struct ssb_device *dev, u16 offset, u16 value)
 {
         struct ssb_bus *bus = dev->bus;
 
-        if (unlikely(do_select_core(bus, dev, &offset)))
+        if (unlikely(select_core_and_segment(dev, &offset)))
                 return;
         writew(value, bus->mmio + offset);
 }
@@ -215,12 +215,12 @@ static void ssb_pcmcia_write32(struct ssb_device *dev, u16 offset, u32 value)
 {
         struct ssb_bus *bus = dev->bus;
 
-        if (unlikely(do_select_core(bus, dev, &offset)))
+        if (unlikely(select_core_and_segment(dev, &offset)))
                 return;
-        readw(bus->mmio + offset);
-        writew(value >> 16, bus->mmio + offset + 2);
-        readw(bus->mmio + offset);
-        writew(value, bus->mmio + offset);
+        writeb((value & 0xFF000000) >> 24, bus->mmio + offset + 3);
+        writeb((value & 0x00FF0000) >> 16, bus->mmio + offset + 2);
+        writeb((value & 0x0000FF00) >> 8, bus->mmio + offset + 1);
+        writeb((value & 0x000000FF) >> 0, bus->mmio + offset + 0);
 }
 
 /* Not "static", as it's used in main.c */
diff --git a/drivers/video/cyber2000fb.c b/drivers/video/cyber2000fb.c
index 5fb8675e0d6b..d0e4cb618269 100644
--- a/drivers/video/cyber2000fb.c
+++ b/drivers/video/cyber2000fb.c
@@ -874,6 +874,8 @@ static int cyber2000fb_set_par(struct fb_info *info)
                 default:
                         BUG();
                 }
+                break;
+
         case 24:/* TRUECOLOUR, 16m */
                 hw.co_pixfmt            = CO_PIXFMT_24BPP;
                 hw.width                *= 3;
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index 0e4baca21b8f..1dc04b6684e6 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -53,7 +53,7 @@ struct vring_virtqueue
         unsigned int num_added;
 
         /* Last used index we've seen. */
-        unsigned int last_used_idx;
+        u16 last_used_idx;
 
         /* How to notify other side. FIXME: commonalize hcalls! */
         void (*notify)(struct virtqueue *vq);
@@ -277,11 +277,17 @@ struct virtqueue *vring_new_virtqueue(unsigned int num,
         struct vring_virtqueue *vq;
         unsigned int i;
 
+        /* We assume num is a power of 2. */
+        if (num & (num - 1)) {
+                dev_warn(&vdev->dev, "Bad virtqueue length %u\n", num);
+                return NULL;
+        }
+
         vq = kmalloc(sizeof(*vq) + sizeof(void *)*num, GFP_KERNEL);
         if (!vq)
                 return NULL;
 
-        vring_init(&vq->vring, num, pages);
+        vring_init(&vq->vring, num, pages, PAGE_SIZE);
         vq->vq.callback = callback;
         vq->vq.vdev = vdev;
         vq->vq.vq_ops = &vring_vq_ops;