158 files changed, 1717 insertions, 697 deletions

diff --git a/drivers/ata/ata_piix.c b/drivers/ata/ata_piix.c
index 942d14ac8792..d51a17c0f59b 100644
--- a/drivers/ata/ata_piix.c
+++ b/drivers/ata/ata_piix.c
@@ -72,6 +72,7 @@
  *      ICH2    spec c #20      - IDE PRD must not cross a 64K boundary
  *                                and must be dword aligned
  *      ICH2    spec c #24      - UDMA mode 4,5 t85/86 should be 6ns not 3.3
+ *      ICH7    errata #16      - MWDMA1 timings are incorrect
  *
  * Should have been BIOS fixed:
  *      450NX:  errata #19      - DMA hangs on old 450NX
@@ -94,7 +95,7 @@
 #include <linux/dmi.h>
 
 #define DRV_NAME        "ata_piix"
-#define DRV_VERSION     "2.12"
+#define DRV_VERSION     "2.13"
 
 enum {
         PIIX_IOCFG              = 0x54, /* IDE I/O configuration register */
@@ -136,6 +137,7 @@ enum piix_controller_ids {
         ich_pata_33,            /* ICH up to UDMA 33 only */
         ich_pata_66,            /* ICH up to 66 Mhz */
         ich_pata_100,           /* ICH up to UDMA 100 */
+        ich_pata_100_nomwdma1,  /* ICH up to UDMA 100 but with no MWDMA1*/
         ich5_sata,
         ich6_sata,
         ich6m_sata,
@@ -216,8 +218,8 @@ static const struct pci_device_id piix_pci_tbl[] = {
         /* ICH6 (and 6) (i915) UDMA 100 */
         { 0x8086, 0x266F, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich_pata_100 },
         /* ICH7/7-R (i945, i975) UDMA 100*/
-        { 0x8086, 0x27DF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich_pata_100 },
-        { 0x8086, 0x269E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich_pata_100 },
+        { 0x8086, 0x27DF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich_pata_100_nomwdma1 },
+        { 0x8086, 0x269E, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich_pata_100_nomwdma1 },
         /* ICH8 Mobile PATA Controller */
         { 0x8086, 0x2850, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich_pata_100 },
 
@@ -487,6 +489,15 @@ static struct ata_port_info piix_port_info[] = {
                 .port_ops       = &ich_pata_ops,
         },
 
+        [ich_pata_100_nomwdma1] =
+        {
+                .flags          = PIIX_PATA_FLAGS | PIIX_FLAG_CHECKINTR,
+                .pio_mask       = ATA_PIO4,
+                .mwdma_mask     = ATA_MWDMA2_ONLY,
+                .udma_mask      = ATA_UDMA5,
+                .port_ops       = &ich_pata_ops,
+        },
+
         [ich5_sata] =
         {
                 .flags          = PIIX_SATA_FLAGS,
@@ -594,6 +605,7 @@ static const struct ich_laptop ich_laptop[] = {
         { 0x24CA, 0x1025, 0x003d },     /* ICH4 on ACER TM290 */
         { 0x266F, 0x1025, 0x0066 },     /* ICH6 on ACER Aspire 1694WLMi */
         { 0x2653, 0x1043, 0x82D8 },     /* ICH6M on Asus Eee 701 */
+        { 0x27df, 0x104d, 0x900e },     /* ICH7 on Sony TZ-90 */
         /* end marker */
         { 0, }
 };
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 17c5d48a75d2..c9242301cfa1 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4091,7 +4091,9 @@ int ata_dev_revalidate(struct ata_device *dev, unsigned int new_class,
 
         /* fail early if !ATA && !ATAPI to avoid issuing [P]IDENTIFY to PMP */
         if (ata_class_enabled(new_class) &&
-            new_class != ATA_DEV_ATA && new_class != ATA_DEV_ATAPI) {
+            new_class != ATA_DEV_ATA &&
+            new_class != ATA_DEV_ATAPI &&
+            new_class != ATA_DEV_SEMB) {
                 ata_dev_printk(dev, KERN_INFO, "class mismatch %u != %u\n",
                                dev->class, new_class);
                 rc = -ENODEV;
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 01831312c360..94919ad03df1 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -2783,6 +2783,12 @@ static int ata_eh_revalidate_and_attach(struct ata_link *link,
                 } else if (dev->class == ATA_DEV_UNKNOWN &&
                            ehc->tries[dev->devno] &&
                            ata_class_enabled(ehc->classes[dev->devno])) {
+                        /* Temporarily set dev->class, it will be
+                         * permanently set once all configurations are
+                         * complete.  This is necessary because new
+                         * device configuration is done in two
+                         * separate loops.
+                         */
                         dev->class = ehc->classes[dev->devno];
 
                         if (dev->class == ATA_DEV_PMP)
@@ -2790,6 +2796,11 @@ static int ata_eh_revalidate_and_attach(struct ata_link *link,
                         else
                                 rc = ata_dev_read_id(dev, &dev->class,
                                                      readid_flags, dev->id);
+
+                        /* read_id might have changed class, store and reset */
+                        ehc->classes[dev->devno] = dev->class;
+                        dev->class = ATA_DEV_UNKNOWN;
+
                         switch (rc) {
                         case 0:
                                 /* clear error info accumulated during probe */
@@ -2799,13 +2810,11 @@ static int ata_eh_revalidate_and_attach(struct ata_link *link,
                         case -ENOENT:
                                 /* IDENTIFY was issued to non-existent
                                  * device.  No need to reset.  Just
-                                 * thaw and kill the device.
+                                 * thaw and ignore the device.
                                  */
                                 ata_eh_thaw_port(ap);
-                                dev->class = ATA_DEV_UNKNOWN;
                                 break;
                         default:
-                                dev->class = ATA_DEV_UNKNOWN;
                                 goto err;
                         }
                 }
@@ -2826,11 +2835,15 @@ static int ata_eh_revalidate_and_attach(struct ata_link *link,
                     dev->class == ATA_DEV_PMP)
                         continue;
 
+                dev->class = ehc->classes[dev->devno];
+
                 ehc->i.flags |= ATA_EHI_PRINTINFO;
                 rc = ata_dev_configure(dev);
                 ehc->i.flags &= ~ATA_EHI_PRINTINFO;
-                if (rc)
+                if (rc) {
+                        dev->class = ATA_DEV_UNKNOWN;
                         goto err;
+                }
 
                 spin_lock_irqsave(ap->lock, flags);
                 ap->pflags |= ATA_PFLAG_SCSI_HOTPLUG;
@@ -3494,6 +3507,8 @@ static void ata_eh_handle_port_suspend(struct ata_port *ap)
  */
 static void ata_eh_handle_port_resume(struct ata_port *ap)
 {
+        struct ata_link *link;
+        struct ata_device *dev;
         unsigned long flags;
         int rc = 0;
 
@@ -3508,6 +3523,17 @@ static void ata_eh_handle_port_resume(struct ata_port *ap)
 
         WARN_ON(!(ap->pflags & ATA_PFLAG_SUSPENDED));
 
+        /*
+         * Error timestamps are in jiffies which doesn't run while
+         * suspended and PHY events during resume isn't too uncommon.
+         * When the two are combined, it can lead to unnecessary speed
+         * downs if the machine is suspended and resumed repeatedly.
+         * Clear error history.
+         */
+        ata_for_each_link(link, ap, HOST_FIRST)
+                ata_for_each_dev(dev, link, ALL)
+                        ata_ering_clear(&dev->ering);
+
         ata_acpi_set_state(ap, PMSG_ON);
 
         if (ap->ops->port_resume)
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 2733b0c90b75..342316064e9f 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -313,7 +313,7 @@ ata_scsi_em_message_show(struct device *dev, struct device_attribute *attr,
                 return ap->ops->em_show(ap, buf);
         return -EINVAL;
 }
-DEVICE_ATTR(em_message, S_IRUGO | S_IWUGO,
+DEVICE_ATTR(em_message, S_IRUGO | S_IWUSR,
                 ata_scsi_em_message_show, ata_scsi_em_message_store);
 EXPORT_SYMBOL_GPL(dev_attr_em_message);
 
@@ -366,7 +366,7 @@ ata_scsi_activity_store(struct device *dev, struct device_attribute *attr,
         }
         return -EINVAL;
 }
-DEVICE_ATTR(sw_activity, S_IWUGO | S_IRUGO, ata_scsi_activity_show,
+DEVICE_ATTR(sw_activity, S_IWUSR | S_IRUGO, ata_scsi_activity_show,
                         ata_scsi_activity_store);
 EXPORT_SYMBOL_GPL(dev_attr_sw_activity);
 
@@ -2142,13 +2142,14 @@ static unsigned int ata_scsiop_inq_89(struct ata_scsi_args *args, u8 *rbuf)
 
 static unsigned int ata_scsiop_inq_b1(struct ata_scsi_args *args, u8 *rbuf)
 {
+        int form_factor = ata_id_form_factor(args->id);
+        int media_rotation_rate = ata_id_rotation_rate(args->id);
+
         rbuf[1] = 0xb1;
         rbuf[3] = 0x3c;
-        if (ata_id_major_version(args->id) > 7) {
-                rbuf[4] = args->id[217] >> 8;
-                rbuf[5] = args->id[217];
-                rbuf[7] = args->id[168] & 0xf;
-        }
+        rbuf[4] = media_rotation_rate >> 8;
+        rbuf[5] = media_rotation_rate;
+        rbuf[7] = form_factor;
 
         return 0;
 }
@@ -2376,7 +2377,23 @@ saving_not_supp:
  */
 static unsigned int ata_scsiop_read_cap(struct ata_scsi_args *args, u8 *rbuf)
 {
-        u64 last_lba = args->dev->n_sectors - 1; /* LBA of the last block */
+        struct ata_device *dev = args->dev;
+        u64 last_lba = dev->n_sectors - 1; /* LBA of the last block */
+        u8 log_per_phys = 0;
+        u16 lowest_aligned = 0;
+        u16 word_106 = dev->id[106];
+        u16 word_209 = dev->id[209];
+
+        if ((word_106 & 0xc000) == 0x4000) {
+                /* Number and offset of logical sectors per physical sector */
+                if (word_106 & (1 << 13))
+                        log_per_phys = word_106 & 0xf;
+                if ((word_209 & 0xc000) == 0x4000) {
+                        u16 first = dev->id[209] & 0x3fff;
+                        if (first > 0)
+                                lowest_aligned = (1 << log_per_phys) - first;
+                }
+        }
 
         VPRINTK("ENTER\n");
 
@@ -2407,6 +2424,11 @@ static unsigned int ata_scsiop_read_cap(struct ata_scsi_args *args, u8 *rbuf)
                 /* sector size */
                 rbuf[10] = ATA_SECT_SIZE >> 8;
                 rbuf[11] = ATA_SECT_SIZE & 0xff;
+
+                rbuf[12] = 0;
+                rbuf[13] = log_per_phys;
+                rbuf[14] = (lowest_aligned >> 8) & 0x3f;
+                rbuf[15] = lowest_aligned;
         }
 
         return 0;
diff --git a/drivers/ata/pata_pdc202xx_old.c b/drivers/ata/pata_pdc202xx_old.c
index 5fedb3d4032b..2f3c9bed63d9 100644
--- a/drivers/ata/pata_pdc202xx_old.c
+++ b/drivers/ata/pata_pdc202xx_old.c
@@ -2,7 +2,7 @@
  * pata_pdc202xx_old.c  - Promise PDC202xx PATA for new ATA layer
  *                        (C) 2005 Red Hat Inc
  *                        Alan Cox <alan@lxorguk.ukuu.org.uk>
- *                        (C) 2007 Bartlomiej Zolnierkiewicz
+ *                        (C) 2007,2009 Bartlomiej Zolnierkiewicz
  *
  * Based in part on linux/drivers/ide/pci/pdc202xx_old.c
  *
@@ -158,7 +158,7 @@ static void pdc2026x_bmdma_start(struct ata_queued_cmd *qc)
         u32 len;
 
         /* Check we keep host level locking here */
-        if (adev->dma_mode >= XFER_UDMA_2)
+        if (adev->dma_mode > XFER_UDMA_2)
                 iowrite8(ioread8(clock) | sel66, clock);
         else
                 iowrite8(ioread8(clock) & ~sel66, clock);
@@ -212,7 +212,7 @@ static void pdc2026x_bmdma_stop(struct ata_queued_cmd *qc)
                 iowrite8(ioread8(clock) & ~sel66, clock);
         }
         /* Flip back to 33Mhz for PIO */
-        if (adev->dma_mode >= XFER_UDMA_2)
+        if (adev->dma_mode > XFER_UDMA_2)
                 iowrite8(ioread8(clock) & ~sel66, clock);
         ata_bmdma_stop(qc);
         pdc202xx_set_piomode(ap, adev);
diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
index c2e90e1fece0..36b8629203be 100644
--- a/drivers/ata/sata_fsl.c
+++ b/drivers/ata/sata_fsl.c
@@ -205,6 +205,7 @@ struct cmdhdr_tbl_entry {
  * Description information bitdefs
  */
 enum {
+        CMD_DESC_RES = (1 << 11),
         VENDOR_SPECIFIC_BIST = (1 << 10),
         CMD_DESC_SNOOP_ENABLE = (1 << 9),
         FPDMA_QUEUED_CMD = (1 << 8),
@@ -332,13 +333,14 @@ static unsigned int sata_fsl_fill_sg(struct ata_queued_cmd *qc, void *cmd_desc,
                 dma_addr_t sg_addr = sg_dma_address(sg);
                 u32 sg_len = sg_dma_len(sg);
 
-                VPRINTK("SATA FSL : fill_sg, sg_addr = 0x%x, sg_len = %d\n",
-                        sg_addr, sg_len);
+                VPRINTK("SATA FSL : fill_sg, sg_addr = 0x%llx, sg_len = %d\n",
+                        (unsigned long long)sg_addr, sg_len);
 
                 /* warn if each s/g element is not dword aligned */
                 if (sg_addr & 0x03)
                         ata_port_printk(qc->ap, KERN_ERR,
-                                        "s/g addr unaligned : 0x%x\n", sg_addr);
+                                        "s/g addr unaligned : 0x%llx\n",
+                                        (unsigned long long)sg_addr);
                 if (sg_len & 0x03)
                         ata_port_printk(qc->ap, KERN_ERR,
                                         "s/g len unaligned : 0x%x\n", sg_len);
@@ -387,7 +389,7 @@ static void sata_fsl_qc_prep(struct ata_queued_cmd *qc)
         void __iomem *hcr_base = host_priv->hcr_base;
         unsigned int tag = sata_fsl_tag(qc->tag, hcr_base);
         struct command_desc *cd;
-        u32 desc_info = CMD_DESC_SNOOP_ENABLE;
+        u32 desc_info = CMD_DESC_RES | CMD_DESC_SNOOP_ENABLE;
         u32 num_prde = 0;
         u32 ttl_dwords = 0;
         dma_addr_t cd_paddr;
@@ -840,7 +842,7 @@ issue_srst:
 
         /* device reset/SRST is a control register update FIS, uses tag0 */
         sata_fsl_setup_cmd_hdr_entry(pp, 0,
-                                     SRST_CMD | CMD_DESC_SNOOP_ENABLE, 0, 0, 5);
+                SRST_CMD | CMD_DESC_RES | CMD_DESC_SNOOP_ENABLE, 0, 0, 5);
 
         tf.ctl |= ATA_SRST;     /* setup SRST bit in taskfile control reg */
         ata_tf_to_fis(&tf, pmp, 0, cfis);
@@ -886,7 +888,8 @@ issue_srst:
          * using ATA signature D2H register FIS to the host controller.
          */
 
-        sata_fsl_setup_cmd_hdr_entry(pp, 0, CMD_DESC_SNOOP_ENABLE, 0, 0, 5);
+        sata_fsl_setup_cmd_hdr_entry(pp, 0, CMD_DESC_RES | CMD_DESC_SNOOP_ENABLE,
+                                      0, 0, 5);
 
         tf.ctl &= ~ATA_SRST;    /* 2nd H2D Ctl. register FIS */
         ata_tf_to_fis(&tf, pmp, 0, cfis);
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index 870dcfd82357..23714aefb825 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -293,6 +293,10 @@ enum {
         FISCFG_WAIT_DEV_ERR     = (1 << 8),     /* wait for host on DevErr */
         FISCFG_SINGLE_SYNC      = (1 << 16),    /* SYNC on DMA activation */
 
+        PHY_MODE9_GEN2          = 0x398,
+        PHY_MODE9_GEN1          = 0x39c,
+        PHYCFG_OFS              = 0x3a0,        /* only in 65n devices */
+
         MV5_PHY_MODE            = 0x74,
         MV5_LTMODE              = 0x30,
         MV5_PHY_CTL             = 0x0C,
@@ -609,6 +613,8 @@ static int mv_soc_reset_hc(struct mv_host_priv *hpriv,
 static void mv_soc_reset_flash(struct mv_host_priv *hpriv,
                                       void __iomem *mmio);
 static void mv_soc_reset_bus(struct ata_host *host, void __iomem *mmio);
+static void mv_soc_65n_phy_errata(struct mv_host_priv *hpriv,
+                                  void __iomem *mmio, unsigned int port);
 static void mv_reset_pci_bus(struct ata_host *host, void __iomem *mmio);
 static void mv_reset_channel(struct mv_host_priv *hpriv, void __iomem *mmio,
                              unsigned int port_no);
@@ -807,6 +813,14 @@ static const struct mv_hw_ops mv_soc_ops = {
         .reset_bus              = mv_soc_reset_bus,
 };
 
+static const struct mv_hw_ops mv_soc_65n_ops = {
+        .phy_errata             = mv_soc_65n_phy_errata,
+        .enable_leds            = mv_soc_enable_leds,
+        .reset_hc               = mv_soc_reset_hc,
+        .reset_flash            = mv_soc_reset_flash,
+        .reset_bus              = mv_soc_reset_bus,
+};
+
 /*
  * Functions
  */
@@ -3397,6 +3411,53 @@ static void mv_soc_reset_bus(struct ata_host *host, void __iomem *mmio)
         return;
 }
 
+static void mv_soc_65n_phy_errata(struct mv_host_priv *hpriv,
+                                  void __iomem *mmio, unsigned int port)
+{
+        void __iomem *port_mmio = mv_port_base(mmio, port);
+        u32     reg;
+
+        reg = readl(port_mmio + PHY_MODE3);
+        reg &= ~(0x3 << 27);    /* SELMUPF (bits 28:27) to 1 */
+        reg |= (0x1 << 27);
+        reg &= ~(0x3 << 29);    /* SELMUPI (bits 30:29) to 1 */
+        reg |= (0x1 << 29);
+        writel(reg, port_mmio + PHY_MODE3);
+
+        reg = readl(port_mmio + PHY_MODE4);
+        reg &= ~0x1;    /* SATU_OD8 (bit 0) to 0, reserved bit 16 must be set */
+        reg |= (0x1 << 16);
+        writel(reg, port_mmio + PHY_MODE4);
+
+        reg = readl(port_mmio + PHY_MODE9_GEN2);
+        reg &= ~0xf;    /* TXAMP[3:0] (bits 3:0) to 8 */
+        reg |= 0x8;
+        reg &= ~(0x1 << 14);    /* TXAMP[4] (bit 14) to 0 */
+        writel(reg, port_mmio + PHY_MODE9_GEN2);
+
+        reg = readl(port_mmio + PHY_MODE9_GEN1);
+        reg &= ~0xf;    /* TXAMP[3:0] (bits 3:0) to 8 */
+        reg |= 0x8;
+        reg &= ~(0x1 << 14);    /* TXAMP[4] (bit 14) to 0 */
+        writel(reg, port_mmio + PHY_MODE9_GEN1);
+}
+
+/**
+ *      soc_is_65 - check if the soc is 65 nano device
+ *
+ *      Detect the type of the SoC, this is done by reading the PHYCFG_OFS
+ *      register, this register should contain non-zero value and it exists only
+ *      in the 65 nano devices, when reading it from older devices we get 0.
+ */
+static bool soc_is_65n(struct mv_host_priv *hpriv)
+{
+        void __iomem *port0_mmio = mv_port_base(hpriv->base, 0);
+
+        if (readl(port0_mmio + PHYCFG_OFS))
+                return true;
+        return false;
+}
+
 static void mv_setup_ifcfg(void __iomem *port_mmio, int want_gen2i)
 {
         u32 ifcfg = readl(port_mmio + SATA_IFCFG);
@@ -3737,7 +3798,10 @@ static int mv_chip_id(struct ata_host *host, unsigned int board_idx)
                 }
                 break;
         case chip_soc:
-                hpriv->ops = &mv_soc_ops;
+                if (soc_is_65n(hpriv))
+                        hpriv->ops = &mv_soc_65n_ops;
+                else
+                        hpriv->ops = &mv_soc_ops;
                 hp_flags |= MV_HP_FLAG_SOC | MV_HP_GEN_IIE |
                         MV_HP_ERRATA_60X1C0;
                 break;
@@ -3800,7 +3864,8 @@ static int mv_init_host(struct ata_host *host, unsigned int board_idx)
         n_hc = mv_get_hc_count(host->ports[0]->flags);
 
         for (port = 0; port < host->n_ports; port++)
-                hpriv->ops->read_preamp(hpriv, port, mmio);
+                if (hpriv->ops->read_preamp)
+                        hpriv->ops->read_preamp(hpriv, port, mmio);
 
         rc = hpriv->ops->reset_hc(hpriv, mmio, n_hc);
         if (rc)
diff --git a/drivers/ata/sata_sx4.c b/drivers/ata/sata_sx4.c
index dce3dccced3f..eb05a3c82a9e 100644
--- a/drivers/ata/sata_sx4.c
+++ b/drivers/ata/sata_sx4.c
@@ -213,8 +213,9 @@ struct pdc_host_priv {
 
 
 static int pdc_sata_init_one(struct pci_dev *pdev, const struct pci_device_id *ent);
-static void pdc_eng_timeout(struct ata_port *ap);
-static void pdc_20621_phy_reset(struct ata_port *ap);
+static void pdc_error_handler(struct ata_port *ap);
+static void pdc_freeze(struct ata_port *ap);
+static void pdc_thaw(struct ata_port *ap);
 static int pdc_port_start(struct ata_port *ap);
 static void pdc20621_qc_prep(struct ata_queued_cmd *qc);
 static void pdc_tf_load_mmio(struct ata_port *ap, const struct ata_taskfile *tf);
@@ -233,6 +234,10 @@ static void pdc20621_put_to_dimm(struct ata_host *host,
                                  void *psource, u32 offset, u32 size);
 static void pdc20621_irq_clear(struct ata_port *ap);
 static unsigned int pdc20621_qc_issue(struct ata_queued_cmd *qc);
+static int pdc_softreset(struct ata_link *link, unsigned int *class,
+                         unsigned long deadline);
+static void pdc_post_internal_cmd(struct ata_queued_cmd *qc);
+static int pdc_check_atapi_dma(struct ata_queued_cmd *qc);
 
 
 static struct scsi_host_template pdc_sata_sht = {
@@ -243,20 +248,24 @@ static struct scsi_host_template pdc_sata_sht = {
 
 /* TODO: inherit from base port_ops after converting to new EH */
 static struct ata_port_operations pdc_20621_ops = {
-        .sff_tf_load            = pdc_tf_load_mmio,
-        .sff_tf_read            = ata_sff_tf_read,
-        .sff_check_status       = ata_sff_check_status,
-        .sff_exec_command       = pdc_exec_command_mmio,
-        .sff_dev_select         = ata_sff_dev_select,
-        .phy_reset              = pdc_20621_phy_reset,
+        .inherits               = &ata_sff_port_ops,
+
+        .check_atapi_dma        = pdc_check_atapi_dma,
         .qc_prep                = pdc20621_qc_prep,
         .qc_issue               = pdc20621_qc_issue,
-        .qc_fill_rtf            = ata_sff_qc_fill_rtf,
-        .sff_data_xfer          = ata_sff_data_xfer,
-        .eng_timeout            = pdc_eng_timeout,
-        .sff_irq_clear          = pdc20621_irq_clear,
-        .sff_irq_on             = ata_sff_irq_on,
+
+        .freeze                 = pdc_freeze,
+        .thaw                   = pdc_thaw,
+        .softreset              = pdc_softreset,
+        .error_handler          = pdc_error_handler,
+        .lost_interrupt         = ATA_OP_NULL,
+        .post_internal_cmd      = pdc_post_internal_cmd,
+
         .port_start             = pdc_port_start,
+
+        .sff_tf_load            = pdc_tf_load_mmio,
+        .sff_exec_command       = pdc_exec_command_mmio,
+        .sff_irq_clear          = pdc20621_irq_clear,
 };
 
 static const struct ata_port_info pdc_port_info[] = {
@@ -310,14 +319,6 @@ static int pdc_port_start(struct ata_port *ap)
         return 0;
 }
 
-static void pdc_20621_phy_reset(struct ata_port *ap)
-{
-        VPRINTK("ENTER\n");
-        ap->cbl = ATA_CBL_SATA;
-        ata_port_probe(ap);
-        ata_bus_reset(ap);
-}
-
 static inline void pdc20621_ata_sg(struct ata_taskfile *tf, u8 *buf,
                                    unsigned int portno,
                                            unsigned int total_len)
@@ -686,8 +687,11 @@ static void pdc20621_packet_start(struct ata_queued_cmd *qc)
 static unsigned int pdc20621_qc_issue(struct ata_queued_cmd *qc)
 {
         switch (qc->tf.protocol) {
-        case ATA_PROT_DMA:
         case ATA_PROT_NODATA:
+                if (qc->tf.flags & ATA_TFLAG_POLLING)
+                        break;
+                /*FALLTHROUGH*/
+        case ATA_PROT_DMA:
                 pdc20621_packet_start(qc);
                 return 0;
 
@@ -786,12 +790,7 @@ static inline unsigned int pdc20621_host_intr(struct ata_port *ap,
 
 static void pdc20621_irq_clear(struct ata_port *ap)
 {
-        struct ata_host *host = ap->host;
-        void __iomem *mmio = host->iomap[PDC_MMIO_BAR];
-
-        mmio += PDC_CHIP0_OFS;
-
-        readl(mmio + PDC_20621_SEQMASK);
+        ioread8(ap->ioaddr.status_addr);
 }
 
 static irqreturn_t pdc20621_interrupt(int irq, void *dev_instance)
@@ -859,46 +858,119 @@ static irqreturn_t pdc20621_interrupt(int irq, void *dev_instance)
         return IRQ_RETVAL(handled);
 }
 
-static void pdc_eng_timeout(struct ata_port *ap)
+static void pdc_freeze(struct ata_port *ap)
 {
-        u8 drv_stat;
-        struct ata_host *host = ap->host;
-        struct ata_queued_cmd *qc;
-        unsigned long flags;
+        void __iomem *mmio = ap->ioaddr.cmd_addr;
+        u32 tmp;
 
-        DPRINTK("ENTER\n");
+        /* FIXME: if all 4 ATA engines are stopped, also stop HDMA engine */
 
-        spin_lock_irqsave(&host->lock, flags);
+        tmp = readl(mmio + PDC_CTLSTAT);
+        tmp |= PDC_MASK_INT;
+        tmp &= ~PDC_DMA_ENABLE;
+        writel(tmp, mmio + PDC_CTLSTAT);
+        readl(mmio + PDC_CTLSTAT); /* flush */
+}
 
-        qc = ata_qc_from_tag(ap, ap->link.active_tag);
+static void pdc_thaw(struct ata_port *ap)
+{
+        void __iomem *mmio = ap->ioaddr.cmd_addr;
+        u32 tmp;
 
-        switch (qc->tf.protocol) {
-        case ATA_PROT_DMA:
-        case ATA_PROT_NODATA:
-                ata_port_printk(ap, KERN_ERR, "command timeout\n");
-                qc->err_mask |= __ac_err_mask(ata_wait_idle(ap));
-                break;
+        /* FIXME: start HDMA engine, if zero ATA engines running */
 
-        default:
-                drv_stat = ata_sff_busy_wait(ap, ATA_BUSY | ATA_DRQ, 1000);
+        /* clear IRQ */
+        ioread8(ap->ioaddr.status_addr);
 
-                ata_port_printk(ap, KERN_ERR,
-                                "unknown timeout, cmd 0x%x stat 0x%x\n",
-                                qc->tf.command, drv_stat);
+        /* turn IRQ back on */
+        tmp = readl(mmio + PDC_CTLSTAT);
+        tmp &= ~PDC_MASK_INT;
+        writel(tmp, mmio + PDC_CTLSTAT);
+        readl(mmio + PDC_CTLSTAT); /* flush */
+}
 
-                qc->err_mask |= ac_err_mask(drv_stat);
-                break;
+static void pdc_reset_port(struct ata_port *ap)
+{
+        void __iomem *mmio = ap->ioaddr.cmd_addr + PDC_CTLSTAT;
+        unsigned int i;
+        u32 tmp;
+
+        /* FIXME: handle HDMA copy engine */
+
+        for (i = 11; i > 0; i--) {
+                tmp = readl(mmio);
+                if (tmp & PDC_RESET)
+                        break;
+
+                udelay(100);
+
+                tmp |= PDC_RESET;
+                writel(tmp, mmio);
         }
 
-        spin_unlock_irqrestore(&host->lock, flags);
-        ata_eh_qc_complete(qc);
-        DPRINTK("EXIT\n");
+        tmp &= ~PDC_RESET;
+        writel(tmp, mmio);
+        readl(mmio);    /* flush */
+}
+
+static int pdc_softreset(struct ata_link *link, unsigned int *class,
+                         unsigned long deadline)
+{
+        pdc_reset_port(link->ap);
+        return ata_sff_softreset(link, class, deadline);
+}
+
+static void pdc_error_handler(struct ata_port *ap)
+{
+        if (!(ap->pflags & ATA_PFLAG_FROZEN))
+                pdc_reset_port(ap);
+
+        ata_std_error_handler(ap);
+}
+
+static void pdc_post_internal_cmd(struct ata_queued_cmd *qc)
+{
+        struct ata_port *ap = qc->ap;
+
+        /* make DMA engine forget about the failed command */
+        if (qc->flags & ATA_QCFLAG_FAILED)
+                pdc_reset_port(ap);
+}
+
+static int pdc_check_atapi_dma(struct ata_queued_cmd *qc)
+{
+        u8 *scsicmd = qc->scsicmd->cmnd;
+        int pio = 1; /* atapi dma off by default */
+
+        /* Whitelist commands that may use DMA. */
+        switch (scsicmd[0]) {
+        case WRITE_12:
+        case WRITE_10:
+        case WRITE_6:
+        case READ_12:
+        case READ_10:
+        case READ_6:
+        case 0xad: /* READ_DVD_STRUCTURE */
+        case 0xbe: /* READ_CD */
+                pio = 0;
+        }
+        /* -45150 (FFFF4FA2) to -1 (FFFFFFFF) shall use PIO mode */
+        if (scsicmd[0] == WRITE_10) {
+                unsigned int lba =
+                        (scsicmd[2] << 24) |
+                        (scsicmd[3] << 16) |
+                        (scsicmd[4] << 8) |
+                        scsicmd[5];
+                if (lba >= 0xFFFF4FA2)
+                        pio = 1;
+        }
+        return pio;
 }
 
 static void pdc_tf_load_mmio(struct ata_port *ap, const struct ata_taskfile *tf)
 {
         WARN_ON(tf->protocol == ATA_PROT_DMA ||
-                tf->protocol == ATA_PROT_NODATA);
+                tf->protocol == ATAPI_PROT_DMA);
         ata_sff_tf_load(ap, tf);
 }
 
@@ -906,7 +978,7 @@ static void pdc_tf_load_mmio(struct ata_port *ap, const struct ata_taskfile *tf)
 static void pdc_exec_command_mmio(struct ata_port *ap, const struct ata_taskfile *tf)
 {
         WARN_ON(tf->protocol == ATA_PROT_DMA ||
-                tf->protocol == ATA_PROT_NODATA);
+                tf->protocol == ATAPI_PROT_DMA);
         ata_sff_exec_command(ap, tf);
 }
 
diff --git a/drivers/base/iommu.c b/drivers/base/iommu.c
index 9f0e672f4be8..8ad4ffea6920 100644
--- a/drivers/base/iommu.c
+++ b/drivers/base/iommu.c
@@ -18,6 +18,8 @@
 
 #include <linux/bug.h>
 #include <linux/types.h>
+#include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/iommu.h>
 
diff --git a/drivers/base/platform.c b/drivers/base/platform.c
index b5b6c973a2e0..8b4708e06244 100644
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -217,7 +217,6 @@ int platform_device_add_data(struct platform_device *pdev, const void *data,
         if (d) {
                 memcpy(d, data, size);
                 pdev->dev.platform_data = d;
-                pdev->platform_data = d;
         }
         return d ? 0 : -ENOMEM;
 }
@@ -247,21 +246,6 @@ int platform_device_add(struct platform_device *pdev)
         else
                 dev_set_name(&pdev->dev, pdev->name);
 
-        /* We will remove platform_data field from struct device
-        * if all platform devices pass its platform specific data
-        * from platform_device. The conversion is going to be a
-        * long time, so we allow the two cases coexist to make
-        * this kind of fix more easily*/
-        if (pdev->platform_data && pdev->dev.platform_data) {
-                printk(KERN_ERR
-                               "%s: use which platform_data?\n",
-                               dev_name(&pdev->dev));
-        } else if (pdev->platform_data) {
-                pdev->dev.platform_data = pdev->platform_data;
-        } else if (pdev->dev.platform_data) {
-                pdev->platform_data = pdev->dev.platform_data;
-        }
-
         for (i = 0; i < pdev->num_resources; i++) {
                 struct resource *p, *r = &pdev->resource[i];
 
@@ -1028,7 +1012,7 @@ static __initdata LIST_HEAD(early_platform_device_list);
 
 /**
  * early_platform_driver_register
- * @edrv: early_platform driver structure
+ * @epdrv: early_platform driver structure
  * @buf: string passed from early_param()
  */
 int __init early_platform_driver_register(struct early_platform_driver *epdrv,
@@ -1112,7 +1096,7 @@ void __init early_platform_driver_register_all(char *class_str)
 
 /**
  * early_platform_match
- * @edrv: early platform driver structure
+ * @epdrv: early platform driver structure
  * @id: id to match against
  */
 static  __init struct platform_device *
@@ -1130,7 +1114,7 @@ early_platform_match(struct early_platform_driver *epdrv, int id)
 
 /**
  * early_platform_left
- * @edrv: early platform driver structure
+ * @epdrv: early platform driver structure
  * @id: return true if id or above exists
  */
 static  __init int early_platform_left(struct early_platform_driver *epdrv,
diff --git a/drivers/char/random.c b/drivers/char/random.c
index f824ef8a9273..b2ced39d76b2 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1665,15 +1665,20 @@ EXPORT_SYMBOL(secure_dccp_sequence_number);
  * value is not cryptographically secure but for several uses the cost of
  * depleting entropy is too high
  */
+DEFINE_PER_CPU(__u32 [4], get_random_int_hash);
 unsigned int get_random_int(void)
 {
-        /*
-         * Use IP's RNG. It suits our purpose perfectly: it re-keys itself
-         * every second, from the entropy pool (and thus creates a limited
-         * drain on it), and uses halfMD4Transform within the second. We
-         * also mix it with jiffies and the PID:
-         */
-        return secure_ip_id((__force __be32)(current->pid + jiffies));
+        struct keydata *keyptr;
+        __u32 *hash = get_cpu_var(get_random_int_hash);
+        int ret;
+
+        keyptr = get_keyptr();
+        hash[0] += current->pid + jiffies + get_cycles() + (int)(long)&ret;
+
+        ret = half_md4_transform(hash, keyptr->secret);
+        put_cpu_var(get_random_int_hash);
+
+        return ret;
 }
 
 /*
diff --git a/drivers/char/sysrq.c b/drivers/char/sysrq.c
index b0a6a3e51924..d6a807f4077d 100644
--- a/drivers/char/sysrq.c
+++ b/drivers/char/sysrq.c
@@ -406,7 +406,7 @@ static struct sysrq_key_op *sysrq_key_table[36] = {
         &sysrq_showlocks_op,            /* d */
         &sysrq_term_op,                 /* e */
         &sysrq_moom_op,                 /* f */
-        /* g: May be registered by ppc for kgdb */
+        /* g: May be registered for the kernel debugger */
         NULL,                           /* g */
         NULL,                           /* h - reserved for help */
         &sysrq_kill_op,                 /* i */
@@ -431,7 +431,7 @@ static struct sysrq_key_op *sysrq_key_table[36] = {
         &sysrq_sync_op,                 /* s */
         &sysrq_showstate_op,            /* t */
         &sysrq_mountro_op,              /* u */
-        /* v: May be registered at init time by SMP VOYAGER */
+        /* v: May be registered for frame buffer console restore */
         NULL,                           /* v */
         &sysrq_showstate_blocked_op,    /* w */
         /* x: May be registered on ppc/powerpc for xmon */
diff --git a/drivers/char/vt_ioctl.c b/drivers/char/vt_ioctl.c
index a2dee0eb6dad..e6ce632a393e 100644
--- a/drivers/char/vt_ioctl.c
+++ b/drivers/char/vt_ioctl.c
@@ -400,6 +400,9 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
         case KIOCSOUND:
                 if (!perm)
                         goto eperm;
+                /* FIXME: This is an old broken API but we need to keep it
+                   supported and somehow separate the historic advertised
+                   tick rate from any real one */
                 if (arg)
                         arg = CLOCK_TICK_RATE / arg;
                 kd_mksound(arg, 0);
@@ -417,6 +420,9 @@ int vt_ioctl(struct tty_struct *tty, struct file * file,
                  */
                 ticks = HZ * ((arg >> 16) & 0xffff) / 1000;
                 count = ticks ? (arg & 0xffff) : 0;
+                /* FIXME: This is an old broken API but we need to keep it
+                   supported and somehow separate the historic advertised
+                   tick rate from any real one */
                 if (count)
                         count = CLOCK_TICK_RATE / count;
                 kd_mksound(count, ticks);
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index 92438e9dacc3..5a87384ea4ff 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -804,11 +804,14 @@ dma_async_memcpy_buf_to_buf(struct dma_chan *chan, void *dest,
         dma_addr_t dma_dest, dma_src;
         dma_cookie_t cookie;
         int cpu;
+        unsigned long flags;
 
         dma_src = dma_map_single(dev->dev, src, len, DMA_TO_DEVICE);
         dma_dest = dma_map_single(dev->dev, dest, len, DMA_FROM_DEVICE);
-        tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len,
-                                         DMA_CTRL_ACK);
+        flags = DMA_CTRL_ACK |
+                DMA_COMPL_SRC_UNMAP_SINGLE |
+                DMA_COMPL_DEST_UNMAP_SINGLE;
+        tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len, flags);
 
         if (!tx) {
                 dma_unmap_single(dev->dev, dma_src, len, DMA_TO_DEVICE);
@@ -850,11 +853,12 @@ dma_async_memcpy_buf_to_pg(struct dma_chan *chan, struct page *page,
         dma_addr_t dma_dest, dma_src;
         dma_cookie_t cookie;
         int cpu;
+        unsigned long flags;
 
         dma_src = dma_map_single(dev->dev, kdata, len, DMA_TO_DEVICE);
         dma_dest = dma_map_page(dev->dev, page, offset, len, DMA_FROM_DEVICE);
-        tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len,
-                                         DMA_CTRL_ACK);
+        flags = DMA_CTRL_ACK | DMA_COMPL_SRC_UNMAP_SINGLE;
+        tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len, flags);
 
         if (!tx) {
                 dma_unmap_single(dev->dev, dma_src, len, DMA_TO_DEVICE);
@@ -898,12 +902,13 @@ dma_async_memcpy_pg_to_pg(struct dma_chan *chan, struct page *dest_pg,
         dma_addr_t dma_dest, dma_src;
         dma_cookie_t cookie;
         int cpu;
+        unsigned long flags;
 
         dma_src = dma_map_page(dev->dev, src_pg, src_off, len, DMA_TO_DEVICE);
         dma_dest = dma_map_page(dev->dev, dest_pg, dest_off, len,
                                 DMA_FROM_DEVICE);
-        tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len,
-                                         DMA_CTRL_ACK);
+        flags = DMA_CTRL_ACK;
+        tx = dev->device_prep_dma_memcpy(chan, dma_dest, dma_src, len, flags);
 
         if (!tx) {
                 dma_unmap_page(dev->dev, dma_src, len, DMA_TO_DEVICE);
diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
index a27c0fb1bc11..fb7da5141e96 100644
--- a/drivers/dma/dmatest.c
+++ b/drivers/dma/dmatest.c
@@ -531,9 +531,7 @@ static int __init dmatest_init(void)
                 chan = dma_request_channel(mask, filter, NULL);
                 if (chan) {
                         err = dmatest_add_channel(chan);
-                        if (err == 0)
-                                continue;
-                        else {
+                        if (err) {
                                 dma_release_channel(chan);
                                 break; /* add_channel failed, punt */
                         }
diff --git a/drivers/dma/ioat_dma.c b/drivers/dma/ioat_dma.c
index e4fc33c1c32f..1955ee8d6d20 100644
--- a/drivers/dma/ioat_dma.c
+++ b/drivers/dma/ioat_dma.c
@@ -1063,22 +1063,31 @@ static void ioat_dma_cleanup_tasklet(unsigned long data)
 static void
 ioat_dma_unmap(struct ioat_dma_chan *ioat_chan, struct ioat_desc_sw *desc)
 {
-        /*
-         * yes we are unmapping both _page and _single
-         * alloc'd regions with unmap_page. Is this
-         * *really* that bad?
-         */
-        if (!(desc->async_tx.flags & DMA_COMPL_SKIP_DEST_UNMAP))
-                pci_unmap_page(ioat_chan->device->pdev,
-                                pci_unmap_addr(desc, dst),
-                                pci_unmap_len(desc, len),
-                                PCI_DMA_FROMDEVICE);
-
-        if (!(desc->async_tx.flags & DMA_COMPL_SKIP_SRC_UNMAP))
-                pci_unmap_page(ioat_chan->device->pdev,
-                                pci_unmap_addr(desc, src),
-                                pci_unmap_len(desc, len),
-                                PCI_DMA_TODEVICE);
+        if (!(desc->async_tx.flags & DMA_COMPL_SKIP_DEST_UNMAP)) {
+                if (desc->async_tx.flags & DMA_COMPL_DEST_UNMAP_SINGLE)
+                        pci_unmap_single(ioat_chan->device->pdev,
+                                         pci_unmap_addr(desc, dst),
+                                         pci_unmap_len(desc, len),
+                                         PCI_DMA_FROMDEVICE);
+                else
+                        pci_unmap_page(ioat_chan->device->pdev,
+                                       pci_unmap_addr(desc, dst),
+                                       pci_unmap_len(desc, len),
+                                       PCI_DMA_FROMDEVICE);
+        }
+
+        if (!(desc->async_tx.flags & DMA_COMPL_SKIP_SRC_UNMAP)) {
+                if (desc->async_tx.flags & DMA_COMPL_SRC_UNMAP_SINGLE)
+                        pci_unmap_single(ioat_chan->device->pdev,
+                                         pci_unmap_addr(desc, src),
+                                         pci_unmap_len(desc, len),
+                                         PCI_DMA_TODEVICE);
+                else
+                        pci_unmap_page(ioat_chan->device->pdev,
+                                       pci_unmap_addr(desc, src),
+                                       pci_unmap_len(desc, len),
+                                       PCI_DMA_TODEVICE);
+        }
 }
 
 /**
@@ -1363,6 +1372,7 @@ static int ioat_dma_self_test(struct ioatdma_device *device)
         int err = 0;
         struct completion cmp;
         unsigned long tmo;
+        unsigned long flags;
 
         src = kzalloc(sizeof(u8) * IOAT_TEST_SIZE, GFP_KERNEL);
         if (!src)
@@ -1392,8 +1402,9 @@ static int ioat_dma_self_test(struct ioatdma_device *device)
                                  DMA_TO_DEVICE);
         dma_dest = dma_map_single(dma_chan->device->dev, dest, IOAT_TEST_SIZE,
                                   DMA_FROM_DEVICE);
+        flags = DMA_COMPL_SRC_UNMAP_SINGLE | DMA_COMPL_DEST_UNMAP_SINGLE;
         tx = device->common.device_prep_dma_memcpy(dma_chan, dma_dest, dma_src,
-                                                   IOAT_TEST_SIZE, 0);
+                                                   IOAT_TEST_SIZE, flags);
         if (!tx) {
                 dev_err(&device->pdev->dev,
                         "Self-test prep failed, disabling\n");
diff --git a/drivers/dma/ipu/ipu_idmac.c b/drivers/dma/ipu/ipu_idmac.c
index e202a6ce5573..9a5bc1a7389e 100644
--- a/drivers/dma/ipu/ipu_idmac.c
+++ b/drivers/dma/ipu/ipu_idmac.c
@@ -1272,7 +1272,8 @@ static irqreturn_t idmac_interrupt(int irq, void *dev_id)
         /* Other interrupts do not interfere with this channel */
         spin_lock(&ichan->lock);
         if (unlikely(chan_id != IDMAC_SDC_0 && chan_id != IDMAC_SDC_1 &&
-                     ((curbuf >> chan_id) & 1) == ichan->active_buffer)) {
+                     ((curbuf >> chan_id) & 1) == ichan->active_buffer &&
+                     !list_is_last(ichan->queue.next, &ichan->queue))) {
                 int i = 100;
 
                 /* This doesn't help. See comment in ipu_disable_channel() */
@@ -1547,7 +1548,7 @@ static irqreturn_t ic_sof_irq(int irq, void *dev_id)
         struct idmac_channel *ichan = dev_id;
         printk(KERN_DEBUG "Got SOF IRQ %d on Channel %d\n",
                irq, ichan->dma_chan.chan_id);
-        disable_irq(irq);
+        disable_irq_nosync(irq);
         return IRQ_HANDLED;
 }
 
@@ -1556,7 +1557,7 @@ static irqreturn_t ic_eof_irq(int irq, void *dev_id)
         struct idmac_channel *ichan = dev_id;
         printk(KERN_DEBUG "Got EOF IRQ %d on Channel %d\n",
                irq, ichan->dma_chan.chan_id);
-        disable_irq(irq);
+        disable_irq_nosync(irq);
         return IRQ_HANDLED;
 }
 
diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
index 3a22eb9be378..17b24c580c09 100644
--- a/drivers/gpu/drm/Kconfig
+++ b/drivers/gpu/drm/Kconfig
@@ -71,6 +71,7 @@ config DRM_I915
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
         select FB
+        select FRAMEBUFFER_CONSOLE if !EMBEDDED
         tristate "i915 driver"
         help
           Choose this option if you have a system that has Intel 830M, 845G,
diff --git a/drivers/gpu/drm/drm_crtc_helper.c b/drivers/gpu/drm/drm_crtc_helper.c
index a04639dc633d..45890447feec 100644
--- a/drivers/gpu/drm/drm_crtc_helper.c
+++ b/drivers/gpu/drm/drm_crtc_helper.c
@@ -561,7 +561,6 @@ bool drm_crtc_helper_set_mode(struct drm_crtc *crtc,
         int saved_x, saved_y;
         struct drm_encoder *encoder;
         bool ret = true;
-        bool depth_changed, bpp_changed;
 
         adjusted_mode = drm_mode_duplicate(dev, mode);
 
@@ -570,15 +569,6 @@ bool drm_crtc_helper_set_mode(struct drm_crtc *crtc,
         if (!crtc->enabled)
                 return true;
 
-        if (old_fb && crtc->fb) {
-                depth_changed = (old_fb->depth != crtc->fb->depth);
-                bpp_changed = (old_fb->bits_per_pixel !=
-                               crtc->fb->bits_per_pixel);
-        } else {
-                depth_changed = true;
-                bpp_changed = true;
-        }
-
         saved_mode = crtc->mode;
         saved_x = crtc->x;
         saved_y = crtc->y;
@@ -590,15 +580,6 @@ bool drm_crtc_helper_set_mode(struct drm_crtc *crtc,
         crtc->x = x;
         crtc->y = y;
 
-        if (drm_mode_equal(&saved_mode, &crtc->mode)) {
-                if (saved_x != crtc->x || saved_y != crtc->y ||
-                    depth_changed || bpp_changed) {
-                        ret = !crtc_funcs->mode_set_base(crtc, crtc->x, crtc->y,
-                                                         old_fb);
-                        goto done;
-                }
-        }
-
         /* Pass our mode to the connectors and the CRTC to give them a chance to
          * adjust it according to limitations or connector properties, and also
          * a chance to reject the mode entirely.
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index c4ada8b6295b..f01def16a669 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -456,7 +456,8 @@ int drm_ioctl(struct inode *inode, struct file *filp,
                 retcode = -EINVAL;
         } else if (((ioctl->flags & DRM_ROOT_ONLY) && !capable(CAP_SYS_ADMIN)) ||
                    ((ioctl->flags & DRM_AUTH) && !file_priv->authenticated) ||
-                   ((ioctl->flags & DRM_MASTER) && !file_priv->is_master)) {
+                   ((ioctl->flags & DRM_MASTER) && !file_priv->is_master) ||
+                   (!(ioctl->flags & DRM_CONTROL_ALLOW) && (file_priv->minor->type == DRM_MINOR_CONTROL))) {
                 retcode = -EACCES;
         } else {
                 if (cmd & (IOC_IN | IOC_OUT)) {
diff --git a/drivers/gpu/drm/drm_stub.c b/drivers/gpu/drm/drm_stub.c
index ef878615c49f..b9631e3a1ea6 100644
--- a/drivers/gpu/drm/drm_stub.c
+++ b/drivers/gpu/drm/drm_stub.c
@@ -402,14 +402,14 @@ int drm_get_dev(struct pci_dev *pdev, const struct pci_device_id *ent,
         if (dev->driver->load) {
                 ret = dev->driver->load(dev, ent->driver_data);
                 if (ret)
-                        goto err_g3;
+                        goto err_g4;
         }
 
         /* setup the grouping for the legacy output */
         if (drm_core_check_feature(dev, DRIVER_MODESET)) {
                 ret = drm_mode_group_init_legacy_group(dev, &dev->primary->mode_group);
                 if (ret)
-                        goto err_g3;
+                        goto err_g4;
         }
 
         list_add_tail(&dev->driver_item, &driver->device_list);
@@ -420,8 +420,11 @@ int drm_get_dev(struct pci_dev *pdev, const struct pci_device_id *ent,
 
         return 0;
 
-err_g3:
+err_g4:
         drm_put_minor(&dev->primary);
+err_g3:
+        if (drm_core_check_feature(dev, DRIVER_MODESET))
+                drm_put_minor(&dev->control);
 err_g2:
         pci_disable_device(pdev);
 err_g1:
@@ -502,11 +505,11 @@ void drm_put_dev(struct drm_device *dev)
                 dev->agp = NULL;
         }
 
-        drm_ht_remove(&dev->map_hash);
-        drm_ctxbitmap_cleanup(dev);
-
         list_for_each_entry_safe(r_list, list_temp, &dev->maplist, head)
                 drm_rmmap(dev, r_list->map);
+        drm_ht_remove(&dev->map_hash);
+
+        drm_ctxbitmap_cleanup(dev);
 
         if (drm_core_check_feature(dev, DRIVER_MODESET))
                 drm_put_minor(&dev->control);
diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c
index 022876ae34f0..8f9372921f82 100644
--- a/drivers/gpu/drm/drm_sysfs.c
+++ b/drivers/gpu/drm/drm_sysfs.c
@@ -489,9 +489,7 @@ int drm_sysfs_device_add(struct drm_minor *minor)
 
         return 0;
 
-        device_unregister(&minor->kdev);
 err_out:
-
         return err;
 }
 
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index 051134c56aef..53d544552625 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -1011,8 +1011,16 @@ static int i915_load_modeset_init(struct drm_device *dev)
         /* Basic memrange allocator for stolen space (aka vram) */
         drm_mm_init(&dev_priv->vram, 0, prealloc_size);
 
-        /* Let GEM Manage from end of prealloc space to end of aperture */
-        i915_gem_do_init(dev, prealloc_size, agp_size);
+        /* Let GEM Manage from end of prealloc space to end of aperture.
+         *
+         * However, leave one page at the end still bound to the scratch page.
+         * There are a number of places where the hardware apparently
+         * prefetches past the end of the object, and we've seen multiple
+         * hangs with the GPU head pointer stuck in a batchbuffer bound
+         * at the last page of the aperture.  One page should be enough to
+         * keep any prefetching inside of the aperture.
+         */
+        i915_gem_do_init(dev, prealloc_size, agp_size - 4096);
 
         ret = i915_gem_init_ringbuffer(dev);
         if (ret)
@@ -1350,6 +1358,7 @@ struct drm_ioctl_desc i915_ioctls[] = {
         DRM_IOCTL_DEF(DRM_I915_GEM_SET_TILING, i915_gem_set_tiling, 0),
         DRM_IOCTL_DEF(DRM_I915_GEM_GET_TILING, i915_gem_get_tiling, 0),
         DRM_IOCTL_DEF(DRM_I915_GEM_GET_APERTURE, i915_gem_get_aperture_ioctl, 0),
+        DRM_IOCTL_DEF(DRM_I915_GET_PIPE_FROM_CRTC_ID, intel_get_pipe_from_crtc_id, 0),
 };
 
 int i915_max_ioctl = DRM_ARRAY_SIZE(i915_ioctls);
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 25065923b8a8..9b149fe824c3 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -283,6 +283,7 @@ typedef struct drm_i915_private {
         u8 saveAR[21];
         u8 saveDACMASK;
         u8 saveCR[37];
+        uint64_t saveFENCE[16];
 
         struct {
                 struct drm_mm gtt_space;
@@ -705,13 +706,8 @@ extern void intel_modeset_cleanup(struct drm_device *dev);
 #define I915_WRITE16(reg, val)  writel(val, dev_priv->regs + (reg))
 #define I915_READ8(reg)         readb(dev_priv->regs + (reg))
 #define I915_WRITE8(reg, val)   writeb(val, dev_priv->regs + (reg))
-#ifdef writeq
 #define I915_WRITE64(reg, val)  writeq(val, dev_priv->regs + (reg))
-#else
-#define I915_WRITE64(reg, val)  (writel(val, dev_priv->regs + (reg)), \
-                                 writel(upper_32_bits(val), dev_priv->regs + \
-                                        (reg) + 4))
-#endif
+#define I915_READ64(reg)        readq(dev_priv->regs + (reg))
 #define POSTING_READ(reg)       (void)I915_READ(reg)
 
 #define I915_VERBOSE 0
@@ -790,7 +786,8 @@ extern int i915_wait_ring(struct drm_device * dev, int n, const char *caller);
                        (dev)->pci_device == 0x2E22 || \
                        (dev)->pci_device == 0x2E32)
 
-#define IS_I965GM(dev) ((dev)->pci_device == 0x2A02)
+#define IS_I965GM(dev) ((dev)->pci_device == 0x2A02 || \
+                        (dev)->pci_device == 0x2A12)
 
 #define IS_GM45(dev) ((dev)->pci_device == 0x2A42)
 
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index ee896d91c5bc..b189b49c7602 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1691,11 +1691,20 @@ static int
 i915_wait_request(struct drm_device *dev, uint32_t seqno)
 {
         drm_i915_private_t *dev_priv = dev->dev_private;
+        u32 ier;
         int ret = 0;
 
         BUG_ON(seqno == 0);
 
         if (!i915_seqno_passed(i915_get_gem_seqno(dev), seqno)) {
+                ier = I915_READ(IER);
+                if (!ier) {
+                        DRM_ERROR("something (likely vbetool) disabled "
+                                  "interrupts, re-enabling\n");
+                        i915_driver_irq_preinstall(dev);
+                        i915_driver_irq_postinstall(dev);
+                }
+
                 dev_priv->mm.waiting_gem_seqno = seqno;
                 i915_user_irq_get(dev);
                 ret = wait_event_interruptible(dev_priv->irq_queue,
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 521194732266..15da44cf21b1 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -526,6 +526,7 @@
 #define   DPLLA_INPUT_BUFFER_ENABLE     (1 << 0)
 #define D_STATE         0x6104
 #define CG_2D_DIS       0x6200
+#define DPCUNIT_CLOCK_GATE_DISABLE      (1 << 24)
 #define CG_3D_DIS       0x6204
 
 /*
diff --git a/drivers/gpu/drm/i915/i915_suspend.c b/drivers/gpu/drm/i915/i915_suspend.c
index d669cc2b42c0..ce8a21344a71 100644
--- a/drivers/gpu/drm/i915/i915_suspend.c
+++ b/drivers/gpu/drm/i915/i915_suspend.c
@@ -349,6 +349,18 @@ int i915_save_state(struct drm_device *dev)
         for (i = 0; i < 3; i++)
                 dev_priv->saveSWF2[i] = I915_READ(SWF30 + (i << 2));
 
+        /* Fences */
+        if (IS_I965G(dev)) {
+                for (i = 0; i < 16; i++)
+                        dev_priv->saveFENCE[i] = I915_READ64(FENCE_REG_965_0 + (i * 8));
+        } else {
+                for (i = 0; i < 8; i++)
+                        dev_priv->saveFENCE[i] = I915_READ(FENCE_REG_830_0 + (i * 4));
+
+                if (IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev))
+                        for (i = 0; i < 8; i++)
+                                dev_priv->saveFENCE[i+8] = I915_READ(FENCE_REG_945_8 + (i * 4));
+        }
         i915_save_vga(dev);
 
         return 0;
@@ -371,6 +383,18 @@ int i915_restore_state(struct drm_device *dev)
         /* Display arbitration */
         I915_WRITE(DSPARB, dev_priv->saveDSPARB);
 
+        /* Fences */
+        if (IS_I965G(dev)) {
+                for (i = 0; i < 16; i++)
+                        I915_WRITE64(FENCE_REG_965_0 + (i * 8), dev_priv->saveFENCE[i]);
+        } else {
+                for (i = 0; i < 8; i++)
+                        I915_WRITE(FENCE_REG_830_0 + (i * 4), dev_priv->saveFENCE[i]);
+                if (IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev))
+                        for (i = 0; i < 8; i++)
+                                I915_WRITE(FENCE_REG_945_8 + (i * 4), dev_priv->saveFENCE[i+8]);
+        }
+
         /* Pipe & plane A info */
         /* Prime the clock */
         if (dev_priv->saveDPLL_A & DPLL_VCO_ENABLE) {
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index 9bdd959260a5..19148c3df637 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -161,7 +161,7 @@ static bool intel_crt_detect_hotplug(struct drm_connector *connector)
         hotplug_en &= CRT_FORCE_HOTPLUG_MASK;
         hotplug_en |= CRT_HOTPLUG_FORCE_DETECT;
 
-        if (IS_GM45(dev))
+        if (IS_G4X(dev))
                 hotplug_en |= CRT_HOTPLUG_ACTIVATION_PERIOD_64;
 
         hotplug_en |= CRT_HOTPLUG_VOLTAGE_COMPARE_50;
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index bdcda36953b0..3387cf32f385 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -1804,6 +1804,37 @@ static void intel_crtc_init(struct drm_device *dev, int pipe)
         }
 }
 
+int intel_get_pipe_from_crtc_id(struct drm_device *dev, void *data,
+                                struct drm_file *file_priv)
+{
+        drm_i915_private_t *dev_priv = dev->dev_private;
+        struct drm_i915_get_pipe_from_crtc_id *pipe_from_crtc_id = data;
+        struct drm_crtc *crtc = NULL;
+        int pipe = -1;
+
+        if (!dev_priv) {
+                DRM_ERROR("called with no initialization\n");
+                return -EINVAL;
+        }
+
+        list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+                struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+                if (crtc->base.id == pipe_from_crtc_id->crtc_id) {
+                        pipe = intel_crtc->pipe;
+                        break;
+                }
+        }
+
+        if (pipe == -1) {
+                DRM_ERROR("no such CRTC id\n");
+                return -EINVAL;
+        }
+
+        pipe_from_crtc_id->pipe = pipe;
+
+       return 0;
+}
+
 struct drm_crtc *intel_get_crtc_from_pipe(struct drm_device *dev, int pipe)
 {
         struct drm_crtc *crtc = NULL;
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 957daef8edff..cd4b9c5f715e 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -109,7 +109,7 @@ struct intel_i2c_chan *intel_i2c_create(struct drm_device *dev, const u32 reg,
 void intel_i2c_destroy(struct intel_i2c_chan *chan);
 int intel_ddc_get_modes(struct intel_output *intel_output);
 extern bool intel_ddc_probe(struct intel_output *intel_output);
-
+void intel_i2c_quirk_set(struct drm_device *dev, bool enable);
 extern void intel_crt_init(struct drm_device *dev);
 extern void intel_hdmi_init(struct drm_device *dev, int sdvox_reg);
 extern bool intel_sdvo_init(struct drm_device *dev, int output_device);
@@ -125,6 +125,8 @@ extern struct drm_encoder *intel_best_encoder(struct drm_connector *connector);
 
 extern struct drm_display_mode *intel_crtc_mode_get(struct drm_device *dev,
                                                     struct drm_crtc *crtc);
+int intel_get_pipe_from_crtc_id(struct drm_device *dev, void *data,
+                                struct drm_file *file_priv);
 extern void intel_wait_for_vblank(struct drm_device *dev);
 extern struct drm_crtc *intel_get_crtc_from_pipe(struct drm_device *dev, int pipe);
 extern struct drm_crtc *intel_get_load_detect_pipe(struct intel_output *intel_output,
diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
index 3e094beecb99..e4652dcdd9bb 100644
--- a/drivers/gpu/drm/i915/intel_fb.c
+++ b/drivers/gpu/drm/i915/intel_fb.c
@@ -864,7 +864,7 @@ static void intelfb_sysrq(int dummy1, struct tty_struct *dummy3)
 
 static struct sysrq_key_op sysrq_intelfb_restore_op = {
         .handler = intelfb_sysrq,
-        .help_msg = "force-fb(G)",
+        .help_msg = "force-fb(V)",
         .action_msg = "Restore framebuffer console",
 };
 
@@ -898,7 +898,7 @@ int intelfb_probe(struct drm_device *dev)
                 ret = intelfb_single_fb_probe(dev);
         }
 
-        register_sysrq_key('g', &sysrq_intelfb_restore_op);
+        register_sysrq_key('v', &sysrq_intelfb_restore_op);
 
         return ret;
 }
diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c
index 550374225388..d0983bb93a18 100644
--- a/drivers/gpu/drm/i915/intel_hdmi.c
+++ b/drivers/gpu/drm/i915/intel_hdmi.c
@@ -155,11 +155,18 @@ intel_hdmi_detect(struct drm_connector *connector)
 
         temp = I915_READ(PORT_HOTPLUG_EN);
 
-        I915_WRITE(PORT_HOTPLUG_EN,
-                   temp |
-                   HDMIB_HOTPLUG_INT_EN |
-                   HDMIC_HOTPLUG_INT_EN |
-                   HDMID_HOTPLUG_INT_EN);
+        switch (hdmi_priv->sdvox_reg) {
+        case SDVOB:
+                temp |= HDMIB_HOTPLUG_INT_EN;
+                break;
+        case SDVOC:
+                temp |= HDMIC_HOTPLUG_INT_EN;
+                break;
+        default:
+                return connector_status_unknown;
+        }
+
+        I915_WRITE(PORT_HOTPLUG_EN, temp);
 
         POSTING_READ(PORT_HOTPLUG_EN);
 
diff --git a/drivers/gpu/drm/i915/intel_i2c.c b/drivers/gpu/drm/i915/intel_i2c.c
index 5ee9d4c25753..f7061f68d050 100644
--- a/drivers/gpu/drm/i915/intel_i2c.c
+++ b/drivers/gpu/drm/i915/intel_i2c.c
@@ -34,6 +34,21 @@
 #include "i915_drm.h"
 #include "i915_drv.h"
 
+void intel_i2c_quirk_set(struct drm_device *dev, bool enable)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+
+        /* When using bit bashing for I2C, this bit needs to be set to 1 */
+        if (!IS_IGD(dev))
+                return;
+        if (enable)
+                I915_WRITE(CG_2D_DIS,
+                        I915_READ(CG_2D_DIS) | DPCUNIT_CLOCK_GATE_DISABLE);
+        else
+                I915_WRITE(CG_2D_DIS,
+                        I915_READ(CG_2D_DIS) & (~DPCUNIT_CLOCK_GATE_DISABLE));
+}
+
 /*
  * Intel GPIO access functions
  */
@@ -153,8 +168,10 @@ struct intel_i2c_chan *intel_i2c_create(struct drm_device *dev, const u32 reg,
                 goto out_free;
 
         /* JJJ:  raise SCL and SDA? */
+        intel_i2c_quirk_set(dev, true);
         set_data(chan, 1);
         set_clock(chan, 1);
+        intel_i2c_quirk_set(dev, false);
         udelay(20);
 
         return chan;
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 6619f26e46a5..439a86514993 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -384,7 +384,51 @@ static const struct drm_encoder_funcs intel_lvds_enc_funcs = {
         .destroy = intel_lvds_enc_destroy,
 };
 
+static int __init intel_no_lvds_dmi_callback(const struct dmi_system_id *id)
+{
+        DRM_DEBUG("Skipping LVDS initialization for %s\n", id->ident);
+        return 1;
+}
 
+/* These systems claim to have LVDS, but really don't */
+static const struct dmi_system_id __initdata intel_no_lvds[] = {
+        {
+                .callback = intel_no_lvds_dmi_callback,
+                .ident = "Apple Mac Mini (Core series)",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Macmini1,1"),
+                },
+        },
+        {
+                .callback = intel_no_lvds_dmi_callback,
+                .ident = "Apple Mac Mini (Core 2 series)",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Apple Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Macmini2,1"),
+                },
+        },
+        {
+                .callback = intel_no_lvds_dmi_callback,
+                .ident = "MSI IM-945GSE-A",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "MSI"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "A9830IMS"),
+                },
+        },
+        {
+                .callback = intel_no_lvds_dmi_callback,
+                .ident = "Dell Studio Hybrid",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Studio Hybrid 140g"),
+                },
+        },
+
+        /* FIXME: add a check for the Aopen Mini PC */
+
+        { }     /* terminating entry */
+};
 
 /**
  * intel_lvds_init - setup LVDS connectors on this device
@@ -404,15 +448,9 @@ void intel_lvds_init(struct drm_device *dev)
         u32 lvds;
         int pipe;
 
-        /* Blacklist machines that we know falsely report LVDS. */
-        /* FIXME: add a check for the Aopen Mini PC */
-
-        /* Apple Mac Mini Core Duo and Mac Mini Core 2 Duo */
-        if(dmi_match(DMI_PRODUCT_NAME, "Macmini1,1") ||
-           dmi_match(DMI_PRODUCT_NAME, "Macmini2,1")) {
-                DRM_DEBUG("Skipping LVDS initialization for Apple Mac Mini\n");
+        /* Skip init on machines we know falsely report LVDS */
+        if (dmi_check_system(intel_no_lvds))
                 return;
-        }
 
         intel_output = kzalloc(sizeof(struct intel_output), GFP_KERNEL);
         if (!intel_output) {
diff --git a/drivers/gpu/drm/i915/intel_modes.c b/drivers/gpu/drm/i915/intel_modes.c
index 07d7ec976168..e0910fefce87 100644
--- a/drivers/gpu/drm/i915/intel_modes.c
+++ b/drivers/gpu/drm/i915/intel_modes.c
@@ -27,6 +27,7 @@
 #include <linux/fb.h>
 #include "drmP.h"
 #include "intel_drv.h"
+#include "i915_drv.h"
 
 /**
  * intel_ddc_probe
@@ -52,7 +53,10 @@ bool intel_ddc_probe(struct intel_output *intel_output)
                 }
         };
 
+        intel_i2c_quirk_set(intel_output->ddc_bus->drm_dev, true);
         ret = i2c_transfer(&intel_output->ddc_bus->adapter, msgs, 2);
+        intel_i2c_quirk_set(intel_output->ddc_bus->drm_dev, false);
+
         if (ret == 2)
                 return true;
 
@@ -70,8 +74,10 @@ int intel_ddc_get_modes(struct intel_output *intel_output)
         struct edid *edid;
         int ret = 0;
 
+        intel_i2c_quirk_set(intel_output->ddc_bus->drm_dev, true);
         edid = drm_get_edid(&intel_output->base,
                             &intel_output->ddc_bus->adapter);
+        intel_i2c_quirk_set(intel_output->ddc_bus->drm_dev, false);
         if (edid) {
                 drm_mode_connector_update_edid_property(&intel_output->base,
                                                         edid);
diff --git a/drivers/gpu/drm/r128/r128_cce.c b/drivers/gpu/drm/r128/r128_cce.c
index 32de4cedc363..077c0455a6b9 100644
--- a/drivers/gpu/drm/r128/r128_cce.c
+++ b/drivers/gpu/drm/r128/r128_cce.c
@@ -511,9 +511,9 @@ static int r128_do_init_cce(struct drm_device * dev, drm_r128_init_t * init)
 
 #if __OS_HAS_AGP
         if (!dev_priv->is_pci) {
-                drm_core_ioremap(dev_priv->cce_ring, dev);
-                drm_core_ioremap(dev_priv->ring_rptr, dev);
-                drm_core_ioremap(dev->agp_buffer_map, dev);
+                drm_core_ioremap_wc(dev_priv->cce_ring, dev);
+                drm_core_ioremap_wc(dev_priv->ring_rptr, dev);
+                drm_core_ioremap_wc(dev->agp_buffer_map, dev);
                 if (!dev_priv->cce_ring->handle ||
                     !dev_priv->ring_rptr->handle ||
                     !dev->agp_buffer_map->handle) {
diff --git a/drivers/gpu/drm/radeon/radeon_drv.h b/drivers/gpu/drm/radeon/radeon_drv.h
index ed4d27e6ee6f..8071d965f142 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.h
+++ b/drivers/gpu/drm/radeon/radeon_drv.h
@@ -99,9 +99,10 @@
  * 1.27- Add support for IGP GART
  * 1.28- Add support for VBL on CRTC2
  * 1.29- R500 3D cmd buffer support
+ * 1.30- Add support for occlusion queries
  */
 #define DRIVER_MAJOR            1
-#define DRIVER_MINOR            29
+#define DRIVER_MINOR            30
 #define DRIVER_PATCHLEVEL       0
 
 /*
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index aa1b995dd033..4d5ee2bbc62b 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -113,6 +113,11 @@
 #define USB_VENDOR_ID_BERKSHIRE         0x0c98
 #define USB_DEVICE_ID_BERKSHIRE_PCWD    0x1140
 
+#define USB_VENDOR_ID_CH                0x068e
+#define USB_DEVICE_ID_CH_PRO_PEDALS     0x00f2
+#define USB_DEVICE_ID_CH_COMBATSTICK    0x00f4
+#define USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE        0x00ff
+
 #define USB_VENDOR_ID_CHERRY            0x046a
 #define USB_DEVICE_ID_CHERRY_CYMOTION   0x0023
 
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index 900ce18dd549..ac8049b5f1e9 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -898,7 +898,7 @@ static int usbhid_parse(struct hid_device *hid)
                 goto err;
         }
 
-        hid->quirks = quirks;
+        hid->quirks |= quirks;
 
         return 0;
 err:
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index 4391717d2519..d8f7423f363e 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -50,6 +50,9 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_2PORTKVM, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVM, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ATEN, USB_DEVICE_ID_ATEN_4PORTKVMC, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_COMBATSTICK, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_PEDALS, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_SUN, USB_DEVICE_ID_RARITAN_KVM_DONGLE, HID_QUIRK_NOGET },
diff --git a/drivers/hwmon/asus_atk0110.c b/drivers/hwmon/asus_atk0110.c
index 0897edef2574..bff0103610c1 100644
--- a/drivers/hwmon/asus_atk0110.c
+++ b/drivers/hwmon/asus_atk0110.c
@@ -348,6 +348,7 @@ static int validate_hwmon_pack(struct atk_data *data, union acpi_object *obj)
         return 0;
 }
 
+#ifdef DEBUG
 static char const *atk_sensor_type(union acpi_object *flags)
 {
         u64 type = flags->integer.value & ATK_TYPE_MASK;
@@ -370,6 +371,7 @@ static char const *atk_sensor_type(union acpi_object *flags)
 
         return what;
 }
+#endif
 
 static void atk_print_sensor(struct atk_data *data, union acpi_object *obj)
 {
diff --git a/drivers/hwmon/w83781d.c b/drivers/hwmon/w83781d.c
index dbfb30c588d8..0bdab959b736 100644
--- a/drivers/hwmon/w83781d.c
+++ b/drivers/hwmon/w83781d.c
@@ -1462,7 +1462,8 @@ static struct w83781d_data *w83781d_update_device(struct device *dev)
                                 data->pwm[i] =
                                     w83781d_read_value(data,
                                                        W83781D_REG_PWM[i]);
-                                if ((data->type != w83782d || !client->driver)
+                                /* Only W83782D on SMBus has PWM3 and PWM4 */
+                                if ((data->type != w83782d || !client)
                                     && i == 1)
                                         break;
                         }
diff --git a/drivers/i2c/algos/i2c-algo-bit.c b/drivers/i2c/algos/i2c-algo-bit.c
index d420cc5f5633..e25e13980af3 100644
--- a/drivers/i2c/algos/i2c-algo-bit.c
+++ b/drivers/i2c/algos/i2c-algo-bit.c
@@ -104,7 +104,7 @@ static int sclhi(struct i2c_algo_bit_data *adap)
                  * chips may hold it low ("clock stretching") while they
                  * are processing data internally.
                  */
-                if (time_after_eq(jiffies, start + adap->timeout))
+                if (time_after(jiffies, start + adap->timeout))
                         return -ETIMEDOUT;
                 cond_resched();
         }
diff --git a/drivers/i2c/algos/i2c-algo-pca.c b/drivers/i2c/algos/i2c-algo-pca.c
index 6318f7ddc1d4..78d42aae0089 100644
--- a/drivers/i2c/algos/i2c-algo-pca.c
+++ b/drivers/i2c/algos/i2c-algo-pca.c
@@ -287,10 +287,21 @@ static int pca_xfer(struct i2c_adapter *i2c_adap,
 
                 case 0x30: /* Data byte in I2CDAT has been transmitted; NOT ACK has been received */
                         DEB2("NOT ACK received after data byte\n");
+                        pca_stop(adap);
                         goto out;
 
                 case 0x38: /* Arbitration lost during SLA+W, SLA+R or data bytes */
                         DEB2("Arbitration lost\n");
+                        /*
+                         * The PCA9564 data sheet (2006-09-01) says "A
+                         * START condition will be transmitted when the
+                         * bus becomes free (STOP or SCL and SDA high)"
+                         * when the STA bit is set (p. 11).
+                         *
+                         * In case this won't work, try pca_reset()
+                         * instead.
+                         */
+                        pca_start(adap);
                         goto out;
 
                 case 0x58: /* Data byte has been received; NOT ACK has been returned */
diff --git a/drivers/i2c/busses/Kconfig b/drivers/i2c/busses/Kconfig
index a48c8aee0218..f1c6ca7e2852 100644
--- a/drivers/i2c/busses/Kconfig
+++ b/drivers/i2c/busses/Kconfig
@@ -467,7 +467,7 @@ config I2C_PXA_SLAVE
 
 config I2C_S3C2410
         tristate "S3C2410 I2C Driver"
-        depends on ARCH_S3C2410
+        depends on ARCH_S3C2410 || ARCH_S3C64XX
         help
           Say Y here to include support for I2C controller in the
           Samsung S3C2410 based System-on-Chip devices.
diff --git a/drivers/i2c/busses/i2c-ali1535.c b/drivers/i2c/busses/i2c-ali1535.c
index 981e080b32ae..d108450df064 100644
--- a/drivers/i2c/busses/i2c-ali1535.c
+++ b/drivers/i2c/busses/i2c-ali1535.c
@@ -284,7 +284,7 @@ static int ali1535_transaction(struct i2c_adapter *adap)
                  && (timeout++ < MAX_TIMEOUT));
 
         /* If the SMBus is still busy, we give up */
-        if (timeout >= MAX_TIMEOUT) {
+        if (timeout > MAX_TIMEOUT) {
                 result = -ETIMEDOUT;
                 dev_err(&adap->dev, "SMBus Timeout!\n");
         }
diff --git a/drivers/i2c/busses/i2c-ali15x3.c b/drivers/i2c/busses/i2c-ali15x3.c
index 39066dee46e3..d627fceb790b 100644
--- a/drivers/i2c/busses/i2c-ali15x3.c
+++ b/drivers/i2c/busses/i2c-ali15x3.c
@@ -306,7 +306,7 @@ static int ali15x3_transaction(struct i2c_adapter *adap)
                  && (timeout++ < MAX_TIMEOUT));
 
         /* If the SMBus is still busy, we give up */
-        if (timeout >= MAX_TIMEOUT) {
+        if (timeout > MAX_TIMEOUT) {
                 result = -ETIMEDOUT;
                 dev_err(&adap->dev, "SMBus Timeout!\n");
         }
diff --git a/drivers/i2c/busses/i2c-amd756.c b/drivers/i2c/busses/i2c-amd756.c
index 220f4a1eee1d..f7d6fe9c49ba 100644
--- a/drivers/i2c/busses/i2c-amd756.c
+++ b/drivers/i2c/busses/i2c-amd756.c
@@ -126,7 +126,7 @@ static int amd756_transaction(struct i2c_adapter *adap)
                 } while ((temp & (GS_HST_STS | GS_SMB_STS)) &&
                          (timeout++ < MAX_TIMEOUT));
                 /* If the SMBus is still busy, we give up */
-                if (timeout >= MAX_TIMEOUT) {
+                if (timeout > MAX_TIMEOUT) {
                         dev_dbg(&adap->dev, "Busy wait timeout (%04x)\n", temp);
                         goto abort;
                 }
@@ -143,7 +143,7 @@ static int amd756_transaction(struct i2c_adapter *adap)
         } while ((temp & GS_HST_STS) && (timeout++ < MAX_TIMEOUT));
 
         /* If the SMBus is still busy, we give up */
-        if (timeout >= MAX_TIMEOUT) {
+        if (timeout > MAX_TIMEOUT) {
                 dev_dbg(&adap->dev, "Completion timeout!\n");
                 goto abort;
         }
diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c
index 3fcf78e906db..b5db8b883615 100644
--- a/drivers/i2c/busses/i2c-cpm.c
+++ b/drivers/i2c/busses/i2c-cpm.c
@@ -531,16 +531,16 @@ static int __devinit cpm_i2c_setup(struct cpm_i2c *cpm)
         rbdf = cpm->rbase;
 
         for (i = 0; i < CPM_MAXBD; i++) {
-                cpm->rxbuf[i] = dma_alloc_coherent(
-                        NULL, CPM_MAX_READ + 1, &cpm->rxdma[i], GFP_KERNEL);
+                cpm->rxbuf[i] = dma_alloc_coherent(&cpm->ofdev->dev,
+                                                   CPM_MAX_READ + 1,
+                                                   &cpm->rxdma[i], GFP_KERNEL);
                 if (!cpm->rxbuf[i]) {
                         ret = -ENOMEM;
                         goto out_muram;
                 }
                 out_be32(&rbdf[i].cbd_bufaddr, ((cpm->rxdma[i] + 1) & ~1));
 
-                cpm->txbuf[i] = (unsigned char *)dma_alloc_coherent(
-                        NULL, CPM_MAX_READ + 1, &cpm->txdma[i], GFP_KERNEL);
+                cpm->txbuf[i] = (unsigned char *)dma_alloc_coherent(&cpm->ofdev->dev, CPM_MAX_READ + 1, &cpm->txdma[i], GFP_KERNEL);
                 if (!cpm->txbuf[i]) {
                         ret = -ENOMEM;
                         goto out_muram;
@@ -585,10 +585,10 @@ static int __devinit cpm_i2c_setup(struct cpm_i2c *cpm)
 out_muram:
         for (i = 0; i < CPM_MAXBD; i++) {
                 if (cpm->rxbuf[i])
-                        dma_free_coherent(NULL, CPM_MAX_READ + 1,
+                        dma_free_coherent(&cpm->ofdev->dev, CPM_MAX_READ + 1,
                                 cpm->rxbuf[i], cpm->rxdma[i]);
                 if (cpm->txbuf[i])
-                        dma_free_coherent(NULL, CPM_MAX_READ + 1,
+                        dma_free_coherent(&cpm->ofdev->dev, CPM_MAX_READ + 1,
                                 cpm->txbuf[i], cpm->txdma[i]);
         }
         cpm_muram_free(cpm->dp_addr);
@@ -619,9 +619,9 @@ static void cpm_i2c_shutdown(struct cpm_i2c *cpm)
 
         /* Free all memory */
         for (i = 0; i < CPM_MAXBD; i++) {
-                dma_free_coherent(NULL, CPM_MAX_READ + 1,
+                dma_free_coherent(&cpm->ofdev->dev, CPM_MAX_READ + 1,
                         cpm->rxbuf[i], cpm->rxdma[i]);
-                dma_free_coherent(NULL, CPM_MAX_READ + 1,
+                dma_free_coherent(&cpm->ofdev->dev, CPM_MAX_READ + 1,
                         cpm->txbuf[i], cpm->txdma[i]);
         }
 
diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
index 10411848fd70..9d2c5adf5d4f 100644
--- a/drivers/i2c/busses/i2c-i801.c
+++ b/drivers/i2c/busses/i2c-i801.c
@@ -237,7 +237,7 @@ static int i801_transaction(int xact)
                 status = inb_p(SMBHSTSTS);
         } while ((status & SMBHSTSTS_HOST_BUSY) && (timeout++ < MAX_TIMEOUT));
 
-        result = i801_check_post(status, timeout >= MAX_TIMEOUT);
+        result = i801_check_post(status, timeout > MAX_TIMEOUT);
         if (result < 0)
                 return result;
 
@@ -257,9 +257,9 @@ static void i801_wait_hwpec(void)
         } while ((!(status & SMBHSTSTS_INTR))
                  && (timeout++ < MAX_TIMEOUT));
 
-        if (timeout >= MAX_TIMEOUT) {
+        if (timeout > MAX_TIMEOUT)
                 dev_dbg(&I801_dev->dev, "PEC Timeout!\n");
-        }
+
         outb_p(status, SMBHSTSTS);
 }
 
@@ -344,7 +344,7 @@ static int i801_block_transaction_byte_by_byte(union i2c_smbus_data *data,
                 while ((!(status & SMBHSTSTS_BYTE_DONE))
                        && (timeout++ < MAX_TIMEOUT));
 
-                result = i801_check_post(status, timeout >= MAX_TIMEOUT);
+                result = i801_check_post(status, timeout > MAX_TIMEOUT);
                 if (result < 0)
                         return result;
 
diff --git a/drivers/i2c/busses/i2c-isch.c b/drivers/i2c/busses/i2c-isch.c
index b9c01aa90036..9f6b8e0f8632 100644
--- a/drivers/i2c/busses/i2c-isch.c
+++ b/drivers/i2c/busses/i2c-isch.c
@@ -112,7 +112,7 @@ static int sch_transaction(void)
         } while ((temp & 0x08) && (timeout++ < MAX_TIMEOUT));
 
         /* If the SMBus is still busy, we give up */
-        if (timeout >= MAX_TIMEOUT) {
+        if (timeout > MAX_TIMEOUT) {
                 dev_err(&sch_adapter.dev, "SMBus Timeout!\n");
                 result = -ETIMEDOUT;
         }
diff --git a/drivers/i2c/busses/i2c-mpc.c b/drivers/i2c/busses/i2c-mpc.c
index 4af5c09f0e8f..dd778d7ae047 100644
--- a/drivers/i2c/busses/i2c-mpc.c
+++ b/drivers/i2c/busses/i2c-mpc.c
@@ -164,7 +164,7 @@ static int i2c_wait(struct mpc_i2c *i2c, unsigned timeout, int writing)
         return 0;
 }
 
-#ifdef CONFIG_PPC_52xx
+#ifdef CONFIG_PPC_MPC52xx
 static const struct mpc_i2c_divider mpc_i2c_dividers_52xx[] = {
         {20, 0x20}, {22, 0x21}, {24, 0x22}, {26, 0x23},
         {28, 0x24}, {30, 0x01}, {32, 0x25}, {34, 0x02},
@@ -188,7 +188,7 @@ static const struct mpc_i2c_divider mpc_i2c_dividers_52xx[] = {
 
 int mpc_i2c_get_fdr_52xx(struct device_node *node, u32 clock, int prescaler)
 {
-        const struct mpc52xx_i2c_divider *div = NULL;
+        const struct mpc_i2c_divider *div = NULL;
         unsigned int pvr = mfspr(SPRN_PVR);
         u32 divider;
         int i;
@@ -203,7 +203,7 @@ int mpc_i2c_get_fdr_52xx(struct device_node *node, u32 clock, int prescaler)
          * We want to choose an FDR/DFSR that generates an I2C bus speed that
          * is equal to or lower than the requested speed.
          */
-        for (i = 0; i < ARRAY_SIZE(mpc52xx_i2c_dividers); i++) {
+        for (i = 0; i < ARRAY_SIZE(mpc_i2c_dividers_52xx); i++) {
                 div = &mpc_i2c_dividers_52xx[i];
                 /* Old MPC5200 rev A CPUs do not support the high bits */
                 if (div->fdr & 0xc0 && pvr == 0x80822011)
@@ -219,20 +219,23 @@ static void mpc_i2c_setclock_52xx(struct device_node *node,
                                   struct mpc_i2c *i2c,
                                   u32 clock, u32 prescaler)
 {
-        int fdr = mpc52xx_i2c_get_fdr(node, clock, prescaler);
+        int ret, fdr;
+
+        ret = mpc_i2c_get_fdr_52xx(node, clock, prescaler);
+        fdr = (ret >= 0) ? ret : 0x3f; /* backward compatibility */
 
-        if (fdr < 0)
-                fdr = 0x3f; /* backward compatibility */
         writeb(fdr & 0xff, i2c->base + MPC_I2C_FDR);
-        dev_info(i2c->dev, "clock %d Hz (fdr=%d)\n", clock, fdr);
+
+        if (ret >= 0)
+                dev_info(i2c->dev, "clock %d Hz (fdr=%d)\n", clock, fdr);
 }
-#else /* !CONFIG_PPC_52xx */
+#else /* !CONFIG_PPC_MPC52xx */
 static void mpc_i2c_setclock_52xx(struct device_node *node,
                                   struct mpc_i2c *i2c,
                                   u32 clock, u32 prescaler)
 {
 }
-#endif /* CONFIG_PPC_52xx*/
+#endif /* CONFIG_PPC_MPC52xx*/
 
 #ifdef CONFIG_FSL_SOC
 static const struct mpc_i2c_divider mpc_i2c_dividers_8xxx[] = {
@@ -321,14 +324,17 @@ static void mpc_i2c_setclock_8xxx(struct device_node *node,
                                   struct mpc_i2c *i2c,
                                   u32 clock, u32 prescaler)
 {
-        int fdr = mpc_i2c_get_fdr_8xxx(node, clock, prescaler);
+        int ret, fdr;
+
+        ret = mpc_i2c_get_fdr_8xxx(node, clock, prescaler);
+        fdr = (ret >= 0) ? ret : 0x1031; /* backward compatibility */
 
-        if (fdr < 0)
-                fdr = 0x1031; /* backward compatibility */
         writeb(fdr & 0xff, i2c->base + MPC_I2C_FDR);
         writeb((fdr >> 8) & 0xff, i2c->base + MPC_I2C_DFSRR);
-        dev_info(i2c->dev, "clock %d Hz (dfsrr=%d fdr=%d)\n",
-                 clock, fdr >> 8, fdr & 0xff);
+
+        if (ret >= 0)
+                dev_info(i2c->dev, "clock %d Hz (dfsrr=%d fdr=%d)\n",
+                         clock, fdr >> 8, fdr & 0xff);
 }
 
 #else /* !CONFIG_FSL_SOC */
diff --git a/drivers/i2c/busses/i2c-nforce2.c b/drivers/i2c/busses/i2c-nforce2.c
index 2ff4683703a8..ec11d1c4e77b 100644
--- a/drivers/i2c/busses/i2c-nforce2.c
+++ b/drivers/i2c/busses/i2c-nforce2.c
@@ -173,7 +173,7 @@ static int nforce2_check_status(struct i2c_adapter *adap)
                 temp = inb_p(NVIDIA_SMB_STS);
         } while ((!temp) && (timeout++ < MAX_TIMEOUT));
 
-        if (timeout >= MAX_TIMEOUT) {
+        if (timeout > MAX_TIMEOUT) {
                 dev_dbg(&adap->dev, "SMBus Timeout!\n");
                 if (smbus->can_abort)
                         nforce2_abort(adap);
diff --git a/drivers/i2c/busses/i2c-pxa.c b/drivers/i2c/busses/i2c-pxa.c
index c1405c8f6ba5..acc7143d9655 100644
--- a/drivers/i2c/busses/i2c-pxa.c
+++ b/drivers/i2c/busses/i2c-pxa.c
@@ -265,10 +265,10 @@ static int i2c_pxa_wait_bus_not_busy(struct pxa_i2c *i2c)
                 show_state(i2c);
         }
 
-        if (timeout <= 0)
+        if (timeout < 0)
                 show_state(i2c);
 
-        return timeout <= 0 ? I2C_RETRY : 0;
+        return timeout < 0 ? I2C_RETRY : 0;
 }
 
 static int i2c_pxa_wait_master(struct pxa_i2c *i2c)
@@ -612,7 +612,7 @@ static int i2c_pxa_pio_set_master(struct pxa_i2c *i2c)
                 show_state(i2c);
         }
 
-        if (timeout <= 0) {
+        if (timeout < 0) {
                 show_state(i2c);
                 dev_err(&i2c->adap.dev,
                         "i2c_pxa: timeout waiting for bus free\n");
diff --git a/drivers/i2c/busses/i2c-sis5595.c b/drivers/i2c/busses/i2c-sis5595.c
index f320ab27da46..139f0c7f12a4 100644
--- a/drivers/i2c/busses/i2c-sis5595.c
+++ b/drivers/i2c/busses/i2c-sis5595.c
@@ -256,7 +256,7 @@ static int sis5595_transaction(struct i2c_adapter *adap)
         } while (!(temp & 0x40) && (timeout++ < MAX_TIMEOUT));
 
         /* If the SMBus is still busy, we give up */
-        if (timeout >= MAX_TIMEOUT) {
+        if (timeout > MAX_TIMEOUT) {
                 dev_dbg(&adap->dev, "SMBus Timeout!\n");
                 result = -ETIMEDOUT;
         }
diff --git a/drivers/i2c/busses/i2c-sis630.c b/drivers/i2c/busses/i2c-sis630.c
index 50c3610e6028..70ca41e90e58 100644
--- a/drivers/i2c/busses/i2c-sis630.c
+++ b/drivers/i2c/busses/i2c-sis630.c
@@ -173,7 +173,7 @@ static int sis630_transaction_wait(struct i2c_adapter *adap, int size)
         } while (!(temp & 0x0e) && (timeout++ < MAX_TIMEOUT));
 
         /* If the SMBus is still busy, we give up */
-        if (timeout >= MAX_TIMEOUT) {
+        if (timeout > MAX_TIMEOUT) {
                 dev_dbg(&adap->dev, "SMBus Timeout!\n");
                 result = -ETIMEDOUT;
         }
diff --git a/drivers/i2c/busses/i2c-sis96x.c b/drivers/i2c/busses/i2c-sis96x.c
index 7e1594b40579..8295885b2fdb 100644
--- a/drivers/i2c/busses/i2c-sis96x.c
+++ b/drivers/i2c/busses/i2c-sis96x.c
@@ -132,7 +132,7 @@ static int sis96x_transaction(int size)
         } while (!(temp & 0x0e) && (timeout++ < MAX_TIMEOUT));
 
         /* If the SMBus is still busy, we give up */
-        if (timeout >= MAX_TIMEOUT) {
+        if (timeout > MAX_TIMEOUT) {
                 dev_dbg(&sis96x_adapter.dev, "SMBus Timeout! (0x%02x)\n", temp);
                 result = -ETIMEDOUT;
         }
diff --git a/drivers/infiniband/hw/cxgb3/cxio_hal.c b/drivers/infiniband/hw/cxgb3/cxio_hal.c
index 8d71086f5a1c..62f9cf2f94ec 100644
--- a/drivers/infiniband/hw/cxgb3/cxio_hal.c
+++ b/drivers/infiniband/hw/cxgb3/cxio_hal.c
@@ -410,6 +410,7 @@ int cxio_flush_sq(struct t3_wq *wq, struct t3_cq *cq, int count)
         ptr = wq->sq_rptr + count;
         sqp = wq->sq + Q_PTR2IDX(ptr, wq->sq_size_log2);
         while (ptr != wq->sq_wptr) {
+                sqp->signaled = 0;
                 insert_sq_cqe(wq, cq, sqp);
                 ptr++;
                 sqp = wq->sq + Q_PTR2IDX(ptr, wq->sq_size_log2);
diff --git a/drivers/infiniband/hw/ipath/ipath_fs.c b/drivers/infiniband/hw/ipath/ipath_fs.c
index 8dc2bb781605..b3684060465e 100644
--- a/drivers/infiniband/hw/ipath/ipath_fs.c
+++ b/drivers/infiniband/hw/ipath/ipath_fs.c
@@ -347,7 +347,7 @@ static int ipathfs_fill_super(struct super_block *sb, void *data,
                 spin_unlock_irqrestore(&ipath_devs_lock, flags);
                 ret = create_device_files(sb, dd);
                 if (ret) {
-                        deactivate_super(sb);
+                        deactivate_locked_super(sb);
                         goto bail;
                 }
                 spin_lock_irqsave(&ipath_devs_lock, flags);
diff --git a/drivers/infiniband/hw/mlx4/mlx4_ib.h b/drivers/infiniband/hw/mlx4/mlx4_ib.h
index 9974e886b8de..8a7dd6795fa0 100644
--- a/drivers/infiniband/hw/mlx4/mlx4_ib.h
+++ b/drivers/infiniband/hw/mlx4/mlx4_ib.h
@@ -86,6 +86,7 @@ struct mlx4_ib_mr {
 
 struct mlx4_ib_fast_reg_page_list {
         struct ib_fast_reg_page_list    ibfrpl;
+        __be64                         *mapped_page_list;
         dma_addr_t                      map;
 };
 
diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c
index 8e4d26d56a95..8f3666b20ea4 100644
--- a/drivers/infiniband/hw/mlx4/mr.c
+++ b/drivers/infiniband/hw/mlx4/mr.c
@@ -231,7 +231,11 @@ struct ib_fast_reg_page_list *mlx4_ib_alloc_fast_reg_page_list(struct ib_device
         if (!mfrpl)
                 return ERR_PTR(-ENOMEM);
 
-        mfrpl->ibfrpl.page_list = dma_alloc_coherent(&dev->dev->pdev->dev,
+        mfrpl->ibfrpl.page_list = kmalloc(size, GFP_KERNEL);
+        if (!mfrpl->ibfrpl.page_list)
+                goto err_free;
+
+        mfrpl->mapped_page_list = dma_alloc_coherent(&dev->dev->pdev->dev,
                                                      size, &mfrpl->map,
                                                      GFP_KERNEL);
         if (!mfrpl->ibfrpl.page_list)
@@ -242,6 +246,7 @@ struct ib_fast_reg_page_list *mlx4_ib_alloc_fast_reg_page_list(struct ib_device
         return &mfrpl->ibfrpl;
 
 err_free:
+        kfree(mfrpl->ibfrpl.page_list);
         kfree(mfrpl);
         return ERR_PTR(-ENOMEM);
 }
@@ -252,8 +257,9 @@ void mlx4_ib_free_fast_reg_page_list(struct ib_fast_reg_page_list *page_list)
         struct mlx4_ib_fast_reg_page_list *mfrpl = to_mfrpl(page_list);
         int size = page_list->max_page_list_len * sizeof (u64);
 
-        dma_free_coherent(&dev->dev->pdev->dev, size, page_list->page_list,
+        dma_free_coherent(&dev->dev->pdev->dev, size, mfrpl->mapped_page_list,
                           mfrpl->map);
+        kfree(mfrpl->ibfrpl.page_list);
         kfree(mfrpl);
 }
 
diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c
index f385a24d31d2..20724aee76f4 100644
--- a/drivers/infiniband/hw/mlx4/qp.c
+++ b/drivers/infiniband/hw/mlx4/qp.c
@@ -1365,7 +1365,7 @@ static void set_fmr_seg(struct mlx4_wqe_fmr_seg *fseg, struct ib_send_wr *wr)
         int i;
 
         for (i = 0; i < wr->wr.fast_reg.page_list_len; ++i)
-                wr->wr.fast_reg.page_list->page_list[i] =
+                mfrpl->mapped_page_list[i] =
                         cpu_to_be64(wr->wr.fast_reg.page_list->page_list[i] |
                                     MLX4_MTT_FLAG_PRESENT);
 
diff --git a/drivers/input/ff-memless.c b/drivers/input/ff-memless.c
index bc4e40f3ede7..2d1415e16834 100644
--- a/drivers/input/ff-memless.c
+++ b/drivers/input/ff-memless.c
@@ -226,7 +226,7 @@ static int get_compatible_type(struct ff_device *ff, int effect_type)
  */
 static void ml_combine_effects(struct ff_effect *effect,
                                struct ml_effect_state *state,
-                               int gain)
+                               unsigned int gain)
 {
         struct ff_effect *new = state->effect;
         unsigned int strong, weak, i;
diff --git a/drivers/input/joydev.c b/drivers/input/joydev.c
index 4224f0112849..012a5e753991 100644
--- a/drivers/input/joydev.c
+++ b/drivers/input/joydev.c
@@ -843,7 +843,13 @@ static const struct input_device_id joydev_blacklist[] = {
                                 INPUT_DEVICE_ID_MATCH_KEYBIT,
                 .evbit = { BIT_MASK(EV_KEY) },
                 .keybit = { [BIT_WORD(BTN_TOUCH)] = BIT_MASK(BTN_TOUCH) },
-        },      /* Avoid itouchpads, touchscreens and tablets */
+        },      /* Avoid itouchpads and touchscreens */
+        {
+                .flags = INPUT_DEVICE_ID_MATCH_EVBIT |
+                                INPUT_DEVICE_ID_MATCH_KEYBIT,
+                .evbit = { BIT_MASK(EV_KEY) },
+                .keybit = { [BIT_WORD(BTN_DIGI)] = BIT_MASK(BTN_DIGI) },
+        },      /* Avoid tablets, digitisers and similar devices */
         { }     /* Terminating entry */
 };
 
diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index 444dec07e5d8..df3f8aa68115 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -895,6 +895,13 @@ static unsigned int atkbd_amilo_pa1510_forced_release_keys[] = {
 };
 
 /*
+ * Amilo Xi 3650 key release for light touch bar not working
+ */
+static unsigned int atkbd_amilo_xi3650_forced_release_keys[] = {
+        0x67, 0xed, 0x90, 0xa2, 0x99, 0xa4, 0xae, 0xb0, -1U
+};
+
+/*
  * atkbd_set_keycode_table() initializes keyboard's keycode table
  * according to the selected scancode set
  */
@@ -1560,6 +1567,15 @@ static struct dmi_system_id atkbd_dmi_quirk_table[] __initdata = {
                 .callback = atkbd_setup_forced_release,
                 .driver_data = atkbd_amilo_pa1510_forced_release_keys,
         },
+        {
+                .ident = "Fujitsu Amilo Xi 3650",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU SIEMENS"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "AMILO Xi 3650"),
+                },
+                .callback = atkbd_setup_forced_release,
+                .driver_data = atkbd_amilo_xi3650_forced_release_keys,
+        },
         { }
 };
 
diff --git a/drivers/input/touchscreen/tsc2007.c b/drivers/input/touchscreen/tsc2007.c
index 536668fbda22..948e167557f1 100644
--- a/drivers/input/touchscreen/tsc2007.c
+++ b/drivers/input/touchscreen/tsc2007.c
@@ -200,8 +200,9 @@ static int tsc2007_read_values(struct tsc2007 *tsc)
 static enum hrtimer_restart tsc2007_timer(struct hrtimer *handle)
 {
         struct tsc2007 *ts = container_of(handle, struct tsc2007, timer);
+        unsigned long flags;
 
-        spin_lock_irq(&ts->lock);
+        spin_lock_irqsave(&ts->lock, flags);
 
         if (unlikely(!ts->get_pendown_state() && ts->pendown)) {
                 struct input_dev *input = ts->input;
@@ -222,7 +223,7 @@ static enum hrtimer_restart tsc2007_timer(struct hrtimer *handle)
                 tsc2007_send_event(ts);
         }
 
-        spin_unlock_irq(&ts->lock);
+        spin_unlock_irqrestore(&ts->lock, flags);
 
         return HRTIMER_NORESTART;
 }
diff --git a/drivers/isdn/capi/capifs.c b/drivers/isdn/capi/capifs.c
index b129409925af..bff72d81f263 100644
--- a/drivers/isdn/capi/capifs.c
+++ b/drivers/isdn/capi/capifs.c
@@ -75,15 +75,17 @@ static int capifs_remount(struct super_block *s, int *flags, char *data)
                 }
         }
 
-        kfree(s->s_options);
-        s->s_options = new_opt;
+        mutex_lock(&s->s_root->d_inode->i_mutex);
 
+        replace_mount_options(s, new_opt);
         config.setuid  = setuid;
         config.setgid  = setgid;
         config.uid     = uid;
         config.gid     = gid;
         config.mode    = mode;
 
+        mutex_unlock(&s->s_root->d_inode->i_mutex);
+
         return 0;
 }
 
@@ -154,13 +156,16 @@ void capifs_new_ncci(unsigned int number, dev_t device)
         if (!inode)
                 return;
         inode->i_ino = number+2;
+
+        dentry = get_node(number);
+
+        /* config contents is protected by root's i_mutex */
         inode->i_uid = config.setuid ? config.uid : current_fsuid();
         inode->i_gid = config.setgid ? config.gid : current_fsgid();
         inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
         init_special_inode(inode, S_IFCHR|config.mode, device);
         //inode->i_op = &capifs_file_inode_operations;
 
-        dentry = get_node(number);
         if (!IS_ERR(dentry) && !dentry->d_inode)
                 d_instantiate(dentry, inode);
         mutex_unlock(&capifs_root->d_inode->i_mutex);
diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
index 1fb91edc7de2..47c68bc75a17 100644
--- a/drivers/md/bitmap.c
+++ b/drivers/md/bitmap.c
@@ -986,6 +986,9 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, sector_t start)
                         oldindex = index;
                         oldpage = page;
 
+                        bitmap->filemap[bitmap->file_pages++] = page;
+                        bitmap->last_page_size = count;
+
                         if (outofdate) {
                                 /*
                                  * if bitmap is out of date, dirty the
@@ -998,15 +1001,9 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, sector_t start)
                                 write_page(bitmap, page, 1);
 
                                 ret = -EIO;
-                                if (bitmap->flags & BITMAP_WRITE_ERROR) {
-                                        /* release, page not in filemap yet */
-                                        put_page(page);
+                                if (bitmap->flags & BITMAP_WRITE_ERROR)
                                         goto err;
-                                }
                         }
-
-                        bitmap->filemap[bitmap->file_pages++] = page;
-                        bitmap->last_page_size = count;
                 }
                 paddr = kmap_atomic(page, KM_USER0);
                 if (bitmap->flags & BITMAP_HOSTENDIAN)
@@ -1016,9 +1013,11 @@ static int bitmap_init_from_disk(struct bitmap *bitmap, sector_t start)
                 kunmap_atomic(paddr, KM_USER0);
                 if (b) {
                         /* if the disk bit is set, set the memory bit */
-                        bitmap_set_memory_bits(bitmap, i << CHUNK_BLOCK_SHIFT(bitmap),
-                                               ((i+1) << (CHUNK_BLOCK_SHIFT(bitmap)) >= start)
-                                );
+                        int needed = ((sector_t)(i+1) << (CHUNK_BLOCK_SHIFT(bitmap))
+                                      >= start);
+                        bitmap_set_memory_bits(bitmap,
+                                               (sector_t)i << CHUNK_BLOCK_SHIFT(bitmap),
+                                               needed);
                         bit_cnt++;
                         set_page_attr(bitmap, page, BITMAP_PAGE_CLEAN);
                 }
@@ -1154,8 +1153,9 @@ void bitmap_daemon_work(struct bitmap *bitmap)
                         spin_lock_irqsave(&bitmap->lock, flags);
                         clear_page_attr(bitmap, page, BITMAP_PAGE_CLEAN);
                 }
-                bmc = bitmap_get_counter(bitmap, j << CHUNK_BLOCK_SHIFT(bitmap),
-                                        &blocks, 0);
+                bmc = bitmap_get_counter(bitmap,
+                                         (sector_t)j << CHUNK_BLOCK_SHIFT(bitmap),
+                                         &blocks, 0);
                 if (bmc) {
 /*
   if (j < 100) printk("bitmap: j=%lu, *bmc = 0x%x\n", j, *bmc);
@@ -1169,7 +1169,8 @@ void bitmap_daemon_work(struct bitmap *bitmap)
                         } else if (*bmc == 1) {
                                 /* we can clear the bit */
                                 *bmc = 0;
-                                bitmap_count_page(bitmap, j << CHUNK_BLOCK_SHIFT(bitmap),
+                                bitmap_count_page(bitmap,
+                                                  (sector_t)j << CHUNK_BLOCK_SHIFT(bitmap),
                                                   -1);
 
                                 /* clear the bit */
@@ -1514,7 +1515,7 @@ void bitmap_dirty_bits(struct bitmap *bitmap, unsigned long s, unsigned long e)
         unsigned long chunk;
 
         for (chunk = s; chunk <= e; chunk++) {
-                sector_t sec = chunk << CHUNK_BLOCK_SHIFT(bitmap);
+                sector_t sec = (sector_t)chunk << CHUNK_BLOCK_SHIFT(bitmap);
                 bitmap_set_memory_bits(bitmap, sec, 1);
                 bitmap_file_set_bit(bitmap, sec);
         }
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 612343fdde94..fccc8343a250 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -3066,11 +3066,8 @@ array_state_store(mddev_t *mddev, const char *buf, size_t len)
                         } else
                                 err = -EBUSY;
                         spin_unlock_irq(&mddev->write_lock);
-                } else {
-                        mddev->ro = 0;
-                        mddev->recovery_cp = MaxSector;
-                        err = do_md_run(mddev);
-                }
+                } else
+                        err = -EINVAL;
                 break;
         case active:
                 if (mddev->pers) {
@@ -4297,6 +4294,7 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
 {
         int err = 0;
         struct gendisk *disk = mddev->gendisk;
+        mdk_rdev_t *rdev;
 
         if (atomic_read(&mddev->openers) > is_open) {
                 printk("md: %s still in use.\n",mdname(mddev));
@@ -4339,6 +4337,13 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
                         /* tell userspace to handle 'inactive' */
                         sysfs_notify_dirent(mddev->sysfs_state);
 
+                        list_for_each_entry(rdev, &mddev->disks, same_set)
+                                if (rdev->raid_disk >= 0) {
+                                        char nm[20];
+                                        sprintf(nm, "rd%d", rdev->raid_disk);
+                                        sysfs_remove_link(&mddev->kobj, nm);
+                                }
+
                         set_capacity(disk, 0);
                         mddev->changed = 1;
 
@@ -4359,7 +4364,6 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
          * Free resources if final stop
          */
         if (mode == 0) {
-                mdk_rdev_t *rdev;
 
                 printk(KERN_INFO "md: %s stopped.\n", mdname(mddev));
 
@@ -4371,13 +4375,6 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
                 }
                 mddev->bitmap_offset = 0;
 
-                list_for_each_entry(rdev, &mddev->disks, same_set)
-                        if (rdev->raid_disk >= 0) {
-                                char nm[20];
-                                sprintf(nm, "rd%d", rdev->raid_disk);
-                                sysfs_remove_link(&mddev->kobj, nm);
-                        }
-
                 /* make sure all md_delayed_delete calls have finished */
                 flush_scheduled_work();
 
@@ -5705,37 +5702,38 @@ static void status_unused(struct seq_file *seq)
 
 static void status_resync(struct seq_file *seq, mddev_t * mddev)
 {
-        sector_t max_blocks, resync, res;
-        unsigned long dt, db, rt;
+        sector_t max_sectors, resync, res;
+        unsigned long dt, db;
+        sector_t rt;
         int scale;
         unsigned int per_milli;
 
-        resync = (mddev->curr_resync - atomic_read(&mddev->recovery_active))/2;
+        resync = mddev->curr_resync - atomic_read(&mddev->recovery_active);
 
         if (test_bit(MD_RECOVERY_SYNC, &mddev->recovery))
-                max_blocks = mddev->resync_max_sectors >> 1;
+                max_sectors = mddev->resync_max_sectors;
         else
-                max_blocks = mddev->dev_sectors / 2;
+                max_sectors = mddev->dev_sectors;
 
         /*
          * Should not happen.
          */
-        if (!max_blocks) {
+        if (!max_sectors) {
                 MD_BUG();
                 return;
         }
         /* Pick 'scale' such that (resync>>scale)*1000 will fit
-         * in a sector_t, and (max_blocks>>scale) will fit in a
+         * in a sector_t, and (max_sectors>>scale) will fit in a
          * u32, as those are the requirements for sector_div.
          * Thus 'scale' must be at least 10
          */
         scale = 10;
         if (sizeof(sector_t) > sizeof(unsigned long)) {
-                while ( max_blocks/2 > (1ULL<<(scale+32)))
+                while ( max_sectors/2 > (1ULL<<(scale+32)))
                         scale++;
         }
         res = (resync>>scale)*1000;
-        sector_div(res, (u32)((max_blocks>>scale)+1));
+        sector_div(res, (u32)((max_sectors>>scale)+1));
 
         per_milli = res;
         {
@@ -5756,25 +5754,35 @@ static void status_resync(struct seq_file *seq, mddev_t * mddev)
                      (test_bit(MD_RECOVERY_SYNC, &mddev->recovery) ?
                       "resync" : "recovery"))),
                    per_milli/10, per_milli % 10,
-                   (unsigned long long) resync,
-                   (unsigned long long) max_blocks);
+                   (unsigned long long) resync/2,
+                   (unsigned long long) max_sectors/2);
 
         /*
-         * We do not want to overflow, so the order of operands and
-         * the * 100 / 100 trick are important. We do a +1 to be
-         * safe against division by zero. We only estimate anyway.
-         *
          * dt: time from mark until now
          * db: blocks written from mark until now
          * rt: remaining time
+         *
+         * rt is a sector_t, so could be 32bit or 64bit.
+         * So we divide before multiply in case it is 32bit and close
+         * to the limit.
+         * We scale the divisor (db) by 32 to avoid loosing precision
+         * near the end of resync when the number of remaining sectors
+         * is close to 'db'.
+         * We then divide rt by 32 after multiplying by db to compensate.
+         * The '+1' avoids division by zero if db is very small.
          */
         dt = ((jiffies - mddev->resync_mark) / HZ);
         if (!dt) dt++;
         db = (mddev->curr_mark_cnt - atomic_read(&mddev->recovery_active))
                 - mddev->resync_mark_cnt;
-        rt = (dt * ((unsigned long)(max_blocks-resync) / (db/2/100+1)))/100;
 
-        seq_printf(seq, " finish=%lu.%lumin", rt / 60, (rt % 60)/6);
+        rt = max_sectors - resync;    /* number of remaining sectors */
+        sector_div(rt, db/32+1);
+        rt *= dt;
+        rt >>= 5;
+
+        seq_printf(seq, " finish=%lu.%lumin", (unsigned long)rt / 60,
+                   ((unsigned long)rt % 60)/6);
 
         seq_printf(seq, " speed=%ldK/sec", db/2/dt);
 }
@@ -5965,7 +5973,7 @@ static int md_seq_show(struct seq_file *seq, void *v)
         return 0;
 }
 
-static struct seq_operations md_seq_ops = {
+static const struct seq_operations md_seq_ops = {
         .start  = md_seq_start,
         .next   = md_seq_next,
         .stop   = md_seq_stop,
diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
index 81a54f17417e..499620afb44b 100644
--- a/drivers/md/raid10.c
+++ b/drivers/md/raid10.c
@@ -1809,17 +1809,17 @@ static sector_t sync_request(mddev_t *mddev, sector_t sector_nr, int *skipped, i
                                 r10_bio->sector = sect;
 
                                 raid10_find_phys(conf, r10_bio);
-                                /* Need to check if this section will still be
+
+                                /* Need to check if the array will still be
                                  * degraded
                                  */
-                                for (j=0; j<conf->copies;j++) {
-                                        int d = r10_bio->devs[j].devnum;
-                                        if (conf->mirrors[d].rdev == NULL ||
-                                            test_bit(Faulty, &conf->mirrors[d].rdev->flags)) {
+                                for (j=0; j<conf->raid_disks; j++)
+                                        if (conf->mirrors[j].rdev == NULL ||
+                                            test_bit(Faulty, &conf->mirrors[j].rdev->flags)) {
                                                 still_degraded = 1;
                                                 break;
                                         }
-                                }
+
                                 must_sync = bitmap_start_sync(mddev->bitmap, sect,
                                                               &sync_blocks, still_degraded);
 
diff --git a/drivers/media/radio/radio-sf16fmi.c b/drivers/media/radio/radio-sf16fmi.c
index 1dba8f0832a0..5cf6c45b91fe 100644
--- a/drivers/media/radio/radio-sf16fmi.c
+++ b/drivers/media/radio/radio-sf16fmi.c
@@ -153,7 +153,7 @@ static int vidioc_g_tuner(struct file *file, void *priv,
         mult = (fmi->flags & V4L2_TUNER_CAP_LOW) ? 1 : 1000;
         v->rangelow = RSF16_MINFREQ / mult;
         v->rangehigh = RSF16_MAXFREQ / mult;
-        v->rxsubchans = V4L2_TUNER_SUB_MONO | V4L2_TUNER_MODE_STEREO;
+        v->rxsubchans = V4L2_TUNER_SUB_MONO | V4L2_TUNER_SUB_STEREO;
         v->capability = fmi->flags & V4L2_TUNER_CAP_LOW;
         v->audmode = V4L2_TUNER_MODE_STEREO;
         v->signal = fmi_getsigstr(fmi);
diff --git a/drivers/media/radio/radio-sf16fmr2.c b/drivers/media/radio/radio-sf16fmr2.c
index c09ca8600ea1..935ff9bcdfcc 100644
--- a/drivers/media/radio/radio-sf16fmr2.c
+++ b/drivers/media/radio/radio-sf16fmr2.c
@@ -233,7 +233,7 @@ static int vidioc_g_tuner(struct file *file, void *priv,
         mult = (fmr2->flags & V4L2_TUNER_CAP_LOW) ? 1 : 1000;
         v->rangelow = RSF16_MINFREQ / mult;
         v->rangehigh = RSF16_MAXFREQ / mult;
-        v->rxsubchans = V4L2_TUNER_SUB_MONO | V4L2_TUNER_MODE_STEREO;
+        v->rxsubchans = V4L2_TUNER_SUB_MONO | V4L2_TUNER_SUB_STEREO;
         v->capability = fmr2->flags&V4L2_TUNER_CAP_LOW;
         v->audmode = fmr2->stereo ? V4L2_TUNER_MODE_STEREO:
                                 V4L2_TUNER_MODE_MONO;
diff --git a/drivers/media/video/cafe_ccic.c b/drivers/media/video/cafe_ccic.c
index 5f582726985d..c4d181dde1ca 100644
--- a/drivers/media/video/cafe_ccic.c
+++ b/drivers/media/video/cafe_ccic.c
@@ -774,6 +774,7 @@ static int cafe_cam_init(struct cafe_camera *cam)
         ret = __cafe_cam_reset(cam);
         if (ret)
                 goto out;
+        chip.ident = V4L2_IDENT_NONE;
         chip.match.type = V4L2_CHIP_MATCH_I2C_ADDR;
         chip.match.addr = cam->sensor_addr;
         ret = sensor_call(cam, core, g_chip_ident, &chip);
diff --git a/drivers/media/video/cx23885/cx23885-dvb.c b/drivers/media/video/cx23885/cx23885-dvb.c
index 0c49a98213c4..1dc070da8652 100644
--- a/drivers/media/video/cx23885/cx23885-dvb.c
+++ b/drivers/media/video/cx23885/cx23885-dvb.c
@@ -472,7 +472,7 @@ static int dvb_register(struct cx23885_tsport *port)
                         static struct xc2028_ctrl ctl = {
                                 .fname       = XC2028_DEFAULT_FIRMWARE,
                                 .max_len     = 64,
-                                .scode_table = XC3028_FE_OREN538,
+                                .demod       = XC3028_FE_OREN538,
                         };
 
                         fe = dvb_attach(xc2028_attach,
diff --git a/drivers/media/video/ivtv/ivtv-driver.c b/drivers/media/video/ivtv/ivtv-driver.c
index b0195e8ee4d1..db2ac9a99acd 100644
--- a/drivers/media/video/ivtv/ivtv-driver.c
+++ b/drivers/media/video/ivtv/ivtv-driver.c
@@ -305,14 +305,17 @@ int ivtv_waitq(wait_queue_head_t *waitq)
 /* Generic utility functions */
 int ivtv_msleep_timeout(unsigned int msecs, int intr)
 {
-        int ret;
         int timeout = msecs_to_jiffies(msecs);
 
         do {
                 set_current_state(intr ? TASK_INTERRUPTIBLE : TASK_UNINTERRUPTIBLE);
                 timeout = schedule_timeout(timeout);
-                if (intr && (ret = signal_pending(current)))
-                        return ret;
+                if (intr) {
+                        int ret = signal_pending(current);
+
+                        if (ret)
+                                return ret;
+                }
         } while (timeout);
         return 0;
 }
diff --git a/drivers/media/video/ivtv/ivtv-gpio.c b/drivers/media/video/ivtv/ivtv-gpio.c
index ceb05bdcaf62..85ac707228e7 100644
--- a/drivers/media/video/ivtv/ivtv-gpio.c
+++ b/drivers/media/video/ivtv/ivtv-gpio.c
@@ -190,8 +190,8 @@ static int subdev_g_tuner(struct v4l2_subdev *sd, struct v4l2_tuner *vt)
 
         mask = itv->card->gpio_audio_detect.mask;
         if (mask == 0 || (read_reg(IVTV_REG_GPIO_IN) & mask))
-                vt->rxsubchans = V4L2_TUNER_MODE_STEREO |
-                        V4L2_TUNER_MODE_LANG1 | V4L2_TUNER_MODE_LANG2;
+                vt->rxsubchans = V4L2_TUNER_SUB_STEREO |
+                        V4L2_TUNER_SUB_LANG1 | V4L2_TUNER_SUB_LANG2;
         else
                 vt->rxsubchans = V4L2_TUNER_SUB_MONO;
         return 0;
diff --git a/drivers/media/video/ivtv/ivtv-ioctl.c b/drivers/media/video/ivtv/ivtv-ioctl.c
index 4a2d464f055e..c342a9fe983e 100644
--- a/drivers/media/video/ivtv/ivtv-ioctl.c
+++ b/drivers/media/video/ivtv/ivtv-ioctl.c
@@ -180,7 +180,7 @@ int ivtv_set_speed(struct ivtv *itv, int speed)
 
                 /* Wait for any DMA to finish */
                 prepare_to_wait(&itv->dma_waitq, &wait, TASK_INTERRUPTIBLE);
-                while (itv->i_flags & IVTV_F_I_DMA) {
+                while (test_bit(IVTV_F_I_DMA, &itv->i_flags)) {
                         got_sig = signal_pending(current);
                         if (got_sig)
                                 break;
@@ -1710,7 +1710,8 @@ static int ivtv_decoder_ioctls(struct file *filp, unsigned int cmd, void *arg)
                            we are waiting unlock first and later lock again. */
                         mutex_unlock(&itv->serialize_lock);
                         prepare_to_wait(&itv->event_waitq, &wait, TASK_INTERRUPTIBLE);
-                        if ((itv->i_flags & (IVTV_F_I_EV_DEC_STOPPED|IVTV_F_I_EV_VSYNC)) == 0)
+                        if (!test_bit(IVTV_F_I_EV_DEC_STOPPED, &itv->i_flags) &&
+                            !test_bit(IVTV_F_I_EV_VSYNC, &itv->i_flags))
                                 schedule();
                         finish_wait(&itv->event_waitq, &wait);
                         mutex_lock(&itv->serialize_lock);
diff --git a/drivers/media/video/ivtv/ivtv-irq.c b/drivers/media/video/ivtv/ivtv-irq.c
index 01c14d2b381a..cd9db0bf33bf 100644
--- a/drivers/media/video/ivtv/ivtv-irq.c
+++ b/drivers/media/video/ivtv/ivtv-irq.c
@@ -196,7 +196,7 @@ static int stream_enc_dma_append(struct ivtv_stream *s, u32 data[CX2341X_MBOX_MA
                                 bytes_needed, s->name);
                 return -1;
         }
-        if (rc && !s->buffers_stolen && (s->s_flags & IVTV_F_S_APPL_IO)) {
+        if (rc && !s->buffers_stolen && test_bit(IVTV_F_S_APPL_IO, &s->s_flags)) {
                 IVTV_WARN("All %s stream buffers are full. Dropping data.\n", s->name);
                 IVTV_WARN("Cause: the application is not reading fast enough.\n");
         }
diff --git a/drivers/media/video/ivtv/ivtv-yuv.c b/drivers/media/video/ivtv/ivtv-yuv.c
index 7912ed6b72ee..c0875378acc2 100644
--- a/drivers/media/video/ivtv/ivtv-yuv.c
+++ b/drivers/media/video/ivtv/ivtv-yuv.c
@@ -1063,7 +1063,8 @@ static int ivtv_yuv_udma_frame(struct ivtv *itv, struct ivtv_dma_frame *args)
         prepare_to_wait(&itv->dma_waitq, &wait, TASK_INTERRUPTIBLE);
         /* if no UDMA is pending and no UDMA is in progress, then the DMA
            is finished */
-        while (itv->i_flags & (IVTV_F_I_UDMA_PENDING | IVTV_F_I_UDMA)) {
+        while (test_bit(IVTV_F_I_UDMA_PENDING, &itv->i_flags) ||
+               test_bit(IVTV_F_I_UDMA, &itv->i_flags)) {
                 /* don't interrupt if the DMA is in progress but break off
                    a still pending DMA. */
                 got_sig = signal_pending(current);
diff --git a/drivers/media/video/ivtv/ivtvfb.c b/drivers/media/video/ivtv/ivtvfb.c
index 66e6eb513076..fa6bb85cb4b0 100644
--- a/drivers/media/video/ivtv/ivtvfb.c
+++ b/drivers/media/video/ivtv/ivtvfb.c
@@ -298,7 +298,8 @@ static int ivtvfb_prep_dec_dma_to_device(struct ivtv *itv,
         prepare_to_wait(&itv->dma_waitq, &wait, TASK_INTERRUPTIBLE);
         /* if no UDMA is pending and no UDMA is in progress, then the DMA
            is finished */
-        while (itv->i_flags & (IVTV_F_I_UDMA_PENDING | IVTV_F_I_UDMA)) {
+        while (test_bit(IVTV_F_I_UDMA_PENDING, &itv->i_flags) ||
+               test_bit(IVTV_F_I_UDMA, &itv->i_flags)) {
                 /* don't interrupt if the DMA is in progress but break off
                    a still pending DMA. */
                 got_sig = signal_pending(current);
diff --git a/drivers/media/video/uvc/uvc_driver.c b/drivers/media/video/uvc/uvc_driver.c
index 399412d7f020..507dc85646b2 100644
--- a/drivers/media/video/uvc/uvc_driver.c
+++ b/drivers/media/video/uvc/uvc_driver.c
@@ -1726,14 +1726,17 @@ static int uvc_suspend(struct usb_interface *intf, pm_message_t message)
 static int __uvc_resume(struct usb_interface *intf, int reset)
 {
         struct uvc_device *dev = usb_get_intfdata(intf);
-        int ret;
 
         uvc_trace(UVC_TRACE_SUSPEND, "Resuming interface %u\n",
                 intf->cur_altsetting->desc.bInterfaceNumber);
 
         if (intf->cur_altsetting->desc.bInterfaceSubClass == SC_VIDEOCONTROL) {
-                if (reset && (ret = uvc_ctrl_resume_device(dev)) < 0)
-                        return ret;
+                if (reset) {
+                        int ret = uvc_ctrl_resume_device(dev);
+
+                        if (ret < 0)
+                                return ret;
+                }
 
                 return uvc_status_resume(dev);
         }
diff --git a/drivers/media/video/uvc/uvc_video.c b/drivers/media/video/uvc/uvc_video.c
index a95e17329c5b..6ce974d7362f 100644
--- a/drivers/media/video/uvc/uvc_video.c
+++ b/drivers/media/video/uvc/uvc_video.c
@@ -742,7 +742,7 @@ static int uvc_alloc_urb_buffers(struct uvc_video_device *video,
 
         /* Buffers are already allocated, bail out. */
         if (video->urb_size)
-                return 0;
+                return video->urb_size / psize;
 
         /* Compute the number of packets. Bulk endpoints might transfer UVC
          * payloads accross multiple URBs.
diff --git a/drivers/media/video/v4l2-ioctl.c b/drivers/media/video/v4l2-ioctl.c
index 88f10d6cbc92..be64a502ea27 100644
--- a/drivers/media/video/v4l2-ioctl.c
+++ b/drivers/media/video/v4l2-ioctl.c
@@ -42,6 +42,12 @@
                         printk(KERN_DEBUG "%s: " fmt, vfd->name, ## arg);\
                 } while (0)
 
+/* Zero out the end of the struct pointed to by p.  Everthing after, but
+ * not including, the specified field is cleared. */
+#define CLEAR_AFTER_FIELD(p, field) \
+        memset((u8 *)(p) + offsetof(typeof(*(p)), field) + sizeof((p)->field), \
+        0, sizeof(*(p)) - offsetof(typeof(*(p)), field) - sizeof((p)->field))
+
 struct std_descr {
         v4l2_std_id std;
         const char *descr;
@@ -544,39 +550,39 @@ static int check_fmt(const struct v4l2_ioctl_ops *ops, enum v4l2_buf_type type)
 
         switch (type) {
         case V4L2_BUF_TYPE_VIDEO_CAPTURE:
-                if (ops->vidioc_try_fmt_vid_cap)
+                if (ops->vidioc_g_fmt_vid_cap)
                         return 0;
                 break;
         case V4L2_BUF_TYPE_VIDEO_OVERLAY:
-                if (ops->vidioc_try_fmt_vid_overlay)
+                if (ops->vidioc_g_fmt_vid_overlay)
                         return 0;
                 break;
         case V4L2_BUF_TYPE_VIDEO_OUTPUT:
-                if (ops->vidioc_try_fmt_vid_out)
+                if (ops->vidioc_g_fmt_vid_out)
                         return 0;
                 break;
         case V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY:
-                if (ops->vidioc_try_fmt_vid_out_overlay)
+                if (ops->vidioc_g_fmt_vid_out_overlay)
                         return 0;
                 break;
         case V4L2_BUF_TYPE_VBI_CAPTURE:
-                if (ops->vidioc_try_fmt_vbi_cap)
+                if (ops->vidioc_g_fmt_vbi_cap)
                         return 0;
                 break;
         case V4L2_BUF_TYPE_VBI_OUTPUT:
-                if (ops->vidioc_try_fmt_vbi_out)
+                if (ops->vidioc_g_fmt_vbi_out)
                         return 0;
                 break;
         case V4L2_BUF_TYPE_SLICED_VBI_CAPTURE:
-                if (ops->vidioc_try_fmt_sliced_vbi_cap)
+                if (ops->vidioc_g_fmt_sliced_vbi_cap)
                         return 0;
                 break;
         case V4L2_BUF_TYPE_SLICED_VBI_OUTPUT:
-                if (ops->vidioc_try_fmt_sliced_vbi_out)
+                if (ops->vidioc_g_fmt_sliced_vbi_out)
                         return 0;
                 break;
         case V4L2_BUF_TYPE_PRIVATE:
-                if (ops->vidioc_try_fmt_type_private)
+                if (ops->vidioc_g_fmt_type_private)
                         return 0;
                 break;
         }
@@ -782,44 +788,53 @@ static long __video_do_ioctl(struct file *file,
 
                 switch (f->type) {
                 case V4L2_BUF_TYPE_VIDEO_CAPTURE:
+                        CLEAR_AFTER_FIELD(f, fmt.pix);
                         v4l_print_pix_fmt(vfd, &f->fmt.pix);
                         if (ops->vidioc_s_fmt_vid_cap)
                                 ret = ops->vidioc_s_fmt_vid_cap(file, fh, f);
                         break;
                 case V4L2_BUF_TYPE_VIDEO_OVERLAY:
+                        CLEAR_AFTER_FIELD(f, fmt.win);
                         if (ops->vidioc_s_fmt_vid_overlay)
                                 ret = ops->vidioc_s_fmt_vid_overlay(file,
                                                                     fh, f);
                         break;
                 case V4L2_BUF_TYPE_VIDEO_OUTPUT:
+                        CLEAR_AFTER_FIELD(f, fmt.pix);
                         v4l_print_pix_fmt(vfd, &f->fmt.pix);
                         if (ops->vidioc_s_fmt_vid_out)
                                 ret = ops->vidioc_s_fmt_vid_out(file, fh, f);
                         break;
                 case V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY:
+                        CLEAR_AFTER_FIELD(f, fmt.win);
                         if (ops->vidioc_s_fmt_vid_out_overlay)
                                 ret = ops->vidioc_s_fmt_vid_out_overlay(file,
                                         fh, f);
                         break;
                 case V4L2_BUF_TYPE_VBI_CAPTURE:
+                        CLEAR_AFTER_FIELD(f, fmt.vbi);
                         if (ops->vidioc_s_fmt_vbi_cap)
                                 ret = ops->vidioc_s_fmt_vbi_cap(file, fh, f);
                         break;
                 case V4L2_BUF_TYPE_VBI_OUTPUT:
+                        CLEAR_AFTER_FIELD(f, fmt.vbi);
                         if (ops->vidioc_s_fmt_vbi_out)
                                 ret = ops->vidioc_s_fmt_vbi_out(file, fh, f);
                         break;
                 case V4L2_BUF_TYPE_SLICED_VBI_CAPTURE:
+                        CLEAR_AFTER_FIELD(f, fmt.sliced);
                         if (ops->vidioc_s_fmt_sliced_vbi_cap)
                                 ret = ops->vidioc_s_fmt_sliced_vbi_cap(file,
                                                                         fh, f);
                         break;
                 case V4L2_BUF_TYPE_SLICED_VBI_OUTPUT:
+                        CLEAR_AFTER_FIELD(f, fmt.sliced);
                         if (ops->vidioc_s_fmt_sliced_vbi_out)
                                 ret = ops->vidioc_s_fmt_sliced_vbi_out(file,
                                                                         fh, f);
                         break;
                 case V4L2_BUF_TYPE_PRIVATE:
+                        /* CLEAR_AFTER_FIELD(f, fmt.raw_data); <- does nothing */
                         if (ops->vidioc_s_fmt_type_private)
                                 ret = ops->vidioc_s_fmt_type_private(file,
                                                                 fh, f);
@@ -836,46 +851,55 @@ static long __video_do_ioctl(struct file *file,
                                                 v4l2_type_names));
                 switch (f->type) {
                 case V4L2_BUF_TYPE_VIDEO_CAPTURE:
+                        CLEAR_AFTER_FIELD(f, fmt.pix);
                         if (ops->vidioc_try_fmt_vid_cap)
                                 ret = ops->vidioc_try_fmt_vid_cap(file, fh, f);
                         if (!ret)
                                 v4l_print_pix_fmt(vfd, &f->fmt.pix);
                         break;
                 case V4L2_BUF_TYPE_VIDEO_OVERLAY:
+                        CLEAR_AFTER_FIELD(f, fmt.win);
                         if (ops->vidioc_try_fmt_vid_overlay)
                                 ret = ops->vidioc_try_fmt_vid_overlay(file,
                                         fh, f);
                         break;
                 case V4L2_BUF_TYPE_VIDEO_OUTPUT:
+                        CLEAR_AFTER_FIELD(f, fmt.pix);
                         if (ops->vidioc_try_fmt_vid_out)
                                 ret = ops->vidioc_try_fmt_vid_out(file, fh, f);
                         if (!ret)
                                 v4l_print_pix_fmt(vfd, &f->fmt.pix);
                         break;
                 case V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY:
+                        CLEAR_AFTER_FIELD(f, fmt.win);
                         if (ops->vidioc_try_fmt_vid_out_overlay)
                                 ret = ops->vidioc_try_fmt_vid_out_overlay(file,
                                        fh, f);
                         break;
                 case V4L2_BUF_TYPE_VBI_CAPTURE:
+                        CLEAR_AFTER_FIELD(f, fmt.vbi);
                         if (ops->vidioc_try_fmt_vbi_cap)
                                 ret = ops->vidioc_try_fmt_vbi_cap(file, fh, f);
                         break;
                 case V4L2_BUF_TYPE_VBI_OUTPUT:
+                        CLEAR_AFTER_FIELD(f, fmt.vbi);
                         if (ops->vidioc_try_fmt_vbi_out)
                                 ret = ops->vidioc_try_fmt_vbi_out(file, fh, f);
                         break;
                 case V4L2_BUF_TYPE_SLICED_VBI_CAPTURE:
+                        CLEAR_AFTER_FIELD(f, fmt.sliced);
                         if (ops->vidioc_try_fmt_sliced_vbi_cap)
                                 ret = ops->vidioc_try_fmt_sliced_vbi_cap(file,
                                                                 fh, f);
                         break;
                 case V4L2_BUF_TYPE_SLICED_VBI_OUTPUT:
+                        CLEAR_AFTER_FIELD(f, fmt.sliced);
                         if (ops->vidioc_try_fmt_sliced_vbi_out)
                                 ret = ops->vidioc_try_fmt_sliced_vbi_out(file,
                                                                 fh, f);
                         break;
                 case V4L2_BUF_TYPE_PRIVATE:
+                        /* CLEAR_AFTER_FIELD(f, fmt.raw_data); <- does nothing */
                         if (ops->vidioc_try_fmt_type_private)
                                 ret = ops->vidioc_try_fmt_type_private(file,
                                                                 fh, f);
@@ -898,6 +922,9 @@ static long __video_do_ioctl(struct file *file,
                 if (ret)
                         break;
 
+                if (p->type < V4L2_BUF_TYPE_PRIVATE)
+                        CLEAR_AFTER_FIELD(p, memory);
+
                 ret = ops->vidioc_reqbufs(file, fh, p);
                 dbgarg(cmd, "count=%d, type=%s, memory=%s\n",
                                 p->count,
diff --git a/drivers/media/video/zoran/zoran_driver.c b/drivers/media/video/zoran/zoran_driver.c
index 092333b1c34f..643cccaa1aab 100644
--- a/drivers/media/video/zoran/zoran_driver.c
+++ b/drivers/media/video/zoran/zoran_driver.c
@@ -1863,22 +1863,20 @@ static int zoran_querycap(struct file *file, void *__fh, struct v4l2_capability
 
 static int zoran_enum_fmt(struct zoran *zr, struct v4l2_fmtdesc *fmt, int flag)
 {
-        int num = -1, i;
-
-        for (i = 0; i < NUM_FORMATS; i++) {
-                if (zoran_formats[i].flags & flag)
-                        num++;
-                if (num == fmt->index)
-                        break;
+        unsigned int num, i;
+
+        for (num = i = 0; i < NUM_FORMATS; i++) {
+                if (zoran_formats[i].flags & flag && num++ == fmt->index) {
+                        strncpy(fmt->description, zoran_formats[i].name,
+                                sizeof(fmt->description) - 1);
+                        /* fmt struct pre-zeroed, so adding '\0' not neeed */
+                        fmt->pixelformat = zoran_formats[i].fourcc;
+                        if (zoran_formats[i].flags & ZORAN_FORMAT_COMPRESSED)
+                                fmt->flags |= V4L2_FMT_FLAG_COMPRESSED;
+                        return 0;
+                }
         }
-        if (fmt->index < 0 /* late, but not too late */  || i == NUM_FORMATS)
-                return -EINVAL;
-
-        strncpy(fmt->description, zoran_formats[i].name, sizeof(fmt->description)-1);
-        fmt->pixelformat = zoran_formats[i].fourcc;
-        if (zoran_formats[i].flags & ZORAN_FORMAT_COMPRESSED)
-                fmt->flags |= V4L2_FMT_FLAG_COMPRESSED;
-        return 0;
+        return -EINVAL;
 }
 
 static int zoran_enum_fmt_vid_cap(struct file *file, void *__fh,
diff --git a/drivers/misc/isl29003.c b/drivers/misc/isl29003.c
index 2e2a5923d4c2..a71e245801ee 100644
--- a/drivers/misc/isl29003.c
+++ b/drivers/misc/isl29003.c
@@ -64,6 +64,7 @@ struct isl29003_data {
         struct i2c_client *client;
         struct mutex lock;
         u8 reg_cache[ISL29003_NUM_CACHABLE_REGS];
+        u8 power_state_before_suspend;
 };
 
 static int gain_range[] = {
@@ -411,6 +412,9 @@ static int __devexit isl29003_remove(struct i2c_client *client)
 #ifdef CONFIG_PM
 static int isl29003_suspend(struct i2c_client *client, pm_message_t mesg)
 {
+        struct isl29003_data *data = i2c_get_clientdata(client);
+
+        data->power_state_before_suspend = isl29003_get_power_state(client);
         return isl29003_set_power_state(client, 0);
 }
 
@@ -421,10 +425,11 @@ static int isl29003_resume(struct i2c_client *client)
 
         /* restore registers from cache */
         for (i = 0; i < ARRAY_SIZE(data->reg_cache); i++)
-                if (!i2c_smbus_write_byte_data(client, i, data->reg_cache[i]))
+                if (i2c_smbus_write_byte_data(client, i, data->reg_cache[i]))
                         return -EIO;
 
-        return 0;
+        return isl29003_set_power_state(client,
+                data->power_state_before_suspend);
 }
 
 #else
diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c
index fe8041e619ea..b25e9b6516ae 100644
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -254,6 +254,14 @@ static int mmc_blk_issue_rq(struct mmc_queue *mq, struct request *req)
                 brq.data.blocks = req->nr_sectors;
 
                 /*
+                 * The block layer doesn't support all sector count
+                 * restrictions, so we need to be prepared for too big
+                 * requests.
+                 */
+                if (brq.data.blocks > card->host->max_blk_count)
+                        brq.data.blocks = card->host->max_blk_count;
+
+                /*
                  * After a read error, we redo the request one sector at a time
                  * in order to accurately determine which sectors can be read
                  * successfully.
diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c
index fa073ab3fa34..264911732756 100644
--- a/drivers/mmc/core/core.c
+++ b/drivers/mmc/core/core.c
@@ -706,7 +706,7 @@ static void mmc_power_up(struct mmc_host *host)
          * This delay should be sufficient to allow the power supply
          * to reach the minimum voltage.
          */
-        mmc_delay(2);
+        mmc_delay(10);
 
         host->ios.clock = host->f_min;
         host->ios.power_mode = MMC_POWER_ON;
@@ -716,7 +716,7 @@ static void mmc_power_up(struct mmc_host *host)
          * This delay must be at least 74 clock sizes, or 1 ms, or the
          * time required to reach a stable voltage.
          */
-        mmc_delay(2);
+        mmc_delay(10);
 }
 
 static void mmc_power_off(struct mmc_host *host)
diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
index a663429b3d55..36875dcfa492 100644
--- a/drivers/mmc/host/mmci.c
+++ b/drivers/mmc/host/mmci.c
@@ -514,6 +514,7 @@ static int __devinit mmci_probe(struct amba_device *dev, void *id)
         }
 
         host = mmc_priv(mmc);
+        host->mmc = mmc;
         /* Bits 12 thru 19 is the designer */
         host->hw_designer = (dev->periphid >> 12) & 0xff;
         /* Bits 20 thru 23 is the revison */
@@ -545,7 +546,6 @@ static int __devinit mmci_probe(struct amba_device *dev, void *id)
                 host->mclk = clk_get_rate(host->clk);
                 DBG(host, "eventual mclk rate: %u Hz\n", host->mclk);
         }
-        host->mmc = mmc;
         host->base = ioremap(dev->res.start, SZ_4K);
         if (!host->base) {
                 ret = -ENOMEM;
diff --git a/drivers/mmc/host/mvsdio.c b/drivers/mmc/host/mvsdio.c
index b5c375d94ab3..c643d0fe118f 100644
--- a/drivers/mmc/host/mvsdio.c
+++ b/drivers/mmc/host/mvsdio.c
@@ -825,24 +825,23 @@ static int __exit mvsd_remove(struct platform_device *pdev)
 }
 
 #ifdef CONFIG_PM
-static int mvsd_suspend(struct platform_device *dev, pm_message_t state,
-                           u32 level)
+static int mvsd_suspend(struct platform_device *dev, pm_message_t state)
 {
         struct mmc_host *mmc = platform_get_drvdata(dev);
         int ret = 0;
 
-        if (mmc && level == SUSPEND_DISABLE)
+        if (mmc)
                 ret = mmc_suspend_host(mmc, state);
 
         return ret;
 }
 
-static int mvsd_resume(struct platform_device *dev, u32 level)
+static int mvsd_resume(struct platform_device *dev)
 {
-        struct mmc_host *mmc = platform_dev_get_drvdata(dev);
+        struct mmc_host *mmc = platform_get_drvdata(dev);
         int ret = 0;
 
-        if (mmc && level == RESUME_ENABLE)
+        if (mmc)
                 ret = mmc_resume_host(mmc);
 
         return ret;
diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
index cd37962ec44f..65be27995d5c 100644
--- a/drivers/mmc/host/sdhci-pci.c
+++ b/drivers/mmc/host/sdhci-pci.c
@@ -522,8 +522,8 @@ static struct sdhci_pci_slot * __devinit sdhci_pci_probe_slot(
 
         host = sdhci_alloc_host(&pdev->dev, sizeof(struct sdhci_pci_slot));
         if (IS_ERR(host)) {
-                ret = PTR_ERR(host);
-                goto unmap;
+                dev_err(&pdev->dev, "cannot allocate host\n");
+                return ERR_PTR(PTR_ERR(host));
         }
 
         slot = sdhci_priv(host);
@@ -541,7 +541,7 @@ static struct sdhci_pci_slot * __devinit sdhci_pci_probe_slot(
         ret = pci_request_region(pdev, bar, mmc_hostname(host->mmc));
         if (ret) {
                 dev_err(&pdev->dev, "cannot request region\n");
-                return ERR_PTR(ret);
+                goto free;
         }
 
         addr = pci_resource_start(pdev, bar);
@@ -572,6 +572,8 @@ unmap:
 
 release:
         pci_release_region(pdev, bar);
+
+free:
         sdhci_free_host(host);
 
         return ERR_PTR(ret);
diff --git a/drivers/mmc/host/sdhci.h b/drivers/mmc/host/sdhci.h
index f20a834f4309..65c6f996bbd3 100644
--- a/drivers/mmc/host/sdhci.h
+++ b/drivers/mmc/host/sdhci.h
@@ -125,7 +125,7 @@
 #define  SDHCI_INT_DATA_MASK    (SDHCI_INT_DATA_END | SDHCI_INT_DMA_END | \
                 SDHCI_INT_DATA_AVAIL | SDHCI_INT_SPACE_AVAIL | \
                 SDHCI_INT_DATA_TIMEOUT | SDHCI_INT_DATA_CRC | \
-                SDHCI_INT_DATA_END_BIT)
+                SDHCI_INT_DATA_END_BIT | SDHCI_ADMA_ERROR)
 #define SDHCI_INT_ALL_MASK      ((unsigned int)-1)
 
 #define SDHCI_ACMD12_ERR        0x3C
diff --git a/drivers/mtd/devices/m25p80.c b/drivers/mtd/devices/m25p80.c
index 8185b1f3e5e6..cc6369ea67dd 100644
--- a/drivers/mtd/devices/m25p80.c
+++ b/drivers/mtd/devices/m25p80.c
@@ -54,7 +54,7 @@
 #define SR_SRWD                 0x80    /* SR write protect */
 
 /* Define max times to check status register before we give up. */
-#define MAX_READY_WAIT_COUNT    100000
+#define MAX_READY_WAIT_JIFFIES  (10 * HZ)       /* eg. M25P128 specs 6s max sector erase */
 #define CMD_SIZE                4
 
 #ifdef CONFIG_M25PXX_USE_FAST_READ
@@ -139,20 +139,20 @@ static inline int write_enable(struct m25p *flash)
  */
 static int wait_till_ready(struct m25p *flash)
 {
-        int count;
+        unsigned long deadline;
         int sr;
 
-        /* one chip guarantees max 5 msec wait here after page writes,
-         * but potentially three seconds (!) after page erase.
-         */
-        for (count = 0; count < MAX_READY_WAIT_COUNT; count++) {
+        deadline = jiffies + MAX_READY_WAIT_JIFFIES;
+
+        do {
                 if ((sr = read_sr(flash)) < 0)
                         break;
                 else if (!(sr & SR_WIP))
                         return 0;
 
-                /* REVISIT sometimes sleeping would be best */
-        }
+                cond_resched();
+
+        } while (!time_after_eq(jiffies, deadline));
 
         return 1;
 }
@@ -246,10 +246,12 @@ static int m25p80_erase(struct mtd_info *mtd, struct erase_info *instr)
         mutex_lock(&flash->lock);
 
         /* whole-chip erase? */
-        if (len == flash->mtd.size && erase_chip(flash)) {
-                instr->state = MTD_ERASE_FAILED;
-                mutex_unlock(&flash->lock);
-                return -EIO;
+        if (len == flash->mtd.size) {
+                if (erase_chip(flash)) {
+                        instr->state = MTD_ERASE_FAILED;
+                        mutex_unlock(&flash->lock);
+                        return -EIO;
+                }
 
         /* REVISIT in some cases we could speed up erasing large regions
          * by using OPCODE_SE instead of OPCODE_BE_4K.  We may have set up
diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index fdd6ae859397..bccb4b1ffc46 100644
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -48,11 +48,11 @@ static LIST_HEAD(mtd_notifiers);
  */
 static void mtd_release(struct device *dev)
 {
-        struct mtd_info *mtd = dev_to_mtd(dev);
+        dev_t index = MTD_DEVT(dev_to_mtd(dev)->index);
 
         /* remove /dev/mtdXro node if needed */
-        if (MTD_DEVT(mtd->index))
-                device_destroy(mtd_class, MTD_DEVT(mtd->index) + 1);
+        if (index)
+                device_destroy(mtd_class, index + 1);
 }
 
 static ssize_t mtd_type_show(struct device *dev,
@@ -132,6 +132,17 @@ static ssize_t mtd_writesize_show(struct device *dev,
 }
 static DEVICE_ATTR(writesize, S_IRUGO, mtd_writesize_show, NULL);
 
+static ssize_t mtd_subpagesize_show(struct device *dev,
+                struct device_attribute *attr, char *buf)
+{
+        struct mtd_info *mtd = dev_to_mtd(dev);
+        unsigned int subpagesize = mtd->writesize >> mtd->subpage_sft;
+
+        return snprintf(buf, PAGE_SIZE, "%u\n", subpagesize);
+
+}
+static DEVICE_ATTR(subpagesize, S_IRUGO, mtd_subpagesize_show, NULL);
+
 static ssize_t mtd_oobsize_show(struct device *dev,
                 struct device_attribute *attr, char *buf)
 {
@@ -169,6 +180,7 @@ static struct attribute *mtd_attrs[] = {
         &dev_attr_size.attr,
         &dev_attr_erasesize.attr,
         &dev_attr_writesize.attr,
+        &dev_attr_subpagesize.attr,
         &dev_attr_oobsize.attr,
         &dev_attr_numeraseregions.attr,
         &dev_attr_name.attr,
diff --git a/drivers/mtd/mtdsuper.c b/drivers/mtd/mtdsuper.c
index 92285d0089c2..af8b42e0a55b 100644
--- a/drivers/mtd/mtdsuper.c
+++ b/drivers/mtd/mtdsuper.c
@@ -74,8 +74,7 @@ static int get_sb_mtd_aux(struct file_system_type *fs_type, int flags,
 
         ret = fill_super(sb, data, flags & MS_SILENT ? 1 : 0);
         if (ret < 0) {
-                up_write(&sb->s_umount);
-                deactivate_super(sb);
+                deactivate_locked_super(sb);
                 return ret;
         }
 
diff --git a/drivers/net/arm/ixp4xx_eth.c b/drivers/net/arm/ixp4xx_eth.c
index 448487e22fa3..672c9626b9ca 100644
--- a/drivers/net/arm/ixp4xx_eth.c
+++ b/drivers/net/arm/ixp4xx_eth.c
@@ -338,12 +338,12 @@ static int ixp4xx_mdio_register(void)
         if (cpu_is_ixp43x()) {
                 /* IXP43x lacks NPE-B and uses NPE-C for MII PHY access */
                 if (!(ixp4xx_read_feature_bits() & IXP4XX_FEATURE_NPEC_ETH))
-                        return -ENOSYS;
+                        return -ENODEV;
                 mdio_regs = (struct eth_regs __iomem *)IXP4XX_EthC_BASE_VIRT;
         } else {
                 /* All MII PHY accesses use NPE-B Ethernet registers */
                 if (!(ixp4xx_read_feature_bits() & IXP4XX_FEATURE_NPEB_ETH0))
-                        return -ENOSYS;
+                        return -ENODEV;
                 mdio_regs = (struct eth_regs __iomem *)IXP4XX_EthB_BASE_VIRT;
         }
 
@@ -456,7 +456,8 @@ static inline void queue_put_desc(unsigned int queue, u32 phys,
         debug_desc(phys, desc);
         BUG_ON(phys & 0x1F);
         qmgr_put_entry(queue, phys);
-        BUG_ON(qmgr_stat_overflow(queue));
+        /* Don't check for queue overflow here, we've allocated sufficient
+           length and queues >= 32 don't support this check anyway. */
 }
 
 
@@ -512,8 +513,8 @@ static int eth_poll(struct napi_struct *napi, int budget)
 #endif
                         napi_complete(napi);
                         qmgr_enable_irq(rxq);
-                        if (!qmgr_stat_empty(rxq) &&
-                            napi_reschedule(napi)) {
+                        if (!qmgr_stat_nearly_empty(rxq) &&
+                            napi_reschedule(napi)) { /* really empty in fact */
 #if DEBUG_RX
                                 printk(KERN_DEBUG "%s: eth_poll"
                                        " napi_reschedule successed\n",
@@ -630,7 +631,8 @@ static void eth_txdone_irq(void *unused)
                         port->tx_buff_tab[n_desc] = NULL;
                 }
 
-                start = qmgr_stat_empty(port->plat->txreadyq);
+                /* really empty in fact */
+                start = qmgr_stat_nearly_empty(port->plat->txreadyq);
                 queue_put_desc(port->plat->txreadyq, phys, desc);
                 if (start) {
 #if DEBUG_TX
@@ -708,13 +710,14 @@ static int eth_xmit(struct sk_buff *skb, struct net_device *dev)
         queue_put_desc(TX_QUEUE(port->id), tx_desc_phys(port, n), desc);
         dev->trans_start = jiffies;
 
-        if (qmgr_stat_empty(txreadyq)) {
+        if (qmgr_stat_nearly_empty(txreadyq)) { /* really empty in fact */
 #if DEBUG_TX
                 printk(KERN_DEBUG "%s: eth_xmit queue full\n", dev->name);
 #endif
                 netif_stop_queue(dev);
                 /* we could miss TX ready interrupt */
-                if (!qmgr_stat_empty(txreadyq)) {
+                /* really empty in fact */
+                if (!qmgr_stat_nearly_empty(txreadyq)) {
 #if DEBUG_TX
                         printk(KERN_DEBUG "%s: eth_xmit ready again\n",
                                dev->name);
@@ -814,29 +817,29 @@ static int request_queues(struct port *port)
         int err;
 
         err = qmgr_request_queue(RXFREE_QUEUE(port->id), RX_DESCS, 0, 0,
-                            "%s:RX-free", port->netdev->name);
+                                 "%s:RX-free", port->netdev->name);
         if (err)
                 return err;
 
         err = qmgr_request_queue(port->plat->rxq, RX_DESCS, 0, 0,
-                            "%s:RX", port->netdev->name);
+                                 "%s:RX", port->netdev->name);
         if (err)
                 goto rel_rxfree;
 
         err = qmgr_request_queue(TX_QUEUE(port->id), TX_DESCS, 0, 0,
-                            "%s:TX", port->netdev->name);
+                                 "%s:TX", port->netdev->name);
         if (err)
                 goto rel_rx;
 
         err = qmgr_request_queue(port->plat->txreadyq, TX_DESCS, 0, 0,
-                            "%s:TX-ready", port->netdev->name);
+                                 "%s:TX-ready", port->netdev->name);
         if (err)
                 goto rel_tx;
 
         /* TX-done queue handles skbs sent out by the NPEs */
         if (!ports_open) {
                 err = qmgr_request_queue(TXDONE_QUEUE, TXDONE_QUEUE_LEN, 0, 0,
-                                    "%s:TX-done", DRV_NAME);
+                                         "%s:TX-done", DRV_NAME);
                 if (err)
                         goto rel_txready;
         }
@@ -1174,7 +1177,7 @@ static int __devinit eth_init_one(struct platform_device *pdev)
                 regs_phys  = IXP4XX_EthC_BASE_PHYS;
                 break;
         default:
-                err = -ENOSYS;
+                err = -ENODEV;
                 goto err_free;
         }
 
@@ -1189,15 +1192,10 @@ static int __devinit eth_init_one(struct platform_device *pdev)
                 goto err_free;
         }
 
-        if (register_netdev(dev)) {
-                err = -EIO;
-                goto err_npe_rel;
-        }
-
         port->mem_res = request_mem_region(regs_phys, REGS_SIZE, dev->name);
         if (!port->mem_res) {
                 err = -EBUSY;
-                goto err_unreg;
+                goto err_npe_rel;
         }
 
         port->plat = plat;
@@ -1215,20 +1213,25 @@ static int __devinit eth_init_one(struct platform_device *pdev)
         snprintf(phy_id, BUS_ID_SIZE, PHY_ID_FMT, "0", plat->phy);
         port->phydev = phy_connect(dev, phy_id, &ixp4xx_adjust_link, 0,
                                    PHY_INTERFACE_MODE_MII);
-        if (IS_ERR(port->phydev)) {
-                printk(KERN_ERR "%s: Could not attach to PHY\n", dev->name);
-                return PTR_ERR(port->phydev);
-        }
+        if ((err = IS_ERR(port->phydev)))
+                goto err_free_mem;
 
         port->phydev->irq = PHY_POLL;
 
+        if ((err = register_netdev(dev)))
+                goto err_phy_dis;
+
         printk(KERN_INFO "%s: MII PHY %i on %s\n", dev->name, plat->phy,
                npe_name(port->npe));
 
         return 0;
 
-err_unreg:
-        unregister_netdev(dev);
+err_phy_dis:
+        phy_disconnect(port->phydev);
+err_free_mem:
+        npe_port_tab[NPE_ID(port->id)] = NULL;
+        platform_set_drvdata(pdev, NULL);
+        release_resource(port->mem_res);
 err_npe_rel:
         npe_release(port->npe);
 err_free:
@@ -1242,6 +1245,7 @@ static int __devexit eth_remove_one(struct platform_device *pdev)
         struct port *port = netdev_priv(dev);
 
         unregister_netdev(dev);
+        phy_disconnect(port->phydev);
         npe_port_tab[NPE_ID(port->id)] = NULL;
         platform_set_drvdata(pdev, NULL);
         npe_release(port->npe);
diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index d47839184a06..b0cb29d4cc01 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -54,8 +54,8 @@
 
 #define DRV_MODULE_NAME         "bnx2"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "2.0.0"
-#define DRV_MODULE_RELDATE      "April 2, 2009"
+#define DRV_MODULE_VERSION      "2.0.1"
+#define DRV_MODULE_RELDATE      "May 6, 2009"
 #define FW_MIPS_FILE_06         "bnx2/bnx2-mips-06-4.6.16.fw"
 #define FW_RV2P_FILE_06         "bnx2/bnx2-rv2p-06-4.6.16.fw"
 #define FW_MIPS_FILE_09         "bnx2/bnx2-mips-09-4.6.17.fw"
@@ -2600,6 +2600,7 @@ bnx2_get_hw_tx_cons(struct bnx2_napi *bnapi)
         /* Tell compiler that status block fields can change. */
         barrier();
         cons = *bnapi->hw_tx_cons_ptr;
+        barrier();
         if (unlikely((cons & MAX_TX_DESC_CNT) == MAX_TX_DESC_CNT))
                 cons++;
         return cons;
@@ -2879,6 +2880,7 @@ bnx2_get_hw_rx_cons(struct bnx2_napi *bnapi)
         /* Tell compiler that status block fields can change. */
         barrier();
         cons = *bnapi->hw_rx_cons_ptr;
+        barrier();
         if (unlikely((cons & MAX_RX_DESC_CNT) == MAX_RX_DESC_CNT))
                 cons++;
         return cons;
diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
index 553a89919778..46d312bedfb8 100644
--- a/drivers/net/bonding/bond_alb.c
+++ b/drivers/net/bonding/bond_alb.c
@@ -1706,10 +1706,8 @@ void bond_alb_handle_active_change(struct bonding *bond, struct slave *new_slave
  * Called with RTNL
  */
 int bond_alb_set_mac_address(struct net_device *bond_dev, void *addr)
-        __releases(&bond->curr_slave_lock)
-        __releases(&bond->lock)
         __acquires(&bond->lock)
-        __acquires(&bond->curr_slave_lock)
+        __releases(&bond->lock)
 {
         struct bonding *bond = netdev_priv(bond_dev);
         struct sockaddr *sa = addr;
@@ -1745,9 +1743,6 @@ int bond_alb_set_mac_address(struct net_device *bond_dev, void *addr)
                 }
         }
 
-        write_unlock_bh(&bond->curr_slave_lock);
-        read_unlock(&bond->lock);
-
         if (swap_slave) {
                 alb_swap_mac_addr(bond, swap_slave, bond->curr_active_slave);
                 alb_fasten_mac_swap(bond, swap_slave, bond->curr_active_slave);
@@ -1755,16 +1750,15 @@ int bond_alb_set_mac_address(struct net_device *bond_dev, void *addr)
                 alb_set_slave_mac_addr(bond->curr_active_slave, bond_dev->dev_addr,
                                        bond->alb_info.rlb_enabled);
 
+                read_lock(&bond->lock);
                 alb_send_learning_packets(bond->curr_active_slave, bond_dev->dev_addr);
                 if (bond->alb_info.rlb_enabled) {
                         /* inform clients mac address has changed */
                         rlb_req_update_slave_clients(bond, bond->curr_active_slave);
                 }
+                read_unlock(&bond->lock);
         }
 
-        read_lock(&bond->lock);
-        write_lock_bh(&bond->curr_slave_lock);
-
         return 0;
 }
 
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 63369b6b14d4..74824028f85c 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2213,33 +2213,24 @@ static int bond_slave_info_query(struct net_device *bond_dev, struct ifslave *in
 {
         struct bonding *bond = netdev_priv(bond_dev);
         struct slave *slave;
-        int i, found = 0;
-
-        if (info->slave_id < 0) {
-                return -ENODEV;
-        }
+        int i, res = -ENODEV;
 
         read_lock(&bond->lock);
 
         bond_for_each_slave(bond, slave, i) {
                 if (i == (int)info->slave_id) {
-                        found = 1;
+                        res = 0;
+                        strcpy(info->slave_name, slave->dev->name);
+                        info->link = slave->link;
+                        info->state = slave->state;
+                        info->link_failure_count = slave->link_failure_count;
                         break;
                 }
         }
 
         read_unlock(&bond->lock);
 
-        if (found) {
-                strcpy(info->slave_name, slave->dev->name);
-                info->link = slave->link;
-                info->state = slave->state;
-                info->link_failure_count = slave->link_failure_count;
-        } else {
-                return -ENODEV;
-        }
-
-        return 0;
+        return res;
 }
 
 /*-------------------------------- Monitoring -------------------------------*/
@@ -5167,16 +5158,15 @@ int bond_create(char *name, struct bond_params *params)
         up_write(&bonding_rwsem);
         rtnl_unlock(); /* allows sysfs registration of net device */
         res = bond_create_sysfs_entry(netdev_priv(bond_dev));
-        if (res < 0) {
-                rtnl_lock();
-                down_write(&bonding_rwsem);
-                bond_deinit(bond_dev);
-                unregister_netdevice(bond_dev);
-                goto out_rtnl;
-        }
+        if (res < 0)
+                goto out_unreg;
 
         return 0;
 
+out_unreg:
+        rtnl_lock();
+        down_write(&bonding_rwsem);
+        unregister_netdevice(bond_dev);
 out_bond:
         bond_deinit(bond_dev);
 out_netdev:
@@ -5191,7 +5181,6 @@ static int __init bonding_init(void)
 {
         int i;
         int res;
-        struct bonding *bond;
 
         printk(KERN_INFO "%s", version);
 
@@ -5222,13 +5211,6 @@ static int __init bonding_init(void)
 
         goto out;
 err:
-        list_for_each_entry(bond, &bond_dev_list, bond_list) {
-                bond_work_cancel_all(bond);
-                destroy_workqueue(bond->wq);
-        }
-
-        bond_destroy_sysfs();
-
         rtnl_lock();
         bond_free_all();
         rtnl_unlock();
diff --git a/drivers/net/cxgb3/t3_hw.c b/drivers/net/cxgb3/t3_hw.c
index e1bd690ff831..4f68aeb2679a 100644
--- a/drivers/net/cxgb3/t3_hw.c
+++ b/drivers/net/cxgb3/t3_hw.c
@@ -3779,7 +3779,7 @@ int t3_prep_adapter(struct adapter *adapter, const struct adapter_info *ai,
 
         adapter->params.info = ai;
         adapter->params.nports = ai->nports0 + ai->nports1;
-        adapter->params.chan_map = !!ai->nports0 | (!!ai->nports1 << 1);
+        adapter->params.chan_map = (!!ai->nports0) | (!!ai->nports1 << 1);
         adapter->params.rev = t3_read_reg(adapter, A_PL_REV);
         /*
          * We used to only run the "adapter check task" once a second if
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 6a46ceed9436..b1419e21b46b 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -3738,7 +3738,7 @@ static irqreturn_t e1000_intr(int irq, void *data)
         struct e1000_hw *hw = &adapter->hw;
         u32 rctl, icr = er32(ICR);
 
-        if (unlikely((!icr) || test_bit(__E1000_RESETTING, &adapter->flags)))
+        if (unlikely((!icr) || test_bit(__E1000_DOWN, &adapter->flags)))
                 return IRQ_NONE;  /* Not our interrupt */
 
         /* IMS will not auto-mask if INT_ASSERTED is not set, and if it is
diff --git a/drivers/net/ehea/ehea.h b/drivers/net/ehea/ehea.h
index 6e317caf429c..16a41389575a 100644
--- a/drivers/net/ehea/ehea.h
+++ b/drivers/net/ehea/ehea.h
@@ -40,7 +40,7 @@
 #include <asm/io.h>
 
 #define DRV_NAME        "ehea"
-#define DRV_VERSION     "EHEA_0100"
+#define DRV_VERSION     "EHEA_0101"
 
 /* eHEA capability flags */
 #define DLPAR_PORT_ADD_REM 1
diff --git a/drivers/net/ehea/ehea_main.c b/drivers/net/ehea/ehea_main.c
index 604c844d0769..b22dab9153f6 100644
--- a/drivers/net/ehea/ehea_main.c
+++ b/drivers/net/ehea/ehea_main.c
@@ -545,14 +545,17 @@ static inline struct sk_buff *get_skb_by_index(struct sk_buff **skb_array,
         x &= (arr_len - 1);
 
         pref = skb_array[x];
-        prefetchw(pref);
-        prefetchw(pref + EHEA_CACHE_LINE);
-
-        pref = (skb_array[x]->data);
-        prefetch(pref);
-        prefetch(pref + EHEA_CACHE_LINE);
-        prefetch(pref + EHEA_CACHE_LINE * 2);
-        prefetch(pref + EHEA_CACHE_LINE * 3);
+        if (pref) {
+                prefetchw(pref);
+                prefetchw(pref + EHEA_CACHE_LINE);
+
+                pref = (skb_array[x]->data);
+                prefetch(pref);
+                prefetch(pref + EHEA_CACHE_LINE);
+                prefetch(pref + EHEA_CACHE_LINE * 2);
+                prefetch(pref + EHEA_CACHE_LINE * 3);
+        }
+
         skb = skb_array[skb_index];
         skb_array[skb_index] = NULL;
         return skb;
@@ -569,12 +572,14 @@ static inline struct sk_buff *get_skb_by_index_ll(struct sk_buff **skb_array,
         x &= (arr_len - 1);
 
         pref = skb_array[x];
-        prefetchw(pref);
-        prefetchw(pref + EHEA_CACHE_LINE);
+        if (pref) {
+                prefetchw(pref);
+                prefetchw(pref + EHEA_CACHE_LINE);
 
-        pref = (skb_array[x]->data);
-        prefetchw(pref);
-        prefetchw(pref + EHEA_CACHE_LINE);
+                pref = (skb_array[x]->data);
+                prefetchw(pref);
+                prefetchw(pref + EHEA_CACHE_LINE);
+        }
 
         skb = skb_array[wqe_index];
         skb_array[wqe_index] = NULL;
diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
index 08c801490c72..e25343588fc7 100644
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -2006,7 +2006,7 @@ static void igb_setup_rctl(struct igb_adapter *adapter)
         struct e1000_hw *hw = &adapter->hw;
         u32 rctl;
         u32 srrctl = 0;
-        int i, j;
+        int i;
 
         rctl = rd32(E1000_RCTL);
 
@@ -2071,8 +2071,6 @@ static void igb_setup_rctl(struct igb_adapter *adapter)
         if (adapter->vfs_allocated_count) {
                 u32 vmolr;
 
-                j = adapter->rx_ring[0].reg_idx;
-
                 /* set all queue drop enable bits */
                 wr32(E1000_QDE, ALL_QUEUES);
                 srrctl |= E1000_SRRCTL_DROP_EN;
@@ -2080,16 +2078,16 @@ static void igb_setup_rctl(struct igb_adapter *adapter)
                 /* disable queue 0 to prevent tail write w/o re-config */
                 wr32(E1000_RXDCTL(0), 0);
 
-                vmolr = rd32(E1000_VMOLR(j));
+                vmolr = rd32(E1000_VMOLR(adapter->vfs_allocated_count));
                 if (rctl & E1000_RCTL_LPE)
                         vmolr |= E1000_VMOLR_LPE;
-                if (adapter->num_rx_queues > 0)
+                if (adapter->num_rx_queues > 1)
                         vmolr |= E1000_VMOLR_RSSE;
-                wr32(E1000_VMOLR(j), vmolr);
+                wr32(E1000_VMOLR(adapter->vfs_allocated_count), vmolr);
         }
 
         for (i = 0; i < adapter->num_rx_queues; i++) {
-                j = adapter->rx_ring[i].reg_idx;
+                int j = adapter->rx_ring[i].reg_idx;
                 wr32(E1000_SRRCTL(j), srrctl);
         }
 
diff --git a/drivers/net/mlx4/en_rx.c b/drivers/net/mlx4/en_rx.c
index 7942c4d3cd88..9ee873e872b3 100644
--- a/drivers/net/mlx4/en_rx.c
+++ b/drivers/net/mlx4/en_rx.c
@@ -951,7 +951,6 @@ static int mlx4_en_config_rss_qp(struct mlx4_en_priv *priv,
         if (err) {
                 mlx4_err(mdev, "Failed to allocate qp #%d\n", qpn);
                 goto out;
-                return err;
         }
         qp->event = mlx4_en_sqp_event;
 
diff --git a/drivers/net/mv643xx_eth.c b/drivers/net/mv643xx_eth.c
index b3185bf2c158..a400d7115f78 100644
--- a/drivers/net/mv643xx_eth.c
+++ b/drivers/net/mv643xx_eth.c
@@ -393,12 +393,12 @@ struct mv643xx_eth_private {
         struct work_struct tx_timeout_task;
 
         struct napi_struct napi;
+        u8 oom;
         u8 work_link;
         u8 work_tx;
         u8 work_tx_end;
         u8 work_rx;
         u8 work_rx_refill;
-        u8 work_rx_oom;
 
         int skb_size;
         struct sk_buff_head rx_recycle;
@@ -661,7 +661,7 @@ static int rxq_refill(struct rx_queue *rxq, int budget)
                                             dma_get_cache_alignment() - 1);
 
                 if (skb == NULL) {
-                        mp->work_rx_oom |= 1 << rxq->index;
+                        mp->oom = 1;
                         goto oom;
                 }
 
@@ -1255,7 +1255,6 @@ static void mib_counters_update(struct mv643xx_eth_private *mp)
 
         spin_lock_bh(&mp->mib_counters_lock);
         p->good_octets_received += mib_read(mp, 0x00);
-        p->good_octets_received += (u64)mib_read(mp, 0x04) << 32;
         p->bad_octets_received += mib_read(mp, 0x08);
         p->internal_mac_transmit_err += mib_read(mp, 0x0c);
         p->good_frames_received += mib_read(mp, 0x10);
@@ -1269,7 +1268,6 @@ static void mib_counters_update(struct mv643xx_eth_private *mp)
         p->frames_512_to_1023_octets += mib_read(mp, 0x30);
         p->frames_1024_to_max_octets += mib_read(mp, 0x34);
         p->good_octets_sent += mib_read(mp, 0x38);
-        p->good_octets_sent += (u64)mib_read(mp, 0x3c) << 32;
         p->good_frames_sent += mib_read(mp, 0x40);
         p->excessive_collision += mib_read(mp, 0x44);
         p->multicast_frames_sent += mib_read(mp, 0x48);
@@ -2167,8 +2165,10 @@ static int mv643xx_eth_poll(struct napi_struct *napi, int budget)
 
         mp = container_of(napi, struct mv643xx_eth_private, napi);
 
-        mp->work_rx_refill |= mp->work_rx_oom;
-        mp->work_rx_oom = 0;
+        if (unlikely(mp->oom)) {
+                mp->oom = 0;
+                del_timer(&mp->rx_oom);
+        }
 
         work_done = 0;
         while (work_done < budget) {
@@ -2182,8 +2182,10 @@ static int mv643xx_eth_poll(struct napi_struct *napi, int budget)
                         continue;
                 }
 
-                queue_mask = mp->work_tx | mp->work_tx_end |
-                                mp->work_rx | mp->work_rx_refill;
+                queue_mask = mp->work_tx | mp->work_tx_end | mp->work_rx;
+                if (likely(!mp->oom))
+                        queue_mask |= mp->work_rx_refill;
+
                 if (!queue_mask) {
                         if (mv643xx_eth_collect_events(mp))
                                 continue;
@@ -2204,7 +2206,7 @@ static int mv643xx_eth_poll(struct napi_struct *napi, int budget)
                         txq_maybe_wake(mp->txq + queue);
                 } else if (mp->work_rx & queue_mask) {
                         work_done += rxq_process(mp->rxq + queue, work_tbd);
-                } else if (mp->work_rx_refill & queue_mask) {
+                } else if (!mp->oom && (mp->work_rx_refill & queue_mask)) {
                         work_done += rxq_refill(mp->rxq + queue, work_tbd);
                 } else {
                         BUG();
@@ -2212,7 +2214,7 @@ static int mv643xx_eth_poll(struct napi_struct *napi, int budget)
         }
 
         if (work_done < budget) {
-                if (mp->work_rx_oom)
+                if (mp->oom)
                         mod_timer(&mp->rx_oom, jiffies + (HZ / 10));
                 napi_complete(napi);
                 wrlp(mp, INT_MASK, INT_TX_END | INT_RX | INT_EXT);
@@ -2372,7 +2374,7 @@ static int mv643xx_eth_open(struct net_device *dev)
                 rxq_refill(mp->rxq + i, INT_MAX);
         }
 
-        if (mp->work_rx_oom) {
+        if (mp->oom) {
                 mp->rx_oom.expires = jiffies + (HZ / 10);
                 add_timer(&mp->rx_oom);
         }
diff --git a/drivers/net/ne2k-pci.c b/drivers/net/ne2k-pci.c
index eb66f658f9d1..7d83896b8c26 100644
--- a/drivers/net/ne2k-pci.c
+++ b/drivers/net/ne2k-pci.c
@@ -374,18 +374,17 @@ static int __devinit ne2k_pci_init_one (struct pci_dev *pdev,
         dev->ethtool_ops = &ne2k_pci_ethtool_ops;
         NS8390_init(dev, 0);
 
+        memcpy(dev->dev_addr, SA_prom, 6);
+        memcpy(dev->perm_addr, dev->dev_addr, dev->addr_len);
+
         i = register_netdev(dev);
         if (i)
                 goto err_out_free_netdev;
 
-        for(i = 0; i < 6; i++)
-                dev->dev_addr[i] = SA_prom[i];
         printk("%s: %s found at %#lx, IRQ %d, %pM.\n",
                dev->name, pci_clone_list[chip_idx].name, ioaddr, dev->irq,
                dev->dev_addr);
 
-        memcpy(dev->perm_addr, dev->dev_addr, dev->addr_len);
-
         return 0;
 
 err_out_free_netdev:
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index eceadf787a67..bf4af5248cb7 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -664,7 +664,7 @@ static int netconsole_netdev_event(struct notifier_block *this,
         struct netconsole_target *nt;
         struct net_device *dev = ptr;
 
-        if (!(event == NETDEV_CHANGENAME))
+        if (!(event == NETDEV_CHANGENAME || event == NETDEV_UNREGISTER))
                 goto done;
 
         spin_lock_irqsave(&target_list_lock, flags);
@@ -675,6 +675,15 @@ static int netconsole_netdev_event(struct notifier_block *this,
                         case NETDEV_CHANGENAME:
                                 strlcpy(nt->np.dev_name, dev->name, IFNAMSIZ);
                                 break;
+                        case NETDEV_UNREGISTER:
+                                if (!nt->enabled)
+                                        break;
+                                netpoll_cleanup(&nt->np);
+                                nt->enabled = 0;
+                                printk(KERN_INFO "netconsole: network logging stopped"
+                                        ", interface %s unregistered\n",
+                                        dev->name);
+                                break;
                         }
                 }
                 netconsole_target_put(nt);
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 8ee21030e9ac..dfc6cf765fbd 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -180,6 +180,20 @@ config USB_NET_CDCETHER
           IEEE 802 "local assignment" bit is set in the address, a "usbX"
           name is used instead.
 
+config USB_NET_CDC_EEM
+        tristate "CDC EEM support"
+        depends on USB_USBNET && EXPERIMENTAL
+        help
+          This option supports devices conforming to the Communication Device
+          Class (CDC) Ethernet Emulation Model, a specification that's easy to
+          implement in device firmware.  The CDC EEM specifications are available
+          from <http://www.usb.org/>.
+
+          This driver creates an interface named "ethX", where X depends on
+          what other networking devices you have in use.  However, if the
+          IEEE 802 "local assignment" bit is set in the address, a "usbX"
+          name is used instead.
+
 config USB_NET_DM9601
         tristate "Davicom DM9601 based USB 1.1 10/100 ethernet devices"
         depends on USB_USBNET
diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile
index 88a87eeb376a..c8aef62cf2b7 100644
--- a/drivers/net/usb/Makefile
+++ b/drivers/net/usb/Makefile
@@ -9,6 +9,7 @@ obj-$(CONFIG_USB_RTL8150)	+= rtl8150.o
 obj-$(CONFIG_USB_HSO)           += hso.o
 obj-$(CONFIG_USB_NET_AX8817X)   += asix.o
 obj-$(CONFIG_USB_NET_CDCETHER)  += cdc_ether.o
+obj-$(CONFIG_USB_NET_CDC_EEM)   += cdc_eem.o
 obj-$(CONFIG_USB_NET_DM9601)    += dm9601.o
 obj-$(CONFIG_USB_NET_SMSC95XX)  += smsc95xx.o
 obj-$(CONFIG_USB_NET_GL620A)    += gl620a.o
diff --git a/drivers/net/usb/cdc_eem.c b/drivers/net/usb/cdc_eem.c
new file mode 100644
index 000000000000..80e01778dd3b
--- /dev/null
+++ b/drivers/net/usb/cdc_eem.c
@@ -0,0 +1,381 @@
+/*
+ * USB CDC EEM network interface driver
+ * Copyright (C) 2009 Oberthur Technologies
+ * by Omar Laazimani, Olivier Condemine
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/ctype.h>
+#include <linux/ethtool.h>
+#include <linux/workqueue.h>
+#include <linux/mii.h>
+#include <linux/usb.h>
+#include <linux/crc32.h>
+#include <linux/usb/cdc.h>
+#include <linux/usb/usbnet.h>
+
+
+/*
+ * This driver is an implementation of the CDC "Ethernet Emulation
+ * Model" (EEM) specification, which encapsulates Ethernet frames
+ * for transport over USB using a simpler USB device model than the
+ * previous CDC "Ethernet Control Model" (ECM, or "CDC Ethernet").
+ *
+ * For details, see www.usb.org/developers/devclass_docs/CDC_EEM10.pdf
+ *
+ * This version has been tested with GIGAntIC WuaoW SIM Smart Card on 2.6.24,
+ * 2.6.27 and 2.6.30rc2 kernel.
+ * It has also been validated on Openmoko Om 2008.12 (based on 2.6.24 kernel).
+ * build on 23-April-2009
+ */
+
+#define EEM_HEAD        2               /* 2 byte header */
+
+/*-------------------------------------------------------------------------*/
+
+static void eem_linkcmd_complete(struct urb *urb)
+{
+        dev_kfree_skb(urb->context);
+        usb_free_urb(urb);
+}
+
+static void eem_linkcmd(struct usbnet *dev, struct sk_buff *skb)
+{
+        struct urb              *urb;
+        int                     status;
+
+        urb = usb_alloc_urb(0, GFP_ATOMIC);
+        if (!urb)
+                goto fail;
+
+        usb_fill_bulk_urb(urb, dev->udev, dev->out,
+                        skb->data, skb->len, eem_linkcmd_complete, skb);
+
+        status = usb_submit_urb(urb, GFP_ATOMIC);
+        if (status) {
+                usb_free_urb(urb);
+fail:
+                dev_kfree_skb(skb);
+                devwarn(dev, "link cmd failure\n");
+                return;
+        }
+}
+
+static int eem_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+        int status = 0;
+
+        status = usbnet_get_endpoints(dev, intf);
+        if (status < 0) {
+                usb_set_intfdata(intf, NULL);
+                usb_driver_release_interface(driver_of(intf), intf);
+                return status;
+        }
+
+        /* no jumbogram (16K) support for now */
+
+        dev->net->hard_header_len += EEM_HEAD + ETH_FCS_LEN;
+
+        return 0;
+}
+
+/*
+ * EEM permits packing multiple Ethernet frames into USB transfers
+ * (a "bundle"), but for TX we don't try to do that.
+ */
+static struct sk_buff *eem_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
+                                       gfp_t flags)
+{
+        struct sk_buff  *skb2 = NULL;
+        u16             len = skb->len;
+        u32             crc = 0;
+        int             padlen = 0;
+
+        /* When ((len + EEM_HEAD + ETH_FCS_LEN) % dev->maxpacket) is
+         * zero, stick two bytes of zero length EEM packet on the end.
+         * Else the framework would add invalid single byte padding,
+         * since it can't know whether ZLPs will be handled right by
+         * all the relevant hardware and software.
+         */
+        if (!((len + EEM_HEAD + ETH_FCS_LEN) % dev->maxpacket))
+                padlen += 2;
+
+        if (!skb_cloned(skb)) {
+                int     headroom = skb_headroom(skb);
+                int     tailroom = skb_tailroom(skb);
+
+                if ((tailroom >= ETH_FCS_LEN + padlen)
+                                && (headroom >= EEM_HEAD))
+                        goto done;
+
+                if ((headroom + tailroom)
+                                > (EEM_HEAD + ETH_FCS_LEN + padlen)) {
+                        skb->data = memmove(skb->head +
+                                        EEM_HEAD,
+                                        skb->data,
+                                        skb->len);
+                        skb_set_tail_pointer(skb, len);
+                        goto done;
+                }
+        }
+
+        skb2 = skb_copy_expand(skb, EEM_HEAD, ETH_FCS_LEN + padlen, flags);
+        if (!skb2)
+                return NULL;
+
+        dev_kfree_skb_any(skb);
+        skb = skb2;
+
+done:
+        /* we don't use the "no Ethernet CRC" option */
+        crc = crc32_le(~0, skb->data, skb->len);
+        crc = ~crc;
+
+        put_unaligned_le32(crc, skb_put(skb, 4));
+
+        /* EEM packet header format:
+         * b0..13:      length of ethernet frame
+         * b14:         bmCRC (1 == valid Ethernet CRC)
+         * b15:         bmType (0 == data)
+         */
+        len = skb->len;
+        put_unaligned_le16(BIT(14) | len, skb_push(skb, 2));
+
+        /* Bundle a zero length EEM packet if needed */
+        if (padlen)
+                put_unaligned_le16(0, skb_put(skb, 2));
+
+        return skb;
+}
+
+static int eem_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+{
+        /*
+         * Our task here is to strip off framing, leaving skb with one
+         * data frame for the usbnet framework code to process.  But we
+         * may have received multiple EEM payloads, or command payloads.
+         * So we must process _everything_ as if it's a header, except
+         * maybe the last data payload
+         *
+         * REVISIT the framework needs updating so that when we consume
+         * all payloads (the last or only message was a command, or a
+         * zero length EEM packet) that is not accounted as an rx_error.
+         */
+        do {
+                struct sk_buff  *skb2 = NULL;
+                u16             header;
+                u16             len = 0;
+
+                /* incomplete EEM header? */
+                if (skb->len < EEM_HEAD)
+                        return 0;
+
+                /*
+                 * EEM packet header format:
+                 * b0..14:      EEM type dependant (Data or Command)
+                 * b15:         bmType
+                 */
+                header = get_unaligned_le16(skb->data);
+                skb_pull(skb, EEM_HEAD);
+
+                /*
+                 * The bmType bit helps to denote when EEM
+                 * packet is data or command :
+                 *      bmType = 0      : EEM data payload
+                 *      bmType = 1      : EEM (link) command
+                 */
+                if (header & BIT(15)) {
+                        u16     bmEEMCmd;
+
+                        /*
+                         * EEM (link) command packet:
+                         * b0..10:      bmEEMCmdParam
+                         * b11..13:     bmEEMCmd
+                         * b14:         bmReserved (must be 0)
+                         * b15:         1 (EEM command)
+                         */
+                        if (header & BIT(14)) {
+                                devdbg(dev, "reserved command %04x\n", header);
+                                continue;
+                        }
+
+                        bmEEMCmd = (header >> 11) & 0x7;
+                        switch (bmEEMCmd) {
+
+                        /* Responding to echo requests is mandatory. */
+                        case 0:         /* Echo command */
+                                len = header & 0x7FF;
+
+                                /* bogus command? */
+                                if (skb->len < len)
+                                        return 0;
+
+                                skb2 = skb_clone(skb, GFP_ATOMIC);
+                                if (unlikely(!skb2))
+                                        goto next;
+                                skb_trim(skb2, len);
+                                put_unaligned_le16(BIT(15) | (1 << 11) | len,
+                                                skb_push(skb2, 2));
+                                eem_linkcmd(dev, skb2);
+                                break;
+
+                        /*
+                         * Host may choose to ignore hints.
+                         *  - suspend: peripheral ready to suspend
+                         *  - response: suggest N millisec polling
+                         *  - response complete: suggest N sec polling
+                         */
+                        case 2:         /* Suspend hint */
+                        case 3:         /* Response hint */
+                        case 4:         /* Response complete hint */
+                                continue;
+
+                        /*
+                         * Hosts should never receive host-to-peripheral
+                         * or reserved command codes; or responses to an
+                         * echo command we didn't send.
+                         */
+                        case 1:         /* Echo response */
+                        case 5:         /* Tickle */
+                        default:        /* reserved */
+                                devwarn(dev, "unexpected link command %d\n",
+                                                bmEEMCmd);
+                                continue;
+                        }
+
+                } else {
+                        u32     crc, crc2;
+                        int     is_last;
+
+                        /* zero length EEM packet? */
+                        if (header == 0)
+                                continue;
+
+                        /*
+                         * EEM data packet header :
+                         * b0..13:      length of ethernet frame
+                         * b14:         bmCRC
+                         * b15:         0 (EEM data)
+                         */
+                        len = header & 0x3FFF;
+
+                        /* bogus EEM payload? */
+                        if (skb->len < len)
+                                return 0;
+
+                        /* bogus ethernet frame? */
+                        if (len < (ETH_HLEN + ETH_FCS_LEN))
+                                goto next;
+
+                        /*
+                         * Treat the last payload differently: framework
+                         * code expects our "fixup" to have stripped off
+                         * headers, so "skb" is a data packet (or error).
+                         * Else if it's not the last payload, keep "skb"
+                         * for further processing.
+                         */
+                        is_last = (len == skb->len);
+                        if (is_last)
+                                skb2 = skb;
+                        else {
+                                skb2 = skb_clone(skb, GFP_ATOMIC);
+                                if (unlikely(!skb2))
+                                        return 0;
+                        }
+
+                        crc = get_unaligned_le32(skb2->data
+                                        + len - ETH_FCS_LEN);
+                        skb_trim(skb2, len - ETH_FCS_LEN);
+
+                        /*
+                         * The bmCRC helps to denote when the CRC field in
+                         * the Ethernet frame contains a calculated CRC:
+                         *      bmCRC = 1       : CRC is calculated
+                         *      bmCRC = 0       : CRC = 0xDEADBEEF
+                         */
+                        if (header & BIT(14))
+                                crc2 = ~crc32_le(~0, skb2->data, len);
+                        else
+                                crc2 = 0xdeadbeef;
+
+                        if (is_last)
+                                return crc == crc2;
+
+                        if (unlikely(crc != crc2)) {
+                                dev->stats.rx_errors++;
+                                dev_kfree_skb_any(skb2);
+                        } else
+                                usbnet_skb_return(dev, skb2);
+                }
+
+next:
+                skb_pull(skb, len);
+        } while (skb->len);
+
+        return 1;
+}
+
+static const struct driver_info eem_info = {
+        .description =  "CDC EEM Device",
+        .flags =        FLAG_ETHER,
+        .bind =         eem_bind,
+        .rx_fixup =     eem_rx_fixup,
+        .tx_fixup =     eem_tx_fixup,
+};
+
+/*-------------------------------------------------------------------------*/
+
+static const struct usb_device_id products[] = {
+{
+        USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_EEM,
+                        USB_CDC_PROTO_EEM),
+        .driver_info = (unsigned long) &eem_info,
+},
+{
+        /* EMPTY == end of list */
+},
+};
+MODULE_DEVICE_TABLE(usb, products);
+
+static struct usb_driver eem_driver = {
+        .name =         "cdc_eem",
+        .id_table =     products,
+        .probe =        usbnet_probe,
+        .disconnect =   usbnet_disconnect,
+        .suspend =      usbnet_suspend,
+        .resume =       usbnet_resume,
+};
+
+
+static int __init eem_init(void)
+{
+        return usb_register(&eem_driver);
+}
+module_init(eem_init);
+
+static void __exit eem_exit(void)
+{
+        usb_deregister(&eem_driver);
+}
+module_exit(eem_exit);
+
+MODULE_AUTHOR("Omar Laazimani <omar.oberthur@gmail.com>");
+MODULE_DESCRIPTION("USB CDC EEM");
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index dc1665326592..5a7283372b53 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -941,6 +941,16 @@ static int smsc95xx_reset(struct usbnet *dev)
         if (netif_msg_ifup(dev))
                 devdbg(dev, "ID_REV = 0x%08x", read_buf);
 
+        /* Configure GPIO pins as LED outputs */
+        write_buf = LED_GPIO_CFG_SPD_LED | LED_GPIO_CFG_LNK_LED |
+                LED_GPIO_CFG_FDX_LED;
+        ret = smsc95xx_write_reg(dev, LED_GPIO_CFG, write_buf);
+        if (ret < 0) {
+                devwarn(dev, "Failed to write LED_GPIO_CFG register, ret=%d",
+                        ret);
+                return ret;
+        }
+
         /* Init Tx */
         write_buf = 0;
         ret = smsc95xx_write_reg(dev, FLOW, write_buf);
@@ -1231,6 +1241,11 @@ static const struct usb_device_id products[] = {
                 USB_DEVICE(0x0424, 0x9500),
                 .driver_info = (unsigned long) &smsc95xx_info,
         },
+        {
+                /* SMSC9512/9514 USB Hub & Ethernet Device */
+                USB_DEVICE(0x0424, 0xec00),
+                .driver_info = (unsigned long) &smsc95xx_info,
+        },
         { },            /* END */
 };
 MODULE_DEVICE_TABLE(usb, products);
diff --git a/drivers/net/usb/smsc95xx.h b/drivers/net/usb/smsc95xx.h
index 66b5c84f302e..86bc44977fbd 100644
--- a/drivers/net/usb/smsc95xx.h
+++ b/drivers/net/usb/smsc95xx.h
@@ -99,6 +99,9 @@
 #define PM_CTL_WUPS_MULTI_              (0x00000003)
 
 #define LED_GPIO_CFG                    (0x24)
+#define LED_GPIO_CFG_SPD_LED            (0x01000000)
+#define LED_GPIO_CFG_LNK_LED            (0x00100000)
+#define LED_GPIO_CFG_FDX_LED            (0x00010000)
 
 #define GPIO_CFG                        (0x28)
 
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 9c82a39497e5..4d1d47953fc6 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -616,10 +616,11 @@ static int virtnet_open(struct net_device *dev)
 static bool virtnet_send_command(struct virtnet_info *vi, u8 class, u8 cmd,
                                  struct scatterlist *data, int out, int in)
 {
-        struct scatterlist sg[VIRTNET_SEND_COMMAND_SG_MAX + 2];
+        struct scatterlist *s, sg[VIRTNET_SEND_COMMAND_SG_MAX + 2];
         struct virtio_net_ctrl_hdr ctrl;
         virtio_net_ctrl_ack status = ~0;
         unsigned int tmp;
+        int i;
 
         if (!virtio_has_feature(vi->vdev, VIRTIO_NET_F_CTRL_VQ)) {
                 BUG();  /* Caller should know better */
@@ -637,7 +638,8 @@ static bool virtnet_send_command(struct virtnet_info *vi, u8 class, u8 cmd,
         sg_init_table(sg, out + in);
 
         sg_set_buf(&sg[0], &ctrl, sizeof(ctrl));
-        memcpy(&sg[1], data, sizeof(struct scatterlist) * (out + in - 2));
+        for_each_sg(data, s, out + in - 2, i)
+                sg_set_buf(&sg[i + 1], sg_virt(s), s->length);
         sg_set_buf(&sg[out + in - 1], &status, sizeof(status));
 
         if (vi->cvq->vq_ops->add_buf(vi->cvq, sg, out, in, vi) != 0)
@@ -692,7 +694,7 @@ static void virtnet_set_rx_mode(struct net_device *dev)
         promisc = ((dev->flags & IFF_PROMISC) != 0);
         allmulti = ((dev->flags & IFF_ALLMULTI) != 0);
 
-        sg_set_buf(sg, &promisc, sizeof(promisc));
+        sg_init_one(sg, &promisc, sizeof(promisc));
 
         if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_RX,
                                   VIRTIO_NET_CTRL_RX_PROMISC,
@@ -700,7 +702,7 @@ static void virtnet_set_rx_mode(struct net_device *dev)
                 dev_warn(&dev->dev, "Failed to %sable promisc mode.\n",
                          promisc ? "en" : "dis");
 
-        sg_set_buf(sg, &allmulti, sizeof(allmulti));
+        sg_init_one(sg, &allmulti, sizeof(allmulti));
 
         if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_RX,
                                   VIRTIO_NET_CTRL_RX_ALLMULTI,
@@ -716,6 +718,8 @@ static void virtnet_set_rx_mode(struct net_device *dev)
                 return;
         }
 
+        sg_init_table(sg, 2);
+
         /* Store the unicast list and count in the front of the buffer */
         mac_data->entries = dev->uc_count;
         addr = dev->uc_list;
@@ -744,24 +748,24 @@ static void virtnet_set_rx_mode(struct net_device *dev)
         kfree(buf);
 }
 
-static void virnet_vlan_rx_add_vid(struct net_device *dev, u16 vid)
+static void virtnet_vlan_rx_add_vid(struct net_device *dev, u16 vid)
 {
         struct virtnet_info *vi = netdev_priv(dev);
         struct scatterlist sg;
 
-        sg_set_buf(&sg, &vid, sizeof(vid));
+        sg_init_one(&sg, &vid, sizeof(vid));
 
         if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_VLAN,
                                   VIRTIO_NET_CTRL_VLAN_ADD, &sg, 1, 0))
                 dev_warn(&dev->dev, "Failed to add VLAN ID %d.\n", vid);
 }
 
-static void virnet_vlan_rx_kill_vid(struct net_device *dev, u16 vid)
+static void virtnet_vlan_rx_kill_vid(struct net_device *dev, u16 vid)
 {
         struct virtnet_info *vi = netdev_priv(dev);
         struct scatterlist sg;
 
-        sg_set_buf(&sg, &vid, sizeof(vid));
+        sg_init_one(&sg, &vid, sizeof(vid));
 
         if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_VLAN,
                                   VIRTIO_NET_CTRL_VLAN_DEL, &sg, 1, 0))
@@ -794,8 +798,8 @@ static const struct net_device_ops virtnet_netdev = {
         .ndo_set_mac_address = virtnet_set_mac_address,
         .ndo_set_rx_mode     = virtnet_set_rx_mode,
         .ndo_change_mtu      = virtnet_change_mtu,
-        .ndo_vlan_rx_add_vid = virnet_vlan_rx_add_vid,
-        .ndo_vlan_rx_kill_vid = virnet_vlan_rx_kill_vid,
+        .ndo_vlan_rx_add_vid = virtnet_vlan_rx_add_vid,
+        .ndo_vlan_rx_kill_vid = virtnet_vlan_rx_kill_vid,
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller = virtnet_netpoll,
 #endif
diff --git a/drivers/net/wan/ixp4xx_hss.c b/drivers/net/wan/ixp4xx_hss.c
index 3bf7d3f447db..1e56e58c6605 100644
--- a/drivers/net/wan/ixp4xx_hss.c
+++ b/drivers/net/wan/ixp4xx_hss.c
@@ -579,7 +579,8 @@ static inline void queue_put_desc(unsigned int queue, u32 phys,
         debug_desc(phys, desc);
         BUG_ON(phys & 0x1F);
         qmgr_put_entry(queue, phys);
-        BUG_ON(qmgr_stat_overflow(queue));
+        /* Don't check for queue overflow here, we've allocated sufficient
+           length and queues >= 32 don't support this check anyway. */
 }
 
 
@@ -789,7 +790,8 @@ static void hss_hdlc_txdone_irq(void *pdev)
                 free_buffer_irq(port->tx_buff_tab[n_desc]);
                 port->tx_buff_tab[n_desc] = NULL;
 
-                start = qmgr_stat_empty(port->plat->txreadyq);
+                /* really empty in fact */
+                start = qmgr_stat_nearly_empty(port->plat->txreadyq);
                 queue_put_desc(port->plat->txreadyq,
                                tx_desc_phys(port, n_desc), desc);
                 if (start) {
@@ -867,13 +869,13 @@ static int hss_hdlc_xmit(struct sk_buff *skb, struct net_device *dev)
         queue_put_desc(queue_ids[port->id].tx, tx_desc_phys(port, n), desc);
         dev->trans_start = jiffies;
 
-        if (qmgr_stat_empty(txreadyq)) {
+        if (qmgr_stat_nearly_empty(txreadyq)) { /* really empty in fact */
 #if DEBUG_TX
                 printk(KERN_DEBUG "%s: hss_hdlc_xmit queue full\n", dev->name);
 #endif
                 netif_stop_queue(dev);
                 /* we could miss TX ready interrupt */
-                if (!qmgr_stat_empty(txreadyq)) {
+                if (!qmgr_stat_nearly_empty(txreadyq)) {
 #if DEBUG_TX
                         printk(KERN_DEBUG "%s: hss_hdlc_xmit ready again\n",
                                dev->name);
@@ -1249,7 +1251,7 @@ static int __devinit hss_init_one(struct platform_device *pdev)
                 return -ENOMEM;
 
         if ((port->npe = npe_request(0)) == NULL) {
-                err = -ENOSYS;
+                err = -ENODEV;
                 goto err_free;
         }
 
@@ -1311,7 +1313,7 @@ static int __init hss_init_module(void)
         if ((ixp4xx_read_feature_bits() &
              (IXP4XX_FEATURE_HDLC | IXP4XX_FEATURE_HSS)) !=
             (IXP4XX_FEATURE_HDLC | IXP4XX_FEATURE_HSS))
-                return -ENOSYS;
+                return -ENODEV;
 
         spin_lock_init(&npe_lock);
 
diff --git a/drivers/net/wireless/airo.c b/drivers/net/wireless/airo.c
index c36d3a3d655f..d73475739127 100644
--- a/drivers/net/wireless/airo.c
+++ b/drivers/net/wireless/airo.c
@@ -6501,7 +6501,10 @@ static int airo_get_encode(struct net_device *dev,
 
         /* Copy the key to the user buffer */
         dwrq->length = get_wep_key(local, index, &buf[0], sizeof(buf));
-        memcpy(extra, buf, dwrq->length);
+        if (dwrq->length != -1)
+                memcpy(extra, buf, dwrq->length);
+        else
+                dwrq->length = 0;
 
         return 0;
 }
@@ -6659,7 +6662,10 @@ static int airo_get_encodeext(struct net_device *dev,
         
         /* Copy the key to the user buffer */
         ext->key_len = get_wep_key(local, idx, &buf[0], sizeof(buf));
-        memcpy(extra, buf, ext->key_len);
+        if (ext->key_len != -1)
+                memcpy(extra, buf, ext->key_len);
+        else
+                ext->key_len = 0;
 
         return 0;
 }
diff --git a/drivers/net/wireless/ath5k/base.c b/drivers/net/wireless/ath5k/base.c
index a08bc8a4fb69..32df27a9c7a2 100644
--- a/drivers/net/wireless/ath5k/base.c
+++ b/drivers/net/wireless/ath5k/base.c
@@ -214,7 +214,7 @@ static struct pci_driver ath5k_pci_driver = {
  * Prototypes - MAC 802.11 stack related functions
  */
 static int ath5k_tx(struct ieee80211_hw *hw, struct sk_buff *skb);
-static int ath5k_reset(struct ath5k_softc *sc, bool stop, bool change_channel);
+static int ath5k_reset(struct ath5k_softc *sc, struct ieee80211_channel *chan);
 static int ath5k_reset_wake(struct ath5k_softc *sc);
 static int ath5k_start(struct ieee80211_hw *hw);
 static void ath5k_stop(struct ieee80211_hw *hw);
@@ -1038,16 +1038,13 @@ ath5k_chan_set(struct ath5k_softc *sc, struct ieee80211_channel *chan)
         if (chan->center_freq != sc->curchan->center_freq ||
                 chan->hw_value != sc->curchan->hw_value) {
 
-                sc->curchan = chan;
-                sc->curband = &sc->sbands[chan->band];
-
                 /*
                  * To switch channels clear any pending DMA operations;
                  * wait long enough for the RX fifo to drain, reset the
                  * hardware at the new frequency, and then re-enable
                  * the relevant bits of the h/w.
                  */
-                return ath5k_reset(sc, true, true);
+                return ath5k_reset(sc, chan);
         }
 
         return 0;
@@ -2314,7 +2311,7 @@ ath5k_init(struct ath5k_softc *sc)
         sc->imask = AR5K_INT_RXOK | AR5K_INT_RXERR | AR5K_INT_RXEOL |
                 AR5K_INT_RXORN | AR5K_INT_TXDESC | AR5K_INT_TXEOL |
                 AR5K_INT_FATAL | AR5K_INT_GLOBAL;
-        ret = ath5k_reset(sc, false, false);
+        ret = ath5k_reset(sc, NULL);
         if (ret)
                 goto done;
 
@@ -2599,18 +2596,25 @@ drop_packet:
         return NETDEV_TX_OK;
 }
 
+/*
+ * Reset the hardware.  If chan is not NULL, then also pause rx/tx
+ * and change to the given channel.
+ */
 static int
-ath5k_reset(struct ath5k_softc *sc, bool stop, bool change_channel)
+ath5k_reset(struct ath5k_softc *sc, struct ieee80211_channel *chan)
 {
         struct ath5k_hw *ah = sc->ah;
         int ret;
 
         ATH5K_DBG(sc, ATH5K_DEBUG_RESET, "resetting\n");
 
-        if (stop) {
+        if (chan) {
                 ath5k_hw_set_imr(ah, 0);
                 ath5k_txq_cleanup(sc);
                 ath5k_rx_stop(sc);
+
+                sc->curchan = chan;
+                sc->curband = &sc->sbands[chan->band];
         }
         ret = ath5k_hw_reset(ah, sc->opmode, sc->curchan, true);
         if (ret) {
@@ -2648,7 +2652,7 @@ ath5k_reset_wake(struct ath5k_softc *sc)
 {
         int ret;
 
-        ret = ath5k_reset(sc, true, true);
+        ret = ath5k_reset(sc, sc->curchan);
         if (!ret)
                 ieee80211_wake_queues(sc->hw);
 
diff --git a/drivers/net/wireless/ath5k/debug.c b/drivers/net/wireless/ath5k/debug.c
index 9770bb3d40f9..4904a07e4b59 100644
--- a/drivers/net/wireless/ath5k/debug.c
+++ b/drivers/net/wireless/ath5k/debug.c
@@ -424,7 +424,7 @@ ath5k_debug_dump_bands(struct ath5k_softc *sc)
 
         for (b = 0; b < IEEE80211_NUM_BANDS; b++) {
                 struct ieee80211_supported_band *band = &sc->sbands[b];
-                char bname[5];
+                char bname[6];
                 switch (band->band) {
                 case IEEE80211_BAND_2GHZ:
                         strcpy(bname, "2 GHz");
diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c
index edfa5e149f71..bd438d8acf55 100644
--- a/drivers/net/wireless/iwlwifi/iwl-6000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-6000.c
@@ -101,8 +101,8 @@ struct iwl_cfg iwl6000_2agn_cfg = {
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
         .mod_params = &iwl50_mod_params,
-        .valid_tx_ant = ANT_BC,
-        .valid_rx_ant = ANT_BC,
+        .valid_tx_ant = ANT_AB,
+        .valid_rx_ant = ANT_AB,
         .need_pll_cfg = false,
 };
 
@@ -117,8 +117,8 @@ struct iwl_cfg iwl6050_2agn_cfg = {
         .eeprom_ver = EEPROM_5000_EEPROM_VERSION,
         .eeprom_calib_ver = EEPROM_5000_TX_POWER_VERSION,
         .mod_params = &iwl50_mod_params,
-        .valid_tx_ant = ANT_BC,
-        .valid_rx_ant = ANT_BC,
+        .valid_tx_ant = ANT_AB,
+        .valid_rx_ant = ANT_AB,
         .need_pll_cfg = false,
 };
 
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 1ef4192207a5..3bb28db4a40f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -3636,7 +3636,9 @@ static struct pci_device_id iwl_hw_card_ids[] = {
         {IWL_PCI_DEVICE(0x0085, 0x1112, iwl6000_2ag_cfg)},
         {IWL_PCI_DEVICE(0x0082, 0x1122, iwl6000_2ag_cfg)},
         {IWL_PCI_DEVICE(0x422B, PCI_ANY_ID, iwl6000_3agn_cfg)},
+        {IWL_PCI_DEVICE(0x422C, PCI_ANY_ID, iwl6000_2agn_cfg)},
         {IWL_PCI_DEVICE(0x4238, PCI_ANY_ID, iwl6000_3agn_cfg)},
+        {IWL_PCI_DEVICE(0x4239, PCI_ANY_ID, iwl6000_2agn_cfg)},
         {IWL_PCI_DEVICE(0x0082, PCI_ANY_ID, iwl6000_2agn_cfg)},
         {IWL_PCI_DEVICE(0x0085, PCI_ANY_ID, iwl6000_3agn_cfg)},
         {IWL_PCI_DEVICE(0x0086, PCI_ANY_ID, iwl6050_3agn_cfg)},
diff --git a/drivers/net/wireless/iwlwifi/iwl-scan.c b/drivers/net/wireless/iwlwifi/iwl-scan.c
index 23644cf884f1..e7c65c4f741b 100644
--- a/drivers/net/wireless/iwlwifi/iwl-scan.c
+++ b/drivers/net/wireless/iwlwifi/iwl-scan.c
@@ -925,11 +925,11 @@ void iwl_bg_scan_completed(struct work_struct *work)
 
         IWL_DEBUG_SCAN(priv, "SCAN complete scan\n");
 
+        ieee80211_scan_completed(priv->hw, false);
+
         if (test_bit(STATUS_EXIT_PENDING, &priv->status))
                 return;
 
-        ieee80211_scan_completed(priv->hw, false);
-
         /* Since setting the TXPOWER may have been deferred while
          * performing the scan, fire one off */
         mutex_lock(&priv->mutex);
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index 5798fe49c771..44ab03a12e40 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -719,6 +719,14 @@ static int iwl_set_tkip_dynamic_key_info(struct iwl_priv *priv,
 {
         unsigned long flags;
         int ret = 0;
+        __le16 key_flags = 0;
+
+        key_flags |= (STA_KEY_FLG_TKIP | STA_KEY_FLG_MAP_KEY_MSK);
+        key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
+        key_flags &= ~STA_KEY_FLG_INVALID;
+
+        if (sta_id == priv->hw_params.bcast_sta_id)
+                key_flags |= STA_KEY_MULTICAST_MSK;
 
         keyconf->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
         keyconf->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
@@ -738,6 +746,9 @@ static int iwl_set_tkip_dynamic_key_info(struct iwl_priv *priv,
         WARN(priv->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET,
                 "no space for a new key");
 
+        priv->stations[sta_id].sta.key.key_flags = key_flags;
+
+
         /* This copy is acutally not needed: we get the key with each TX */
         memcpy(priv->stations[sta_id].keyinfo.key, keyconf->key, 16);
 
@@ -754,9 +765,7 @@ void iwl_update_tkip_key(struct iwl_priv *priv,
 {
         u8 sta_id = IWL_INVALID_STATION;
         unsigned long flags;
-        __le16 key_flags = 0;
         int i;
-        DECLARE_MAC_BUF(mac);
 
         sta_id = iwl_find_station(priv, addr);
         if (sta_id == IWL_INVALID_STATION) {
@@ -771,16 +780,8 @@ void iwl_update_tkip_key(struct iwl_priv *priv,
                 return;
         }
 
-        key_flags |= (STA_KEY_FLG_TKIP | STA_KEY_FLG_MAP_KEY_MSK);
-        key_flags |= cpu_to_le16(keyconf->keyidx << STA_KEY_FLG_KEYID_POS);
-        key_flags &= ~STA_KEY_FLG_INVALID;
-
-        if (sta_id == priv->hw_params.bcast_sta_id)
-                key_flags |= STA_KEY_MULTICAST_MSK;
-
         spin_lock_irqsave(&priv->sta_lock, flags);
 
-        priv->stations[sta_id].sta.key.key_flags = key_flags;
         priv->stations[sta_id].sta.key.tkip_rx_tsc_byte2 = (u8) iv32;
 
         for (i = 0; i < 5; i++)
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 617c4235d971..4cce66133500 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -1694,7 +1694,6 @@ void iwl3945_rx_queue_reset(struct iwl_priv *priv, struct iwl_rx_queue *rxq)
         rxq->free_count = 0;
         spin_unlock_irqrestore(&rxq->lock, flags);
 }
-EXPORT_SYMBOL(iwl3945_rx_queue_reset);
 
 /*
  * this should be called while priv->lock is locked
@@ -1745,7 +1744,6 @@ static void iwl3945_rx_queue_free(struct iwl_priv *priv, struct iwl_rx_queue *rx
         rxq->bd = NULL;
         rxq->rb_stts  = NULL;
 }
-EXPORT_SYMBOL(iwl3945_rx_queue_free);
 
 
 /* Convert linear signal-to-noise ratio into dB */
diff --git a/drivers/net/wireless/rndis_wlan.c b/drivers/net/wireless/rndis_wlan.c
index db91db776508..bebf735cd4bd 100644
--- a/drivers/net/wireless/rndis_wlan.c
+++ b/drivers/net/wireless/rndis_wlan.c
@@ -2558,6 +2558,11 @@ static int rndis_wext_bind(struct usbnet *usbdev, struct usb_interface *intf)
         mutex_init(&priv->command_lock);
         spin_lock_init(&priv->stats_lock);
 
+        /* because rndis_command() sleeps we need to use workqueue */
+        priv->workqueue = create_singlethread_workqueue("rndis_wlan");
+        INIT_WORK(&priv->work, rndis_wext_worker);
+        INIT_DELAYED_WORK(&priv->stats_work, rndis_update_wireless_stats);
+
         /* try bind rndis_host */
         retval = generic_rndis_bind(usbdev, intf, FLAG_RNDIS_PHYM_WIRELESS);
         if (retval < 0)
@@ -2603,16 +2608,17 @@ static int rndis_wext_bind(struct usbnet *usbdev, struct usb_interface *intf)
         disassociate(usbdev, 1);
         netif_carrier_off(usbdev->net);
 
-        /* because rndis_command() sleeps we need to use workqueue */
-        priv->workqueue = create_singlethread_workqueue("rndis_wlan");
-        INIT_DELAYED_WORK(&priv->stats_work, rndis_update_wireless_stats);
         queue_delayed_work(priv->workqueue, &priv->stats_work,
                 round_jiffies_relative(STATS_UPDATE_JIFFIES));
-        INIT_WORK(&priv->work, rndis_wext_worker);
 
         return 0;
 
 fail:
+        cancel_delayed_work_sync(&priv->stats_work);
+        cancel_work_sync(&priv->work);
+        flush_workqueue(priv->workqueue);
+        destroy_workqueue(priv->workqueue);
+
         kfree(priv);
         return retval;
 }
diff --git a/drivers/net/wireless/rtl818x/rtl8187.h b/drivers/net/wireless/rtl818x/rtl8187.h
index 9718f61809cf..edeff82a4d06 100644
--- a/drivers/net/wireless/rtl818x/rtl8187.h
+++ b/drivers/net/wireless/rtl818x/rtl8187.h
@@ -120,6 +120,12 @@ struct rtl8187_priv {
                 __le64 buf;
                 struct sk_buff_head queue;
         } b_tx_status; /* This queue is used by both -b and non-b devices */
+        struct mutex io_mutex;
+        union {
+                u8 bits8;
+                __le16 bits16;
+                __le32 bits32;
+        } *io_dmabuf;
 };
 
 void rtl8187_write_phy(struct ieee80211_hw *dev, u8 addr, u32 data);
@@ -129,10 +135,14 @@ static inline u8 rtl818x_ioread8_idx(struct rtl8187_priv *priv,
 {
         u8 val;
 
+        mutex_lock(&priv->io_mutex);
         usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0),
                         RTL8187_REQ_GET_REG, RTL8187_REQT_READ,
-                        (unsigned long)addr, idx & 0x03, &val,
-                        sizeof(val), HZ / 2);
+                        (unsigned long)addr, idx & 0x03,
+                        &priv->io_dmabuf->bits8, sizeof(val), HZ / 2);
+
+        val = priv->io_dmabuf->bits8;
+        mutex_unlock(&priv->io_mutex);
 
         return val;
 }
@@ -147,10 +157,14 @@ static inline u16 rtl818x_ioread16_idx(struct rtl8187_priv *priv,
 {
         __le16 val;
 
+        mutex_lock(&priv->io_mutex);
         usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0),
                         RTL8187_REQ_GET_REG, RTL8187_REQT_READ,
-                        (unsigned long)addr, idx & 0x03, &val,
-                        sizeof(val), HZ / 2);
+                        (unsigned long)addr, idx & 0x03,
+                        &priv->io_dmabuf->bits16, sizeof(val), HZ / 2);
+
+        val = priv->io_dmabuf->bits16;
+        mutex_unlock(&priv->io_mutex);
 
         return le16_to_cpu(val);
 }
@@ -165,10 +179,14 @@ static inline u32 rtl818x_ioread32_idx(struct rtl8187_priv *priv,
 {
         __le32 val;
 
+        mutex_lock(&priv->io_mutex);
         usb_control_msg(priv->udev, usb_rcvctrlpipe(priv->udev, 0),
                         RTL8187_REQ_GET_REG, RTL8187_REQT_READ,
-                        (unsigned long)addr, idx & 0x03, &val,
-                        sizeof(val), HZ / 2);
+                        (unsigned long)addr, idx & 0x03,
+                        &priv->io_dmabuf->bits32, sizeof(val), HZ / 2);
+
+        val = priv->io_dmabuf->bits32;
+        mutex_unlock(&priv->io_mutex);
 
         return le32_to_cpu(val);
 }
@@ -181,10 +199,15 @@ static inline u32 rtl818x_ioread32(struct rtl8187_priv *priv, __le32 *addr)
 static inline void rtl818x_iowrite8_idx(struct rtl8187_priv *priv,
                                         u8 *addr, u8 val, u8 idx)
 {
+        mutex_lock(&priv->io_mutex);
+
+        priv->io_dmabuf->bits8 = val;
         usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
                         RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
-                        (unsigned long)addr, idx & 0x03, &val,
-                        sizeof(val), HZ / 2);
+                        (unsigned long)addr, idx & 0x03,
+                        &priv->io_dmabuf->bits8, sizeof(val), HZ / 2);
+
+        mutex_unlock(&priv->io_mutex);
 }
 
 static inline void rtl818x_iowrite8(struct rtl8187_priv *priv, u8 *addr, u8 val)
@@ -195,12 +218,15 @@ static inline void rtl818x_iowrite8(struct rtl8187_priv *priv, u8 *addr, u8 val)
 static inline void rtl818x_iowrite16_idx(struct rtl8187_priv *priv,
                                          __le16 *addr, u16 val, u8 idx)
 {
-        __le16 buf = cpu_to_le16(val);
+        mutex_lock(&priv->io_mutex);
 
+        priv->io_dmabuf->bits16 = cpu_to_le16(val);
         usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
                         RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
-                        (unsigned long)addr, idx & 0x03, &buf, sizeof(buf),
-                        HZ / 2);
+                        (unsigned long)addr, idx & 0x03,
+                        &priv->io_dmabuf->bits16, sizeof(val), HZ / 2);
+
+        mutex_unlock(&priv->io_mutex);
 }
 
 static inline void rtl818x_iowrite16(struct rtl8187_priv *priv, __le16 *addr,
@@ -212,12 +238,15 @@ static inline void rtl818x_iowrite16(struct rtl8187_priv *priv, __le16 *addr,
 static inline void rtl818x_iowrite32_idx(struct rtl8187_priv *priv,
                                          __le32 *addr, u32 val, u8 idx)
 {
-        __le32 buf = cpu_to_le32(val);
+        mutex_lock(&priv->io_mutex);
 
+        priv->io_dmabuf->bits32 = cpu_to_le32(val);
         usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
                         RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
-                        (unsigned long)addr, idx & 0x03, &buf, sizeof(buf),
-                        HZ / 2);
+                        (unsigned long)addr, idx & 0x03,
+                        &priv->io_dmabuf->bits32, sizeof(val), HZ / 2);
+
+        mutex_unlock(&priv->io_mutex);
 }
 
 static inline void rtl818x_iowrite32(struct rtl8187_priv *priv, __le32 *addr,
diff --git a/drivers/net/wireless/rtl818x/rtl8187_dev.c b/drivers/net/wireless/rtl818x/rtl8187_dev.c
index fd81884b9c7d..bac6cfba6abd 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_dev.c
@@ -1329,6 +1329,14 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
         priv = dev->priv;
         priv->is_rtl8187b = (id->driver_info == DEVICE_RTL8187B);
 
+        /* allocate "DMA aware" buffer for register accesses */
+        priv->io_dmabuf = kmalloc(sizeof(*priv->io_dmabuf), GFP_KERNEL);
+        if (!priv->io_dmabuf) {
+                err = -ENOMEM;
+                goto err_free_dev;
+        }
+        mutex_init(&priv->io_mutex);
+
         SET_IEEE80211_DEV(dev, &intf->dev);
         usb_set_intfdata(intf, dev);
         priv->udev = udev;
@@ -1495,7 +1503,7 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
         err = ieee80211_register_hw(dev);
         if (err) {
                 printk(KERN_ERR "rtl8187: Cannot register device\n");
-                goto err_free_dev;
+                goto err_free_dmabuf;
         }
         mutex_init(&priv->conf_mutex);
         skb_queue_head_init(&priv->b_tx_status.queue);
@@ -1506,6 +1514,8 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
 
         return 0;
 
+ err_free_dmabuf:
+        kfree(priv->io_dmabuf);
  err_free_dev:
         ieee80211_free_hw(dev);
         usb_set_intfdata(intf, NULL);
@@ -1526,6 +1536,7 @@ static void __devexit rtl8187_disconnect(struct usb_interface *intf)
         priv = dev->priv;
         usb_reset_device(priv->udev);
         usb_put_dev(interface_to_usbdev(intf));
+        kfree(priv->io_dmabuf);
         ieee80211_free_hw(dev);
 }
 
diff --git a/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c b/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c
index 78df281b297a..a09819386a1e 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c
@@ -88,9 +88,15 @@ static void rtl8225_write_8051(struct ieee80211_hw *dev, u8 addr, __le16 data)
         rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, reg80);
         udelay(10);
 
+        mutex_lock(&priv->io_mutex);
+
+        priv->io_dmabuf->bits16 = data;
         usb_control_msg(priv->udev, usb_sndctrlpipe(priv->udev, 0),
                         RTL8187_REQ_SET_REG, RTL8187_REQT_WRITE,
-                        addr, 0x8225, &data, sizeof(data), HZ / 2);
+                        addr, 0x8225, &priv->io_dmabuf->bits16, sizeof(data),
+                        HZ / 2);
+
+        mutex_unlock(&priv->io_mutex);
 
         rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, reg80 | (1 << 2));
         udelay(10);
diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
index 001b328adf80..a563fbe559d0 100644
--- a/drivers/pci/intel-iommu.c
+++ b/drivers/pci/intel-iommu.c
@@ -59,6 +59,10 @@
 #define DMA_32BIT_PFN           IOVA_PFN(DMA_BIT_MASK(32))
 #define DMA_64BIT_PFN           IOVA_PFN(DMA_BIT_MASK(64))
 
+#ifndef PHYSICAL_PAGE_MASK
+#define PHYSICAL_PAGE_MASK PAGE_MASK
+#endif
+
 /* global iommu list, set NULL for ignored DMAR units */
 static struct intel_iommu **g_iommus;
 
@@ -1216,7 +1220,7 @@ static void dmar_init_reserved_ranges(void)
                         if (!r->flags || !(r->flags & IORESOURCE_MEM))
                                 continue;
                         addr = r->start;
-                        addr &= PAGE_MASK;
+                        addr &= PHYSICAL_PAGE_MASK;
                         size = r->end - addr;
                         size = PAGE_ALIGN(size);
                         iova = reserve_iova(&reserved_iova_list, IOVA_PFN(addr),
@@ -2173,7 +2177,8 @@ static dma_addr_t __intel_map_single(struct device *hwdev, phys_addr_t paddr,
          * is not a big problem
          */
         ret = domain_page_mapping(domain, start_paddr,
-                ((u64)paddr) & PAGE_MASK, size, prot);
+                                  ((u64)paddr) & PHYSICAL_PAGE_MASK,
+                                  size, prot);
         if (ret)
                 goto error;
 
@@ -2463,8 +2468,8 @@ static int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int ne
                 addr = page_to_phys(sg_page(sg)) + sg->offset;
                 size = aligned_size((u64)addr, sg->length);
                 ret = domain_page_mapping(domain, start_addr + offset,
-                        ((u64)addr) & PAGE_MASK,
-                        size, prot);
+                                          ((u64)addr) & PHYSICAL_PAGE_MASK,
+                                          size, prot);
                 if (ret) {
                         /*  clear the page */
                         dma_pte_clear_range(domain, start_addr,
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 6f2e6295e773..362773247fbf 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -455,8 +455,6 @@ static int msix_capability_init(struct pci_dev *dev,
                 entry->msi_attrib.default_irq = dev->irq;
                 entry->msi_attrib.pos = pos;
                 entry->mask_base = base;
-                entry->masked = readl(base + j * PCI_MSIX_ENTRY_SIZE +
-                                        PCI_MSIX_ENTRY_VECTOR_CTRL_OFFSET);
                 msix_mask_irq(entry, 1);
 
                 list_add_tail(&entry->list, &dev->msi_list);
@@ -493,6 +491,12 @@ static int msix_capability_init(struct pci_dev *dev,
         msix_set_enable(dev, 1);
         dev->msix_enabled = 1;
 
+        list_for_each_entry(entry, &dev->msi_list, list) {
+                int vector = entry->msi_attrib.entry_nr;
+                entry->masked = readl(base + vector * PCI_MSIX_ENTRY_SIZE +
+                                        PCI_MSIX_ENTRY_VECTOR_CTRL_OFFSET);
+        }
+
         return 0;
 }
 
diff --git a/drivers/pci/pcie/aer/aerdrv.h b/drivers/pci/pcie/aer/aerdrv.h
index c7ad68b6c6d6..aa14482a4779 100644
--- a/drivers/pci/pcie/aer/aerdrv.h
+++ b/drivers/pci/pcie/aer/aerdrv.h
@@ -95,6 +95,9 @@ struct aer_broadcast_data {
 static inline pci_ers_result_t merge_result(enum pci_ers_result orig,
                 enum pci_ers_result new)
 {
+        if (new == PCI_ERS_RESULT_NONE)
+                return orig;
+
         switch (orig) {
         case PCI_ERS_RESULT_CAN_RECOVER:
         case PCI_ERS_RESULT_RECOVERED:
diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
index b924e2463f85..091ce70051e0 100644
--- a/drivers/pci/pcie/portdrv_pci.c
+++ b/drivers/pci/pcie/portdrv_pci.c
@@ -200,7 +200,7 @@ static int slot_reset_iter(struct device *device, void *data)
 
 static pci_ers_result_t pcie_portdrv_slot_reset(struct pci_dev *dev)
 {
-        pci_ers_result_t status = PCI_ERS_RESULT_NONE;
+        pci_ers_result_t status = PCI_ERS_RESULT_RECOVERED;
         int retval;
 
         /* If fatal, restore cfg space for possible link reset at upstream */
diff --git a/drivers/rtc/rtc-twl4030.c b/drivers/rtc/rtc-twl4030.c
index a6341e4f9a0f..9c8c70c497dc 100644
--- a/drivers/rtc/rtc-twl4030.c
+++ b/drivers/rtc/rtc-twl4030.c
@@ -495,9 +495,7 @@ static int twl4030_rtc_suspend(struct platform_device *pdev, pm_message_t state)
 {
         irqstat = rtc_irq_bits;
 
-        /* REVISIT alarm may need to wake us from sleep */
-        mask_rtc_irq_bit(BIT_RTC_INTERRUPTS_REG_IT_TIMER_M |
-                         BIT_RTC_INTERRUPTS_REG_IT_ALARM_M);
+        mask_rtc_irq_bit(BIT_RTC_INTERRUPTS_REG_IT_TIMER_M);
         return 0;
 }
 
diff --git a/drivers/scsi/osd/osd_uld.c b/drivers/scsi/osd/osd_uld.c
index f644c9571eab..22b59e13ba83 100644
--- a/drivers/scsi/osd/osd_uld.c
+++ b/drivers/scsi/osd/osd_uld.c
@@ -173,26 +173,26 @@ static const struct file_operations osd_fops = {
         .unlocked_ioctl = osd_uld_ioctl,
 };
 
-struct osd_dev *osduld_path_lookup(const char *path)
+struct osd_dev *osduld_path_lookup(const char *name)
 {
-        struct nameidata nd;
+        struct path path;
         struct inode *inode;
         struct cdev *cdev;
         struct osd_uld_device *uninitialized_var(oud);
         int error;
 
-        if (!path || !*path) {
+        if (!name || !*name) {
                 OSD_ERR("Mount with !path || !*path\n");
                 return ERR_PTR(-EINVAL);
         }
 
-        error = path_lookup(path, LOOKUP_FOLLOW, &nd);
+        error = kern_path(name, LOOKUP_FOLLOW, &path);
         if (error) {
-                OSD_ERR("path_lookup of %s faild=>%d\n", path, error);
+                OSD_ERR("path_lookup of %s failed=>%d\n", name, error);
                 return ERR_PTR(error);
         }
 
-        inode = nd.path.dentry->d_inode;
+        inode = path.dentry->d_inode;
         error = -EINVAL; /* Not the right device e.g osd_uld_device */
         if (!S_ISCHR(inode->i_mode)) {
                 OSD_DEBUG("!S_ISCHR()\n");
@@ -202,15 +202,15 @@ struct osd_dev *osduld_path_lookup(const char *path)
         cdev = inode->i_cdev;
         if (!cdev) {
                 OSD_ERR("Before mounting an OSD Based filesystem\n");
-                OSD_ERR("  user-mode must open+close the %s device\n", path);
-                OSD_ERR("  Example: bash: echo < %s\n", path);
+                OSD_ERR("  user-mode must open+close the %s device\n", name);
+                OSD_ERR("  Example: bash: echo < %s\n", name);
                 goto out;
         }
 
         /* The Magic wand. Is it our char-dev */
         /* TODO: Support sg devices */
         if (cdev->owner != THIS_MODULE) {
-                OSD_ERR("Error mounting %s - is not an OSD device\n", path);
+                OSD_ERR("Error mounting %s - is not an OSD device\n", name);
                 goto out;
         }
 
@@ -220,7 +220,7 @@ struct osd_dev *osduld_path_lookup(const char *path)
         error = 0;
 
 out:
-        path_put(&nd.path);
+        path_put(&path);
         return error ? ERR_PTR(error) : &oud->od;
 }
 EXPORT_SYMBOL(osduld_path_lookup);
diff --git a/drivers/serial/jsm/jsm.h b/drivers/serial/jsm/jsm.h
index 8871aaa3dba6..c0a3e2734e24 100644
--- a/drivers/serial/jsm/jsm.h
+++ b/drivers/serial/jsm/jsm.h
@@ -130,8 +130,6 @@ struct jsm_board
         struct pci_dev  *pci_dev;
         u32             maxports;       /* MAX ports this board can handle */
 
-        spinlock_t      bd_lock;        /* Used to protect board */
-
         spinlock_t      bd_intr_lock;   /* Used to protect the poller tasklet and
                                          * the interrupt routine from each other.
                                          */
diff --git a/drivers/serial/jsm/jsm_driver.c b/drivers/serial/jsm/jsm_driver.c
index d2d32a198629..b3604aa322a4 100644
--- a/drivers/serial/jsm/jsm_driver.c
+++ b/drivers/serial/jsm/jsm_driver.c
@@ -88,7 +88,6 @@ static int __devinit jsm_probe_one(struct pci_dev *pdev, const struct pci_device
         else
                 brd->maxports = 2;
 
-        spin_lock_init(&brd->bd_lock);
         spin_lock_init(&brd->bd_intr_lock);
 
         /* store which revision we have */
diff --git a/drivers/serial/nwpserial.c b/drivers/serial/nwpserial.c
index 32f3eaf0d262..9e150b19d726 100644
--- a/drivers/serial/nwpserial.c
+++ b/drivers/serial/nwpserial.c
@@ -145,11 +145,13 @@ static irqreturn_t nwpserial_interrupt(int irq, void *dev_id)
                 ch = dcr_read(up->dcr_host, UART_RX);
                 if (up->port.ignore_status_mask != NWPSERIAL_STATUS_RXVALID)
                         tty_insert_flip_char(tty, ch, TTY_NORMAL);
-        } while (dcr_read(up->dcr_host, UART_RX) & UART_LSR_DR);
+        } while (dcr_read(up->dcr_host, UART_LSR) & UART_LSR_DR);
 
         tty_flip_buffer_push(tty);
         ret = IRQ_HANDLED;
 
+        /* clear interrupt */
+        dcr_write(up->dcr_host, UART_IIR, 1);
 out:
         spin_unlock(&up->port.lock);
         return ret;
diff --git a/drivers/serial/s3c6400.c b/drivers/serial/s3c6400.c
index 06936d13393f..3e3785233682 100644
--- a/drivers/serial/s3c6400.c
+++ b/drivers/serial/s3c6400.c
@@ -102,6 +102,7 @@ static struct s3c24xx_uart_info s3c6400_uart_inf = {
         .name           = "Samsung S3C6400 UART",
         .type           = PORT_S3C6400,
         .fifosize       = 64,
+        .has_divslot    = 1,
         .rx_fifomask    = S3C2440_UFSTAT_RXMASK,
         .rx_fifoshift   = S3C2440_UFSTAT_RXSHIFT,
         .rx_fifofull    = S3C2440_UFSTAT_RXFULL,
diff --git a/drivers/serial/samsung.c b/drivers/serial/samsung.c
index e06686ae858b..93b5d75db126 100644
--- a/drivers/serial/samsung.c
+++ b/drivers/serial/samsung.c
@@ -508,6 +508,7 @@ s3c24xx_serial_setsource(struct uart_port *port, struct s3c24xx_uart_clksrc *c)
 struct baud_calc {
         struct s3c24xx_uart_clksrc      *clksrc;
         unsigned int                     calc;
+        unsigned int                     divslot;
         unsigned int                     quot;
         struct clk                      *src;
 };
@@ -517,6 +518,7 @@ static int s3c24xx_serial_calcbaud(struct baud_calc *calc,
                                    struct s3c24xx_uart_clksrc *clksrc,
                                    unsigned int baud)
 {
+        struct s3c24xx_uart_port *ourport = to_ourport(port);
         unsigned long rate;
 
         calc->src = clk_get(port->dev, clksrc->name);
@@ -527,8 +529,24 @@ static int s3c24xx_serial_calcbaud(struct baud_calc *calc,
         rate /= clksrc->divisor;
 
         calc->clksrc = clksrc;
-        calc->quot = (rate + (8 * baud)) / (16 * baud);
-        calc->calc = (rate / (calc->quot * 16));
+
+        if (ourport->info->has_divslot) {
+                unsigned long div = rate / baud;
+
+                /* The UDIVSLOT register on the newer UARTs allows us to
+                 * get a divisor adjustment of 1/16th on the baud clock.
+                 *
+                 * We don't keep the UDIVSLOT value (the 16ths we calculated
+                 * by not multiplying the baud by 16) as it is easy enough
+                 * to recalculate.
+                 */
+
+                calc->quot = div / 16;
+                calc->calc = rate / div;
+        } else {
+                calc->quot = (rate + (8 * baud)) / (16 * baud);
+                calc->calc = (rate / (calc->quot * 16));
+        }
 
         calc->quot--;
         return 1;
@@ -611,6 +629,30 @@ static unsigned int s3c24xx_serial_getclk(struct uart_port *port,
         return best->quot;
 }
 
+/* udivslot_table[]
+ *
+ * This table takes the fractional value of the baud divisor and gives
+ * the recommended setting for the UDIVSLOT register.
+ */
+static u16 udivslot_table[16] = {
+        [0] = 0x0000,
+        [1] = 0x0080,
+        [2] = 0x0808,
+        [3] = 0x0888,
+        [4] = 0x2222,
+        [5] = 0x4924,
+        [6] = 0x4A52,
+        [7] = 0x54AA,
+        [8] = 0x5555,
+        [9] = 0xD555,
+        [10] = 0xD5D5,
+        [11] = 0xDDD5,
+        [12] = 0xDDDD,
+        [13] = 0xDFDD,
+        [14] = 0xDFDF,
+        [15] = 0xFFDF,
+};
+
 static void s3c24xx_serial_set_termios(struct uart_port *port,
                                        struct ktermios *termios,
                                        struct ktermios *old)
@@ -623,6 +665,7 @@ static void s3c24xx_serial_set_termios(struct uart_port *port,
         unsigned int baud, quot;
         unsigned int ulcon;
         unsigned int umcon;
+        unsigned int udivslot = 0;
 
         /*
          * We don't support modem control lines.
@@ -644,6 +687,7 @@ static void s3c24xx_serial_set_termios(struct uart_port *port,
         /* check to see if we need  to change clock source */
 
         if (ourport->clksrc != clksrc || ourport->baudclk != clk) {
+                dbg("selecting clock %p\n", clk);
                 s3c24xx_serial_setsource(port, clksrc);
 
                 if (ourport->baudclk != NULL && !IS_ERR(ourport->baudclk)) {
@@ -658,6 +702,13 @@ static void s3c24xx_serial_set_termios(struct uart_port *port,
                 ourport->baudclk_rate = clk ? clk_get_rate(clk) : 0;
         }
 
+        if (ourport->info->has_divslot) {
+                unsigned int div = ourport->baudclk_rate / baud;
+
+                udivslot = udivslot_table[div & 15];
+                dbg("udivslot = %04x (div %d)\n", udivslot, div & 15);
+        }
+
         switch (termios->c_cflag & CSIZE) {
         case CS5:
                 dbg("config: 5bits/char\n");
@@ -697,12 +748,16 @@ static void s3c24xx_serial_set_termios(struct uart_port *port,
 
         spin_lock_irqsave(&port->lock, flags);
 
-        dbg("setting ulcon to %08x, brddiv to %d\n", ulcon, quot);
+        dbg("setting ulcon to %08x, brddiv to %d, udivslot %08x\n",
+            ulcon, quot, udivslot);
 
         wr_regl(port, S3C2410_ULCON, ulcon);
         wr_regl(port, S3C2410_UBRDIV, quot);
         wr_regl(port, S3C2410_UMCON, umcon);
 
+        if (ourport->info->has_divslot)
+                wr_regl(port, S3C2443_DIVSLOT, udivslot);
+
         dbg("uart: ulcon = 0x%08x, ucon = 0x%08x, ufcon = 0x%08x\n",
             rd_regl(port, S3C2410_ULCON),
             rd_regl(port, S3C2410_UCON),
diff --git a/drivers/serial/samsung.h b/drivers/serial/samsung.h
index 571d6b90d206..7afb94843a08 100644
--- a/drivers/serial/samsung.h
+++ b/drivers/serial/samsung.h
@@ -21,6 +21,10 @@ struct s3c24xx_uart_info {
         unsigned long           tx_fifoshift;
         unsigned long           tx_fifofull;
 
+        /* uart port features */
+
+        unsigned int            has_divslot:1;
+
         /* clock source control */
 
         int (*get_clksrc)(struct uart_port *, struct s3c24xx_uart_clksrc *clk);
diff --git a/drivers/spi/pxa2xx_spi.c b/drivers/spi/pxa2xx_spi.c
index 885194a07418..3f3c08c6ba4e 100644
--- a/drivers/spi/pxa2xx_spi.c
+++ b/drivers/spi/pxa2xx_spi.c
@@ -1373,6 +1373,9 @@ static void cleanup(struct spi_device *spi)
 {
         struct chip_data *chip = spi_get_ctldata(spi);
 
+        if (!chip)
+                return;
+
         if (gpio_is_valid(chip->gpio_cs))
                 gpio_free(chip->gpio_cs);
 
diff --git a/drivers/staging/comedi/TODO b/drivers/staging/comedi/TODO
index 557812958464..15c9348fb938 100644
--- a/drivers/staging/comedi/TODO
+++ b/drivers/staging/comedi/TODO
@@ -11,4 +11,3 @@ Please send patches to Greg Kroah-Hartman <greg@kroah.com> and
 copy:
         Ian Abbott <abbotti@mev.co.uk>
         Frank Mori Hess <fmhess@users.sourceforge.net>
-        David Schleef <ds@schleef.org>
diff --git a/drivers/staging/rt2870/rt2870.h b/drivers/staging/rt2870/rt2870.h
index a42caa370808..a69cf338e498 100644
--- a/drivers/staging/rt2870/rt2870.h
+++ b/drivers/staging/rt2870/rt2870.h
@@ -145,6 +145,7 @@
         {USB_DEVICE(0x0789,0x0162)}, /* Logitec */              \
         {USB_DEVICE(0x0789,0x0163)}, /* Logitec */              \
         {USB_DEVICE(0x0789,0x0164)}, /* Logitec */              \
+        {USB_DEVICE(0x7392,0x7717)}, /* Edimax */               \
         { }/* Terminating entry */                      \
 }
 
diff --git a/drivers/staging/rtl8187se/r8180.h b/drivers/staging/rtl8187se/r8180.h
index 12215fc61ddc..db446b7e2e08 100644
--- a/drivers/staging/rtl8187se/r8180.h
+++ b/drivers/staging/rtl8187se/r8180.h
@@ -19,7 +19,7 @@
 #define R8180H
 
 
-#define RTL8180_MODULE_NAME "rtl8180"
+#define RTL8180_MODULE_NAME "r8180"
 #define DMESG(x,a...) printk(KERN_INFO RTL8180_MODULE_NAME ": " x "\n", ## a)
 #define DMESGW(x,a...) printk(KERN_WARNING RTL8180_MODULE_NAME ": WW:" x "\n", ## a)
 #define DMESGE(x,a...) printk(KERN_WARNING RTL8180_MODULE_NAME ": EE:" x "\n", ## a)
diff --git a/drivers/staging/rtl8187se/r8180_core.c b/drivers/staging/rtl8187se/r8180_core.c
index 6ecd12de4296..e10413cee0df 100644
--- a/drivers/staging/rtl8187se/r8180_core.c
+++ b/drivers/staging/rtl8187se/r8180_core.c
@@ -640,11 +640,9 @@ void rtl8180_proc_init_one(struct net_device *dev)
 {
         struct proc_dir_entry *e;
         struct r8180_priv *priv = (struct r8180_priv *)ieee80211_priv(dev);
-        priv->dir_dev = create_proc_entry(dev->name,
-                                          S_IFDIR | S_IRUGO | S_IXUGO,
-                                          rtl8180_proc);
+        priv->dir_dev = rtl8180_proc;
         if (!priv->dir_dev) {
-                DMESGE("Unable to initialize /proc/net/rtl8180/%s\n",
+                DMESGE("Unable to initialize /proc/net/r8180/%s\n",
                       dev->name);
                 return;
         }
@@ -654,7 +652,7 @@ void rtl8180_proc_init_one(struct net_device *dev)
 
         if (!e) {
                 DMESGE("Unable to initialize "
-                      "/proc/net/rtl8180/%s/stats-hw\n",
+                      "/proc/net/r8180/%s/stats-hw\n",
                       dev->name);
         }
 
@@ -663,7 +661,7 @@ void rtl8180_proc_init_one(struct net_device *dev)
 
         if (!e) {
                 DMESGE("Unable to initialize "
-                      "/proc/net/rtl8180/%s/stats-rx\n",
+                      "/proc/net/r8180/%s/stats-rx\n",
                       dev->name);
         }
 
@@ -673,7 +671,7 @@ void rtl8180_proc_init_one(struct net_device *dev)
 
         if (!e) {
                 DMESGE("Unable to initialize "
-                      "/proc/net/rtl8180/%s/stats-tx\n",
+                      "/proc/net/r8180/%s/stats-tx\n",
                       dev->name);
         }
         #if 0
@@ -702,7 +700,7 @@ void rtl8180_proc_init_one(struct net_device *dev)
 
         if (!e) {
                 DMESGE("Unable to initialize "
-                      "/proc/net/rtl8180/%s/registers\n",
+                      "/proc/net/r8180/%s/registers\n",
                       dev->name);
         }
 }
@@ -977,13 +975,6 @@ void check_tx_ring(struct net_device *dev, int pri)
                               *tmp & (1<<15)? "ok": "err", *(tmp+4));
         }
 
-        DMESG("nic at %d",
-                (nic-nicbegin) / 8 /4);
-        DMESG("tail at %d", ((int)tail - (int)begin) /8 /4);
-        DMESG("head at %d", ((int)head - (int)begin) /8 /4);
-        DMESG("check free desc returns %d", check_nic_enought_desc(dev,pri));
-        DMESG("free desc is %d\n", get_curr_tx_free_desc(dev,pri));
-        //rtl8180_reset(dev);
         return;
 }
 
@@ -1736,17 +1727,7 @@ short alloc_tx_desc_ring(struct net_device *dev, int bufsize, int count,
                  * descriptor's buffer must be 256 byte aligned
                  * we shouldn't be here, since we set DMA mask !
                  */
-                DMESGW("Fixing TX alignment");
-                desc = (u32*)((u8*)desc + 256);
-#if (defined(CONFIG_HIGHMEM64G) || defined(CONFIG_64BIT_PHYS_ADDR))
-                desc = (u32*)((u64)desc &~ 0xff);
-                dma_desc = (dma_addr_t)((u8*)dma_desc + 256);
-                dma_desc = (dma_addr_t)((u64)dma_desc &~ 0xff);
-#else
-                desc = (u32*)((u32)desc &~ 0xff);
-                dma_desc = (dma_addr_t)((u8*)dma_desc + 256);
-                dma_desc = (dma_addr_t)((u32)dma_desc &~ 0xff);
-#endif
+                WARN(1, "DMA buffer is not aligned\n");
         }
         tmp=desc;
         for (i=0;i<count;i++)
@@ -1984,18 +1965,7 @@ short alloc_rx_desc_ring(struct net_device *dev, u16 bufsize, int count)
                  * descriptor's buffer must be 256 byte aligned
                  * should never happen since we specify the DMA mask
                  */
-
-                DMESGW("Fixing RX alignment");
-                desc = (u32*)((u8*)desc + 256);
-#if (defined(CONFIG_HIGHMEM64G) || defined(CONFIG_64BIT_PHYS_ADDR))
-                desc = (u32*)((u64)desc &~ 0xff);
-                dma_desc = (dma_addr_t)((u8*)dma_desc + 256);
-                dma_desc = (dma_addr_t)((u64)dma_desc &~ 0xff);
-#else
-                desc = (u32*)((u32)desc &~ 0xff);
-                dma_desc = (dma_addr_t)((u8*)dma_desc + 256);
-                dma_desc = (dma_addr_t)((u32)dma_desc &~ 0xff);
-#endif
+                WARN(1, "DMA buffer is not aligned\n");
         }
 
         priv->rxring=desc;
diff --git a/drivers/staging/winbond/wbusb.c b/drivers/staging/winbond/wbusb.c
index 9c3f9439f35e..3b2d52819b4c 100644
--- a/drivers/staging/winbond/wbusb.c
+++ b/drivers/staging/winbond/wbusb.c
@@ -386,7 +386,7 @@ static int wb35_probe(struct usb_interface *intf, const struct usb_device_id *id
         if (err)
                 goto error_free_hw;
 
-        usb_set_intfdata(intf, priv);
+        usb_set_intfdata(intf, dev);
 
         return 0;
 
@@ -415,10 +415,15 @@ static void wb35_hw_halt(struct wbsoft_priv *adapter)
 
 static void wb35_disconnect(struct usb_interface *intf)
 {
-        struct wbsoft_priv *priv = usb_get_intfdata(intf);
+        struct ieee80211_hw *hw = usb_get_intfdata(intf);
+        struct wbsoft_priv *priv = hw->priv;
 
         wb35_hw_halt(priv);
 
+        ieee80211_stop_queues(hw);
+        ieee80211_unregister_hw(hw);
+        ieee80211_free_hw(hw);
+
         usb_set_intfdata(intf, NULL);
         usb_put_dev(interface_to_usbdev(intf));
 }
diff --git a/drivers/usb/Makefile b/drivers/usb/Makefile
index 89299a5ce168..0716cdb44cd8 100644
--- a/drivers/usb/Makefile
+++ b/drivers/usb/Makefile
@@ -27,6 +27,8 @@ obj-$(CONFIG_USB_WUSB)		+= wusbcore/
 
 obj-$(CONFIG_USB_ACM)           += class/
 obj-$(CONFIG_USB_PRINTER)       += class/
+obj-$(CONFIG_USB_WDM)           += class/
+obj-$(CONFIG_USB_TMC)           += class/
 
 obj-$(CONFIG_USB_STORAGE)       += storage/
 obj-$(CONFIG_USB)               += storage/
diff --git a/drivers/usb/atm/cxacru.c b/drivers/usb/atm/cxacru.c
index 6789089e2461..56802d2e994b 100644
--- a/drivers/usb/atm/cxacru.c
+++ b/drivers/usb/atm/cxacru.c
@@ -227,8 +227,14 @@ static ssize_t cxacru_sysfs_showattr_s8(s8 value, char *buf)
 
 static ssize_t cxacru_sysfs_showattr_dB(s16 value, char *buf)
 {
-        return snprintf(buf, PAGE_SIZE, "%d.%02u\n",
-                                        value / 100, abs(value) % 100);
+        if (likely(value >= 0)) {
+                return snprintf(buf, PAGE_SIZE, "%u.%02u\n",
+                                        value / 100, value % 100);
+        } else {
+                value = -value;
+                return snprintf(buf, PAGE_SIZE, "-%u.%02u\n",
+                                        value / 100, value % 100);
+        }
 }
 
 static ssize_t cxacru_sysfs_showattr_bool(u32 value, char *buf)
diff --git a/drivers/usb/gadget/usbstring.c b/drivers/usb/gadget/usbstring.c
index 4154be375c7a..58c4d37d312a 100644
--- a/drivers/usb/gadget/usbstring.c
+++ b/drivers/usb/gadget/usbstring.c
@@ -38,7 +38,7 @@ static int utf8_to_utf16le(const char *s, __le16 *cp, unsigned len)
                                 uchar = (c & 0x1f) << 6;
 
                                 c = (u8) *s++;
-                                if ((c & 0xc0) != 0xc0)
+                                if ((c & 0xc0) != 0x80)
                                         goto fail;
                                 c &= 0x3f;
                                 uchar |= c;
@@ -49,13 +49,13 @@ static int utf8_to_utf16le(const char *s, __le16 *cp, unsigned len)
                                 uchar = (c & 0x0f) << 12;
 
                                 c = (u8) *s++;
-                                if ((c & 0xc0) != 0xc0)
+                                if ((c & 0xc0) != 0x80)
                                         goto fail;
                                 c &= 0x3f;
                                 uchar |= c << 6;
 
                                 c = (u8) *s++;
-                                if ((c & 0xc0) != 0xc0)
+                                if ((c & 0xc0) != 0x80)
                                         goto fail;
                                 c &= 0x3f;
                                 uchar |= c;
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 8100f1d25904..0ab8474b00cb 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -56,6 +56,7 @@ static __u16 vendor = FTDI_VID;
 static __u16 product;
 
 struct ftdi_private {
+        struct kref kref;
         ftdi_chip_type_t chip_type;
                                 /* type of device, either SIO or FT8U232AM */
         int baud_base;          /* baud base clock for divisor setting */
@@ -669,6 +670,8 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(ADI_VID, ADI_GNICE_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { USB_DEVICE(JETI_VID, JETI_SPC1201_PID) },
+        { USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID),
+                .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { },                                    /* Optional parameter entry */
         { }                                     /* Terminating entry */
 };
@@ -1352,6 +1355,7 @@ static int ftdi_sio_port_probe(struct usb_serial_port *port)
                 return -ENOMEM;
         }
 
+        kref_init(&priv->kref);
         spin_lock_init(&priv->rx_lock);
         spin_lock_init(&priv->tx_lock);
         init_waitqueue_head(&priv->delta_msr_wait);
@@ -1468,6 +1472,13 @@ static void ftdi_shutdown(struct usb_serial *serial)
         dbg("%s", __func__);
 }
 
+static void ftdi_sio_priv_release(struct kref *k)
+{
+        struct ftdi_private *priv = container_of(k, struct ftdi_private, kref);
+
+        kfree(priv);
+}
+
 static int ftdi_sio_port_remove(struct usb_serial_port *port)
 {
         struct ftdi_private *priv = usb_get_serial_port_data(port);
@@ -1482,7 +1493,7 @@ static int ftdi_sio_port_remove(struct usb_serial_port *port)
 
         if (priv) {
                 usb_set_serial_port_data(port, NULL);
-                kfree(priv);
+                kref_put(&priv->kref, ftdi_sio_priv_release);
         }
 
         return 0;
@@ -1547,7 +1558,8 @@ static int ftdi_open(struct tty_struct *tty,
                 dev_err(&port->dev,
                         "%s - failed submitting read urb, error %d\n",
                         __func__, result);
-
+        else
+                kref_get(&priv->kref);
 
         return result;
 } /* ftdi_open */
@@ -1589,11 +1601,11 @@ static void ftdi_close(struct tty_struct *tty,
         mutex_unlock(&port->serial->disc_mutex);
 
         /* cancel any scheduled reading */
-        cancel_delayed_work(&priv->rx_work);
-        flush_scheduled_work();
+        cancel_delayed_work_sync(&priv->rx_work);
 
         /* shutdown our bulk read */
         usb_kill_urb(port->read_urb);
+        kref_put(&priv->kref, ftdi_sio_priv_release);
 } /* ftdi_close */
 
 
diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
index c09f658a448b..12330fa1c095 100644
--- a/drivers/usb/serial/ftdi_sio.h
+++ b/drivers/usb/serial/ftdi_sio.h
@@ -920,6 +920,12 @@
 #define JETI_SPC1201_PID        0x04b2
 
 /*
+ * Marvell SheevaPlug
+ */
+#define MARVELL_VID             0x9e88
+#define MARVELL_SHEEVAPLUG_PID  0x9e8f
+
+/*
  *   BmRequestType:  1100 0000b
  *   bRequest:       FTDI_E2_READ
  *   wValue:         0
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index fa65a3b08601..4b8b69045fe6 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -160,8 +160,9 @@ UNUSUAL_DEV(  0x0420, 0x0001, 0x0100, 0x0100,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_IGNORE_RESIDUE ),
 
-/* Reported by Andrew Nayenko <relan@bk.ru> */
-UNUSUAL_DEV(  0x0421, 0x0019, 0x0592, 0x0592,
+/* Reported by Andrew Nayenko <relan@bk.ru>
+ * Updated for new firmware by Phillip Potter <phillipinda@hotmail.com> */
+UNUSUAL_DEV(  0x0421, 0x0019, 0x0592, 0x0610,
                 "Nokia",
                 "Nokia 6288",
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index 93258e114517..8083d862ebc5 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -1128,13 +1128,6 @@ config FB_INTEL
           830M/845G/852GM/855GM/865G/915G/915GM/945G/945GM/965G/965GM chipsets.
           Say Y if you have and plan to use such a board.
 
-          If you say Y here and want DDC/I2C support you must first say Y to
-          "I2C support" and "I2C bit-banging support" in the character devices
-          section.
-
-          If you say M here then "I2C support" and "I2C bit-banging support"
-          can be build either as modules or built-in.
-
           To compile this driver as a module, choose M here: the
           module will be called intelfb.
 
@@ -1207,11 +1200,10 @@ config FB_MATROX_G
           pixel and 32 bpp packed pixel. You can also use font widths
           different from 8.
 
-          If you need support for G400 secondary head, you must first say Y to
-          "I2C support" in the character devices section, and then to
-          "Matrox I2C support" and "G400 second head support" here in the
-          framebuffer section. G450/G550 secondary head and digital output
-          are supported without additional modules.
+          If you need support for G400 secondary head, you must say Y to
+          "Matrox I2C support" and "G400 second head support" right below.
+          G450/G550 secondary head and digital output are supported without
+          additional modules.
 
           The driver starts in monitor mode. You must use the matroxset tool 
           (available at <ftp://platan.vc.cvut.cz/pub/linux/matrox-latest/>) to 
@@ -1310,13 +1302,6 @@ config FB_RADEON
           a framebuffer device.  There are both PCI and AGP versions.  You
           don't need to choose this to run the Radeon in plain VGA mode.
 
-          If you say Y here and want DDC/I2C support you must first say Y to
-          "I2C support" and "I2C bit-banging support" in the character devices
-          section.
-
-          If you say M here then "I2C support" and "I2C bit-banging support" 
-          can be build either as modules or built-in.
-
           There is a product page at
           http://apps.ati.com/ATIcompare/
 
diff --git a/drivers/video/Makefile b/drivers/video/Makefile
index 0dbd6c68d76b..d8d0be5151e3 100644
--- a/drivers/video/Makefile
+++ b/drivers/video/Makefile
@@ -56,7 +56,6 @@ obj-$(CONFIG_FB_CT65550)          += chipsfb.o
 obj-$(CONFIG_FB_IMSTT)            += imsttfb.o
 obj-$(CONFIG_FB_FM2)              += fm2fb.o
 obj-$(CONFIG_FB_VT8623)           += vt8623fb.o
-obj-$(CONFIG_FB_CYBLA)            += cyblafb.o
 obj-$(CONFIG_FB_TRIDENT)          += tridentfb.o
 obj-$(CONFIG_FB_LE80578)          += vermilion/
 obj-$(CONFIG_FB_S3)               += s3fb.o
diff --git a/drivers/video/cfbfillrect.c b/drivers/video/cfbfillrect.c
index 64b35766b2a2..ba9f58b2a5e8 100644
--- a/drivers/video/cfbfillrect.c
+++ b/drivers/video/cfbfillrect.c
@@ -9,10 +9,6 @@
  *
  * NOTES:
  *
- *  The code for depths like 24 that don't have integer number of pixels per
- *  long is broken and needs to be fixed. For now I turned these types of
- *  mode off.
- *
  *  Also need to add code to deal with cards endians that are different than
  *  the native cpu endians. I also need to deal with MSB position in the word.
  *
@@ -139,7 +135,7 @@ bitfill_unaligned(struct fb_info *p, unsigned long __iomem *dst, int dst_idx,
 
                 // Trailing bits
                 if (last)
-                        FB_WRITEL(comp(pat, FB_READL(dst), first), dst);
+                        FB_WRITEL(comp(pat, FB_READL(dst), last), dst);
         }
 }
 
@@ -281,7 +277,7 @@ bitfill_unaligned_rev(struct fb_info *p, unsigned long __iomem *dst,
 
 void cfb_fillrect(struct fb_info *p, const struct fb_fillrect *rect)
 {
-        unsigned long pat, fg;
+        unsigned long pat, pat2, fg;
         unsigned long width = rect->width, height = rect->height;
         int bits = BITS_PER_LONG, bytes = bits >> 3;
         u32 bpp = p->var.bits_per_pixel;
@@ -297,7 +293,7 @@ void cfb_fillrect(struct fb_info *p, const struct fb_fillrect *rect)
         else
                 fg = rect->color;
 
-        pat = pixel_to_pat( bpp, fg);
+        pat = pixel_to_pat(bpp, fg);
 
         dst = (unsigned long __iomem *)((unsigned long)p->screen_base & ~(bytes-1));
         dst_idx = ((unsigned long)p->screen_base & (bytes - 1))*8;
@@ -333,17 +329,16 @@ void cfb_fillrect(struct fb_info *p, const struct fb_fillrect *rect)
                         dst_idx += p->fix.line_length*8;
                 }
         } else {
-                int right;
-                int r;
-                int rot = (left-dst_idx) % bpp;
+                int right, r;
                 void (*fill_op)(struct fb_info *p, unsigned long __iomem *dst,
                                 int dst_idx, unsigned long pat, int left,
                                 int right, unsigned n, int bits) = NULL;
-
-                /* rotate pattern to correct start position */
-                pat = pat << rot | pat >> (bpp-rot);
-
-                right = bpp-left;
+#ifdef __LITTLE_ENDIAN
+                right = left;
+                left = bpp - right;
+#else
+                right = bpp - left;
+#endif
                 switch (rect->rop) {
                 case ROP_XOR:
                         fill_op = bitfill_unaligned_rev;
@@ -352,17 +347,18 @@ void cfb_fillrect(struct fb_info *p, const struct fb_fillrect *rect)
                         fill_op = bitfill_unaligned;
                         break;
                 default:
-                        printk( KERN_ERR "cfb_fillrect(): unknown rop, defaulting to ROP_COPY\n");
+                        printk(KERN_ERR "cfb_fillrect(): unknown rop, defaulting to ROP_COPY\n");
                         fill_op = bitfill_unaligned;
                         break;
                 }
                 while (height--) {
-                        dst += dst_idx >> (ffs(bits) - 1);
+                        dst += dst_idx / bits;
                         dst_idx &= (bits - 1);
-                        fill_op(p, dst, dst_idx, pat, left, right,
+                        r = dst_idx % bpp;
+                        /* rotate pattern to the correct start position */
+                        pat2 = le_long_to_cpu(rolx(cpu_to_le_long(pat), r, bpp));
+                        fill_op(p, dst, dst_idx, pat2, left, right,
                                 width*bpp, bits);
-                        r = (p->fix.line_length*8) % bpp;
-                        pat = pat << (bpp-r) | pat >> r;
                         dst_idx += p->fix.line_length*8;
                 }
         }
diff --git a/drivers/video/fb_draw.h b/drivers/video/fb_draw.h
index 1db622192bde..04c01faaf772 100644
--- a/drivers/video/fb_draw.h
+++ b/drivers/video/fb_draw.h
@@ -33,11 +33,11 @@ pixel_to_pat( u32 bpp, u32 pixel)
         case 8:
                 return 0x0101010101010101ul*pixel;
         case 12:
-                return 0x0001001001001001ul*pixel;
+                return 0x1001001001001001ul*pixel;
         case 16:
                 return 0x0001000100010001ul*pixel;
         case 24:
-                return 0x0000000001000001ul*pixel;
+                return 0x0001000001000001ul*pixel;
         case 32:
                 return 0x0000000100000001ul*pixel;
         default:
@@ -58,11 +58,11 @@ pixel_to_pat( u32 bpp, u32 pixel)
         case 8:
                 return 0x01010101ul*pixel;
         case 12:
-                return 0x00001001ul*pixel;
+                return 0x01001001ul*pixel;
         case 16:
                 return 0x00010001ul*pixel;
         case 24:
-                return 0x00000001ul*pixel;
+                return 0x01000001ul*pixel;
         case 32:
                 return 0x00000001ul*pixel;
         default:
@@ -167,4 +167,17 @@ static inline unsigned long fb_rev_pixels_in_long(unsigned long val,
 
 #endif  /* CONFIG_FB_CFB_REV_PIXELS_IN_BYTE */
 
+#define cpu_to_le_long _cpu_to_le_long(BITS_PER_LONG)
+#define _cpu_to_le_long(x) __cpu_to_le_long(x)
+#define __cpu_to_le_long(x) cpu_to_le##x
+
+#define le_long_to_cpu _le_long_to_cpu(BITS_PER_LONG)
+#define _le_long_to_cpu(x) __le_long_to_cpu(x)
+#define __le_long_to_cpu(x) le##x##_to_cpu
+
+static inline unsigned long rolx(unsigned long word, unsigned int shift, unsigned int x)
+{
+        return (word << shift) | (word >> (x - shift));
+}
+
 #endif /* FB_DRAW_H */
diff --git a/drivers/video/gbefb.c b/drivers/video/gbefb.c
index fe5b519860b1..1a83709f9611 100644
--- a/drivers/video/gbefb.c
+++ b/drivers/video/gbefb.c
@@ -75,7 +75,7 @@ struct gbefb_par {
 static unsigned int gbe_mem_size = CONFIG_FB_GBE_MEM * 1024*1024;
 static void *gbe_mem;
 static dma_addr_t gbe_dma_addr;
-unsigned long gbe_mem_phys;
+static unsigned long gbe_mem_phys;
 
 static struct {
         uint16_t *cpu;
@@ -185,8 +185,8 @@ static struct fb_videomode default_mode_LCD __initdata = {
         .vmode          = FB_VMODE_NONINTERLACED,
 };
 
-struct fb_videomode *default_mode __initdata = &default_mode_CRT;
-struct fb_var_screeninfo *default_var __initdata = &default_var_CRT;
+static struct fb_videomode *default_mode __initdata = &default_mode_CRT;
+static struct fb_var_screeninfo *default_var __initdata = &default_var_CRT;
 
 static int flat_panel_enabled = 0;
 
@@ -205,7 +205,7 @@ static void gbe_reset(void)
  *              console.
  */
 
-void gbe_turn_off(void)
+static void gbe_turn_off(void)
 {
         int i;
         unsigned int val, x, y, vpixen_off;
@@ -1097,7 +1097,7 @@ static void gbefb_create_sysfs(struct device *dev)
  * Initialization
  */
 
-int __init gbefb_setup(char *options)
+static int __init gbefb_setup(char *options)
 {
         char *this_opt;
 
@@ -1283,7 +1283,7 @@ static struct platform_driver gbefb_driver = {
 
 static struct platform_device *gbefb_device;
 
-int __init gbefb_init(void)
+static int __init gbefb_init(void)
 {
         int ret = platform_driver_register(&gbefb_driver);
         if (!ret) {
@@ -1301,7 +1301,7 @@ int __init gbefb_init(void)
         return ret;
 }
 
-void __exit gbefb_exit(void)
+static void __exit gbefb_exit(void)
 {
         platform_device_unregister(gbefb_device);
         platform_driver_unregister(&gbefb_driver);
diff --git a/drivers/video/sysfillrect.c b/drivers/video/sysfillrect.c
index f94d6b6e29ee..33ee3d34f9d2 100644
--- a/drivers/video/sysfillrect.c
+++ b/drivers/video/sysfillrect.c
@@ -124,7 +124,7 @@ bitfill_unaligned(struct fb_info *p, unsigned long *dst, int dst_idx,
 
                 /* Trailing bits */
                 if (last)
-                        *dst = comp(pat, *dst, first);
+                        *dst = comp(pat, *dst, last);
         }
 }
 
@@ -242,7 +242,7 @@ bitfill_unaligned_rev(struct fb_info *p, unsigned long *dst, int dst_idx,
 
 void sys_fillrect(struct fb_info *p, const struct fb_fillrect *rect)
 {
-        unsigned long pat, fg;
+        unsigned long pat, pat2, fg;
         unsigned long width = rect->width, height = rect->height;
         int bits = BITS_PER_LONG, bytes = bits >> 3;
         u32 bpp = p->var.bits_per_pixel;
@@ -292,17 +292,16 @@ void sys_fillrect(struct fb_info *p, const struct fb_fillrect *rect)
                         dst_idx += p->fix.line_length*8;
                 }
         } else {
-                int right;
-                int r;
-                int rot = (left-dst_idx) % bpp;
+                int right, r;
                 void (*fill_op)(struct fb_info *p, unsigned long *dst,
                                 int dst_idx, unsigned long pat, int left,
                                 int right, unsigned n, int bits) = NULL;
-
-                /* rotate pattern to correct start position */
-                pat = pat << rot | pat >> (bpp-rot);
-
-                right = bpp-left;
+#ifdef __LITTLE_ENDIAN
+                right = left;
+                left = bpp - right;
+#else
+                right = bpp - left;
+#endif
                 switch (rect->rop) {
                 case ROP_XOR:
                         fill_op = bitfill_unaligned_rev;
@@ -311,18 +310,19 @@ void sys_fillrect(struct fb_info *p, const struct fb_fillrect *rect)
                         fill_op = bitfill_unaligned;
                         break;
                 default:
-                        printk(KERN_ERR "cfb_fillrect(): unknown rop, "
+                        printk(KERN_ERR "sys_fillrect(): unknown rop, "
                                 "defaulting to ROP_COPY\n");
                         fill_op = bitfill_unaligned;
                         break;
                 }
                 while (height--) {
-                        dst += dst_idx >> (ffs(bits) - 1);
+                        dst += dst_idx / bits;
                         dst_idx &= (bits - 1);
-                        fill_op(p, dst, dst_idx, pat, left, right,
+                        r = dst_idx % bpp;
+                        /* rotate pattern to the correct start position */
+                        pat2 = le_long_to_cpu(rolx(cpu_to_le_long(pat), r, bpp));
+                        fill_op(p, dst, dst_idx, pat2, left, right,
                                 width*bpp, bits);
-                        r = (p->fix.line_length*8) % bpp;
-                        pat = pat << (bpp-r) | pat >> r;
                         dst_idx += p->fix.line_length*8;
                 }
         }
diff --git a/drivers/video/via/viafbdev.c b/drivers/video/via/viafbdev.c
index e327b84820d2..a0fec298216e 100644
--- a/drivers/video/via/viafbdev.c
+++ b/drivers/video/via/viafbdev.c
@@ -2103,7 +2103,7 @@ static void viafb_remove_proc(struct proc_dir_entry *viafb_entry)
 
 static int __devinit via_pci_probe(void)
 {
-        unsigned int default_xres, default_yres;
+        unsigned long default_xres, default_yres;
         char *tmpc, *tmpm;
         char *tmpc_sec, *tmpm_sec;
         int vmode_index;
@@ -2196,8 +2196,8 @@ static int __devinit via_pci_probe(void)
         viafb_FB_MM = viaparinfo->fbmem_virt;
         tmpm = viafb_mode;
         tmpc = strsep(&tmpm, "x");
-        strict_strtoul(tmpc, 0, (unsigned long *)&default_xres);
-        strict_strtoul(tmpm, 0, (unsigned long *)&default_yres);
+        strict_strtoul(tmpc, 0, &default_xres);
+        strict_strtoul(tmpm, 0, &default_yres);
 
         vmode_index = viafb_get_mode_index(default_xres, default_yres, 0);
         DEBUG_MSG(KERN_INFO "0->index=%d\n", vmode_index);
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index efa4b363ce72..f5bbd9e83416 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -513,7 +513,8 @@ static ssize_t show_target(struct sys_device *dev, struct sysdev_attribute *attr
                               char *buf)
 {
         return sprintf(buf, "%llu\n",
-                       (u64)balloon_stats.target_pages << PAGE_SHIFT);
+                       (unsigned long long)balloon_stats.target_pages
+                       << PAGE_SHIFT);
 }
 
 static ssize_t store_target(struct sys_device *dev,