396 files changed, 10827 insertions, 2804 deletions

diff --git a/Documentation/DocBook/drm.tmpl b/Documentation/DocBook/drm.tmpl
index 4ee2304f82f9..6c11d77c8d02 100644
--- a/Documentation/DocBook/drm.tmpl
+++ b/Documentation/DocBook/drm.tmpl
@@ -978,10 +978,25 @@ int max_width, max_height;</synopsis>
         If the parameters are deemed valid, drivers then create, initialize and
         return an instance of struct <structname>drm_framebuffer</structname>.
         If desired the instance can be embedded in a larger driver-specific
-        structure. The new instance is initialized with a call to
-        <function>drm_framebuffer_init</function> which takes a pointer to DRM
-        frame buffer operations (struct
-        <structname>drm_framebuffer_funcs</structname>). Frame buffer operations are
+        structure. Drivers must fill its <structfield>width</structfield>,
+        <structfield>height</structfield>, <structfield>pitches</structfield>,
+        <structfield>offsets</structfield>, <structfield>depth</structfield>,
+        <structfield>bits_per_pixel</structfield> and
+        <structfield>pixel_format</structfield> fields from the values passed
+        through the <parameter>drm_mode_fb_cmd2</parameter> argument. They
+        should call the <function>drm_helper_mode_fill_fb_struct</function>
+        helper function to do so.
+      </para>
+
+      <para>
+        The initailization of the new framebuffer instance is finalized with a
+        call to <function>drm_framebuffer_init</function> which takes a pointer
+        to DRM frame buffer operations (struct
+        <structname>drm_framebuffer_funcs</structname>). Note that this function
+        publishes the framebuffer and so from this point on it can be accessed
+        concurrently from other threads. Hence it must be the last step in the
+        driver's framebuffer initialization sequence. Frame buffer operations
+        are
         <itemizedlist>
           <listitem>
             <synopsis>int (*create_handle)(struct drm_framebuffer *fb,
@@ -1022,16 +1037,16 @@ int max_width, max_height;</synopsis>
         </itemizedlist>
       </para>
       <para>
-        After initializing the <structname>drm_framebuffer</structname>
-        instance drivers must fill its <structfield>width</structfield>,
-        <structfield>height</structfield>, <structfield>pitches</structfield>,
-        <structfield>offsets</structfield>, <structfield>depth</structfield>,
-        <structfield>bits_per_pixel</structfield> and
-        <structfield>pixel_format</structfield> fields from the values passed
-        through the <parameter>drm_mode_fb_cmd2</parameter> argument. They
-        should call the <function>drm_helper_mode_fill_fb_struct</function>
-        helper function to do so.
-      </para>
+        The lifetime of a drm framebuffer is controlled with a reference count,
+        drivers can grab additional references with
+        <function>drm_framebuffer_reference</function> </para> and drop them
+        again with <function>drm_framebuffer_unreference</function>. For
+        driver-private framebuffers for which the last reference is never
+        dropped (e.g. for the fbdev framebuffer when the struct
+        <structname>drm_framebuffer</structname> is embedded into the fbdev
+        helper struct) drivers can manually clean up a framebuffer at module
+        unload time with
+        <function>drm_framebuffer_unregister_private</function>.
     </sect2>
     <sect2>
       <title>Output Polling</title>
@@ -1043,6 +1058,22 @@ int max_width, max_height;</synopsis>
         operation.
       </para>
     </sect2>
+    <sect2>
+      <title>Locking</title>
+      <para>
+        Beside some lookup structures with their own locking (which is hidden
+        behind the interface functions) most of the modeset state is protected
+        by the <code>dev-&lt;mode_config.lock</code> mutex and additionally
+        per-crtc locks to allow cursor updates, pageflips and similar operations
+        to occur concurrently with background tasks like output detection.
+        Operations which cross domains like a full modeset always grab all
+        locks. Drivers there need to protect resources shared between crtcs with
+        additional locking. They also need to be careful to always grab the
+        relevant crtc locks if a modset functions touches crtc state, e.g. for
+        load detection (which does only grab the <code>mode_config.lock</code>
+        to allow concurrent screen updates on live crtcs).
+      </para>
+    </sect2>
   </sect1>
 
   <!-- Internals: kms initialization and cleanup -->
@@ -1609,6 +1640,10 @@ void intel_crt_init(struct drm_device *dev)
         make its properties available to applications.
       </para>
     </sect2>
+    <sect2>
+      <title>KMS API Functions</title>
+!Edrivers/gpu/drm/drm_crtc.c
+    </sect2>
   </sect1>
 
   <!-- Internals: kms helper functions -->
diff --git a/MAINTAINERS b/MAINTAINERS
index 915564eda145..3105c4868c4e 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -228,7 +228,7 @@ S:	Maintained
 F:      drivers/platform/x86/acerhdf.c
 
 ACER WMI LAPTOP EXTRAS
-M:      Joey Lee <jlee@novell.com>
+M:      "Lee, Chun-Yi" <jlee@suse.com>
 L:      platform-driver-x86@vger.kernel.org
 S:      Maintained
 F:      drivers/platform/x86/acer-wmi.c
@@ -648,7 +648,7 @@ F:	arch/arm/
 
 ARM SUB-ARCHITECTURES
 L:      linux-arm-kernel@lists.infradead.org (moderated for non-subscribers)
-S:      MAINTAINED
+S:      Maintained
 F:      arch/arm/mach-*/
 F:      arch/arm/plat-*/
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc.git
@@ -1351,6 +1351,14 @@ W:	http://wireless.kernel.org/en/users/Drivers/ath9k
 S:      Supported
 F:      drivers/net/wireless/ath/ath9k/
 
+WILOCITY WIL6210 WIRELESS DRIVER
+M:      Vladimir Kondratiev <qca_vkondrat@qca.qualcomm.com>
+L:      linux-wireless@vger.kernel.org
+L:      wil6210@qca.qualcomm.com
+S:      Supported
+W:      http://wireless.kernel.org/en/users/Drivers/wil6210
+F:      drivers/net/wireless/ath/wil6210/
+
 CARL9170 LINUX COMMUNITY WIRELESS DRIVER
 M:      Christian Lamparter <chunkeey@googlemail.com>
 L:      linux-wireless@vger.kernel.org
@@ -1964,9 +1972,9 @@ S:	Maintained
 F:      drivers/usb/host/ohci-ep93xx.c
 
 CIRRUS LOGIC CS4270 SOUND DRIVER
-M:      Timur Tabi <timur@freescale.com>
+M:      Timur Tabi <timur@tabi.org>
 L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
-S:      Supported
+S:      Odd Fixes
 F:      sound/soc/codecs/cs4270*
 
 CLEANCACHE API
@@ -3183,9 +3191,9 @@ F:	include/uapi/video/
 F:      include/uapi/linux/fb.h
 
 FREESCALE DIU FRAMEBUFFER DRIVER
-M:      Timur Tabi <timur@freescale.com>
+M:      Timur Tabi <timur@tabi.org>
 L:      linux-fbdev@vger.kernel.org
-S:      Supported
+S:      Maintained
 F:      drivers/video/fsl-diu-fb.*
 
 FREESCALE DMA DRIVER
@@ -3220,9 +3228,8 @@ F:	drivers/net/ethernet/freescale/fs_enet/
 F:      include/linux/fs_enet_pd.h
 
 FREESCALE QUICC ENGINE LIBRARY
-M:      Timur Tabi <timur@freescale.com>
 L:      linuxppc-dev@lists.ozlabs.org
-S:      Supported
+S:      Orphan
 F:      arch/powerpc/sysdev/qe_lib/
 F:      arch/powerpc/include/asm/*qe.h
 
@@ -3241,16 +3248,16 @@ S:	Maintained
 F:      drivers/net/ethernet/freescale/ucc_geth*
 
 FREESCALE QUICC ENGINE UCC UART DRIVER
-M:      Timur Tabi <timur@freescale.com>
+M:      Timur Tabi <timur@tabi.org>
 L:      linuxppc-dev@lists.ozlabs.org
-S:      Supported
+S:      Maintained
 F:      drivers/tty/serial/ucc_uart.c
 
 FREESCALE SOC SOUND DRIVERS
-M:      Timur Tabi <timur@freescale.com>
+M:      Timur Tabi <timur@tabi.org>
 L:      alsa-devel@alsa-project.org (moderated for non-subscribers)
 L:      linuxppc-dev@lists.ozlabs.org
-S:      Supported
+S:      Maintained
 F:      sound/soc/fsl/fsl*
 F:      sound/soc/fsl/mpc8610_hpcd.c
 
@@ -5077,7 +5084,7 @@ S:	Maintained
 F:      drivers/media/radio/radio-mr800.c
 
 MSI LAPTOP SUPPORT
-M:      "Lee, Chun-Yi" <jlee@novell.com>
+M:      "Lee, Chun-Yi" <jlee@suse.com>
 L:      platform-driver-x86@vger.kernel.org
 S:      Maintained
 F:      drivers/platform/x86/msi-laptop.c
@@ -5507,8 +5514,7 @@ M:	Benoît Cousson <b-cousson@ti.com>
 M:      Paul Walmsley <paul@pwsan.com>
 L:      linux-omap@vger.kernel.org
 S:      Maintained
-F:      arch/arm/mach-omap2/omap_hwmod.c
-F:      arch/arm/plat-omap/include/plat/omap_hwmod.h
+F:      arch/arm/mach-omap2/omap_hwmod.*
 
 OMAP HWMOD DATA FOR OMAP4-BASED DEVICES
 M:      Benoît Cousson <b-cousson@ti.com>
@@ -7334,7 +7340,7 @@ S:	Odd Fixes
 F:      drivers/staging/speakup/
 
 STAGING - TI DSP BRIDGE DRIVERS
-M:      Omar Ramirez Luna <omar.ramirez@ti.com>
+M:      Omar Ramirez Luna <omar.ramirez@copitl.com>
 S:      Odd Fixes
 F:      drivers/staging/tidspbridge/
 
@@ -8526,7 +8532,7 @@ F:	Documentation/x86/
 F:      arch/x86/
 
 X86 PLATFORM DRIVERS
-M:      Matthew Garrett <mjg@redhat.com>
+M:      Matthew Garrett <matthew.garrett@nebula.com>
 L:      platform-driver-x86@vger.kernel.org
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/mjg59/platform-drivers-x86.git
 S:      Maintained
diff --git a/Makefile b/Makefile
index a1667c4bcce5..253a455d8d8d 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 8
 SUBLEVEL = 0
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc4
 NAME = Terrified Chipmunk
 
 # *DOCUMENTATION*
diff --git a/arch/arm/boot/dts/Makefile b/arch/arm/boot/dts/Makefile
index e44da40d984f..5ebb44fe826a 100644
--- a/arch/arm/boot/dts/Makefile
+++ b/arch/arm/boot/dts/Makefile
@@ -155,6 +155,7 @@ dtb-$(CONFIG_ARCH_VT8500) += vt8500-bv07.dtb \
 dtb-$(CONFIG_ARCH_ZYNQ) += zynq-zc702.dtb
 
 targets += dtbs
+targets += $(dtb-y)
 endif
 
 # *.dtb used to be generated in the directory above. Clean out the
diff --git a/arch/arm/boot/dts/at91sam9260.dtsi b/arch/arm/boot/dts/at91sam9260.dtsi
index 68bccf41a2c6..cb7bcc51608d 100644
--- a/arch/arm/boot/dts/at91sam9260.dtsi
+++ b/arch/arm/boot/dts/at91sam9260.dtsi
@@ -306,6 +306,22 @@
                                         };
                                 };
 
+                                ssc0 {
+                                        pinctrl_ssc0_tx: ssc0_tx-0 {
+                                                atmel,pins =
+                                                        <1 16 0x1 0x0   /* PB16 periph A */
+                                                         1 17 0x1 0x0   /* PB17 periph A */
+                                                         1 18 0x1 0x0>; /* PB18 periph A */
+                                        };
+
+                                        pinctrl_ssc0_rx: ssc0_rx-0 {
+                                                atmel,pins =
+                                                        <1 19 0x1 0x0   /* PB19 periph A */
+                                                         1 20 0x1 0x0   /* PB20 periph A */
+                                                         1 21 0x1 0x0>; /* PB21 periph A */
+                                        };
+                                };
+
                                 pioA: gpio@fffff400 {
                                         compatible = "atmel,at91rm9200-gpio";
                                         reg = <0xfffff400 0x200>;
@@ -450,6 +466,8 @@
                                 compatible = "atmel,at91rm9200-ssc";
                                 reg = <0xfffbc000 0x4000>;
                                 interrupts = <14 4 5>;
+                                pinctrl-names = "default";
+                                pinctrl-0 = <&pinctrl_ssc0_tx &pinctrl_ssc0_rx>;
                                 status = "disabled";
                         };
 
diff --git a/arch/arm/boot/dts/at91sam9263.dtsi b/arch/arm/boot/dts/at91sam9263.dtsi
index 32ec62cf5385..271d4de026e9 100644
--- a/arch/arm/boot/dts/at91sam9263.dtsi
+++ b/arch/arm/boot/dts/at91sam9263.dtsi
@@ -271,6 +271,38 @@
                                         };
                                 };
 
+                                ssc0 {
+                                        pinctrl_ssc0_tx: ssc0_tx-0 {
+                                                atmel,pins =
+                                                        <1 0 0x2 0x0    /* PB0 periph B */
+                                                         1 1 0x2 0x0    /* PB1 periph B */
+                                                         1 2 0x2 0x0>;  /* PB2 periph B */
+                                        };
+
+                                        pinctrl_ssc0_rx: ssc0_rx-0 {
+                                                atmel,pins =
+                                                        <1 3 0x2 0x0    /* PB3 periph B */
+                                                         1 4 0x2 0x0    /* PB4 periph B */
+                                                         1 5 0x2 0x0>;  /* PB5 periph B */
+                                        };
+                                };
+
+                                ssc1 {
+                                        pinctrl_ssc1_tx: ssc1_tx-0 {
+                                                atmel,pins =
+                                                        <1 6 0x1 0x0    /* PB6 periph A */
+                                                         1 7 0x1 0x0    /* PB7 periph A */
+                                                         1 8 0x1 0x0>;  /* PB8 periph A */
+                                        };
+
+                                        pinctrl_ssc1_rx: ssc1_rx-0 {
+                                                atmel,pins =
+                                                        <1 9 0x1 0x0    /* PB9 periph A */
+                                                         1 10 0x1 0x0   /* PB10 periph A */
+                                                         1 11 0x1 0x0>; /* PB11 periph A */
+                                        };
+                                };
+
                                 pioA: gpio@fffff200 {
                                         compatible = "atmel,at91rm9200-gpio";
                                         reg = <0xfffff200 0x200>;
@@ -368,6 +400,8 @@
                                 compatible = "atmel,at91rm9200-ssc";
                                 reg = <0xfff98000 0x4000>;
                                 interrupts = <16 4 5>;
+                                pinctrl-names = "default";
+                                pinctrl-0 = <&pinctrl_ssc0_tx &pinctrl_ssc0_rx>;
                                 status = "disabled";
                         };
 
@@ -375,6 +409,8 @@
                                 compatible = "atmel,at91rm9200-ssc";
                                 reg = <0xfff9c000 0x4000>;
                                 interrupts = <17 4 5>;
+                                pinctrl-names = "default";
+                                pinctrl-0 = <&pinctrl_ssc1_tx &pinctrl_ssc1_rx>;
                                 status = "disabled";
                         };
 
diff --git a/arch/arm/boot/dts/at91sam9g45.dtsi b/arch/arm/boot/dts/at91sam9g45.dtsi
index 231858ffd850..6b1d4cab24c2 100644
--- a/arch/arm/boot/dts/at91sam9g45.dtsi
+++ b/arch/arm/boot/dts/at91sam9g45.dtsi
@@ -290,6 +290,38 @@
                                         };
                                 };
 
+                                ssc0 {
+                                        pinctrl_ssc0_tx: ssc0_tx-0 {
+                                                atmel,pins =
+                                                        <3 0 0x1 0x0    /* PD0 periph A */
+                                                         3 1 0x1 0x0    /* PD1 periph A */
+                                                         3 2 0x1 0x0>;  /* PD2 periph A */
+                                        };
+
+                                        pinctrl_ssc0_rx: ssc0_rx-0 {
+                                                atmel,pins =
+                                                        <3 3 0x1 0x0    /* PD3 periph A */
+                                                         3 4 0x1 0x0    /* PD4 periph A */
+                                                         3 5 0x1 0x0>;  /* PD5 periph A */
+                                        };
+                                };
+
+                                ssc1 {
+                                        pinctrl_ssc1_tx: ssc1_tx-0 {
+                                                atmel,pins =
+                                                        <3 10 0x1 0x0   /* PD10 periph A */
+                                                         3 11 0x1 0x0   /* PD11 periph A */
+                                                         3 12 0x1 0x0>; /* PD12 periph A */
+                                        };
+
+                                        pinctrl_ssc1_rx: ssc1_rx-0 {
+                                                atmel,pins =
+                                                        <3 13 0x1 0x0   /* PD13 periph A */
+                                                         3 14 0x1 0x0   /* PD14 periph A */
+                                                         3 15 0x1 0x0>; /* PD15 periph A */
+                                        };
+                                };
+
                                 pioA: gpio@fffff200 {
                                         compatible = "atmel,at91rm9200-gpio";
                                         reg = <0xfffff200 0x200>;
@@ -425,6 +457,8 @@
                                 compatible = "atmel,at91sam9g45-ssc";
                                 reg = <0xfff9c000 0x4000>;
                                 interrupts = <16 4 5>;
+                                pinctrl-names = "default";
+                                pinctrl-0 = <&pinctrl_ssc0_tx &pinctrl_ssc0_rx>;
                                 status = "disabled";
                         };
 
@@ -432,6 +466,8 @@
                                 compatible = "atmel,at91sam9g45-ssc";
                                 reg = <0xfffa0000 0x4000>;
                                 interrupts = <17 4 5>;
+                                pinctrl-names = "default";
+                                pinctrl-0 = <&pinctrl_ssc1_tx &pinctrl_ssc1_rx>;
                                 status = "disabled";
                         };
 
diff --git a/arch/arm/boot/dts/at91sam9n12.dtsi b/arch/arm/boot/dts/at91sam9n12.dtsi
index e9efb34f4379..80e29c605d4e 100644
--- a/arch/arm/boot/dts/at91sam9n12.dtsi
+++ b/arch/arm/boot/dts/at91sam9n12.dtsi
@@ -28,6 +28,7 @@
                 tcb1 = &tcb1;
                 i2c0 = &i2c0;
                 i2c1 = &i2c1;
+                ssc0 = &ssc0;
         };
         cpus {
                 cpu@0 {
@@ -244,6 +245,22 @@
                                         };
                                 };
 
+                                ssc0 {
+                                        pinctrl_ssc0_tx: ssc0_tx-0 {
+                                                atmel,pins =
+                                                        <0 24 0x2 0x0   /* PA24 periph B */
+                                                         0 25 0x2 0x0   /* PA25 periph B */
+                                                         0 26 0x2 0x0>; /* PA26 periph B */
+                                        };
+
+                                        pinctrl_ssc0_rx: ssc0_rx-0 {
+                                                atmel,pins =
+                                                        <0 27 0x2 0x0   /* PA27 periph B */
+                                                         0 28 0x2 0x0   /* PA28 periph B */
+                                                         0 29 0x2 0x0>; /* PA29 periph B */
+                                        };
+                                };
+
                                 pioA: gpio@fffff400 {
                                         compatible = "atmel,at91sam9x5-gpio", "atmel,at91rm9200-gpio";
                                         reg = <0xfffff400 0x200>;
@@ -294,6 +311,15 @@
                                 status = "disabled";
                         };
 
+                        ssc0: ssc@f0010000 {
+                                compatible = "atmel,at91sam9g45-ssc";
+                                reg = <0xf0010000 0x4000>;
+                                interrupts = <28 4 5>;
+                                pinctrl-names = "default";
+                                pinctrl-0 = <&pinctrl_ssc0_tx &pinctrl_ssc0_rx>;
+                                status = "disabled";
+                        };
+
                         usart0: serial@f801c000 {
                                 compatible = "atmel,at91sam9260-usart";
                                 reg = <0xf801c000 0x4000>;
diff --git a/arch/arm/boot/dts/at91sam9x5.dtsi b/arch/arm/boot/dts/at91sam9x5.dtsi
index 40ac3a4eb1ab..3a47cf952146 100644
--- a/arch/arm/boot/dts/at91sam9x5.dtsi
+++ b/arch/arm/boot/dts/at91sam9x5.dtsi
@@ -88,13 +88,6 @@
                                 interrupts = <1 4 7>;
                         };
 
-                        ssc0: ssc@f0010000 {
-                                compatible = "atmel,at91sam9g45-ssc";
-                                reg = <0xf0010000 0x4000>;
-                                interrupts = <28 4 5>;
-                                status = "disabled";
-                        };
-
                         tcb0: timer@f8008000 {
                                 compatible = "atmel,at91sam9x5-tcb";
                                 reg = <0xf8008000 0x100>;
@@ -290,6 +283,22 @@
                                         };
                                 };
 
+                                ssc0 {
+                                        pinctrl_ssc0_tx: ssc0_tx-0 {
+                                                atmel,pins =
+                                                        <0 24 0x2 0x0   /* PA24 periph B */
+                                                         0 25 0x2 0x0   /* PA25 periph B */
+                                                         0 26 0x2 0x0>; /* PA26 periph B */
+                                        };
+
+                                        pinctrl_ssc0_rx: ssc0_rx-0 {
+                                                atmel,pins =
+                                                        <0 27 0x2 0x0   /* PA27 periph B */
+                                                         0 28 0x2 0x0   /* PA28 periph B */
+                                                         0 29 0x2 0x0>; /* PA29 periph B */
+                                        };
+                                };
+
                                 pioA: gpio@fffff400 {
                                         compatible = "atmel,at91sam9x5-gpio", "atmel,at91rm9200-gpio";
                                         reg = <0xfffff400 0x200>;
@@ -333,6 +342,15 @@
                                 };
                         };
 
+                        ssc0: ssc@f0010000 {
+                                compatible = "atmel,at91sam9g45-ssc";
+                                reg = <0xf0010000 0x4000>;
+                                interrupts = <28 4 5>;
+                                pinctrl-names = "default";
+                                pinctrl-0 = <&pinctrl_ssc0_tx &pinctrl_ssc0_rx>;
+                                status = "disabled";
+                        };
+
                         mmc0: mmc@f0008000 {
                                 compatible = "atmel,hsmci";
                                 reg = <0xf0008000 0x600>;
diff --git a/arch/arm/mach-pxa/include/mach/mfp-pxa27x.h b/arch/arm/mach-pxa/include/mach/mfp-pxa27x.h
index a611ad3153c7..b6132aa95dc0 100644
--- a/arch/arm/mach-pxa/include/mach/mfp-pxa27x.h
+++ b/arch/arm/mach-pxa/include/mach/mfp-pxa27x.h
@@ -463,6 +463,9 @@
         GPIO76_LCD_PCLK,        \
         GPIO77_LCD_BIAS
 
+/* these enable a work-around for a hw bug in pxa27x during ac97 warm reset */
+#define GPIO113_AC97_nRESET_GPIO_HIGH MFP_CFG_OUT(GPIO113, AF0, DEFAULT)
+#define GPIO95_AC97_nRESET_GPIO_HIGH MFP_CFG_OUT(GPIO95, AF0, DEFAULT)
 
 extern int keypad_set_wake(unsigned int on);
 #endif /* __ASM_ARCH_MFP_PXA27X_H */
diff --git a/arch/arm/mach-pxa/pxa27x.c b/arch/arm/mach-pxa/pxa27x.c
index 8047ee0effc5..616cb87b6179 100644
--- a/arch/arm/mach-pxa/pxa27x.c
+++ b/arch/arm/mach-pxa/pxa27x.c
@@ -47,9 +47,9 @@ void pxa27x_clear_otgph(void)
 EXPORT_SYMBOL(pxa27x_clear_otgph);
 
 static unsigned long ac97_reset_config[] = {
-        GPIO113_GPIO,
+        GPIO113_AC97_nRESET_GPIO_HIGH,
         GPIO113_AC97_nRESET,
-        GPIO95_GPIO,
+        GPIO95_AC97_nRESET_GPIO_HIGH,
         GPIO95_AC97_nRESET,
 };
 
diff --git a/arch/arm64/boot/dts/Makefile b/arch/arm64/boot/dts/Makefile
index 801e2d7fcbc6..32ac0aef0068 100644
--- a/arch/arm64/boot/dts/Makefile
+++ b/arch/arm64/boot/dts/Makefile
@@ -1,4 +1,5 @@
 targets += dtbs
+targets += $(dtb-y)
 
 dtbs: $(addprefix $(obj)/, $(dtb-y))
 
diff --git a/arch/arm64/include/asm/pgtable.h b/arch/arm64/include/asm/pgtable.h
index 64b133949502..e333a243bfcc 100644
--- a/arch/arm64/include/asm/pgtable.h
+++ b/arch/arm64/include/asm/pgtable.h
@@ -24,7 +24,8 @@
 /*
  * Software defined PTE bits definition.
  */
-#define PTE_VALID               (_AT(pteval_t, 1) << 0) /* pte_present() check */
+#define PTE_VALID               (_AT(pteval_t, 1) << 0)
+#define PTE_PROT_NONE           (_AT(pteval_t, 1) << 1) /* only when !PTE_VALID */
 #define PTE_FILE                (_AT(pteval_t, 1) << 2) /* only when !pte_present() */
 #define PTE_DIRTY               (_AT(pteval_t, 1) << 55)
 #define PTE_SPECIAL             (_AT(pteval_t, 1) << 56)
@@ -60,9 +61,12 @@ extern void __pgd_error(const char *file, int line, unsigned long val);
 
 extern pgprot_t pgprot_default;
 
-#define _MOD_PROT(p, b) __pgprot(pgprot_val(p) | (b))
+#define __pgprot_modify(prot,mask,bits) \
+        __pgprot((pgprot_val(prot) & ~(mask)) | (bits))
+
+#define _MOD_PROT(p, b)         __pgprot_modify(p, 0, b)
 
-#define PAGE_NONE               _MOD_PROT(pgprot_default, PTE_NG | PTE_PXN | PTE_UXN | PTE_RDONLY)
+#define PAGE_NONE               __pgprot_modify(pgprot_default, PTE_TYPE_MASK, PTE_PROT_NONE)
 #define PAGE_SHARED             _MOD_PROT(pgprot_default, PTE_USER | PTE_NG | PTE_PXN | PTE_UXN)
 #define PAGE_SHARED_EXEC        _MOD_PROT(pgprot_default, PTE_USER | PTE_NG | PTE_PXN)
 #define PAGE_COPY               _MOD_PROT(pgprot_default, PTE_USER | PTE_NG | PTE_PXN | PTE_UXN | PTE_RDONLY)
@@ -72,7 +76,7 @@ extern pgprot_t pgprot_default;
 #define PAGE_KERNEL             _MOD_PROT(pgprot_default, PTE_PXN | PTE_UXN | PTE_DIRTY)
 #define PAGE_KERNEL_EXEC        _MOD_PROT(pgprot_default, PTE_UXN | PTE_DIRTY)
 
-#define __PAGE_NONE             __pgprot(_PAGE_DEFAULT | PTE_NG | PTE_PXN | PTE_UXN | PTE_RDONLY)
+#define __PAGE_NONE             __pgprot(((_PAGE_DEFAULT) & ~PTE_TYPE_MASK) | PTE_PROT_NONE)
 #define __PAGE_SHARED           __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_NG | PTE_PXN | PTE_UXN)
 #define __PAGE_SHARED_EXEC      __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_NG | PTE_PXN)
 #define __PAGE_COPY             __pgprot(_PAGE_DEFAULT | PTE_USER | PTE_NG | PTE_PXN | PTE_UXN | PTE_RDONLY)
@@ -125,16 +129,15 @@ extern struct page *empty_zero_page;
 /*
  * The following only work if pte_present(). Undefined behaviour otherwise.
  */
-#define pte_present(pte)        (pte_val(pte) & PTE_VALID)
+#define pte_present(pte)        (pte_val(pte) & (PTE_VALID | PTE_PROT_NONE))
 #define pte_dirty(pte)          (pte_val(pte) & PTE_DIRTY)
 #define pte_young(pte)          (pte_val(pte) & PTE_AF)
 #define pte_special(pte)        (pte_val(pte) & PTE_SPECIAL)
 #define pte_write(pte)          (!(pte_val(pte) & PTE_RDONLY))
 #define pte_exec(pte)           (!(pte_val(pte) & PTE_UXN))
 
-#define pte_present_exec_user(pte) \
-        ((pte_val(pte) & (PTE_VALID | PTE_USER | PTE_UXN)) == \
-         (PTE_VALID | PTE_USER))
+#define pte_valid_user(pte) \
+        ((pte_val(pte) & (PTE_VALID | PTE_USER)) == (PTE_VALID | PTE_USER))
 
 #define PTE_BIT_FUNC(fn,op) \
 static inline pte_t pte_##fn(pte_t pte) { pte_val(pte) op; return pte; }
@@ -157,10 +160,13 @@ extern void __sync_icache_dcache(pte_t pteval, unsigned long addr);
 static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
                               pte_t *ptep, pte_t pte)
 {
-        if (pte_present_exec_user(pte))
-                __sync_icache_dcache(pte, addr);
-        if (!pte_dirty(pte))
-                pte = pte_wrprotect(pte);
+        if (pte_valid_user(pte)) {
+                if (pte_exec(pte))
+                        __sync_icache_dcache(pte, addr);
+                if (!pte_dirty(pte))
+                        pte = pte_wrprotect(pte);
+        }
+
         set_pte(ptep, pte);
 }
 
@@ -170,9 +176,6 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr,
 #define pte_huge(pte)           ((pte_val(pte) & PTE_TYPE_MASK) == PTE_TYPE_HUGEPAGE)
 #define pte_mkhuge(pte)         (__pte((pte_val(pte) & ~PTE_TYPE_MASK) | PTE_TYPE_HUGEPAGE))
 
-#define __pgprot_modify(prot,mask,bits)         \
-        __pgprot((pgprot_val(prot) & ~(mask)) | (bits))
-
 #define __HAVE_ARCH_PTE_SPECIAL
 
 /*
@@ -264,7 +267,8 @@ static inline pmd_t *pmd_offset(pud_t *pud, unsigned long addr)
 
 static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
 {
-        const pteval_t mask = PTE_USER | PTE_PXN | PTE_UXN | PTE_RDONLY;
+        const pteval_t mask = PTE_USER | PTE_PXN | PTE_UXN | PTE_RDONLY |
+                              PTE_PROT_NONE | PTE_VALID;
         pte_val(pte) = (pte_val(pte) & ~mask) | (pgprot_val(newprot) & mask);
         return pte;
 }
diff --git a/arch/arm64/include/asm/unistd32.h b/arch/arm64/include/asm/unistd32.h
index 58432625fdb3..5ef47ba3ed45 100644
--- a/arch/arm64/include/asm/unistd32.h
+++ b/arch/arm64/include/asm/unistd32.h
@@ -395,8 +395,13 @@ __SYSCALL(370, sys_name_to_handle_at)
 __SYSCALL(371, compat_sys_open_by_handle_at)
 __SYSCALL(372, compat_sys_clock_adjtime)
 __SYSCALL(373, sys_syncfs)
+__SYSCALL(374, compat_sys_sendmmsg)
+__SYSCALL(375, sys_setns)
+__SYSCALL(376, compat_sys_process_vm_readv)
+__SYSCALL(377, compat_sys_process_vm_writev)
+__SYSCALL(378, sys_ni_syscall)                  /* 378 for kcmp */
 
-#define __NR_compat_syscalls            374
+#define __NR_compat_syscalls            379
 
 /*
  * Compat syscall numbers used by the AArch64 kernel.
diff --git a/arch/arm64/kernel/vdso.c b/arch/arm64/kernel/vdso.c
index c958cb84d75f..6a389dc1bd49 100644
--- a/arch/arm64/kernel/vdso.c
+++ b/arch/arm64/kernel/vdso.c
@@ -252,10 +252,6 @@ void update_vsyscall(struct timekeeper *tk)
 
 void update_vsyscall_tz(void)
 {
-        ++vdso_data->tb_seq_count;
-        smp_wmb();
         vdso_data->tz_minuteswest       = sys_tz.tz_minuteswest;
         vdso_data->tz_dsttime           = sys_tz.tz_dsttime;
-        smp_wmb();
-        ++vdso_data->tb_seq_count;
 }
diff --git a/arch/arm64/kernel/vdso/gettimeofday.S b/arch/arm64/kernel/vdso/gettimeofday.S
index 8bf658d974f9..f0a6d10b5211 100644
--- a/arch/arm64/kernel/vdso/gettimeofday.S
+++ b/arch/arm64/kernel/vdso/gettimeofday.S
@@ -73,8 +73,6 @@ ENTRY(__kernel_gettimeofday)
         /* If tz is NULL, return 0. */
         cbz     x1, 3f
         ldp     w4, w5, [vdso_data, #VDSO_TZ_MINWEST]
-        seqcnt_read w9
-        seqcnt_check w9, 1b
         stp     w4, w5, [x1, #TZ_MINWEST]
 3:
         mov     x0, xzr
diff --git a/arch/mn10300/Kconfig b/arch/mn10300/Kconfig
index aa03f2e13385..e70001cfa05b 100644
--- a/arch/mn10300/Kconfig
+++ b/arch/mn10300/Kconfig
@@ -6,6 +6,7 @@ config MN10300
         select ARCH_WANT_IPC_PARSE_VERSION
         select HAVE_ARCH_TRACEHOOK
         select HAVE_ARCH_KGDB
+        select GENERIC_ATOMIC64
         select HAVE_NMI_WATCHDOG if MN10300_WD_TIMER
         select GENERIC_CLOCKEVENTS
         select MODULES_USE_ELF_RELA
diff --git a/arch/powerpc/include/uapi/asm/kvm_para.h b/arch/powerpc/include/uapi/asm/kvm_para.h
index ed0e0254b47f..e3af3286a068 100644
--- a/arch/powerpc/include/uapi/asm/kvm_para.h
+++ b/arch/powerpc/include/uapi/asm/kvm_para.h
@@ -78,7 +78,7 @@ struct kvm_vcpu_arch_shared {
 
 #define KVM_HCALL_TOKEN(num)     _EV_HCALL_TOKEN(EV_KVM_VENDOR_ID, num)
 
-#include <uapi/asm/epapr_hcalls.h>
+#include <asm/epapr_hcalls.h>
 
 #define KVM_FEATURE_MAGIC_PAGE  1
 
diff --git a/arch/powerpc/kvm/book3s_hv_ras.c b/arch/powerpc/kvm/book3s_hv_ras.c
index 35f3cf0269b3..a353c485808c 100644
--- a/arch/powerpc/kvm/book3s_hv_ras.c
+++ b/arch/powerpc/kvm/book3s_hv_ras.c
@@ -79,7 +79,9 @@ static void flush_tlb_power7(struct kvm_vcpu *vcpu)
 static long kvmppc_realmode_mc_power7(struct kvm_vcpu *vcpu)
 {
         unsigned long srr1 = vcpu->arch.shregs.msr;
+#ifdef CONFIG_PPC_POWERNV
         struct opal_machine_check_event *opal_evt;
+#endif
         long handled = 1;
 
         if (srr1 & SRR1_MC_LDSTERR) {
@@ -117,6 +119,7 @@ static long kvmppc_realmode_mc_power7(struct kvm_vcpu *vcpu)
                 handled = 0;
         }
 
+#ifdef CONFIG_PPC_POWERNV
         /*
          * See if OPAL has already handled the condition.
          * We assume that if the condition is recovered then OPAL
@@ -131,6 +134,7 @@ static long kvmppc_realmode_mc_power7(struct kvm_vcpu *vcpu)
 
         if (handled)
                 opal_evt->in_use = 0;
+#endif
 
         return handled;
 }
diff --git a/arch/s390/Makefile b/arch/s390/Makefile
index 4b8e08b56f49..7e3ce78d4290 100644
--- a/arch/s390/Makefile
+++ b/arch/s390/Makefile
@@ -24,8 +24,8 @@ CHECKFLAGS	+= -D__s390__ -msize-long
 else
 LD_BFD          := elf64-s390
 LDFLAGS         := -m elf64_s390
-KBUILD_AFLAGS_MODULE += -fpic -D__PIC__
-KBUILD_CFLAGS_MODULE += -fpic -D__PIC__
+KBUILD_AFLAGS_MODULE += -fPIC
+KBUILD_CFLAGS_MODULE += -fPIC
 KBUILD_CFLAGS   += -m64
 KBUILD_AFLAGS   += -m64
 UTS_MACHINE     := s390x
diff --git a/arch/s390/include/asm/dma.h b/arch/s390/include/asm/dma.h
index de015d85e3e5..bb9bdcd20864 100644
--- a/arch/s390/include/asm/dma.h
+++ b/arch/s390/include/asm/dma.h
@@ -10,4 +10,10 @@
  */
 #define MAX_DMA_ADDRESS         0x80000000
 
+#ifdef CONFIG_PCI
+extern int isa_dma_bridge_buggy;
+#else
+#define isa_dma_bridge_buggy    (0)
+#endif
+
 #endif /* _ASM_S390_DMA_H */
diff --git a/arch/s390/include/asm/io.h b/arch/s390/include/asm/io.h
index 16c3eb164f4f..27cb32185ce1 100644
--- a/arch/s390/include/asm/io.h
+++ b/arch/s390/include/asm/io.h
@@ -85,6 +85,11 @@ static inline void iounmap(volatile void __iomem *addr)
 #define __raw_writel    zpci_write_u32
 #define __raw_writeq    zpci_write_u64
 
+#define readb_relaxed   readb
+#define readw_relaxed   readw
+#define readl_relaxed   readl
+#define readq_relaxed   readq
+
 #endif /* CONFIG_PCI */
 
 #include <asm-generic/io.h>
diff --git a/arch/s390/include/asm/irq.h b/arch/s390/include/asm/irq.h
index e6972f85d2b0..7def77302d63 100644
--- a/arch/s390/include/asm/irq.h
+++ b/arch/s390/include/asm/irq.h
@@ -2,43 +2,61 @@
 #define _ASM_IRQ_H
 
 #include <linux/hardirq.h>
+#include <linux/percpu.h>
+#include <linux/cache.h>
 #include <linux/types.h>
 
-enum interruption_class {
+enum interruption_main_class {
         EXTERNAL_INTERRUPT,
         IO_INTERRUPT,
-        EXTINT_CLK,
-        EXTINT_EXC,
-        EXTINT_EMS,
-        EXTINT_TMR,
-        EXTINT_TLA,
-        EXTINT_PFL,
-        EXTINT_DSD,
-        EXTINT_VRT,
-        EXTINT_SCP,
-        EXTINT_IUC,
-        EXTINT_CMS,
-        EXTINT_CMC,
-        EXTINT_CMR,
-        IOINT_CIO,
-        IOINT_QAI,
-        IOINT_DAS,
-        IOINT_C15,
-        IOINT_C70,
-        IOINT_TAP,
-        IOINT_VMR,
-        IOINT_LCS,
-        IOINT_CLW,
-        IOINT_CTC,
-        IOINT_APB,
-        IOINT_ADM,
-        IOINT_CSC,
-        IOINT_PCI,
-        IOINT_MSI,
+        NR_IRQS
+};
+
+enum interruption_class {
+        IRQEXT_CLK,
+        IRQEXT_EXC,
+        IRQEXT_EMS,
+        IRQEXT_TMR,
+        IRQEXT_TLA,
+        IRQEXT_PFL,
+        IRQEXT_DSD,
+        IRQEXT_VRT,
+        IRQEXT_SCP,
+        IRQEXT_IUC,
+        IRQEXT_CMS,
+        IRQEXT_CMC,
+        IRQEXT_CMR,
+        IRQIO_CIO,
+        IRQIO_QAI,
+        IRQIO_DAS,
+        IRQIO_C15,
+        IRQIO_C70,
+        IRQIO_TAP,
+        IRQIO_VMR,
+        IRQIO_LCS,
+        IRQIO_CLW,
+        IRQIO_CTC,
+        IRQIO_APB,
+        IRQIO_ADM,
+        IRQIO_CSC,
+        IRQIO_PCI,
+        IRQIO_MSI,
         NMI_NMI,
-        NR_IRQS,
+        CPU_RST,
+        NR_ARCH_IRQS
 };
 
+struct irq_stat {
+        unsigned int irqs[NR_ARCH_IRQS];
+};
+
+DECLARE_PER_CPU_SHARED_ALIGNED(struct irq_stat, irq_stat);
+
+static __always_inline void inc_irq_stat(enum interruption_class irq)
+{
+        __get_cpu_var(irq_stat).irqs[irq]++;
+}
+
 struct ext_code {
         unsigned short subcode;
         unsigned short code;
diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h
index c928dc1938f2..c1d7930a82f4 100644
--- a/arch/s390/include/asm/pgtable.h
+++ b/arch/s390/include/asm/pgtable.h
@@ -1387,10 +1387,7 @@ static inline int has_transparent_hugepage(void)
 
 static inline unsigned long pmd_pfn(pmd_t pmd)
 {
-        if (pmd_trans_huge(pmd))
-                return pmd_val(pmd) >> HPAGE_SHIFT;
-        else
-                return pmd_val(pmd) >> PAGE_SHIFT;
+        return pmd_val(pmd) >> PAGE_SHIFT;
 }
 #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
 
diff --git a/arch/s390/include/asm/timex.h b/arch/s390/include/asm/timex.h
index fba4d66788a2..4c060bb5b8ea 100644
--- a/arch/s390/include/asm/timex.h
+++ b/arch/s390/include/asm/timex.h
@@ -128,4 +128,32 @@ static inline unsigned long long get_clock_monotonic(void)
         return get_clock_xt() - sched_clock_base_cc;
 }
 
+/**
+ * tod_to_ns - convert a TOD format value to nanoseconds
+ * @todval: to be converted TOD format value
+ * Returns: number of nanoseconds that correspond to the TOD format value
+ *
+ * Converting a 64 Bit TOD format value to nanoseconds means that the value
+ * must be divided by 4.096. In order to achieve that we multiply with 125
+ * and divide by 512:
+ *
+ *    ns = (todval * 125) >> 9;
+ *
+ * In order to avoid an overflow with the multiplication we can rewrite this.
+ * With a split todval == 2^32 * th + tl (th upper 32 bits, tl lower 32 bits)
+ * we end up with
+ *
+ *    ns = ((2^32 * th + tl) * 125 ) >> 9;
+ * -> ns = (2^23 * th * 125) + ((tl * 125) >> 9);
+ *
+ */
+static inline unsigned long long tod_to_ns(unsigned long long todval)
+{
+        unsigned long long ns;
+
+        ns = ((todval >> 32) << 23) * 125;
+        ns += ((todval & 0xffffffff) * 125) >> 9;
+        return ns;
+}
+
 #endif
diff --git a/arch/s390/include/uapi/asm/unistd.h b/arch/s390/include/uapi/asm/unistd.h
index 63e6078699f1..864f693c237f 100644
--- a/arch/s390/include/uapi/asm/unistd.h
+++ b/arch/s390/include/uapi/asm/unistd.h
@@ -279,7 +279,8 @@
 #define __NR_process_vm_writev  341
 #define __NR_s390_runtime_instr 342
 #define __NR_kcmp               343
-#define NR_syscalls 344
+#define __NR_finit_module       344
+#define NR_syscalls 345
 
 /* 
  * There are some system calls that are not present on 64 bit, some
diff --git a/arch/s390/kernel/compat_wrapper.S b/arch/s390/kernel/compat_wrapper.S
index 827e094a2f49..9b9a805656b5 100644
--- a/arch/s390/kernel/compat_wrapper.S
+++ b/arch/s390/kernel/compat_wrapper.S
@@ -1659,3 +1659,9 @@ ENTRY(sys_kcmp_wrapper)
         llgfr   %r5,%r5                 # unsigned long
         llgfr   %r6,%r6                 # unsigned long
         jg      sys_kcmp
+
+ENTRY(sys_finit_module_wrapper)
+        lgfr    %r2,%r2                 # int
+        llgtr   %r3,%r3                 # const char __user *
+        lgfr    %r4,%r4                 # int
+        jg      sys_finit_module
diff --git a/arch/s390/kernel/debug.c b/arch/s390/kernel/debug.c
index ba500d8dc392..4e8215e0d4b6 100644
--- a/arch/s390/kernel/debug.c
+++ b/arch/s390/kernel/debug.c
@@ -1127,13 +1127,14 @@ debug_register_view(debug_info_t * id, struct debug_view *view)
         if (i == DEBUG_MAX_VIEWS) {
                 pr_err("Registering view %s/%s would exceed the maximum "
                        "number of views %i\n", id->name, view->name, i);
-                debugfs_remove(pde);
                 rc = -1;
         } else {
                 id->views[i] = view;
                 id->debugfs_entries[i] = pde;
         }
         spin_unlock_irqrestore(&id->lock, flags);
+        if (rc)
+                debugfs_remove(pde);
 out:
         return rc;
 }
@@ -1146,9 +1147,9 @@ EXPORT_SYMBOL(debug_register_view);
 int
 debug_unregister_view(debug_info_t * id, struct debug_view *view)
 {
-        int rc = 0;
-        int i;
+        struct dentry *dentry = NULL;
         unsigned long flags;
+        int i, rc = 0;
 
         if (!id)
                 goto out;
@@ -1160,10 +1161,12 @@ debug_unregister_view(debug_info_t * id, struct debug_view *view)
         if (i == DEBUG_MAX_VIEWS)
                 rc = -1;
         else {
-                debugfs_remove(id->debugfs_entries[i]);
+                dentry = id->debugfs_entries[i];
                 id->views[i] = NULL;
+                id->debugfs_entries[i] = NULL;
         }
         spin_unlock_irqrestore(&id->lock, flags);
+        debugfs_remove(dentry);
 out:
         return rc;
 }
diff --git a/arch/s390/kernel/irq.c b/arch/s390/kernel/irq.c
index bf24293970ce..9df824ea1667 100644
--- a/arch/s390/kernel/irq.c
+++ b/arch/s390/kernel/irq.c
@@ -24,43 +24,65 @@
 #include <asm/irq.h>
 #include "entry.h"
 
+DEFINE_PER_CPU_SHARED_ALIGNED(struct irq_stat, irq_stat);
+EXPORT_PER_CPU_SYMBOL_GPL(irq_stat);
+
 struct irq_class {
         char *name;
         char *desc;
 };
 
-static const struct irq_class intrclass_names[] = {
+/*
+ * The list of "main" irq classes on s390. This is the list of interrrupts
+ * that appear both in /proc/stat ("intr" line) and /proc/interrupts.
+ * Historically only external and I/O interrupts have been part of /proc/stat.
+ * We can't add the split external and I/O sub classes since the first field
+ * in the "intr" line in /proc/stat is supposed to be the sum of all other
+ * fields.
+ * Since the external and I/O interrupt fields are already sums we would end
+ * up with having a sum which accounts each interrupt twice.
+ */
+static const struct irq_class irqclass_main_desc[NR_IRQS] = {
         [EXTERNAL_INTERRUPT] = {.name = "EXT"},
-        [IO_INTERRUPT]       = {.name = "I/O"},
-        [EXTINT_CLK] = {.name = "CLK", .desc = "[EXT] Clock Comparator"},
-        [EXTINT_EXC] = {.name = "EXC", .desc = "[EXT] External Call"},
-        [EXTINT_EMS] = {.name = "EMS", .desc = "[EXT] Emergency Signal"},
-        [EXTINT_TMR] = {.name = "TMR", .desc = "[EXT] CPU Timer"},
-        [EXTINT_TLA] = {.name = "TAL", .desc = "[EXT] Timing Alert"},
-        [EXTINT_PFL] = {.name = "PFL", .desc = "[EXT] Pseudo Page Fault"},
-        [EXTINT_DSD] = {.name = "DSD", .desc = "[EXT] DASD Diag"},
-        [EXTINT_VRT] = {.name = "VRT", .desc = "[EXT] Virtio"},
-        [EXTINT_SCP] = {.name = "SCP", .desc = "[EXT] Service Call"},
-        [EXTINT_IUC] = {.name = "IUC", .desc = "[EXT] IUCV"},
-        [EXTINT_CMS] = {.name = "CMS", .desc = "[EXT] CPU-Measurement: Sampling"},
-        [EXTINT_CMC] = {.name = "CMC", .desc = "[EXT] CPU-Measurement: Counter"},
-        [EXTINT_CMR] = {.name = "CMR", .desc = "[EXT] CPU-Measurement: RI"},
-        [IOINT_CIO]  = {.name = "CIO", .desc = "[I/O] Common I/O Layer Interrupt"},
-        [IOINT_QAI]  = {.name = "QAI", .desc = "[I/O] QDIO Adapter Interrupt"},
-        [IOINT_DAS]  = {.name = "DAS", .desc = "[I/O] DASD"},
-        [IOINT_C15]  = {.name = "C15", .desc = "[I/O] 3215"},
-        [IOINT_C70]  = {.name = "C70", .desc = "[I/O] 3270"},
-        [IOINT_TAP]  = {.name = "TAP", .desc = "[I/O] Tape"},
-        [IOINT_VMR]  = {.name = "VMR", .desc = "[I/O] Unit Record Devices"},
-        [IOINT_LCS]  = {.name = "LCS", .desc = "[I/O] LCS"},
-        [IOINT_CLW]  = {.name = "CLW", .desc = "[I/O] CLAW"},
-        [IOINT_CTC]  = {.name = "CTC", .desc = "[I/O] CTC"},
-        [IOINT_APB]  = {.name = "APB", .desc = "[I/O] AP Bus"},
-        [IOINT_ADM]  = {.name = "ADM", .desc = "[I/O] EADM Subchannel"},
-        [IOINT_CSC]  = {.name = "CSC", .desc = "[I/O] CHSC Subchannel"},
-        [IOINT_PCI]  = {.name = "PCI", .desc = "[I/O] PCI Interrupt" },
-        [IOINT_MSI] =  {.name = "MSI", .desc = "[I/O] MSI Interrupt" },
+        [IO_INTERRUPT]       = {.name = "I/O"}
+};
+
+/*
+ * The list of split external and I/O interrupts that appear only in
+ * /proc/interrupts.
+ * In addition this list contains non external / I/O events like NMIs.
+ */
+static const struct irq_class irqclass_sub_desc[NR_ARCH_IRQS] = {
+        [IRQEXT_CLK] = {.name = "CLK", .desc = "[EXT] Clock Comparator"},
+        [IRQEXT_EXC] = {.name = "EXC", .desc = "[EXT] External Call"},
+        [IRQEXT_EMS] = {.name = "EMS", .desc = "[EXT] Emergency Signal"},
+        [IRQEXT_TMR] = {.name = "TMR", .desc = "[EXT] CPU Timer"},
+        [IRQEXT_TLA] = {.name = "TAL", .desc = "[EXT] Timing Alert"},
+        [IRQEXT_PFL] = {.name = "PFL", .desc = "[EXT] Pseudo Page Fault"},
+        [IRQEXT_DSD] = {.name = "DSD", .desc = "[EXT] DASD Diag"},
+        [IRQEXT_VRT] = {.name = "VRT", .desc = "[EXT] Virtio"},
+        [IRQEXT_SCP] = {.name = "SCP", .desc = "[EXT] Service Call"},
+        [IRQEXT_IUC] = {.name = "IUC", .desc = "[EXT] IUCV"},
+        [IRQEXT_CMS] = {.name = "CMS", .desc = "[EXT] CPU-Measurement: Sampling"},
+        [IRQEXT_CMC] = {.name = "CMC", .desc = "[EXT] CPU-Measurement: Counter"},
+        [IRQEXT_CMR] = {.name = "CMR", .desc = "[EXT] CPU-Measurement: RI"},
+        [IRQIO_CIO]  = {.name = "CIO", .desc = "[I/O] Common I/O Layer Interrupt"},
+        [IRQIO_QAI]  = {.name = "QAI", .desc = "[I/O] QDIO Adapter Interrupt"},
+        [IRQIO_DAS]  = {.name = "DAS", .desc = "[I/O] DASD"},
+        [IRQIO_C15]  = {.name = "C15", .desc = "[I/O] 3215"},
+        [IRQIO_C70]  = {.name = "C70", .desc = "[I/O] 3270"},
+        [IRQIO_TAP]  = {.name = "TAP", .desc = "[I/O] Tape"},
+        [IRQIO_VMR]  = {.name = "VMR", .desc = "[I/O] Unit Record Devices"},
+        [IRQIO_LCS]  = {.name = "LCS", .desc = "[I/O] LCS"},
+        [IRQIO_CLW]  = {.name = "CLW", .desc = "[I/O] CLAW"},
+        [IRQIO_CTC]  = {.name = "CTC", .desc = "[I/O] CTC"},
+        [IRQIO_APB]  = {.name = "APB", .desc = "[I/O] AP Bus"},
+        [IRQIO_ADM]  = {.name = "ADM", .desc = "[I/O] EADM Subchannel"},
+        [IRQIO_CSC]  = {.name = "CSC", .desc = "[I/O] CHSC Subchannel"},
+        [IRQIO_PCI]  = {.name = "PCI", .desc = "[I/O] PCI Interrupt" },
+        [IRQIO_MSI]  = {.name = "MSI", .desc = "[I/O] MSI Interrupt" },
         [NMI_NMI]    = {.name = "NMI", .desc = "[NMI] Machine Check"},
+        [CPU_RST]    = {.name = "RST", .desc = "[CPU] CPU Restart"},
 };
 
 /*
@@ -68,30 +90,34 @@ static const struct irq_class intrclass_names[] = {
  */
 int show_interrupts(struct seq_file *p, void *v)
 {
-        int i = *(loff_t *) v, j;
+        int irq = *(loff_t *) v;
+        int cpu;
 
         get_online_cpus();
-        if (i == 0) {
+        if (irq == 0) {
                 seq_puts(p, "           ");
-                for_each_online_cpu(j)
-                        seq_printf(p, "CPU%d       ",j);
+                for_each_online_cpu(cpu)
+                        seq_printf(p, "CPU%d       ", cpu);
                 seq_putc(p, '\n');
         }
-
-        if (i < NR_IRQS) {
-                seq_printf(p, "%s: ", intrclass_names[i].name);
-#ifndef CONFIG_SMP
-                seq_printf(p, "%10u ", kstat_irqs(i));
-#else
-                for_each_online_cpu(j)
-                        seq_printf(p, "%10u ", kstat_cpu(j).irqs[i]);
-#endif
-                if (intrclass_names[i].desc)
-                        seq_printf(p, "  %s", intrclass_names[i].desc);
-                seq_putc(p, '\n');
-        }
+        if (irq < NR_IRQS) {
+                seq_printf(p, "%s: ", irqclass_main_desc[irq].name);
+                for_each_online_cpu(cpu)
+                        seq_printf(p, "%10u ", kstat_cpu(cpu).irqs[irq]);
+                seq_putc(p, '\n');
+                goto skip_arch_irqs;
+        }
+        for (irq = 0; irq < NR_ARCH_IRQS; irq++) {
+                seq_printf(p, "%s: ", irqclass_sub_desc[irq].name);
+                for_each_online_cpu(cpu)
+                        seq_printf(p, "%10u ", per_cpu(irq_stat, cpu).irqs[irq]);
+                if (irqclass_sub_desc[irq].desc)
+                        seq_printf(p, "  %s", irqclass_sub_desc[irq].desc);
+                seq_putc(p, '\n');
+        }
+skip_arch_irqs:
         put_online_cpus();
-        return 0;
+        return 0;
 }
 
 /*
@@ -222,7 +248,7 @@ void __irq_entry do_extint(struct pt_regs *regs, struct ext_code ext_code,
                 /* Serve timer interrupts first. */
                 clock_comparator_work();
         }
-        kstat_cpu(smp_processor_id()).irqs[EXTERNAL_INTERRUPT]++;
+        kstat_incr_irqs_this_cpu(EXTERNAL_INTERRUPT, NULL);
         if (ext_code.code != 0x1004)
                 __get_cpu_var(s390_idle).nohz_delay = 1;
 
diff --git a/arch/s390/kernel/nmi.c b/arch/s390/kernel/nmi.c
index a6daa5c5cdb0..7918fbea36bb 100644
--- a/arch/s390/kernel/nmi.c
+++ b/arch/s390/kernel/nmi.c
@@ -254,7 +254,7 @@ void notrace s390_do_machine_check(struct pt_regs *regs)
         int umode;
 
         nmi_enter();
-        kstat_cpu(smp_processor_id()).irqs[NMI_NMI]++;
+        inc_irq_stat(NMI_NMI);
         mci = (struct mci *) &S390_lowcore.mcck_interruption_code;
         mcck = &__get_cpu_var(cpu_mcck);
         umode = user_mode(regs);
diff --git a/arch/s390/kernel/perf_cpum_cf.c b/arch/s390/kernel/perf_cpum_cf.c
index c4e7269d4a09..86ec7447e1f5 100644
--- a/arch/s390/kernel/perf_cpum_cf.c
+++ b/arch/s390/kernel/perf_cpum_cf.c
@@ -229,7 +229,7 @@ static void cpumf_measurement_alert(struct ext_code ext_code,
         if (!(alert & CPU_MF_INT_CF_MASK))
                 return;
 
-        kstat_cpu(smp_processor_id()).irqs[EXTINT_CMC]++;
+        inc_irq_stat(IRQEXT_CMC);
         cpuhw = &__get_cpu_var(cpu_hw_events);
 
         /* Measurement alerts are shared and might happen when the PMU
diff --git a/arch/s390/kernel/runtime_instr.c b/arch/s390/kernel/runtime_instr.c
index 61066f6f71a5..077a99389b07 100644
--- a/arch/s390/kernel/runtime_instr.c
+++ b/arch/s390/kernel/runtime_instr.c
@@ -71,7 +71,7 @@ static void runtime_instr_int_handler(struct ext_code ext_code,
         if (!(param32 & CPU_MF_INT_RI_MASK))
                 return;
 
-        kstat_cpu(smp_processor_id()).irqs[EXTINT_CMR]++;
+        inc_irq_stat(IRQEXT_CMR);
 
         if (!current->thread.ri_cb)
                 return;
diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c
index 2568590973ad..a5360de85ec7 100644
--- a/arch/s390/kernel/setup.c
+++ b/arch/s390/kernel/setup.c
@@ -16,7 +16,7 @@
 #define pr_fmt(fmt) KMSG_COMPONENT ": " fmt
 
 #include <linux/errno.h>
-#include <linux/module.h>
+#include <linux/export.h>
 #include <linux/sched.h>
 #include <linux/kernel.h>
 #include <linux/memblock.h>
@@ -289,6 +289,7 @@ void machine_power_off(void)
  * Dummy power off function.
  */
 void (*pm_power_off)(void) = machine_power_off;
+EXPORT_SYMBOL_GPL(pm_power_off);
 
 static int __init early_parse_mem(char *p)
 {
diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c
index 0b45baa55438..7433a2f9e5cc 100644
--- a/arch/s390/kernel/smp.c
+++ b/arch/s390/kernel/smp.c
@@ -433,9 +433,9 @@ static void do_ext_call_interrupt(struct ext_code ext_code,
 
         cpu = smp_processor_id();
         if (ext_code.code == 0x1202)
-                kstat_cpu(cpu).irqs[EXTINT_EXC]++;
+                inc_irq_stat(IRQEXT_EXC);
         else
-                kstat_cpu(cpu).irqs[EXTINT_EMS]++;
+                inc_irq_stat(IRQEXT_EMS);
         /*
          * handle bit signal external calls
          */
@@ -623,9 +623,10 @@ static struct sclp_cpu_info *smp_get_cpu_info(void)
         return info;
 }
 
-static int smp_add_present_cpu(int cpu);
+static int __cpuinit smp_add_present_cpu(int cpu);
 
-static int __smp_rescan_cpus(struct sclp_cpu_info *info, int sysfs_add)
+static int __cpuinit __smp_rescan_cpus(struct sclp_cpu_info *info,
+                                       int sysfs_add)
 {
         struct pcpu *pcpu;
         cpumask_t avail;
@@ -708,6 +709,7 @@ static void __cpuinit smp_start_secondary(void *cpuvoid)
         pfault_init();
         notify_cpu_starting(smp_processor_id());
         set_cpu_online(smp_processor_id(), true);
+        inc_irq_stat(CPU_RST);
         local_irq_enable();
         /* cpu_idle will call schedule for us */
         cpu_idle();
@@ -985,7 +987,7 @@ static int __cpuinit smp_cpu_notify(struct notifier_block *self,
         return notifier_from_errno(err);
 }
 
-static int smp_add_present_cpu(int cpu)
+static int __cpuinit smp_add_present_cpu(int cpu)
 {
         struct cpu *c = &pcpu_devices[cpu].cpu;
         struct device *s = &c->dev;
diff --git a/arch/s390/kernel/syscalls.S b/arch/s390/kernel/syscalls.S
index 48174850f3b0..6a6c61f94dd3 100644
--- a/arch/s390/kernel/syscalls.S
+++ b/arch/s390/kernel/syscalls.S
@@ -352,3 +352,4 @@ SYSCALL(sys_process_vm_readv,sys_process_vm_readv,compat_sys_process_vm_readv_wr
 SYSCALL(sys_process_vm_writev,sys_process_vm_writev,compat_sys_process_vm_writev_wrapper)
 SYSCALL(sys_ni_syscall,sys_s390_runtime_instr,sys_s390_runtime_instr_wrapper)
 SYSCALL(sys_kcmp,sys_kcmp,sys_kcmp_wrapper)
+SYSCALL(sys_finit_module,sys_finit_module,sys_finit_module_wrapper)
diff --git a/arch/s390/kernel/time.c b/arch/s390/kernel/time.c
index 7fcd690d42c7..a5f4f5a1d24b 100644
--- a/arch/s390/kernel/time.c
+++ b/arch/s390/kernel/time.c
@@ -63,7 +63,7 @@ static DEFINE_PER_CPU(struct clock_event_device, comparators);
  */
 unsigned long long notrace __kprobes sched_clock(void)
 {
-        return (get_clock_monotonic() * 125) >> 9;
+        return tod_to_ns(get_clock_monotonic());
 }
 
 /*
@@ -168,7 +168,7 @@ static void clock_comparator_interrupt(struct ext_code ext_code,
                                        unsigned int param32,
                                        unsigned long param64)
 {
-        kstat_cpu(smp_processor_id()).irqs[EXTINT_CLK]++;
+        inc_irq_stat(IRQEXT_CLK);
         if (S390_lowcore.clock_comparator == -1ULL)
                 set_clock_comparator(S390_lowcore.clock_comparator);
 }
@@ -179,7 +179,7 @@ static void stp_timing_alert(struct stp_irq_parm *);
 static void timing_alert_interrupt(struct ext_code ext_code,
                                    unsigned int param32, unsigned long param64)
 {
-        kstat_cpu(smp_processor_id()).irqs[EXTINT_TLA]++;
+        inc_irq_stat(IRQEXT_TLA);
         if (param32 & 0x00c40000)
                 etr_timing_alert((struct etr_irq_parm *) &param32);
         if (param32 & 0x00038000)
diff --git a/arch/s390/kernel/topology.c b/arch/s390/kernel/topology.c
index f1aba87cceb8..4b2e3e317004 100644
--- a/arch/s390/kernel/topology.c
+++ b/arch/s390/kernel/topology.c
@@ -10,6 +10,7 @@
 #include <linux/bootmem.h>
 #include <linux/cpuset.h>
 #include <linux/device.h>
+#include <linux/export.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
 #include <linux/init.h>
@@ -42,6 +43,7 @@ static struct mask_info socket_info;
 static struct mask_info book_info;
 
 struct cpu_topology_s390 cpu_topology[NR_CPUS];
+EXPORT_SYMBOL_GPL(cpu_topology);
 
 static cpumask_t cpu_group_map(struct mask_info *info, unsigned int cpu)
 {
diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
index c30615e605ac..82c481ddef76 100644
--- a/arch/s390/kvm/interrupt.c
+++ b/arch/s390/kvm/interrupt.c
@@ -408,7 +408,7 @@ int kvm_s390_handle_wait(struct kvm_vcpu *vcpu)
                 return 0;
         }
 
-        sltime = ((vcpu->arch.sie_block->ckc - now)*125)>>9;
+        sltime = tod_to_ns(vcpu->arch.sie_block->ckc - now);
 
         hrtimer_start(&vcpu->arch.ckc_timer, ktime_set (0, sltime) , HRTIMER_MODE_REL);
         VCPU_EVENT(vcpu, 5, "enabled wait via clock comparator: %llx ns", sltime);
diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
index c9011bfaabbe..f090e819bf71 100644
--- a/arch/s390/kvm/kvm-s390.c
+++ b/arch/s390/kvm/kvm-s390.c
@@ -613,7 +613,9 @@ static int __vcpu_run(struct kvm_vcpu *vcpu)
                 kvm_s390_deliver_pending_interrupts(vcpu);
 
         vcpu->arch.sie_block->icptcode = 0;
+        preempt_disable();
         kvm_guest_enter();
+        preempt_enable();
         VCPU_EVENT(vcpu, 6, "entering sie flags %x",
                    atomic_read(&vcpu->arch.sie_block->cpuflags));
         trace_kvm_s390_sie_enter(vcpu,
diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c
index 42601d6e166f..2fb9e63b8fc4 100644
--- a/arch/s390/mm/fault.c
+++ b/arch/s390/mm/fault.c
@@ -569,7 +569,7 @@ static void pfault_interrupt(struct ext_code ext_code,
         subcode = ext_code.subcode;
         if ((subcode & 0xff00) != __SUBCODE_MASK)
                 return;
-        kstat_cpu(smp_processor_id()).irqs[EXTINT_PFL]++;
+        inc_irq_stat(IRQEXT_PFL);
         /* Get the token (= pid of the affected task). */
         pid = sizeof(void *) == 4 ? param32 : param64;
         rcu_read_lock();
diff --git a/arch/s390/oprofile/hwsampler.c b/arch/s390/oprofile/hwsampler.c
index 0cb385da202c..b5b2916895e0 100644
--- a/arch/s390/oprofile/hwsampler.c
+++ b/arch/s390/oprofile/hwsampler.c
@@ -233,7 +233,7 @@ static void hws_ext_handler(struct ext_code ext_code,
         if (!(param32 & CPU_MF_INT_SF_MASK))
                 return;
 
-        kstat_cpu(smp_processor_id()).irqs[EXTINT_CMS]++;
+        inc_irq_stat(IRQEXT_CMS);
         atomic_xchg(&cb->ext_params, atomic_read(&cb->ext_params) | param32);
 
         if (hws_wq)
diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c
index ff49427e9941..60e0372545d2 100644
--- a/arch/s390/pci/pci.c
+++ b/arch/s390/pci/pci.c
@@ -160,35 +160,6 @@ int pci_proc_domain(struct pci_bus *bus)
 }
 EXPORT_SYMBOL_GPL(pci_proc_domain);
 
-/* Store PCI function information block */
-static int zpci_store_fib(struct zpci_dev *zdev, u8 *fc)
-{
-        struct zpci_fib *fib;
-        u8 status, cc;
-
-        fib = (void *) get_zeroed_page(GFP_KERNEL);
-        if (!fib)
-                return -ENOMEM;
-
-        do {
-                cc = __stpcifc(zdev->fh, 0, fib, &status);
-                if (cc == 2) {
-                        msleep(ZPCI_INSN_BUSY_DELAY);
-                        memset(fib, 0, PAGE_SIZE);
-                }
-        } while (cc == 2);
-
-        if (cc)
-                pr_err_once("%s: cc: %u  status: %u\n",
-                            __func__, cc, status);
-
-        /* Return PCI function controls */
-        *fc = fib->fc;
-
-        free_page((unsigned long) fib);
-        return (cc) ? -EIO : 0;
-}
-
 /* Modify PCI: Register adapter interruptions */
 static int zpci_register_airq(struct zpci_dev *zdev, unsigned int aisb,
                               u64 aibv)
@@ -469,7 +440,7 @@ static void zpci_irq_handler(void *dont, void *need)
         int rescan = 0, max = aisb_max;
         struct zdev_irq_map *imap;
 
-        kstat_cpu(smp_processor_id()).irqs[IOINT_PCI]++;
+        inc_irq_stat(IRQIO_PCI);
         sbit = start;
 
 scan:
@@ -481,7 +452,7 @@ scan:
                 /* find vector bit */
                 imap = bucket->imap[sbit];
                 for_each_set_bit_left(mbit, &imap->aibv, imap->msi_vecs) {
-                        kstat_cpu(smp_processor_id()).irqs[IOINT_MSI]++;
+                        inc_irq_stat(IRQIO_MSI);
                         clear_bit(63 - mbit, &imap->aibv);
 
                         spin_lock(&imap->lock);
diff --git a/arch/s390/pci/pci_dma.c b/arch/s390/pci/pci_dma.c
index 6138468b420f..a547419907c3 100644
--- a/arch/s390/pci/pci_dma.c
+++ b/arch/s390/pci/pci_dma.c
@@ -13,8 +13,6 @@
 #include <linux/pci.h>
 #include <asm/pci_dma.h>
 
-static enum zpci_ioat_dtype zpci_ioat_dt = ZPCI_IOTA_RTTO;
-
 static struct kmem_cache *dma_region_table_cache;
 static struct kmem_cache *dma_page_table_cache;
 
diff --git a/arch/sh/boards/mach-ecovec24/setup.c b/arch/sh/boards/mach-ecovec24/setup.c
index 3fede4556c91..a0fa5791cd44 100644
--- a/arch/sh/boards/mach-ecovec24/setup.c
+++ b/arch/sh/boards/mach-ecovec24/setup.c
@@ -70,6 +70,16 @@
  *                                  OFF-ON : MMC
  */
 
+/*
+ * FSI - DA7210
+ *
+ * it needs amixer settings for playing
+ *
+ * amixer set 'HeadPhone' 80
+ * amixer set 'Out Mixer Left DAC Left' on
+ * amixer set 'Out Mixer Right DAC Right' on
+ */
+
 /* Heartbeat */
 static unsigned char led_pos[] = { 0, 1, 2, 3 };
 
diff --git a/arch/sh/include/asm/elf.h b/arch/sh/include/asm/elf.h
index 37924afa8d8a..bf9f44f17c29 100644
--- a/arch/sh/include/asm/elf.h
+++ b/arch/sh/include/asm/elf.h
@@ -203,9 +203,9 @@ extern void __kernel_vsyscall;
         if (vdso_enabled)                                       \
                 NEW_AUX_ENT(AT_SYSINFO_EHDR, VDSO_BASE);        \
         else                                                    \
-                NEW_AUX_ENT(AT_IGNORE, 0);
+                NEW_AUX_ENT(AT_IGNORE, 0)
 #else
-#define VSYSCALL_AUX_ENT
+#define VSYSCALL_AUX_ENT        NEW_AUX_ENT(AT_IGNORE, 0)
 #endif /* CONFIG_VSYSCALL */
 
 #ifdef CONFIG_SH_FPU
diff --git a/arch/sh/include/asm/processor_32.h b/arch/sh/include/asm/processor_32.h
index b1320d55ca30..e699a12cdcca 100644
--- a/arch/sh/include/asm/processor_32.h
+++ b/arch/sh/include/asm/processor_32.h
@@ -39,7 +39,7 @@
 /* This decides where the kernel will search for a free chunk of vm
  * space during mmap's.
  */
-#define TASK_UNMAPPED_BASE      (TASK_SIZE / 3)
+#define TASK_UNMAPPED_BASE      PAGE_ALIGN(TASK_SIZE / 3)
 
 /*
  * Bit of SR register
diff --git a/arch/sh/include/asm/processor_64.h b/arch/sh/include/asm/processor_64.h
index 1ee8946f0952..1cc7d3197143 100644
--- a/arch/sh/include/asm/processor_64.h
+++ b/arch/sh/include/asm/processor_64.h
@@ -47,7 +47,7 @@ pc; })
 /* This decides where the kernel will search for a free chunk of vm
  * space during mmap's.
  */
-#define TASK_UNMAPPED_BASE      (TASK_SIZE / 3)
+#define TASK_UNMAPPED_BASE      PAGE_ALIGN(TASK_SIZE / 3)
 
 /*
  * Bit of SR register
diff --git a/arch/sh/include/uapi/asm/unistd_32.h b/arch/sh/include/uapi/asm/unistd_32.h
index 9e465f246dc1..d13a1d623736 100644
--- a/arch/sh/include/uapi/asm/unistd_32.h
+++ b/arch/sh/include/uapi/asm/unistd_32.h
@@ -379,7 +379,8 @@
 #define __NR_process_vm_readv   365
 #define __NR_process_vm_writev  366
 #define __NR_kcmp               367
+#define __NR_finit_module       368
 
-#define NR_syscalls 368
+#define NR_syscalls 369
 
 #endif /* __ASM_SH_UNISTD_32_H */
diff --git a/arch/sh/include/uapi/asm/unistd_64.h b/arch/sh/include/uapi/asm/unistd_64.h
index 8e3a2edd284e..e6820c86e8c7 100644
--- a/arch/sh/include/uapi/asm/unistd_64.h
+++ b/arch/sh/include/uapi/asm/unistd_64.h
@@ -399,7 +399,8 @@
 #define __NR_process_vm_readv   376
 #define __NR_process_vm_writev  377
 #define __NR_kcmp               378
+#define __NR_finit_module       379
 
-#define NR_syscalls 379
+#define NR_syscalls 380
 
 #endif /* __ASM_SH_UNISTD_64_H */
diff --git a/arch/sh/kernel/syscalls_32.S b/arch/sh/kernel/syscalls_32.S
index fe97ae5e56f1..734234be2f01 100644
--- a/arch/sh/kernel/syscalls_32.S
+++ b/arch/sh/kernel/syscalls_32.S
@@ -385,3 +385,4 @@ ENTRY(sys_call_table)
         .long sys_process_vm_readv      /* 365 */
         .long sys_process_vm_writev
         .long sys_kcmp
+        .long sys_finit_module
diff --git a/arch/sh/kernel/syscalls_64.S b/arch/sh/kernel/syscalls_64.S
index 5c7b1c67bdc1..579fcb9a896b 100644
--- a/arch/sh/kernel/syscalls_64.S
+++ b/arch/sh/kernel/syscalls_64.S
@@ -405,3 +405,4 @@ sys_call_table:
         .long sys_process_vm_readv
         .long sys_process_vm_writev
         .long sys_kcmp
+        .long sys_finit_module
diff --git a/arch/sh/lib/mcount.S b/arch/sh/lib/mcount.S
index 60164e65d665..52aa2011d753 100644
--- a/arch/sh/lib/mcount.S
+++ b/arch/sh/lib/mcount.S
@@ -294,6 +294,8 @@ stack_panic:
         .align 2
 .L_init_thread_union:
         .long   init_thread_union
+.L_ebss:
+        .long   __bss_stop
 .Lpanic:
         .long   panic
 .Lpanic_s:
diff --git a/arch/sparc/include/uapi/asm/unistd.h b/arch/sparc/include/uapi/asm/unistd.h
index cac719d1bc5c..62ced589bcf7 100644
--- a/arch/sparc/include/uapi/asm/unistd.h
+++ b/arch/sparc/include/uapi/asm/unistd.h
@@ -407,8 +407,9 @@
 #define __NR_process_vm_writev  339
 #define __NR_kern_features      340
 #define __NR_kcmp               341
+#define __NR_finit_module       342
 
-#define NR_syscalls             342
+#define NR_syscalls             343
 
 /* Bitmask values returned from kern_features system call.  */
 #define KERN_FEATURE_MIXED_MODE_STACK   0x00000001
diff --git a/arch/sparc/kernel/pci.c b/arch/sparc/kernel/pci.c
index 04bacce76fe6..baf4366e2d6a 100644
--- a/arch/sparc/kernel/pci.c
+++ b/arch/sparc/kernel/pci.c
@@ -378,7 +378,8 @@ static void apb_calc_first_last(u8 map, u32 *first_p, u32 *last_p)
 /* Cook up fake bus resources for SUNW,simba PCI bridges which lack
  * a proper 'ranges' property.
  */
-static void apb_fake_ranges(struct pci_dev *dev, struct pci_bus *bus,
+static void apb_fake_ranges(struct pci_dev *dev,
+                            struct pci_bus *bus,
                             struct pci_pbm_info *pbm)
 {
         struct pci_bus_region region;
@@ -403,13 +404,15 @@ static void apb_fake_ranges(struct pci_dev *dev, struct pci_bus *bus,
         pcibios_bus_to_resource(dev, res, &region);
 }
 
-static void pci_of_scan_bus(struct pci_pbm_info *pbm, struct device_node *node,
+static void pci_of_scan_bus(struct pci_pbm_info *pbm,
+                            struct device_node *node,
                             struct pci_bus *bus);
 
 #define GET_64BIT(prop, i)      ((((u64) (prop)[(i)]) << 32) | (prop)[(i)+1])
 
 static void of_scan_pci_bridge(struct pci_pbm_info *pbm,
-                               struct device_node *node, struct pci_dev *dev)
+                               struct device_node *node,
+                               struct pci_dev *dev)
 {
         struct pci_bus *bus;
         const u32 *busrange, *ranges;
@@ -500,7 +503,8 @@ after_ranges:
         pci_of_scan_bus(pbm, node, bus);
 }
 
-static void pci_of_scan_bus(struct pci_pbm_info *pbm, struct device_node *node,
+static void pci_of_scan_bus(struct pci_pbm_info *pbm,
+                            struct device_node *node,
                             struct pci_bus *bus)
 {
         struct device_node *child;
diff --git a/arch/sparc/kernel/pci_psycho.c b/arch/sparc/kernel/pci_psycho.c
index b85238289717..c647634ead2b 100644
--- a/arch/sparc/kernel/pci_psycho.c
+++ b/arch/sparc/kernel/pci_psycho.c
@@ -366,7 +366,8 @@ static void pbm_config_busmastering(struct pci_pbm_info *pbm)
         pci_config_write8(addr, 64);
 }
 
-static void psycho_scan_bus(struct pci_pbm_info *pbm, struct device *parent)
+static void psycho_scan_bus(struct pci_pbm_info *pbm,
+                            struct device *parent)
 {
         pbm_config_busmastering(pbm);
         pbm->is_66mhz_capable = 0;
diff --git a/arch/sparc/kernel/pci_sabre.c b/arch/sparc/kernel/pci_sabre.c
index 531186d7c9ab..6f00d27e8dac 100644
--- a/arch/sparc/kernel/pci_sabre.c
+++ b/arch/sparc/kernel/pci_sabre.c
@@ -442,7 +442,8 @@ static void sabre_scan_bus(struct pci_pbm_info *pbm, struct device *parent)
         sabre_register_error_handlers(pbm);
 }
 
-static void sabre_pbm_init(struct pci_pbm_info *pbm, struct platform_device *op)
+static void sabre_pbm_init(struct pci_pbm_info *pbm,
+                           struct platform_device *op)
 {
         psycho_pbm_init_common(pbm, op, "SABRE", PBM_CHIP_TYPE_SABRE);
         pbm->pci_afsr = pbm->controller_regs + SABRE_PIOAFSR;
diff --git a/arch/sparc/kernel/pci_schizo.c b/arch/sparc/kernel/pci_schizo.c
index 29e888158ae6..8f76f23dac38 100644
--- a/arch/sparc/kernel/pci_schizo.c
+++ b/arch/sparc/kernel/pci_schizo.c
@@ -1306,8 +1306,9 @@ static void schizo_pbm_hw_init(struct pci_pbm_info *pbm)
         }
 }
 
-static int schizo_pbm_init(struct pci_pbm_info *pbm, struct platform_device *op,
-                           u32 portid, int chip_type)
+static int schizo_pbm_init(struct pci_pbm_info *pbm,
+                           struct platform_device *op, u32 portid,
+                           int chip_type)
 {
         const struct linux_prom64_registers *regs;
         struct device_node *dp = op->dev.of_node;
diff --git a/arch/sparc/kernel/systbls_32.S b/arch/sparc/kernel/systbls_32.S
index 5147f574f125..6ac43c36bbbf 100644
--- a/arch/sparc/kernel/systbls_32.S
+++ b/arch/sparc/kernel/systbls_32.S
@@ -85,4 +85,4 @@ sys_call_table:
 /*325*/ .long sys_pwritev, sys_rt_tgsigqueueinfo, sys_perf_event_open, sys_recvmmsg, sys_fanotify_init
 /*330*/ .long sys_fanotify_mark, sys_prlimit64, sys_name_to_handle_at, sys_open_by_handle_at, sys_clock_adjtime
 /*335*/ .long sys_syncfs, sys_sendmmsg, sys_setns, sys_process_vm_readv, sys_process_vm_writev
-/*340*/ .long sys_ni_syscall, sys_kcmp
+/*340*/ .long sys_ni_syscall, sys_kcmp, sys_finit_module
diff --git a/arch/sparc/kernel/systbls_64.S b/arch/sparc/kernel/systbls_64.S
index cdbd9b817751..1009ecb92678 100644
--- a/arch/sparc/kernel/systbls_64.S
+++ b/arch/sparc/kernel/systbls_64.S
@@ -86,7 +86,7 @@ sys_call_table32:
         .word compat_sys_pwritev, compat_sys_rt_tgsigqueueinfo, sys_perf_event_open, compat_sys_recvmmsg, sys_fanotify_init
 /*330*/ .word sys32_fanotify_mark, sys_prlimit64, sys_name_to_handle_at, compat_sys_open_by_handle_at, compat_sys_clock_adjtime
         .word sys_syncfs, compat_sys_sendmmsg, sys_setns, compat_sys_process_vm_readv, compat_sys_process_vm_writev
-/*340*/ .word sys_kern_features, sys_kcmp
+/*340*/ .word sys_kern_features, sys_kcmp, sys_finit_module
 
 #endif /* CONFIG_COMPAT */
 
@@ -164,4 +164,4 @@ sys_call_table:
         .word sys_pwritev, sys_rt_tgsigqueueinfo, sys_perf_event_open, sys_recvmmsg, sys_fanotify_init
 /*330*/ .word sys_fanotify_mark, sys_prlimit64, sys_name_to_handle_at, sys_open_by_handle_at, sys_clock_adjtime
         .word sys_syncfs, sys_sendmmsg, sys_setns, sys_process_vm_readv, sys_process_vm_writev
-/*340*/ .word sys_kern_features, sys_kcmp
+/*340*/ .word sys_kern_features, sys_kcmp, sys_finit_module
diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
index b1942e222768..18e329ca108e 100644
--- a/arch/x86/boot/compressed/eboot.c
+++ b/arch/x86/boot/compressed/eboot.c
@@ -302,7 +302,7 @@ static efi_status_t setup_efi_pci(struct boot_params *params)
                 if (status != EFI_SUCCESS)
                         continue;
 
-                if (!attributes & EFI_PCI_IO_ATTRIBUTE_EMBEDDED_ROM)
+                if (!(attributes & EFI_PCI_IO_ATTRIBUTE_EMBEDDED_ROM))
                         continue;
 
                 if (!pci->romimage || !pci->romsize)
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index 08b973f64032..9c2bd8bd4b4c 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -43,6 +43,7 @@
 #include <asm/apicdef.h>
 #include <asm/hypervisor.h>
 #include <asm/kvm_guest.h>
+#include <asm/context_tracking.h>
 
 static int kvmapf = 1;
 
@@ -121,6 +122,8 @@ void kvm_async_pf_task_wait(u32 token)
         struct kvm_task_sleep_node n, *e;
         DEFINE_WAIT(wait);
 
+        rcu_irq_enter();
+
         spin_lock(&b->lock);
         e = _find_apf_task(b, token);
         if (e) {
@@ -128,6 +131,8 @@ void kvm_async_pf_task_wait(u32 token)
                 hlist_del(&e->link);
                 kfree(e);
                 spin_unlock(&b->lock);
+
+                rcu_irq_exit();
                 return;
         }
 
@@ -152,13 +157,16 @@ void kvm_async_pf_task_wait(u32 token)
                         /*
                          * We cannot reschedule. So halt.
                          */
+                        rcu_irq_exit();
                         native_safe_halt();
+                        rcu_irq_enter();
                         local_irq_disable();
                 }
         }
         if (!n.halted)
                 finish_wait(&n.wq, &wait);
 
+        rcu_irq_exit();
         return;
 }
 EXPORT_SYMBOL_GPL(kvm_async_pf_task_wait);
@@ -252,10 +260,10 @@ do_async_page_fault(struct pt_regs *regs, unsigned long error_code)
                 break;
         case KVM_PV_REASON_PAGE_NOT_PRESENT:
                 /* page is swapped out by the host. */
-                rcu_irq_enter();
+                exception_enter(regs);
                 exit_idle();
                 kvm_async_pf_task_wait((u32)read_cr2());
-                rcu_irq_exit();
+                exception_exit(regs);
                 break;
         case KVM_PV_REASON_PAGE_READY:
                 rcu_irq_enter();
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index 23ddd558fbd5..00f6c1472b85 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -610,6 +610,83 @@ static __init void reserve_ibft_region(void)
 
 static unsigned reserve_low = CONFIG_X86_RESERVE_LOW << 10;
 
+static bool __init snb_gfx_workaround_needed(void)
+{
+#ifdef CONFIG_PCI
+        int i;
+        u16 vendor, devid;
+        static const __initconst u16 snb_ids[] = {
+                0x0102,
+                0x0112,
+                0x0122,
+                0x0106,
+                0x0116,
+                0x0126,
+                0x010a,
+        };
+
+        /* Assume no if something weird is going on with PCI */
+        if (!early_pci_allowed())
+                return false;
+
+        vendor = read_pci_config_16(0, 2, 0, PCI_VENDOR_ID);
+        if (vendor != 0x8086)
+                return false;
+
+        devid = read_pci_config_16(0, 2, 0, PCI_DEVICE_ID);
+        for (i = 0; i < ARRAY_SIZE(snb_ids); i++)
+                if (devid == snb_ids[i])
+                        return true;
+#endif
+
+        return false;
+}
+
+/*
+ * Sandy Bridge graphics has trouble with certain ranges, exclude
+ * them from allocation.
+ */
+static void __init trim_snb_memory(void)
+{
+        static const __initconst unsigned long bad_pages[] = {
+                0x20050000,
+                0x20110000,
+                0x20130000,
+                0x20138000,
+                0x40004000,
+        };
+        int i;
+
+        if (!snb_gfx_workaround_needed())
+                return;
+
+        printk(KERN_DEBUG "reserving inaccessible SNB gfx pages\n");
+
+        /*
+         * Reserve all memory below the 1 MB mark that has not
+         * already been reserved.
+         */
+        memblock_reserve(0, 1<<20);
+        
+        for (i = 0; i < ARRAY_SIZE(bad_pages); i++) {
+                if (memblock_reserve(bad_pages[i], PAGE_SIZE))
+                        printk(KERN_WARNING "failed to reserve 0x%08lx\n",
+                               bad_pages[i]);
+        }
+}
+
+/*
+ * Here we put platform-specific memory range workarounds, i.e.
+ * memory known to be corrupt or otherwise in need to be reserved on
+ * specific platforms.
+ *
+ * If this gets used more widely it could use a real dispatch mechanism.
+ */
+static void __init trim_platform_memory_ranges(void)
+{
+        trim_snb_memory();
+}
+
 static void __init trim_bios_range(void)
 {
         /*
@@ -630,6 +707,7 @@ static void __init trim_bios_range(void)
          * take them out.
          */
         e820_remove_range(BIOS_BEGIN, BIOS_END - BIOS_BEGIN, E820_RAM, 1);
+
         sanitize_e820_map(e820.map, ARRAY_SIZE(e820.map), &e820.nr_map);
 }
 
@@ -908,6 +986,8 @@ void __init setup_arch(char **cmdline_p)
 
         setup_real_mode();
 
+        trim_platform_memory_ranges();
+
         init_gbpages();
 
         /* max_pfn_mapped is updated here */
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index 76f54461f7cb..c243b81e3c74 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -120,7 +120,7 @@ struct kvm_shared_msrs {
 };
 
 static struct kvm_shared_msrs_global __read_mostly shared_msrs_global;
-static DEFINE_PER_CPU(struct kvm_shared_msrs, shared_msrs);
+static struct kvm_shared_msrs __percpu *shared_msrs;
 
 struct kvm_stats_debugfs_item debugfs_entries[] = {
         { "pf_fixed", VCPU_STAT(pf_fixed) },
@@ -191,10 +191,10 @@ static void kvm_on_user_return(struct user_return_notifier *urn)
 
 static void shared_msr_update(unsigned slot, u32 msr)
 {
-        struct kvm_shared_msrs *smsr;
         u64 value;
+        unsigned int cpu = smp_processor_id();
+        struct kvm_shared_msrs *smsr = per_cpu_ptr(shared_msrs, cpu);
 
-        smsr = &__get_cpu_var(shared_msrs);
         /* only read, and nobody should modify it at this time,
          * so don't need lock */
         if (slot >= shared_msrs_global.nr) {
@@ -226,7 +226,8 @@ static void kvm_shared_msr_cpu_online(void)
 
 void kvm_set_shared_msr(unsigned slot, u64 value, u64 mask)
 {
-        struct kvm_shared_msrs *smsr = &__get_cpu_var(shared_msrs);
+        unsigned int cpu = smp_processor_id();
+        struct kvm_shared_msrs *smsr = per_cpu_ptr(shared_msrs, cpu);
 
         if (((value ^ smsr->values[slot].curr) & mask) == 0)
                 return;
@@ -242,7 +243,8 @@ EXPORT_SYMBOL_GPL(kvm_set_shared_msr);
 
 static void drop_user_return_notifiers(void *ignore)
 {
-        struct kvm_shared_msrs *smsr = &__get_cpu_var(shared_msrs);
+        unsigned int cpu = smp_processor_id();
+        struct kvm_shared_msrs *smsr = per_cpu_ptr(shared_msrs, cpu);
 
         if (smsr->registered)
                 kvm_on_user_return(&smsr->urn);
@@ -5233,9 +5235,16 @@ int kvm_arch_init(void *opaque)
                 goto out;
         }
 
+        r = -ENOMEM;
+        shared_msrs = alloc_percpu(struct kvm_shared_msrs);
+        if (!shared_msrs) {
+                printk(KERN_ERR "kvm: failed to allocate percpu kvm_shared_msrs\n");
+                goto out;
+        }
+
         r = kvm_mmu_module_init();
         if (r)
-                goto out;
+                goto out_free_percpu;
 
         kvm_set_mmio_spte_mask();
         kvm_init_msr_list();
@@ -5258,6 +5267,8 @@ int kvm_arch_init(void *opaque)
 
         return 0;
 
+out_free_percpu:
+        free_percpu(shared_msrs);
 out:
         return r;
 }
@@ -5275,6 +5286,7 @@ void kvm_arch_exit(void)
 #endif
         kvm_x86_ops = NULL;
         kvm_mmu_module_exit();
+        free_percpu(shared_msrs);
 }
 
 int kvm_emulate_halt(struct kvm_vcpu *vcpu)
diff --git a/drivers/acpi/glue.c b/drivers/acpi/glue.c
index 95af6f674a6c..35da18113216 100644
--- a/drivers/acpi/glue.c
+++ b/drivers/acpi/glue.c
@@ -297,7 +297,7 @@ static int acpi_platform_notify(struct device *dev)
         if (!ret) {
                 struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
 
-                acpi_get_name(dev->acpi_handle, ACPI_FULL_PATHNAME, &buffer);
+                acpi_get_name(ACPI_HANDLE(dev), ACPI_FULL_PATHNAME, &buffer);
                 DBG("Device %s -> %s\n", dev_name(dev), (char *)buffer.pointer);
                 kfree(buffer.pointer);
         } else
diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c
index 63452943abd1..fb10728f6372 100644
--- a/drivers/base/cpu.c
+++ b/drivers/base/cpu.c
@@ -224,7 +224,7 @@ static void cpu_device_release(struct device *dev)
          * by the cpu device.
          *
          * Never copy this way of doing things, or you too will be made fun of
-         * on the linux-kerenl list, you have been warned.
+         * on the linux-kernel list, you have been warned.
          */
 }
 
diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
index d81460309182..b392b353be39 100644
--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -305,7 +305,7 @@ static bool fw_read_file_contents(struct file *file, struct firmware_buf *fw_buf
         char *buf;
 
         size = fw_file_size(file);
-        if (size < 0)
+        if (size <= 0)
                 return false;
         buf = vmalloc(size);
         if (!buf)
diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
index 07aad786f817..46a213a596e2 100644
--- a/drivers/base/regmap/regmap-debugfs.c
+++ b/drivers/base/regmap/regmap-debugfs.c
@@ -56,6 +56,19 @@ static const struct file_operations regmap_name_fops = {
         .llseek = default_llseek,
 };
 
+static void regmap_debugfs_free_dump_cache(struct regmap *map)
+{
+        struct regmap_debugfs_off_cache *c;
+
+        while (!list_empty(&map->debugfs_off_cache)) {
+                c = list_first_entry(&map->debugfs_off_cache,
+                                     struct regmap_debugfs_off_cache,
+                                     list);
+                list_del(&c->list);
+                kfree(c);
+        }
+}
+
 /*
  * Work out where the start offset maps into register numbers, bearing
  * in mind that we suppress hidden registers.
@@ -91,8 +104,10 @@ static unsigned int regmap_debugfs_get_dump_start(struct regmap *map,
                         /* No cache entry?  Start a new one */
                         if (!c) {
                                 c = kzalloc(sizeof(*c), GFP_KERNEL);
-                                if (!c)
-                                        break;
+                                if (!c) {
+                                        regmap_debugfs_free_dump_cache(map);
+                                        return base;
+                                }
                                 c->min = p;
                                 c->base_reg = i;
                         }
@@ -101,14 +116,34 @@ static unsigned int regmap_debugfs_get_dump_start(struct regmap *map,
                 }
         }
 
+        /* Close the last entry off if we didn't scan beyond it */
+        if (c) {
+                c->max = p - 1;
+                list_add_tail(&c->list,
+                              &map->debugfs_off_cache);
+        } else {
+                return base;
+        }
+
+        /*
+         * This should never happen; we return above if we fail to
+         * allocate and we should never be in this code if there are
+         * no registers at all.
+         */
+        if (list_empty(&map->debugfs_off_cache)) {
+                WARN_ON(list_empty(&map->debugfs_off_cache));
+                return base;
+        }
+
         /* Find the relevant block */
         list_for_each_entry(c, &map->debugfs_off_cache, list) {
-                if (*pos >= c->min && *pos <= c->max) {
+                if (from >= c->min && from <= c->max) {
                         *pos = c->min;
                         return c->base_reg;
                 }
 
-                ret = c->max;
+                *pos = c->min;
+                ret = c->base_reg;
         }
 
         return ret;
@@ -387,16 +422,8 @@ void regmap_debugfs_init(struct regmap *map, const char *name)
 
 void regmap_debugfs_exit(struct regmap *map)
 {
-        struct regmap_debugfs_off_cache *c;
-
         debugfs_remove_recursive(map->debugfs);
-        while (!list_empty(&map->debugfs_off_cache)) {
-                c = list_first_entry(&map->debugfs_off_cache,
-                                     struct regmap_debugfs_off_cache,
-                                     list);
-                list_del(&c->list);
-                kfree(c);
-        }
+        regmap_debugfs_free_dump_cache(map);
         kfree(map->debugfs_name);
 }
 
diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
index fb4a7dd57f94..e1f6860e069c 100644
--- a/drivers/cpuidle/cpuidle.c
+++ b/drivers/cpuidle/cpuidle.c
@@ -69,24 +69,15 @@ int cpuidle_play_dead(void)
 {
         struct cpuidle_device *dev = __this_cpu_read(cpuidle_devices);
         struct cpuidle_driver *drv = cpuidle_get_cpu_driver(dev);
-        int i, dead_state = -1;
-        int power_usage = INT_MAX;
+        int i;
 
         if (!drv)
                 return -ENODEV;
 
         /* Find lowest-power state that supports long-term idle */
-        for (i = CPUIDLE_DRIVER_STATE_START; i < drv->state_count; i++) {
-                struct cpuidle_state *s = &drv->states[i];
-
-                if (s->power_usage < power_usage && s->enter_dead) {
-                        power_usage = s->power_usage;
-                        dead_state = i;
-                }
-        }
-
-        if (dead_state != -1)
-                return drv->states[dead_state].enter_dead(dev, dead_state);
+        for (i = drv->state_count - 1; i >= CPUIDLE_DRIVER_STATE_START; i--)
+                if (drv->states[i].enter_dead)
+                        return drv->states[i].enter_dead(dev, i);
 
         return -ENODEV;
 }
diff --git a/drivers/cpuidle/driver.c b/drivers/cpuidle/driver.c
index c2b281afe0ed..422c7b69ba7c 100644
--- a/drivers/cpuidle/driver.c
+++ b/drivers/cpuidle/driver.c
@@ -19,34 +19,9 @@ DEFINE_SPINLOCK(cpuidle_driver_lock);
 static void __cpuidle_set_cpu_driver(struct cpuidle_driver *drv, int cpu);
 static struct cpuidle_driver * __cpuidle_get_cpu_driver(int cpu);
 
-static void set_power_states(struct cpuidle_driver *drv)
-{
-        int i;
-
-        /*
-         * cpuidle driver should set the drv->power_specified bit
-         * before registering if the driver provides
-         * power_usage numbers.
-         *
-         * If power_specified is not set,
-         * we fill in power_usage with decreasing values as the
-         * cpuidle code has an implicit assumption that state Cn
-         * uses less power than C(n-1).
-         *
-         * With CONFIG_ARCH_HAS_CPU_RELAX, C0 is already assigned
-         * an power value of -1.  So we use -2, -3, etc, for other
-         * c-states.
-         */
-        for (i = CPUIDLE_DRIVER_STATE_START; i < drv->state_count; i++)
-                drv->states[i].power_usage = -1 - i;
-}
-
 static void __cpuidle_driver_init(struct cpuidle_driver *drv)
 {
         drv->refcnt = 0;
-
-        if (!drv->power_specified)
-                set_power_states(drv);
 }
 
 static int __cpuidle_register_driver(struct cpuidle_driver *drv, int cpu)
diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c
index 20ea33afdda1..fe343a06b7da 100644
--- a/drivers/cpuidle/governors/menu.c
+++ b/drivers/cpuidle/governors/menu.c
@@ -312,7 +312,6 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev)
 {
         struct menu_device *data = &__get_cpu_var(menu_devices);
         int latency_req = pm_qos_request(PM_QOS_CPU_DMA_LATENCY);
-        int power_usage = INT_MAX;
         int i;
         int multiplier;
         struct timespec t;
@@ -383,11 +382,8 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev)
                 if (s->exit_latency * multiplier > data->predicted_us)
                         continue;
 
-                if (s->power_usage < power_usage) {
-                        power_usage = s->power_usage;
-                        data->last_state_idx = i;
-                        data->exit_us = s->exit_latency;
-                }
+                data->last_state_idx = i;
+                data->exit_us = s->exit_latency;
         }
 
         /* not deepest C-state chosen for low predicted residency */
diff --git a/drivers/cpuidle/sysfs.c b/drivers/cpuidle/sysfs.c
index 340942946106..428754af6236 100644
--- a/drivers/cpuidle/sysfs.c
+++ b/drivers/cpuidle/sysfs.c
@@ -374,7 +374,7 @@ static int cpuidle_add_state_sysfs(struct cpuidle_device *device)
         struct cpuidle_driver *drv = cpuidle_get_cpu_driver(device);
 
         /* state statistics */
-        for (i = 0; i < drv->state_count; i++) {
+        for (i = 0; i < device->state_count; i++) {
                 kobj = kzalloc(sizeof(struct cpuidle_state_kobj), GFP_KERNEL);
                 if (!kobj)
                         goto error_state;
diff --git a/drivers/gpu/drm/ast/ast_drv.c b/drivers/gpu/drm/ast/ast_drv.c
index 2d2c2f8d6dc6..df0d0a08097a 100644
--- a/drivers/gpu/drm/ast/ast_drv.c
+++ b/drivers/gpu/drm/ast/ast_drv.c
@@ -94,9 +94,9 @@ static int ast_drm_thaw(struct drm_device *dev)
         ast_post_gpu(dev);
 
         drm_mode_config_reset(dev);
-        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
         drm_helper_resume_force_mode(dev);
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
 
         console_lock();
         ast_fbdev_set_suspend(dev, 0);
diff --git a/drivers/gpu/drm/ast/ast_drv.h b/drivers/gpu/drm/ast/ast_drv.h
index 5ccf984f063a..528429252f0f 100644
--- a/drivers/gpu/drm/ast/ast_drv.h
+++ b/drivers/gpu/drm/ast/ast_drv.h
@@ -98,6 +98,8 @@ struct ast_private {
 
         struct drm_gem_object *cursor_cache;
         uint64_t cursor_cache_gpu_addr;
+        /* Acces to this cache is protected by the crtc->mutex of the only crtc
+         * we have. */
         struct ttm_bo_kmap_obj cache_kmap;
         int next_cursor;
 };
diff --git a/drivers/gpu/drm/ast/ast_fb.c b/drivers/gpu/drm/ast/ast_fb.c
index d9ec77959dff..3e6584b940dc 100644
--- a/drivers/gpu/drm/ast/ast_fb.c
+++ b/drivers/gpu/drm/ast/ast_fb.c
@@ -290,6 +290,7 @@ static void ast_fbdev_destroy(struct drm_device *dev,
         drm_fb_helper_fini(&afbdev->helper);
 
         vfree(afbdev->sysram);
+        drm_framebuffer_unregister_private(&afb->base);
         drm_framebuffer_cleanup(&afb->base);
 }
 
diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
index f668e6cc0f7a..f60fd7bd1183 100644
--- a/drivers/gpu/drm/ast/ast_main.c
+++ b/drivers/gpu/drm/ast/ast_main.c
@@ -246,16 +246,8 @@ static void ast_user_framebuffer_destroy(struct drm_framebuffer *fb)
         kfree(fb);
 }
 
-static int ast_user_framebuffer_create_handle(struct drm_framebuffer *fb,
-                                              struct drm_file *file,
-                                              unsigned int *handle)
-{
-        return -EINVAL;
-}
-
 static const struct drm_framebuffer_funcs ast_fb_funcs = {
         .destroy = ast_user_framebuffer_destroy,
-        .create_handle = ast_user_framebuffer_create_handle,
 };
 
 
@@ -266,13 +258,13 @@ int ast_framebuffer_init(struct drm_device *dev,
 {
         int ret;
 
+        drm_helper_mode_fill_fb_struct(&ast_fb->base, mode_cmd);
+        ast_fb->obj = obj;
         ret = drm_framebuffer_init(dev, &ast_fb->base, &ast_fb_funcs);
         if (ret) {
                 DRM_ERROR("framebuffer init failed %d\n", ret);
                 return ret;
         }
-        drm_helper_mode_fill_fb_struct(&ast_fb->base, mode_cmd);
-        ast_fb->obj = obj;
         return 0;
 }
 
diff --git a/drivers/gpu/drm/cirrus/cirrus_fbdev.c b/drivers/gpu/drm/cirrus/cirrus_fbdev.c
index 6c6b4c87d309..3daea0f638c3 100644
--- a/drivers/gpu/drm/cirrus/cirrus_fbdev.c
+++ b/drivers/gpu/drm/cirrus/cirrus_fbdev.c
@@ -258,6 +258,7 @@ static int cirrus_fbdev_destroy(struct drm_device *dev,
 
         vfree(gfbdev->sysram);
         drm_fb_helper_fini(&gfbdev->helper);
+        drm_framebuffer_unregister_private(&gfb->base);
         drm_framebuffer_cleanup(&gfb->base);
 
         return 0;
diff --git a/drivers/gpu/drm/cirrus/cirrus_main.c b/drivers/gpu/drm/cirrus/cirrus_main.c
index 6a9b12e88d46..35cbae827771 100644
--- a/drivers/gpu/drm/cirrus/cirrus_main.c
+++ b/drivers/gpu/drm/cirrus/cirrus_main.c
@@ -23,16 +23,8 @@ static void cirrus_user_framebuffer_destroy(struct drm_framebuffer *fb)
         kfree(fb);
 }
 
-static int cirrus_user_framebuffer_create_handle(struct drm_framebuffer *fb,
-                                                 struct drm_file *file_priv,
-                                                 unsigned int *handle)
-{
-        return 0;
-}
-
 static const struct drm_framebuffer_funcs cirrus_fb_funcs = {
         .destroy = cirrus_user_framebuffer_destroy,
-        .create_handle = cirrus_user_framebuffer_create_handle,
 };
 
 int cirrus_framebuffer_init(struct drm_device *dev,
@@ -42,13 +34,13 @@ int cirrus_framebuffer_init(struct drm_device *dev,
 {
         int ret;
 
+        drm_helper_mode_fill_fb_struct(&gfb->base, mode_cmd);
+        gfb->obj = obj;
         ret = drm_framebuffer_init(dev, &gfb->base, &cirrus_fb_funcs);
         if (ret) {
                 DRM_ERROR("drm_framebuffer_init failed: %d\n", ret);
                 return ret;
         }
-        drm_helper_mode_fill_fb_struct(&gfb->base, mode_cmd);
-        gfb->obj = obj;
         return 0;
 }
 
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index f2d667b8bee2..9c797f6fea75 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -37,6 +37,40 @@
 #include <drm/drm_edid.h>
 #include <drm/drm_fourcc.h>
 
+/**
+ * drm_modeset_lock_all - take all modeset locks
+ * @dev: drm device
+ *
+ * This function takes all modeset locks, suitable where a more fine-grained
+ * scheme isn't (yet) implemented.
+ */
+void drm_modeset_lock_all(struct drm_device *dev)
+{
+        struct drm_crtc *crtc;
+
+        mutex_lock(&dev->mode_config.mutex);
+
+        list_for_each_entry(crtc, &dev->mode_config.crtc_list, head)
+                mutex_lock_nest_lock(&crtc->mutex, &dev->mode_config.mutex);
+}
+EXPORT_SYMBOL(drm_modeset_lock_all);
+
+/**
+ * drm_modeset_unlock_all - drop all modeset locks
+ * @dev: device
+ */
+void drm_modeset_unlock_all(struct drm_device *dev)
+{
+        struct drm_crtc *crtc;
+
+        list_for_each_entry(crtc, &dev->mode_config.crtc_list, head)
+                mutex_unlock(&crtc->mutex);
+
+        mutex_unlock(&dev->mode_config.mutex);
+}
+
+EXPORT_SYMBOL(drm_modeset_unlock_all);
+
 /* Avoid boilerplate.  I'm tired of typing. */
 #define DRM_ENUM_NAME_FN(fnname, list)                          \
         char *fnname(int val)                                   \
@@ -203,12 +237,10 @@ char *drm_get_connector_status_name(enum drm_connector_status status)
 }
 
 /**
- * drm_mode_object_get - allocate a new identifier
+ * drm_mode_object_get - allocate a new modeset identifier
  * @dev: DRM device
- * @ptr: object pointer, used to generate unique ID
- * @type: object type
- *
- * LOCKING:
+ * @obj: object pointer, used to generate unique ID
+ * @obj_type: object type
  *
  * Create a unique identifier based on @ptr in @dev's identifier space.  Used
  * for tracking modes, CRTCs and connectors.
@@ -231,24 +263,27 @@ again:
 
         mutex_lock(&dev->mode_config.idr_mutex);
         ret = idr_get_new_above(&dev->mode_config.crtc_idr, obj, 1, &new_id);
+
+        if (!ret) {
+                /*
+                 * Set up the object linking under the protection of the idr
+                 * lock so that other users can't see inconsistent state.
+                 */
+                obj->id = new_id;
+                obj->type = obj_type;
+        }
         mutex_unlock(&dev->mode_config.idr_mutex);
+
         if (ret == -EAGAIN)
                 goto again;
-        else if (ret)
-                return ret;
 
-        obj->id = new_id;
-        obj->type = obj_type;
-        return 0;
+        return ret;
 }
 
 /**
- * drm_mode_object_put - free an identifer
+ * drm_mode_object_put - free a modeset identifer
  * @dev: DRM device
- * @id: ID to free
- *
- * LOCKING:
- * Caller must hold DRM mode_config lock.
+ * @object: object to free
  *
  * Free @id from @dev's unique identifier pool.
  */
@@ -260,11 +295,24 @@ static void drm_mode_object_put(struct drm_device *dev,
         mutex_unlock(&dev->mode_config.idr_mutex);
 }
 
+/**
+ * drm_mode_object_find - look up a drm object with static lifetime
+ * @dev: drm device
+ * @id: id of the mode object
+ * @type: type of the mode object
+ *
+ * Note that framebuffers cannot be looked up with this functions - since those
+ * are reference counted, they need special treatment.
+ */
 struct drm_mode_object *drm_mode_object_find(struct drm_device *dev,
                 uint32_t id, uint32_t type)
 {
         struct drm_mode_object *obj = NULL;
 
+        /* Framebuffers are reference counted and need their own lookup
+         * function.*/
+        WARN_ON(type == DRM_MODE_OBJECT_FB);
+
         mutex_lock(&dev->mode_config.idr_mutex);
         obj = idr_find(&dev->mode_config.crtc_idr, id);
         if (!obj || (obj->type != type) || (obj->id != id))
@@ -278,13 +326,18 @@ EXPORT_SYMBOL(drm_mode_object_find);
 /**
  * drm_framebuffer_init - initialize a framebuffer
  * @dev: DRM device
- *
- * LOCKING:
- * Caller must hold mode config lock.
+ * @fb: framebuffer to be initialized
+ * @funcs: ... with these functions
  *
  * Allocates an ID for the framebuffer's parent mode object, sets its mode
  * functions & device file and adds it to the master fd list.
  *
+ * IMPORTANT:
+ * This functions publishes the fb and makes it available for concurrent access
+ * by other users. Which means by this point the fb _must_ be fully set up -
+ * since all the fb attributes are invariant over its lifetime, no further
+ * locking but only correct reference counting is required.
+ *
  * RETURNS:
  * Zero on success, error code on failure.
  */
@@ -293,16 +346,23 @@ int drm_framebuffer_init(struct drm_device *dev, struct drm_framebuffer *fb,
 {
         int ret;
 
+        mutex_lock(&dev->mode_config.fb_lock);
         kref_init(&fb->refcount);
+        INIT_LIST_HEAD(&fb->filp_head);
+        fb->dev = dev;
+        fb->funcs = funcs;
 
         ret = drm_mode_object_get(dev, &fb->base, DRM_MODE_OBJECT_FB);
         if (ret)
-                return ret;
+                goto out;
+
+        /* Grab the idr reference. */
+        drm_framebuffer_reference(fb);
 
-        fb->dev = dev;
-        fb->funcs = funcs;
         dev->mode_config.num_fb++;
         list_add(&fb->head, &dev->mode_config.fb_list);
+out:
+        mutex_unlock(&dev->mode_config.fb_lock);
 
         return 0;
 }
@@ -315,23 +375,63 @@ static void drm_framebuffer_free(struct kref *kref)
         fb->funcs->destroy(fb);
 }
 
+static struct drm_framebuffer *__drm_framebuffer_lookup(struct drm_device *dev,
+                                                        uint32_t id)
+{
+        struct drm_mode_object *obj = NULL;
+        struct drm_framebuffer *fb;
+
+        mutex_lock(&dev->mode_config.idr_mutex);
+        obj = idr_find(&dev->mode_config.crtc_idr, id);
+        if (!obj || (obj->type != DRM_MODE_OBJECT_FB) || (obj->id != id))
+                fb = NULL;
+        else
+                fb = obj_to_fb(obj);
+        mutex_unlock(&dev->mode_config.idr_mutex);
+
+        return fb;
+}
+
+/**
+ * drm_framebuffer_lookup - look up a drm framebuffer and grab a reference
+ * @dev: drm device
+ * @id: id of the fb object
+ *
+ * If successful, this grabs an additional reference to the framebuffer -
+ * callers need to make sure to eventually unreference the returned framebuffer
+ * again.
+ */
+struct drm_framebuffer *drm_framebuffer_lookup(struct drm_device *dev,
+                                               uint32_t id)
+{
+        struct drm_framebuffer *fb;
+
+        mutex_lock(&dev->mode_config.fb_lock);
+        fb = __drm_framebuffer_lookup(dev, id);
+        if (fb)
+                kref_get(&fb->refcount);
+        mutex_unlock(&dev->mode_config.fb_lock);
+
+        return fb;
+}
+EXPORT_SYMBOL(drm_framebuffer_lookup);
+
 /**
  * drm_framebuffer_unreference - unref a framebuffer
+ * @fb: framebuffer to unref
  *
- * LOCKING:
- * Caller must hold mode config lock.
+ * This functions decrements the fb's refcount and frees it if it drops to zero.
  */
 void drm_framebuffer_unreference(struct drm_framebuffer *fb)
 {
-        struct drm_device *dev = fb->dev;
         DRM_DEBUG("FB ID: %d\n", fb->base.id);
-        WARN_ON(!mutex_is_locked(&dev->mode_config.mutex));
         kref_put(&fb->refcount, drm_framebuffer_free);
 }
 EXPORT_SYMBOL(drm_framebuffer_unreference);
 
 /**
  * drm_framebuffer_reference - incr the fb refcnt
+ * @fb: framebuffer
  */
 void drm_framebuffer_reference(struct drm_framebuffer *fb)
 {
@@ -340,29 +440,74 @@ void drm_framebuffer_reference(struct drm_framebuffer *fb)
 }
 EXPORT_SYMBOL(drm_framebuffer_reference);
 
+static void drm_framebuffer_free_bug(struct kref *kref)
+{
+        BUG();
+}
+
+static void __drm_framebuffer_unreference(struct drm_framebuffer *fb)
+{
+        DRM_DEBUG("FB ID: %d\n", fb->base.id);
+        kref_put(&fb->refcount, drm_framebuffer_free_bug);
+}
+
+/* dev->mode_config.fb_lock must be held! */
+static void __drm_framebuffer_unregister(struct drm_device *dev,
+                                         struct drm_framebuffer *fb)
+{
+        mutex_lock(&dev->mode_config.idr_mutex);
+        idr_remove(&dev->mode_config.crtc_idr, fb->base.id);
+        mutex_unlock(&dev->mode_config.idr_mutex);
+
+        fb->base.id = 0;
+
+        __drm_framebuffer_unreference(fb);
+}
+
+/**
+ * drm_framebuffer_unregister_private - unregister a private fb from the lookup idr
+ * @fb: fb to unregister
+ *
+ * Drivers need to call this when cleaning up driver-private framebuffers, e.g.
+ * those used for fbdev. Note that the caller must hold a reference of it's own,
+ * i.e. the object may not be destroyed through this call (since it'll lead to a
+ * locking inversion).
+ */
+void drm_framebuffer_unregister_private(struct drm_framebuffer *fb)
+{
+        struct drm_device *dev = fb->dev;
+
+        mutex_lock(&dev->mode_config.fb_lock);
+        /* Mark fb as reaped and drop idr ref. */
+        __drm_framebuffer_unregister(dev, fb);
+        mutex_unlock(&dev->mode_config.fb_lock);
+}
+EXPORT_SYMBOL(drm_framebuffer_unregister_private);
+
 /**
  * drm_framebuffer_cleanup - remove a framebuffer object
  * @fb: framebuffer to remove
  *
- * LOCKING:
- * Caller must hold mode config lock.
+ * Cleanup references to a user-created framebuffer. This function is intended
+ * to be used from the drivers ->destroy callback.
+ *
+ * Note that this function does not remove the fb from active usuage - if it is
+ * still used anywhere, hilarity can ensue since userspace could call getfb on
+ * the id and get back -EINVAL. Obviously no concern at driver unload time.
  *
- * Scans all the CRTCs in @dev's mode_config.  If they're using @fb, removes
- * it, setting it to NULL.
+ * Also, the framebuffer will not be removed from the lookup idr - for
+ * user-created framebuffers this will happen in in the rmfb ioctl. For
+ * driver-private objects (e.g. for fbdev) drivers need to explicitly call
+ * drm_framebuffer_unregister_private.
  */
 void drm_framebuffer_cleanup(struct drm_framebuffer *fb)
 {
         struct drm_device *dev = fb->dev;
-        /*
-         * This could be moved to drm_framebuffer_remove(), but for
-         * debugging is nice to keep around the list of fb's that are
-         * no longer associated w/ a drm_file but are not unreferenced
-         * yet.  (i915 and omapdrm have debugfs files which will show
-         * this.)
-         */
-        drm_mode_object_put(dev, &fb->base);
+
+        mutex_lock(&dev->mode_config.fb_lock);
         list_del(&fb->head);
         dev->mode_config.num_fb--;
+        mutex_unlock(&dev->mode_config.fb_lock);
 }
 EXPORT_SYMBOL(drm_framebuffer_cleanup);
 
@@ -370,11 +515,13 @@ EXPORT_SYMBOL(drm_framebuffer_cleanup);
  * drm_framebuffer_remove - remove and unreference a framebuffer object
  * @fb: framebuffer to remove
  *
- * LOCKING:
- * Caller must hold mode config lock.
- *
  * Scans all the CRTCs and planes in @dev's mode_config.  If they're
- * using @fb, removes it, setting it to NULL.
+ * using @fb, removes it, setting it to NULL. Then drops the reference to the
+ * passed-in framebuffer. Might take the modeset locks.
+ *
+ * Note that this function optimizes the cleanup away if the caller holds the
+ * last reference to the framebuffer. It is also guaranteed to not take the
+ * modeset locks in this case.
  */
 void drm_framebuffer_remove(struct drm_framebuffer *fb)
 {
@@ -384,33 +531,53 @@ void drm_framebuffer_remove(struct drm_framebuffer *fb)
         struct drm_mode_set set;
         int ret;
 
-        /* remove from any CRTC */
-        list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
-                if (crtc->fb == fb) {
-                        /* should turn off the crtc */
-                        memset(&set, 0, sizeof(struct drm_mode_set));
-                        set.crtc = crtc;
-                        set.fb = NULL;
-                        ret = crtc->funcs->set_config(&set);
-                        if (ret)
-                                DRM_ERROR("failed to reset crtc %p when fb was deleted\n", crtc);
+        WARN_ON(!list_empty(&fb->filp_head));
+
+        /*
+         * drm ABI mandates that we remove any deleted framebuffers from active
+         * useage. But since most sane clients only remove framebuffers they no
+         * longer need, try to optimize this away.
+         *
+         * Since we're holding a reference ourselves, observing a refcount of 1
+         * means that we're the last holder and can skip it. Also, the refcount
+         * can never increase from 1 again, so we don't need any barriers or
+         * locks.
+         *
+         * Note that userspace could try to race with use and instate a new
+         * usage _after_ we've cleared all current ones. End result will be an
+         * in-use fb with fb-id == 0. Userspace is allowed to shoot its own foot
+         * in this manner.
+         */
+        if (atomic_read(&fb->refcount.refcount) > 1) {
+                drm_modeset_lock_all(dev);
+                /* remove from any CRTC */
+                list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+                        if (crtc->fb == fb) {
+                                /* should turn off the crtc */
+                                memset(&set, 0, sizeof(struct drm_mode_set));
+                                set.crtc = crtc;
+                                set.fb = NULL;
+                                ret = drm_mode_set_config_internal(&set);
+                                if (ret)
+                                        DRM_ERROR("failed to reset crtc %p when fb was deleted\n", crtc);
+                        }
                 }
-        }
 
-        list_for_each_entry(plane, &dev->mode_config.plane_list, head) {
-                if (plane->fb == fb) {
-                        /* should turn off the crtc */
-                        ret = plane->funcs->disable_plane(plane);
-                        if (ret)
-                                DRM_ERROR("failed to disable plane with busy fb\n");
-                        /* disconnect the plane from the fb and crtc: */
-                        plane->fb = NULL;
-                        plane->crtc = NULL;
+                list_for_each_entry(plane, &dev->mode_config.plane_list, head) {
+                        if (plane->fb == fb) {
+                                /* should turn off the crtc */
+                                ret = plane->funcs->disable_plane(plane);
+                                if (ret)
+                                        DRM_ERROR("failed to disable plane with busy fb\n");
+                                /* disconnect the plane from the fb and crtc: */
+                                __drm_framebuffer_unreference(plane->fb);
+                                plane->fb = NULL;
+                                plane->crtc = NULL;
+                        }
                 }
+                drm_modeset_unlock_all(dev);
         }
 
-        list_del(&fb->filp_head);
-
         drm_framebuffer_unreference(fb);
 }
 EXPORT_SYMBOL(drm_framebuffer_remove);
@@ -421,9 +588,6 @@ EXPORT_SYMBOL(drm_framebuffer_remove);
  * @crtc: CRTC object to init
  * @funcs: callbacks for the new CRTC
  *
- * LOCKING:
- * Takes mode_config lock.
- *
  * Inits a new object created as base part of an driver crtc object.
  *
  * RETURNS:
@@ -438,7 +602,9 @@ int drm_crtc_init(struct drm_device *dev, struct drm_crtc *crtc,
         crtc->funcs = funcs;
         crtc->invert_dimensions = false;
 
-        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
+        mutex_init(&crtc->mutex);
+        mutex_lock_nest_lock(&crtc->mutex, &dev->mode_config.mutex);
 
         ret = drm_mode_object_get(dev, &crtc->base, DRM_MODE_OBJECT_CRTC);
         if (ret)
@@ -450,7 +616,7 @@ int drm_crtc_init(struct drm_device *dev, struct drm_crtc *crtc,
         dev->mode_config.num_crtc++;
 
  out:
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
 
         return ret;
 }
@@ -460,9 +626,6 @@ EXPORT_SYMBOL(drm_crtc_init);
  * drm_crtc_cleanup - Cleans up the core crtc usage.
  * @crtc: CRTC to cleanup
  *
- * LOCKING:
- * Caller must hold mode config lock.
- *
  * Cleanup @crtc. Removes from drm modesetting space
  * does NOT free object, caller does that.
  */
@@ -484,9 +647,6 @@ EXPORT_SYMBOL(drm_crtc_cleanup);
  * @connector: connector the new mode
  * @mode: mode data
  *
- * LOCKING:
- * Caller must hold mode config lock.
- *
  * Add @mode to @connector's mode list for later use.
  */
 void drm_mode_probed_add(struct drm_connector *connector,
@@ -501,9 +661,6 @@ EXPORT_SYMBOL(drm_mode_probed_add);
  * @connector: connector list to modify
  * @mode: mode to remove
  *
- * LOCKING:
- * Caller must hold mode config lock.
- *
  * Remove @mode from @connector's mode list, then free it.
  */
 void drm_mode_remove(struct drm_connector *connector,
@@ -519,10 +676,7 @@ EXPORT_SYMBOL(drm_mode_remove);
  * @dev: DRM device
  * @connector: the connector to init
  * @funcs: callbacks for this connector
- * @name: user visible name of the connector
- *
- * LOCKING:
- * Takes mode config lock.
+ * @connector_type: user visible type of the connector
  *
  * Initialises a preallocated connector. Connectors should be
  * subclassed as part of driver connector objects.
@@ -537,7 +691,7 @@ int drm_connector_init(struct drm_device *dev,
 {
         int ret;
 
-        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
 
         ret = drm_mode_object_get(dev, &connector->base, DRM_MODE_OBJECT_CONNECTOR);
         if (ret)
@@ -567,7 +721,7 @@ int drm_connector_init(struct drm_device *dev,
                                       dev->mode_config.dpms_property, 0);
 
  out:
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
 
         return ret;
 }
@@ -577,9 +731,6 @@ EXPORT_SYMBOL(drm_connector_init);
  * drm_connector_cleanup - cleans up an initialised connector
  * @connector: connector to cleanup
  *
- * LOCKING:
- * Takes mode config lock.
- *
  * Cleans up the connector but doesn't free the object.
  */
 void drm_connector_cleanup(struct drm_connector *connector)
@@ -596,11 +747,9 @@ void drm_connector_cleanup(struct drm_connector *connector)
         list_for_each_entry_safe(mode, t, &connector->user_modes, head)
                 drm_mode_remove(connector, mode);
 
-        mutex_lock(&dev->mode_config.mutex);
         drm_mode_object_put(dev, &connector->base);
         list_del(&connector->head);
         dev->mode_config.num_connector--;
-        mutex_unlock(&dev->mode_config.mutex);
 }
 EXPORT_SYMBOL(drm_connector_cleanup);
 
@@ -622,7 +771,7 @@ int drm_encoder_init(struct drm_device *dev,
 {
         int ret;
 
-        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
 
         ret = drm_mode_object_get(dev, &encoder->base, DRM_MODE_OBJECT_ENCODER);
         if (ret)
@@ -636,7 +785,7 @@ int drm_encoder_init(struct drm_device *dev,
         dev->mode_config.num_encoder++;
 
  out:
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
 
         return ret;
 }
@@ -645,11 +794,11 @@ EXPORT_SYMBOL(drm_encoder_init);
 void drm_encoder_cleanup(struct drm_encoder *encoder)
 {
         struct drm_device *dev = encoder->dev;
-        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
         drm_mode_object_put(dev, &encoder->base);
         list_del(&encoder->head);
         dev->mode_config.num_encoder--;
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
 }
 EXPORT_SYMBOL(drm_encoder_cleanup);
 
@@ -661,7 +810,7 @@ int drm_plane_init(struct drm_device *dev, struct drm_plane *plane,
 {
         int ret;
 
-        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
 
         ret = drm_mode_object_get(dev, &plane->base, DRM_MODE_OBJECT_PLANE);
         if (ret)
@@ -695,7 +844,7 @@ int drm_plane_init(struct drm_device *dev, struct drm_plane *plane,
         }
 
  out:
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
 
         return ret;
 }
@@ -705,7 +854,7 @@ void drm_plane_cleanup(struct drm_plane *plane)
 {
         struct drm_device *dev = plane->dev;
 
-        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
         kfree(plane->format_types);
         drm_mode_object_put(dev, &plane->base);
         /* if not added to a list, it must be a private plane */
@@ -713,7 +862,7 @@ void drm_plane_cleanup(struct drm_plane *plane)
                 list_del(&plane->head);
                 dev->mode_config.num_plane--;
         }
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
 }
 EXPORT_SYMBOL(drm_plane_cleanup);
 
@@ -721,9 +870,6 @@ EXPORT_SYMBOL(drm_plane_cleanup);
  * drm_mode_create - create a new display mode
  * @dev: DRM device
  *
- * LOCKING:
- * Caller must hold DRM mode_config lock.
- *
  * Create a new drm_display_mode, give it an ID, and return it.
  *
  * RETURNS:
@@ -751,9 +897,6 @@ EXPORT_SYMBOL(drm_mode_create);
  * @dev: DRM device
  * @mode: mode to remove
  *
- * LOCKING:
- * Caller must hold mode config lock.
- *
  * Free @mode's unique identifier, then free it.
  */
 void drm_mode_destroy(struct drm_device *dev, struct drm_display_mode *mode)
@@ -978,16 +1121,19 @@ EXPORT_SYMBOL(drm_mode_create_dirty_info_property);
  * drm_mode_config_init - initialize DRM mode_configuration structure
  * @dev: DRM device
  *
- * LOCKING:
- * None, should happen single threaded at init time.
- *
  * Initialize @dev's mode_config structure, used for tracking the graphics
  * configuration of @dev.
+ *
+ * Since this initializes the modeset locks, no locking is possible. Which is no
+ * problem, since this should happen single threaded at init time. It is the
+ * driver's problem to ensure this guarantee.
+ *
  */
 void drm_mode_config_init(struct drm_device *dev)
 {
         mutex_init(&dev->mode_config.mutex);
         mutex_init(&dev->mode_config.idr_mutex);
+        mutex_init(&dev->mode_config.fb_lock);
         INIT_LIST_HEAD(&dev->mode_config.fb_list);
         INIT_LIST_HEAD(&dev->mode_config.crtc_list);
         INIT_LIST_HEAD(&dev->mode_config.connector_list);
@@ -997,9 +1143,9 @@ void drm_mode_config_init(struct drm_device *dev)
         INIT_LIST_HEAD(&dev->mode_config.plane_list);
         idr_init(&dev->mode_config.crtc_idr);
 
-        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
         drm_mode_create_standard_connector_properties(dev);
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
 
         /* Just to be sure */
         dev->mode_config.num_fb = 0;
@@ -1057,12 +1203,13 @@ EXPORT_SYMBOL(drm_mode_group_init_legacy_group);
  * drm_mode_config_cleanup - free up DRM mode_config info
  * @dev: DRM device
  *
- * LOCKING:
- * Caller must hold mode config lock.
- *
  * Free up all the connectors and CRTCs associated with this DRM device, then
  * free up the framebuffers and associated buffer objects.
  *
+ * Note that since this /should/ happen single-threaded at driver/device
+ * teardown time, no locking is required. It's the driver's job to ensure that
+ * this guarantee actually holds true.
+ *
  * FIXME: cleanup any dangling user buffer objects too
  */
 void drm_mode_config_cleanup(struct drm_device *dev)
@@ -1089,6 +1236,15 @@ void drm_mode_config_cleanup(struct drm_device *dev)
                 drm_property_destroy(dev, property);
         }
 
+        /*
+         * Single-threaded teardown context, so it's not required to grab the
+         * fb_lock to protect against concurrent fb_list access. Contrary, it
+         * would actually deadlock with the drm_framebuffer_cleanup function.
+         *
+         * Also, if there are any framebuffers left, that's a driver leak now,
+         * so politely WARN about this.
+         */
+        WARN_ON(!list_empty(&dev->mode_config.fb_list));
         list_for_each_entry_safe(fb, fbt, &dev->mode_config.fb_list, head) {
                 drm_framebuffer_remove(fb);
         }
@@ -1112,9 +1268,6 @@ EXPORT_SYMBOL(drm_mode_config_cleanup);
  * @out: drm_mode_modeinfo struct to return to the user
  * @in: drm_display_mode to use
  *
- * LOCKING:
- * None.
- *
  * Convert a drm_display_mode into a drm_mode_modeinfo structure to return to
  * the user.
  */
@@ -1151,9 +1304,6 @@ static void drm_crtc_convert_to_umode(struct drm_mode_modeinfo *out,
  * @out: drm_display_mode to return to the user
  * @in: drm_mode_modeinfo to use
  *
- * LOCKING:
- * None.
- *
  * Convert a drm_mode_modeinfo into a drm_display_mode structure to return to
  * the caller.
  *
@@ -1188,13 +1338,9 @@ static int drm_crtc_convert_umode(struct drm_display_mode *out,
 
 /**
  * drm_mode_getresources - get graphics configuration
- * @inode: inode from the ioctl
- * @filp: file * from the ioctl
- * @cmd: cmd from ioctl
- * @arg: arg from ioctl
- *
- * LOCKING:
- * Takes mode config lock.
+ * @dev: drm device for the ioctl
+ * @data: data pointer for the ioctl
+ * @file_priv: drm file for the ioctl call
  *
  * Construct a set of configuration description structures and return
  * them to the user, including CRTC, connector and framebuffer configuration.
@@ -1228,8 +1374,8 @@ int drm_mode_getresources(struct drm_device *dev, void *data,
         if (!drm_core_check_feature(dev, DRIVER_MODESET))
                 return -EINVAL;
 
-        mutex_lock(&dev->mode_config.mutex);
 
+        mutex_lock(&file_priv->fbs_lock);
         /*
          * For the non-control nodes we need to limit the list of resources
          * by IDs in the group list for this node
@@ -1237,6 +1383,23 @@ int drm_mode_getresources(struct drm_device *dev, void *data,
         list_for_each(lh, &file_priv->fbs)
                 fb_count++;
 
+        /* handle this in 4 parts */
+        /* FBs */
+        if (card_res->count_fbs >= fb_count) {
+                copied = 0;
+                fb_id = (uint32_t __user *)(unsigned long)card_res->fb_id_ptr;
+                list_for_each_entry(fb, &file_priv->fbs, filp_head) {
+                        if (put_user(fb->base.id, fb_id + copied)) {
+                                mutex_unlock(&file_priv->fbs_lock);
+                                return -EFAULT;
+                        }
+                        copied++;
+                }
+        }
+        card_res->count_fbs = fb_count;
+        mutex_unlock(&file_priv->fbs_lock);
+
+        drm_modeset_lock_all(dev);
         mode_group = &file_priv->master->minor->mode_group;
         if (file_priv->master->minor->type == DRM_MINOR_CONTROL) {
 
@@ -1260,21 +1423,6 @@ int drm_mode_getresources(struct drm_device *dev, void *data,
         card_res->max_width = dev->mode_config.max_width;
         card_res->min_width = dev->mode_config.min_width;
 
-        /* handle this in 4 parts */
-        /* FBs */
-        if (card_res->count_fbs >= fb_count) {
-                copied = 0;
-                fb_id = (uint32_t __user *)(unsigned long)card_res->fb_id_ptr;
-                list_for_each_entry(fb, &file_priv->fbs, filp_head) {
-                        if (put_user(fb->base.id, fb_id + copied)) {
-                                ret = -EFAULT;
-                                goto out;
-                        }
-                        copied++;
-                }
-        }
-        card_res->count_fbs = fb_count;
-
         /* CRTCs */
         if (card_res->count_crtcs >= crtc_count) {
                 copied = 0;
@@ -1370,19 +1518,15 @@ int drm_mode_getresources(struct drm_device *dev, void *data,
                   card_res->count_connectors, card_res->count_encoders);
 
 out:
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
         return ret;
 }
 
 /**
  * drm_mode_getcrtc - get CRTC configuration
- * @inode: inode from the ioctl
- * @filp: file * from the ioctl
- * @cmd: cmd from ioctl
- * @arg: arg from ioctl
- *
- * LOCKING:
- * Takes mode config lock.
+ * @dev: drm device for the ioctl
+ * @data: data pointer for the ioctl
+ * @file_priv: drm file for the ioctl call
  *
  * Construct a CRTC configuration structure to return to the user.
  *
@@ -1402,7 +1546,7 @@ int drm_mode_getcrtc(struct drm_device *dev,
         if (!drm_core_check_feature(dev, DRIVER_MODESET))
                 return -EINVAL;
 
-        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
 
         obj = drm_mode_object_find(dev, crtc_resp->crtc_id,
                                    DRM_MODE_OBJECT_CRTC);
@@ -1430,19 +1574,15 @@ int drm_mode_getcrtc(struct drm_device *dev,
         }
 
 out:
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
         return ret;
 }
 
 /**
  * drm_mode_getconnector - get connector configuration
- * @inode: inode from the ioctl
- * @filp: file * from the ioctl
- * @cmd: cmd from ioctl
- * @arg: arg from ioctl
- *
- * LOCKING:
- * Takes mode config lock.
+ * @dev: drm device for the ioctl
+ * @data: data pointer for the ioctl
+ * @file_priv: drm file for the ioctl call
  *
  * Construct a connector configuration structure to return to the user.
  *
@@ -1575,6 +1715,7 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
 
 out:
         mutex_unlock(&dev->mode_config.mutex);
+
         return ret;
 }
 
@@ -1589,7 +1730,7 @@ int drm_mode_getencoder(struct drm_device *dev, void *data,
         if (!drm_core_check_feature(dev, DRIVER_MODESET))
                 return -EINVAL;
 
-        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
         obj = drm_mode_object_find(dev, enc_resp->encoder_id,
                                    DRM_MODE_OBJECT_ENCODER);
         if (!obj) {
@@ -1608,7 +1749,7 @@ int drm_mode_getencoder(struct drm_device *dev, void *data,
         enc_resp->possible_clones = encoder->possible_clones;
 
 out:
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
         return ret;
 }
 
@@ -1618,9 +1759,6 @@ out:
  * @data: ioctl data
  * @file_priv: DRM file info
  *
- * LOCKING:
- * Takes mode config lock.
- *
  * Return an plane count and set of IDs.
  */
 int drm_mode_getplane_res(struct drm_device *dev, void *data,
@@ -1635,7 +1773,7 @@ int drm_mode_getplane_res(struct drm_device *dev, void *data,
         if (!drm_core_check_feature(dev, DRIVER_MODESET))
                 return -EINVAL;
 
-        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
         config = &dev->mode_config;
 
         /*
@@ -1657,7 +1795,7 @@ int drm_mode_getplane_res(struct drm_device *dev, void *data,
         plane_resp->count_planes = config->num_plane;
 
 out:
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
         return ret;
 }
 
@@ -1667,9 +1805,6 @@ out:
  * @data: ioctl data
  * @file_priv: DRM file info
  *
- * LOCKING:
- * Takes mode config lock.
- *
  * Return plane info, including formats supported, gamma size, any
  * current fb, etc.
  */
@@ -1685,7 +1820,7 @@ int drm_mode_getplane(struct drm_device *dev, void *data,
         if (!drm_core_check_feature(dev, DRIVER_MODESET))
                 return -EINVAL;
 
-        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
         obj = drm_mode_object_find(dev, plane_resp->plane_id,
                                    DRM_MODE_OBJECT_PLANE);
         if (!obj) {
@@ -1725,7 +1860,7 @@ int drm_mode_getplane(struct drm_device *dev, void *data,
         plane_resp->count_format_types = plane->format_count;
 
 out:
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
         return ret;
 }
 
@@ -1733,10 +1868,7 @@ out:
  * drm_mode_setplane - set up or tear down an plane
  * @dev: DRM device
  * @data: ioctl data*
- * @file_prive: DRM file info
- *
- * LOCKING:
- * Takes mode config lock.
+ * @file_priv: DRM file info
  *
  * Set plane info, including placement, fb, scaling, and other factors.
  * Or pass a NULL fb to disable.
@@ -1748,7 +1880,7 @@ int drm_mode_setplane(struct drm_device *dev, void *data,
         struct drm_mode_object *obj;
         struct drm_plane *plane;
         struct drm_crtc *crtc;
-        struct drm_framebuffer *fb;
+        struct drm_framebuffer *fb = NULL, *old_fb = NULL;
         int ret = 0;
         unsigned int fb_width, fb_height;
         int i;
@@ -1756,8 +1888,6 @@ int drm_mode_setplane(struct drm_device *dev, void *data,
         if (!drm_core_check_feature(dev, DRIVER_MODESET))
                 return -EINVAL;
 
-        mutex_lock(&dev->mode_config.mutex);
-
         /*
          * First, find the plane, crtc, and fb objects.  If not available,
          * we don't bother to call the driver.
@@ -1767,16 +1897,18 @@ int drm_mode_setplane(struct drm_device *dev, void *data,
         if (!obj) {
                 DRM_DEBUG_KMS("Unknown plane ID %d\n",
                               plane_req->plane_id);
-                ret = -ENOENT;
-                goto out;
+                return -ENOENT;
         }
         plane = obj_to_plane(obj);
 
         /* No fb means shut it down */
         if (!plane_req->fb_id) {
+                drm_modeset_lock_all(dev);
+                old_fb = plane->fb;
                 plane->funcs->disable_plane(plane);
                 plane->crtc = NULL;
                 plane->fb = NULL;
+                drm_modeset_unlock_all(dev);
                 goto out;
         }
 
@@ -1790,15 +1922,13 @@ int drm_mode_setplane(struct drm_device *dev, void *data,
         }
         crtc = obj_to_crtc(obj);
 
-        obj = drm_mode_object_find(dev, plane_req->fb_id,
-                                   DRM_MODE_OBJECT_FB);
-        if (!obj) {
+        fb = drm_framebuffer_lookup(dev, plane_req->fb_id);
+        if (!fb) {
                 DRM_DEBUG_KMS("Unknown framebuffer ID %d\n",
                               plane_req->fb_id);
                 ret = -ENOENT;
                 goto out;
         }
-        fb = obj_to_fb(obj);
 
         /* Check whether this plane supports the fb pixel format. */
         for (i = 0; i < plane->format_count; i++)
@@ -1844,31 +1974,62 @@ int drm_mode_setplane(struct drm_device *dev, void *data,
                 goto out;
         }
 
+        drm_modeset_lock_all(dev);
         ret = plane->funcs->update_plane(plane, crtc, fb,
                                          plane_req->crtc_x, plane_req->crtc_y,
                                          plane_req->crtc_w, plane_req->crtc_h,
                                          plane_req->src_x, plane_req->src_y,
                                          plane_req->src_w, plane_req->src_h);
         if (!ret) {
+                old_fb = plane->fb;
+                fb = NULL;
                 plane->crtc = crtc;
                 plane->fb = fb;
         }
+        drm_modeset_unlock_all(dev);
 
 out:
-        mutex_unlock(&dev->mode_config.mutex);
+        if (fb)
+                drm_framebuffer_unreference(fb);
+        if (old_fb)
+                drm_framebuffer_unreference(old_fb);
 
         return ret;
 }
 
 /**
- * drm_mode_setcrtc - set CRTC configuration
- * @inode: inode from the ioctl
- * @filp: file * from the ioctl
- * @cmd: cmd from ioctl
- * @arg: arg from ioctl
+ * drm_mode_set_config_internal - helper to call ->set_config
+ * @set: modeset config to set
  *
- * LOCKING:
- * Takes mode config lock.
+ * This is a little helper to wrap internal calls to the ->set_config driver
+ * interface. The only thing it adds is correct refcounting dance.
+ */
+int drm_mode_set_config_internal(struct drm_mode_set *set)
+{
+        struct drm_crtc *crtc = set->crtc;
+        struct drm_framebuffer *fb, *old_fb;
+        int ret;
+
+        old_fb = crtc->fb;
+        fb = set->fb;
+
+        ret = crtc->funcs->set_config(set);
+        if (ret == 0) {
+                if (old_fb)
+                        drm_framebuffer_unreference(old_fb);
+                if (fb)
+                        drm_framebuffer_reference(fb);
+        }
+
+        return ret;
+}
+EXPORT_SYMBOL(drm_mode_set_config_internal);
+
+/**
+ * drm_mode_setcrtc - set CRTC configuration
+ * @dev: drm device for the ioctl
+ * @data: data pointer for the ioctl
+ * @file_priv: drm file for the ioctl call
  *
  * Build a new CRTC configuration based on user request.
  *
@@ -1899,7 +2060,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
         if (crtc_req->x > INT_MAX || crtc_req->y > INT_MAX)
                 return -ERANGE;
 
-        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
         obj = drm_mode_object_find(dev, crtc_req->crtc_id,
                                    DRM_MODE_OBJECT_CRTC);
         if (!obj) {
@@ -1921,16 +2082,16 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
                                 goto out;
                         }
                         fb = crtc->fb;
+                        /* Make refcounting symmetric with the lookup path. */
+                        drm_framebuffer_reference(fb);
                 } else {
-                        obj = drm_mode_object_find(dev, crtc_req->fb_id,
-                                                   DRM_MODE_OBJECT_FB);
-                        if (!obj) {
+                        fb = drm_framebuffer_lookup(dev, crtc_req->fb_id);
+                        if (!fb) {
                                 DRM_DEBUG_KMS("Unknown FB ID%d\n",
                                                 crtc_req->fb_id);
                                 ret = -EINVAL;
                                 goto out;
                         }
-                        fb = obj_to_fb(obj);
                 }
 
                 mode = drm_mode_create(dev);
@@ -2027,12 +2188,15 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
         set.connectors = connector_set;
         set.num_connectors = crtc_req->count_connectors;
         set.fb = fb;
-        ret = crtc->funcs->set_config(&set);
+        ret = drm_mode_set_config_internal(&set);
 
 out:
+        if (fb)
+                drm_framebuffer_unreference(fb);
+
         kfree(connector_set);
         drm_mode_destroy(dev, mode);
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
         return ret;
 }
 
@@ -2050,15 +2214,14 @@ int drm_mode_cursor_ioctl(struct drm_device *dev,
         if (!req->flags || (~DRM_MODE_CURSOR_FLAGS & req->flags))
                 return -EINVAL;
 
-        mutex_lock(&dev->mode_config.mutex);
         obj = drm_mode_object_find(dev, req->crtc_id, DRM_MODE_OBJECT_CRTC);
         if (!obj) {
                 DRM_DEBUG_KMS("Unknown CRTC ID %d\n", req->crtc_id);
-                ret = -EINVAL;
-                goto out;
+                return -EINVAL;
         }
         crtc = obj_to_crtc(obj);
 
+        mutex_lock(&crtc->mutex);
         if (req->flags & DRM_MODE_CURSOR_BO) {
                 if (!crtc->funcs->cursor_set) {
                         ret = -ENXIO;
@@ -2078,7 +2241,8 @@ int drm_mode_cursor_ioctl(struct drm_device *dev,
                 }
         }
 out:
-        mutex_unlock(&dev->mode_config.mutex);
+        mutex_unlock(&crtc->mutex);
+
         return ret;
 }
 
@@ -2120,13 +2284,9 @@ EXPORT_SYMBOL(drm_mode_legacy_fb_format);
 
 /**
  * drm_mode_addfb - add an FB to the graphics configuration
- * @inode: inode from the ioctl
- * @filp: file * from the ioctl
- * @cmd: cmd from ioctl
- * @arg: arg from ioctl
- *
- * LOCKING:
- * Takes mode config lock.
+ * @dev: drm device for the ioctl
+ * @data: data pointer for the ioctl
+ * @file_priv: drm file for the ioctl call
  *
  * Add a new FB to the specified CRTC, given a user request.
  *
@@ -2161,24 +2321,19 @@ int drm_mode_addfb(struct drm_device *dev,
         if ((config->min_height > r.height) || (r.height > config->max_height))
                 return -EINVAL;
 
-        mutex_lock(&dev->mode_config.mutex);
-
-        /* TODO check buffer is sufficiently large */
-        /* TODO setup destructor callback */
-
         fb = dev->mode_config.funcs->fb_create(dev, file_priv, &r);
         if (IS_ERR(fb)) {
                 DRM_DEBUG_KMS("could not create framebuffer\n");
-                ret = PTR_ERR(fb);
-                goto out;
+                drm_modeset_unlock_all(dev);
+                return PTR_ERR(fb);
         }
 
+        mutex_lock(&file_priv->fbs_lock);
         or->fb_id = fb->base.id;
         list_add(&fb->filp_head, &file_priv->fbs);
         DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
+        mutex_unlock(&file_priv->fbs_lock);
 
-out:
-        mutex_unlock(&dev->mode_config.mutex);
         return ret;
 }
 
@@ -2304,13 +2459,9 @@ static int framebuffer_check(const struct drm_mode_fb_cmd2 *r)
 
 /**
  * drm_mode_addfb2 - add an FB to the graphics configuration
- * @inode: inode from the ioctl
- * @filp: file * from the ioctl
- * @cmd: cmd from ioctl
- * @arg: arg from ioctl
- *
- * LOCKING:
- * Takes mode config lock.
+ * @dev: drm device for the ioctl
+ * @data: data pointer for the ioctl
+ * @file_priv: drm file for the ioctl call
  *
  * Add a new FB to the specified CRTC, given a user request with format.
  *
@@ -2350,33 +2501,28 @@ int drm_mode_addfb2(struct drm_device *dev,
         if (ret)
                 return ret;
 
-        mutex_lock(&dev->mode_config.mutex);
-
         fb = dev->mode_config.funcs->fb_create(dev, file_priv, r);
         if (IS_ERR(fb)) {
                 DRM_DEBUG_KMS("could not create framebuffer\n");
-                ret = PTR_ERR(fb);
-                goto out;
+                drm_modeset_unlock_all(dev);
+                return PTR_ERR(fb);
         }
 
+        mutex_lock(&file_priv->fbs_lock);
         r->fb_id = fb->base.id;
         list_add(&fb->filp_head, &file_priv->fbs);
         DRM_DEBUG_KMS("[FB:%d]\n", fb->base.id);
+        mutex_unlock(&file_priv->fbs_lock);
+
 
-out:
-        mutex_unlock(&dev->mode_config.mutex);
         return ret;
 }
 
 /**
  * drm_mode_rmfb - remove an FB from the configuration
- * @inode: inode from the ioctl
- * @filp: file * from the ioctl
- * @cmd: cmd from ioctl
- * @arg: arg from ioctl
- *
- * LOCKING:
- * Takes mode config lock.
+ * @dev: drm device for the ioctl
+ * @data: data pointer for the ioctl
+ * @file_priv: drm file for the ioctl call
  *
  * Remove the FB specified by the user.
  *
@@ -2388,50 +2534,49 @@ out:
 int drm_mode_rmfb(struct drm_device *dev,
                    void *data, struct drm_file *file_priv)
 {
-        struct drm_mode_object *obj;
         struct drm_framebuffer *fb = NULL;
         struct drm_framebuffer *fbl = NULL;
         uint32_t *id = data;
-        int ret = 0;
         int found = 0;
 
         if (!drm_core_check_feature(dev, DRIVER_MODESET))
                 return -EINVAL;
 
-        mutex_lock(&dev->mode_config.mutex);
-        obj = drm_mode_object_find(dev, *id, DRM_MODE_OBJECT_FB);
-        /* TODO check that we really get a framebuffer back. */
-        if (!obj) {
-                ret = -EINVAL;
-                goto out;
-        }
-        fb = obj_to_fb(obj);
+        mutex_lock(&file_priv->fbs_lock);
+        mutex_lock(&dev->mode_config.fb_lock);
+        fb = __drm_framebuffer_lookup(dev, *id);
+        if (!fb)
+                goto fail_lookup;
 
         list_for_each_entry(fbl, &file_priv->fbs, filp_head)
                 if (fb == fbl)
                         found = 1;
+        if (!found)
+                goto fail_lookup;
 
-        if (!found) {
-                ret = -EINVAL;
-                goto out;
-        }
+        /* Mark fb as reaped, we still have a ref from fpriv->fbs. */
+        __drm_framebuffer_unregister(dev, fb);
+
+        list_del_init(&fb->filp_head);
+        mutex_unlock(&dev->mode_config.fb_lock);
+        mutex_unlock(&file_priv->fbs_lock);
 
         drm_framebuffer_remove(fb);
 
-out:
-        mutex_unlock(&dev->mode_config.mutex);
-        return ret;
+        return 0;
+
+fail_lookup:
+        mutex_unlock(&dev->mode_config.fb_lock);
+        mutex_unlock(&file_priv->fbs_lock);
+
+        return -EINVAL;
 }
 
 /**
  * drm_mode_getfb - get FB info
- * @inode: inode from the ioctl
- * @filp: file * from the ioctl
- * @cmd: cmd from ioctl
- * @arg: arg from ioctl
- *
- * LOCKING:
- * Takes mode config lock.
+ * @dev: drm device for the ioctl
+ * @data: data pointer for the ioctl
+ * @file_priv: drm file for the ioctl call
  *
  * Lookup the FB given its ID and return info about it.
  *
@@ -2444,30 +2589,28 @@ int drm_mode_getfb(struct drm_device *dev,
                    void *data, struct drm_file *file_priv)
 {
         struct drm_mode_fb_cmd *r = data;
-        struct drm_mode_object *obj;
         struct drm_framebuffer *fb;
-        int ret = 0;
+        int ret;
 
         if (!drm_core_check_feature(dev, DRIVER_MODESET))
                 return -EINVAL;
 
-        mutex_lock(&dev->mode_config.mutex);
-        obj = drm_mode_object_find(dev, r->fb_id, DRM_MODE_OBJECT_FB);
-        if (!obj) {
-                ret = -EINVAL;
-                goto out;
-        }
-        fb = obj_to_fb(obj);
+        fb = drm_framebuffer_lookup(dev, r->fb_id);
+        if (!fb)
+                return -EINVAL;
 
         r->height = fb->height;
         r->width = fb->width;
         r->depth = fb->depth;
         r->bpp = fb->bits_per_pixel;
         r->pitch = fb->pitches[0];
-        fb->funcs->create_handle(fb, file_priv, &r->handle);
+        if (fb->funcs->create_handle)
+                ret = fb->funcs->create_handle(fb, file_priv, &r->handle);
+        else
+                ret = -ENODEV;
+
+        drm_framebuffer_unreference(fb);
 
-out:
-        mutex_unlock(&dev->mode_config.mutex);
         return ret;
 }
 
@@ -2477,7 +2620,6 @@ int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
         struct drm_clip_rect __user *clips_ptr;
         struct drm_clip_rect *clips = NULL;
         struct drm_mode_fb_dirty_cmd *r = data;
-        struct drm_mode_object *obj;
         struct drm_framebuffer *fb;
         unsigned flags;
         int num_clips;
@@ -2486,13 +2628,9 @@ int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
         if (!drm_core_check_feature(dev, DRIVER_MODESET))
                 return -EINVAL;
 
-        mutex_lock(&dev->mode_config.mutex);
-        obj = drm_mode_object_find(dev, r->fb_id, DRM_MODE_OBJECT_FB);
-        if (!obj) {
-                ret = -EINVAL;
-                goto out_err1;
-        }
-        fb = obj_to_fb(obj);
+        fb = drm_framebuffer_lookup(dev, r->fb_id);
+        if (!fb)
+                return -EINVAL;
 
         num_clips = r->num_clips;
         clips_ptr = (struct drm_clip_rect __user *)(unsigned long)r->clips_ptr;
@@ -2530,27 +2668,26 @@ int drm_mode_dirtyfb_ioctl(struct drm_device *dev,
         }
 
         if (fb->funcs->dirty) {
+                drm_modeset_lock_all(dev);
                 ret = fb->funcs->dirty(fb, file_priv, flags, r->color,
                                        clips, num_clips);
+                drm_modeset_unlock_all(dev);
         } else {
                 ret = -ENOSYS;
-                goto out_err2;
         }
 
 out_err2:
         kfree(clips);
 out_err1:
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_framebuffer_unreference(fb);
+
         return ret;
 }
 
 
 /**
  * drm_fb_release - remove and free the FBs on this file
- * @filp: file * from the ioctl
- *
- * LOCKING:
- * Takes mode config lock.
+ * @priv: drm file for the ioctl
  *
  * Destroy all the FBs associated with @filp.
  *
@@ -2564,11 +2701,20 @@ void drm_fb_release(struct drm_file *priv)
         struct drm_device *dev = priv->minor->dev;
         struct drm_framebuffer *fb, *tfb;
 
-        mutex_lock(&dev->mode_config.mutex);
+        mutex_lock(&priv->fbs_lock);
         list_for_each_entry_safe(fb, tfb, &priv->fbs, filp_head) {
+
+                mutex_lock(&dev->mode_config.fb_lock);
+                /* Mark fb as reaped, we still have a ref from fpriv->fbs. */
+                __drm_framebuffer_unregister(dev, fb);
+                mutex_unlock(&dev->mode_config.fb_lock);
+
+                list_del_init(&fb->filp_head);
+
+                /* This will also drop the fpriv->fbs reference. */
                 drm_framebuffer_remove(fb);
         }
-        mutex_unlock(&dev->mode_config.mutex);
+        mutex_unlock(&priv->fbs_lock);
 }
 
 /**
@@ -2660,10 +2806,9 @@ EXPORT_SYMBOL(drm_mode_detachmode_crtc);
 
 /**
  * drm_fb_attachmode - Attach a user mode to an connector
- * @inode: inode from the ioctl
- * @filp: file * from the ioctl
- * @cmd: cmd from ioctl
- * @arg: arg from ioctl
+ * @dev: drm device for the ioctl
+ * @data: data pointer for the ioctl
+ * @file_priv: drm file for the ioctl call
  *
  * This attaches a user specified mode to an connector.
  * Called by the user via ioctl.
@@ -2684,7 +2829,7 @@ int drm_mode_attachmode_ioctl(struct drm_device *dev,
         if (!drm_core_check_feature(dev, DRIVER_MODESET))
                 return -EINVAL;
 
-        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
 
         obj = drm_mode_object_find(dev, mode_cmd->connector_id, DRM_MODE_OBJECT_CONNECTOR);
         if (!obj) {
@@ -2708,17 +2853,16 @@ int drm_mode_attachmode_ioctl(struct drm_device *dev,
 
         drm_mode_attachmode(dev, connector, mode);
 out:
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
         return ret;
 }
 
 
 /**
  * drm_fb_detachmode - Detach a user specified mode from an connector
- * @inode: inode from the ioctl
- * @filp: file * from the ioctl
- * @cmd: cmd from ioctl
- * @arg: arg from ioctl
+ * @dev: drm device for the ioctl
+ * @data: data pointer for the ioctl
+ * @file_priv: drm file for the ioctl call
  *
  * Called by the user via ioctl.
  *
@@ -2738,7 +2882,7 @@ int drm_mode_detachmode_ioctl(struct drm_device *dev,
         if (!drm_core_check_feature(dev, DRIVER_MODESET))
                 return -EINVAL;
 
-        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
 
         obj = drm_mode_object_find(dev, mode_cmd->connector_id, DRM_MODE_OBJECT_CONNECTOR);
         if (!obj) {
@@ -2755,7 +2899,7 @@ int drm_mode_detachmode_ioctl(struct drm_device *dev,
 
         ret = drm_mode_detachmode(dev, connector, &mode);
 out:
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
         return ret;
 }
 
@@ -3001,7 +3145,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
         if (!drm_core_check_feature(dev, DRIVER_MODESET))
                 return -EINVAL;
 
-        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
         obj = drm_mode_object_find(dev, out_resp->prop_id, DRM_MODE_OBJECT_PROPERTY);
         if (!obj) {
                 ret = -EINVAL;
@@ -3079,7 +3223,7 @@ int drm_mode_getproperty_ioctl(struct drm_device *dev,
                 out_resp->count_enum_blobs = blob_count;
         }
 done:
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
         return ret;
 }
 
@@ -3130,7 +3274,7 @@ int drm_mode_getblob_ioctl(struct drm_device *dev,
         if (!drm_core_check_feature(dev, DRIVER_MODESET))
                 return -EINVAL;
 
-        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
         obj = drm_mode_object_find(dev, out_resp->blob_id, DRM_MODE_OBJECT_BLOB);
         if (!obj) {
                 ret = -EINVAL;
@@ -3148,7 +3292,7 @@ int drm_mode_getblob_ioctl(struct drm_device *dev,
         out_resp->length = blob->length;
 
 done:
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
         return ret;
 }
 
@@ -3290,7 +3434,7 @@ int drm_mode_obj_get_properties_ioctl(struct drm_device *dev, void *data,
         if (!drm_core_check_feature(dev, DRIVER_MODESET))
                 return -EINVAL;
 
-        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
 
         obj = drm_mode_object_find(dev, arg->obj_id, arg->obj_type);
         if (!obj) {
@@ -3327,7 +3471,7 @@ int drm_mode_obj_get_properties_ioctl(struct drm_device *dev, void *data,
         }
         arg->count_props = props_count;
 out:
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
         return ret;
 }
 
@@ -3344,7 +3488,7 @@ int drm_mode_obj_set_property_ioctl(struct drm_device *dev, void *data,
         if (!drm_core_check_feature(dev, DRIVER_MODESET))
                 return -EINVAL;
 
-        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
 
         arg_obj = drm_mode_object_find(dev, arg->obj_id, arg->obj_type);
         if (!arg_obj)
@@ -3382,7 +3526,7 @@ int drm_mode_obj_set_property_ioctl(struct drm_device *dev, void *data,
         }
 
 out:
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
         return ret;
 }
 
@@ -3444,7 +3588,7 @@ int drm_mode_gamma_set_ioctl(struct drm_device *dev,
         if (!drm_core_check_feature(dev, DRIVER_MODESET))
                 return -EINVAL;
 
-        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
         obj = drm_mode_object_find(dev, crtc_lut->crtc_id, DRM_MODE_OBJECT_CRTC);
         if (!obj) {
                 ret = -EINVAL;
@@ -3485,7 +3629,7 @@ int drm_mode_gamma_set_ioctl(struct drm_device *dev,
         crtc->funcs->gamma_set(crtc, r_base, g_base, b_base, 0, crtc->gamma_size);
 
 out:
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
         return ret;
 
 }
@@ -3503,7 +3647,7 @@ int drm_mode_gamma_get_ioctl(struct drm_device *dev,
         if (!drm_core_check_feature(dev, DRIVER_MODESET))
                 return -EINVAL;
 
-        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
         obj = drm_mode_object_find(dev, crtc_lut->crtc_id, DRM_MODE_OBJECT_CRTC);
         if (!obj) {
                 ret = -EINVAL;
@@ -3536,7 +3680,7 @@ int drm_mode_gamma_get_ioctl(struct drm_device *dev,
                 goto out;
         }
 out:
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
         return ret;
 }
 
@@ -3546,7 +3690,7 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev,
         struct drm_mode_crtc_page_flip *page_flip = data;
         struct drm_mode_object *obj;
         struct drm_crtc *crtc;
-        struct drm_framebuffer *fb;
+        struct drm_framebuffer *fb = NULL, *old_fb = NULL;
         struct drm_pending_vblank_event *e = NULL;
         unsigned long flags;
         int hdisplay, vdisplay;
@@ -3556,12 +3700,12 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev,
             page_flip->reserved != 0)
                 return -EINVAL;
 
-        mutex_lock(&dev->mode_config.mutex);
         obj = drm_mode_object_find(dev, page_flip->crtc_id, DRM_MODE_OBJECT_CRTC);
         if (!obj)
-                goto out;
+                return -EINVAL;
         crtc = obj_to_crtc(obj);
 
+        mutex_lock(&crtc->mutex);
         if (crtc->fb == NULL) {
                 /* The framebuffer is currently unbound, presumably
                  * due to a hotplug event, that userspace has not
@@ -3574,10 +3718,9 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev,
         if (crtc->funcs->page_flip == NULL)
                 goto out;
 
-        obj = drm_mode_object_find(dev, page_flip->fb_id, DRM_MODE_OBJECT_FB);
-        if (!obj)
+        fb = drm_framebuffer_lookup(dev, page_flip->fb_id);
+        if (!fb)
                 goto out;
-        fb = obj_to_fb(obj);
 
         hdisplay = crtc->mode.hdisplay;
         vdisplay = crtc->mode.vdisplay;
@@ -3623,6 +3766,7 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev,
                         (void (*) (struct drm_pending_event *)) kfree;
         }
 
+        old_fb = crtc->fb;
         ret = crtc->funcs->page_flip(crtc, fb, e);
         if (ret) {
                 if (page_flip->flags & DRM_MODE_PAGE_FLIP_EVENT) {
@@ -3631,10 +3775,20 @@ int drm_mode_page_flip_ioctl(struct drm_device *dev,
                         spin_unlock_irqrestore(&dev->event_lock, flags);
                         kfree(e);
                 }
+                /* Keep the old fb, don't unref it. */
+                old_fb = NULL;
+        } else {
+                /* Unref only the old framebuffer. */
+                fb = NULL;
         }
 
 out:
-        mutex_unlock(&dev->mode_config.mutex);
+        if (fb)
+                drm_framebuffer_unreference(fb);
+        if (old_fb)
+                drm_framebuffer_unreference(old_fb);
+        mutex_unlock(&crtc->mutex);
+
         return ret;
 }
 
diff --git a/drivers/gpu/drm/drm_fb_cma_helper.c b/drivers/gpu/drm/drm_fb_cma_helper.c
index fd9d0af4d536..3742bc96421e 100644
--- a/drivers/gpu/drm/drm_fb_cma_helper.c
+++ b/drivers/gpu/drm/drm_fb_cma_helper.c
@@ -85,6 +85,11 @@ static struct drm_fb_cma *drm_fb_cma_alloc(struct drm_device *dev,
         if (!fb_cma)
                 return ERR_PTR(-ENOMEM);
 
+        drm_helper_mode_fill_fb_struct(&fb_cma->fb, mode_cmd);
+
+        for (i = 0; i < num_planes; i++)
+                fb_cma->obj[i] = obj[i];
+
         ret = drm_framebuffer_init(dev, &fb_cma->fb, &drm_fb_cma_funcs);
         if (ret) {
                 dev_err(dev->dev, "Failed to initalize framebuffer: %d\n", ret);
@@ -92,11 +97,6 @@ static struct drm_fb_cma *drm_fb_cma_alloc(struct drm_device *dev,
                 return ERR_PTR(ret);
         }
 
-        drm_helper_mode_fill_fb_struct(&fb_cma->fb, mode_cmd);
-
-        for (i = 0; i < num_planes; i++)
-                fb_cma->obj[i] = obj[i];
-
         return fb_cma;
 }
 
@@ -266,6 +266,7 @@ static int drm_fbdev_cma_create(struct drm_fb_helper *helper,
         return 0;
 
 err_drm_fb_cma_destroy:
+        drm_framebuffer_unregister_private(fb);
         drm_fb_cma_destroy(fb);
 err_framebuffer_release:
         framebuffer_release(fbi);
@@ -370,8 +371,10 @@ void drm_fbdev_cma_fini(struct drm_fbdev_cma *fbdev_cma)
                 framebuffer_release(info);
         }
 
-        if (fbdev_cma->fb)
+        if (fbdev_cma->fb) {
+                drm_framebuffer_unregister_private(&fbdev_cma->fb->fb);
                 drm_fb_cma_destroy(&fbdev_cma->fb->fb);
+        }
 
         drm_fb_helper_fini(&fbdev_cma->fb_helper);
         kfree(fbdev_cma);
diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
index 954d175bd7fa..0c6e25e979dd 100644
--- a/drivers/gpu/drm/drm_fb_helper.c
+++ b/drivers/gpu/drm/drm_fb_helper.c
@@ -245,7 +245,7 @@ bool drm_fb_helper_restore_fbdev_mode(struct drm_fb_helper *fb_helper)
         int i, ret;
         for (i = 0; i < fb_helper->crtc_count; i++) {
                 struct drm_mode_set *mode_set = &fb_helper->crtc_info[i].mode_set;
-                ret = mode_set->crtc->funcs->set_config(mode_set);
+                ret = drm_mode_set_config_internal(mode_set);
                 if (ret)
                         error = true;
         }
@@ -305,6 +305,24 @@ void drm_fb_helper_restore(void)
 }
 EXPORT_SYMBOL(drm_fb_helper_restore);
 
+static bool drm_fb_helper_is_bound(struct drm_fb_helper *fb_helper)
+{
+        struct drm_device *dev = fb_helper->dev;
+        struct drm_crtc *crtc;
+        int bound = 0, crtcs_bound = 0;
+
+        list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+                if (crtc->fb)
+                        crtcs_bound++;
+                if (crtc->fb == fb_helper->fb)
+                        bound++;
+        }
+
+        if (bound < crtcs_bound)
+                return false;
+        return true;
+}
+
 #ifdef CONFIG_MAGIC_SYSRQ
 static void drm_fb_helper_restore_work_fn(struct work_struct *ignored)
 {
@@ -337,7 +355,12 @@ static void drm_fb_helper_dpms(struct fb_info *info, int dpms_mode)
         /*
          * For each CRTC in this fb, turn the connectors on/off.
          */
-        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
+        if (!drm_fb_helper_is_bound(fb_helper)) {
+                drm_modeset_unlock_all(dev);
+                return;
+        }
+
         for (i = 0; i < fb_helper->crtc_count; i++) {
                 crtc = fb_helper->crtc_info[i].mode_set.crtc;
 
@@ -352,7 +375,7 @@ static void drm_fb_helper_dpms(struct fb_info *info, int dpms_mode)
                                 dev->mode_config.dpms_property, dpms_mode);
                 }
         }
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
 }
 
 int drm_fb_helper_blank(int blank, struct fb_info *info)
@@ -672,16 +695,16 @@ int drm_fb_helper_set_par(struct fb_info *info)
                 return -EINVAL;
         }
 
-        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
         for (i = 0; i < fb_helper->crtc_count; i++) {
                 crtc = fb_helper->crtc_info[i].mode_set.crtc;
-                ret = crtc->funcs->set_config(&fb_helper->crtc_info[i].mode_set);
+                ret = drm_mode_set_config_internal(&fb_helper->crtc_info[i].mode_set);
                 if (ret) {
-                        mutex_unlock(&dev->mode_config.mutex);
+                        drm_modeset_unlock_all(dev);
                         return ret;
                 }
         }
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
 
         if (fb_helper->delayed_hotplug) {
                 fb_helper->delayed_hotplug = false;
@@ -701,7 +724,12 @@ int drm_fb_helper_pan_display(struct fb_var_screeninfo *var,
         int ret = 0;
         int i;
 
-        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
+        if (!drm_fb_helper_is_bound(fb_helper)) {
+                drm_modeset_unlock_all(dev);
+                return -EBUSY;
+        }
+
         for (i = 0; i < fb_helper->crtc_count; i++) {
                 crtc = fb_helper->crtc_info[i].mode_set.crtc;
 
@@ -711,14 +739,14 @@ int drm_fb_helper_pan_display(struct fb_var_screeninfo *var,
                 modeset->y = var->yoffset;
 
                 if (modeset->num_connectors) {
-                        ret = crtc->funcs->set_config(modeset);
+                        ret = drm_mode_set_config_internal(modeset);
                         if (!ret) {
                                 info->var.xoffset = var->xoffset;
                                 info->var.yoffset = var->yoffset;
                         }
                 }
         }
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
         return ret;
 }
 EXPORT_SYMBOL(drm_fb_helper_pan_display);
@@ -1369,23 +1397,14 @@ int drm_fb_helper_hotplug_event(struct drm_fb_helper *fb_helper)
         struct drm_device *dev = fb_helper->dev;
         int count = 0;
         u32 max_width, max_height, bpp_sel;
-        int bound = 0, crtcs_bound = 0;
-        struct drm_crtc *crtc;
 
         if (!fb_helper->fb)
                 return 0;
 
-        mutex_lock(&dev->mode_config.mutex);
-        list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
-                if (crtc->fb)
-                        crtcs_bound++;
-                if (crtc->fb == fb_helper->fb)
-                        bound++;
-        }
-
-        if (bound < crtcs_bound) {
+        drm_modeset_lock_all(dev);
+        if (!drm_fb_helper_is_bound(fb_helper)) {
                 fb_helper->delayed_hotplug = true;
-                mutex_unlock(&dev->mode_config.mutex);
+                drm_modeset_unlock_all(dev);
                 return 0;
         }
         DRM_DEBUG_KMS("\n");
@@ -1397,7 +1416,7 @@ int drm_fb_helper_hotplug_event(struct drm_fb_helper *fb_helper)
         count = drm_fb_helper_probe_connector_modes(fb_helper, max_width,
                                                     max_height);
         drm_setup_crtcs(fb_helper);
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
 
         return drm_fb_helper_single_fb_probe(fb_helper, bpp_sel);
 }
diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
index 133b4132983e..13fdcd10a605 100644
--- a/drivers/gpu/drm/drm_fops.c
+++ b/drivers/gpu/drm/drm_fops.c
@@ -276,6 +276,7 @@ static int drm_open_helper(struct inode *inode, struct file *filp,
 
         INIT_LIST_HEAD(&priv->lhead);
         INIT_LIST_HEAD(&priv->fbs);
+        mutex_init(&priv->fbs_lock);
         INIT_LIST_HEAD(&priv->event_list);
         init_waitqueue_head(&priv->event_wait);
         priv->event_space = 4096; /* set aside 4k for event buffer */
diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
index 86272f04b82f..db1e2d6f90d7 100644
--- a/drivers/gpu/drm/drm_mm.c
+++ b/drivers/gpu/drm/drm_mm.c
@@ -252,11 +252,13 @@ static void drm_mm_insert_helper_range(struct drm_mm_node *hole_node,
 
         BUG_ON(!hole_node->hole_follows || node->allocated);
 
-        if (mm->color_adjust)
-                mm->color_adjust(hole_node, color, &adj_start, &adj_end);
-
         if (adj_start < start)
                 adj_start = start;
+        if (adj_end > end)
+                adj_end = end;
+
+        if (mm->color_adjust)
+                mm->color_adjust(hole_node, color, &adj_start, &adj_end);
 
         if (alignment) {
                 unsigned tmp = adj_start % alignment;
@@ -536,7 +538,7 @@ void drm_mm_init_scan(struct drm_mm *mm,
         mm->scan_size = size;
         mm->scanned_blocks = 0;
         mm->scan_hit_start = 0;
-        mm->scan_hit_size = 0;
+        mm->scan_hit_end = 0;
         mm->scan_check_range = 0;
         mm->prev_scanned_node = NULL;
 }
@@ -563,7 +565,7 @@ void drm_mm_init_scan_with_range(struct drm_mm *mm,
         mm->scan_size = size;
         mm->scanned_blocks = 0;
         mm->scan_hit_start = 0;
-        mm->scan_hit_size = 0;
+        mm->scan_hit_end = 0;
         mm->scan_start = start;
         mm->scan_end = end;
         mm->scan_check_range = 1;
@@ -582,8 +584,7 @@ int drm_mm_scan_add_block(struct drm_mm_node *node)
         struct drm_mm *mm = node->mm;
         struct drm_mm_node *prev_node;
         unsigned long hole_start, hole_end;
-        unsigned long adj_start;
-        unsigned long adj_end;
+        unsigned long adj_start, adj_end;
 
         mm->scanned_blocks++;
 
@@ -600,14 +601,8 @@ int drm_mm_scan_add_block(struct drm_mm_node *node)
         node->node_list.next = &mm->prev_scanned_node->node_list;
         mm->prev_scanned_node = node;
 
-        hole_start = drm_mm_hole_node_start(prev_node);
-        hole_end = drm_mm_hole_node_end(prev_node);
-
-        adj_start = hole_start;
-        adj_end = hole_end;
-
-        if (mm->color_adjust)
-                mm->color_adjust(prev_node, mm->scan_color, &adj_start, &adj_end);
+        adj_start = hole_start = drm_mm_hole_node_start(prev_node);
+        adj_end = hole_end = drm_mm_hole_node_end(prev_node);
 
         if (mm->scan_check_range) {
                 if (adj_start < mm->scan_start)
@@ -616,11 +611,14 @@ int drm_mm_scan_add_block(struct drm_mm_node *node)
                         adj_end = mm->scan_end;
         }
 
+        if (mm->color_adjust)
+                mm->color_adjust(prev_node, mm->scan_color,
+                                 &adj_start, &adj_end);
+
         if (check_free_hole(adj_start, adj_end,
                             mm->scan_size, mm->scan_alignment)) {
                 mm->scan_hit_start = hole_start;
-                mm->scan_hit_size = hole_end;
-
+                mm->scan_hit_end = hole_end;
                 return 1;
         }
 
@@ -656,19 +654,10 @@ int drm_mm_scan_remove_block(struct drm_mm_node *node)
                                node_list);
 
         prev_node->hole_follows = node->scanned_preceeds_hole;
-        INIT_LIST_HEAD(&node->node_list);
         list_add(&node->node_list, &prev_node->node_list);
 
-        /* Only need to check for containement because start&size for the
-         * complete resulting free block (not just the desired part) is
-         * stored. */
-        if (node->start >= mm->scan_hit_start &&
-            node->start + node->size
-                        <= mm->scan_hit_start + mm->scan_hit_size) {
-                return 1;
-        }
-
-        return 0;
+         return (drm_mm_hole_node_end(node) > mm->scan_hit_start &&
+                 node->start < mm->scan_hit_end);
 }
 EXPORT_SYMBOL(drm_mm_scan_remove_block);
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
index 71f867340a88..90d335cfb8c0 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_fbdev.c
@@ -326,8 +326,10 @@ static void exynos_drm_fbdev_destroy(struct drm_device *dev,
         /* release drm framebuffer and real buffer */
         if (fb_helper->fb && fb_helper->fb->funcs) {
                 fb = fb_helper->fb;
-                if (fb)
+                if (fb) {
+                        drm_framebuffer_unregister_private(fb);
                         drm_framebuffer_remove(fb);
+                }
         }
 
         /* release linux framebuffer */
diff --git a/drivers/gpu/drm/gma500/framebuffer.c b/drivers/gpu/drm/gma500/framebuffer.c
index afded54dbb10..c1ef37e2efdf 100644
--- a/drivers/gpu/drm/gma500/framebuffer.c
+++ b/drivers/gpu/drm/gma500/framebuffer.c
@@ -260,13 +260,13 @@ static int psb_framebuffer_init(struct drm_device *dev,
         default:
                 return -EINVAL;
         }
+        drm_helper_mode_fill_fb_struct(&fb->base, mode_cmd);
+        fb->gtt = gt;
         ret = drm_framebuffer_init(dev, &fb->base, &psb_fb_funcs);
         if (ret) {
                 dev_err(dev->dev, "framebuffer init failed: %d\n", ret);
                 return ret;
         }
-        drm_helper_mode_fill_fb_struct(&fb->base, mode_cmd);
-        fb->gtt = gt;
         return 0;
 }
 
@@ -590,6 +590,7 @@ static int psb_fbdev_destroy(struct drm_device *dev, struct psb_fbdev *fbdev)
                 framebuffer_release(info);
         }
         drm_fb_helper_fini(&fbdev->psb_fb_helper);
+        drm_framebuffer_unregister_private(&psbfb->base);
         drm_framebuffer_cleanup(&psbfb->base);
 
         if (psbfb->gtt)
@@ -668,30 +669,6 @@ static void psb_user_framebuffer_destroy(struct drm_framebuffer *fb)
 {
         struct psb_framebuffer *psbfb = to_psb_fb(fb);
         struct gtt_range *r = psbfb->gtt;
-        struct drm_device *dev = fb->dev;
-        struct drm_psb_private *dev_priv = dev->dev_private;
-        struct psb_fbdev *fbdev = dev_priv->fbdev;
-        struct drm_crtc *crtc;
-        int reset = 0;
-
-        /* Should never get stolen memory for a user fb */
-        WARN_ON(r->stolen);
-
-        /* Check if we are erroneously live */
-        list_for_each_entry(crtc, &dev->mode_config.crtc_list, head)
-                if (crtc->fb == fb)
-                        reset = 1;
-
-        if (reset)
-                /*
-                 * Now force a sane response before we permit the DRM CRTC
-                 * layer to do stupid things like blank the display. Instead
-                 * we reset this framebuffer as if the user had forced a reset.
-                 * We must do this before the cleanup so that the DRM layer
-                 * doesn't get a chance to stick its oar in where it isn't
-                 * wanted.
-                 */
-                drm_fb_helper_restore_fbdev_mode(&fbdev->psb_fb_helper);
 
         /* Let DRM do its clean up */
         drm_framebuffer_cleanup(fb);
diff --git a/drivers/gpu/drm/gma500/psb_device.c b/drivers/gpu/drm/gma500/psb_device.c
index b58c4701c4e8..f6f534b4197e 100644
--- a/drivers/gpu/drm/gma500/psb_device.c
+++ b/drivers/gpu/drm/gma500/psb_device.c
@@ -194,7 +194,7 @@ static int psb_save_display_registers(struct drm_device *dev)
         regs->saveCHICKENBIT = PSB_RVDC32(DSPCHICKENBIT);
 
         /* Save crtc and output state */
-        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
         list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
                 if (drm_helper_crtc_in_use(crtc))
                         crtc->funcs->save(crtc);
@@ -204,7 +204,7 @@ static int psb_save_display_registers(struct drm_device *dev)
                 if (connector->funcs->save)
                         connector->funcs->save(connector);
 
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
         return 0;
 }
 
@@ -234,7 +234,7 @@ static int psb_restore_display_registers(struct drm_device *dev)
         /*make sure VGA plane is off. it initializes to on after reset!*/
         PSB_WVDC32(0x80000000, VGACNTRL);
 
-        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
         list_for_each_entry(crtc, &dev->mode_config.crtc_list, head)
                 if (drm_helper_crtc_in_use(crtc))
                         crtc->funcs->restore(crtc);
@@ -243,7 +243,7 @@ static int psb_restore_display_registers(struct drm_device *dev)
                 if (connector->funcs->restore)
                         connector->funcs->restore(connector);
 
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
         return 0;
 }
 
diff --git a/drivers/gpu/drm/gma500/psb_drv.c b/drivers/gpu/drm/gma500/psb_drv.c
index dd1fbfa7e467..111e3df9c5de 100644
--- a/drivers/gpu/drm/gma500/psb_drv.c
+++ b/drivers/gpu/drm/gma500/psb_drv.c
@@ -149,6 +149,16 @@ static struct drm_ioctl_desc psb_ioctls[] = {
 
 static void psb_lastclose(struct drm_device *dev)
 {
+        int ret;
+        struct drm_psb_private *dev_priv = dev->dev_private;
+        struct psb_fbdev *fbdev = dev_priv->fbdev;
+
+        drm_modeset_lock_all(dev);
+        ret = drm_fb_helper_restore_fbdev_mode(&fbdev->psb_fb_helper);
+        if (ret)
+                DRM_DEBUG("failed to restore crtc mode\n");
+        drm_modeset_unlock_all(dev);
+
         return;
 }
 
@@ -476,7 +486,7 @@ static int psb_mode_operation_ioctl(struct drm_device *dev, void *data,
         case PSB_MODE_OPERATION_MODE_VALID:
                 umode = &arg->mode;
 
-                mutex_lock(&dev->mode_config.mutex);
+                drm_modeset_lock_all(dev);
 
                 obj = drm_mode_object_find(dev, obj_id,
                                         DRM_MODE_OBJECT_CONNECTOR);
@@ -525,7 +535,7 @@ static int psb_mode_operation_ioctl(struct drm_device *dev, void *data,
                 if (mode)
                         drm_mode_destroy(dev, mode);
 mode_op_out:
-                mutex_unlock(&dev->mode_config.mutex);
+                drm_modeset_unlock_all(dev);
                 return ret;
 
         default:
diff --git a/drivers/gpu/drm/i2c/ch7006_drv.c b/drivers/gpu/drm/i2c/ch7006_drv.c
index b865d0728e28..51fa32392029 100644
--- a/drivers/gpu/drm/i2c/ch7006_drv.c
+++ b/drivers/gpu/drm/i2c/ch7006_drv.c
@@ -364,7 +364,7 @@ static int ch7006_encoder_set_property(struct drm_encoder *encoder,
                                 .crtc = crtc,
                         };
 
-                        crtc->funcs->set_config(&modeset);
+                        drm_mode_set_config_internal(&modeset);
                 }
         }
 
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index f7d88e99ebf0..7576e7874698 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -1440,28 +1440,31 @@ static int i915_gem_framebuffer_info(struct seq_file *m, void *data)
         ifbdev = dev_priv->fbdev;
         fb = to_intel_framebuffer(ifbdev->helper.fb);
 
-        seq_printf(m, "fbcon size: %d x %d, depth %d, %d bpp, obj ",
+        seq_printf(m, "fbcon size: %d x %d, depth %d, %d bpp, refcount %d, obj ",
                    fb->base.width,
                    fb->base.height,
                    fb->base.depth,
-                   fb->base.bits_per_pixel);
+                   fb->base.bits_per_pixel,
+                   atomic_read(&fb->base.refcount.refcount));
         describe_obj(m, fb->obj);
         seq_printf(m, "\n");
+        mutex_unlock(&dev->mode_config.mutex);
 
+        mutex_lock(&dev->mode_config.fb_lock);
         list_for_each_entry(fb, &dev->mode_config.fb_list, base.head) {
                 if (&fb->base == ifbdev->helper.fb)
                         continue;
 
-                seq_printf(m, "user size: %d x %d, depth %d, %d bpp, obj ",
+                seq_printf(m, "user size: %d x %d, depth %d, %d bpp, refcount %d, obj ",
                            fb->base.width,
                            fb->base.height,
                            fb->base.depth,
-                           fb->base.bits_per_pixel);
+                           fb->base.bits_per_pixel,
+                           atomic_read(&fb->base.refcount.refcount));
                 describe_obj(m, fb->obj);
                 seq_printf(m, "\n");
         }
-
-        mutex_unlock(&dev->mode_config.mutex);
+        mutex_unlock(&dev->mode_config.fb_lock);
 
         return 0;
 }
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index e6cc020ea32c..4418e14e3d69 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1720,7 +1720,8 @@ i915_gem_object_put_pages(struct drm_i915_gem_object *obj)
 }
 
 static long
-i915_gem_purge(struct drm_i915_private *dev_priv, long target)
+__i915_gem_shrink(struct drm_i915_private *dev_priv, long target,
+                  bool purgeable_only)
 {
         struct drm_i915_gem_object *obj, *next;
         long count = 0;
@@ -1728,7 +1729,7 @@ i915_gem_purge(struct drm_i915_private *dev_priv, long target)
         list_for_each_entry_safe(obj, next,
                                  &dev_priv->mm.unbound_list,
                                  gtt_list) {
-                if (i915_gem_object_is_purgeable(obj) &&
+                if ((i915_gem_object_is_purgeable(obj) || !purgeable_only) &&
                     i915_gem_object_put_pages(obj) == 0) {
                         count += obj->base.size >> PAGE_SHIFT;
                         if (count >= target)
@@ -1739,7 +1740,7 @@ i915_gem_purge(struct drm_i915_private *dev_priv, long target)
         list_for_each_entry_safe(obj, next,
                                  &dev_priv->mm.inactive_list,
                                  mm_list) {
-                if (i915_gem_object_is_purgeable(obj) &&
+                if ((i915_gem_object_is_purgeable(obj) || !purgeable_only) &&
                     i915_gem_object_unbind(obj) == 0 &&
                     i915_gem_object_put_pages(obj) == 0) {
                         count += obj->base.size >> PAGE_SHIFT;
@@ -1751,6 +1752,12 @@ i915_gem_purge(struct drm_i915_private *dev_priv, long target)
         return count;
 }
 
+static long
+i915_gem_purge(struct drm_i915_private *dev_priv, long target)
+{
+        return __i915_gem_shrink(dev_priv, target, true);
+}
+
 static void
 i915_gem_shrink_all(struct drm_i915_private *dev_priv)
 {
@@ -3545,14 +3552,15 @@ i915_gem_pin_ioctl(struct drm_device *dev, void *data,
                 goto out;
         }
 
-        obj->user_pin_count++;
-        obj->pin_filp = file;
-        if (obj->user_pin_count == 1) {
+        if (obj->user_pin_count == 0) {
                 ret = i915_gem_object_pin(obj, args->alignment, true, false);
                 if (ret)
                         goto out;
         }
 
+        obj->user_pin_count++;
+        obj->pin_filp = file;
+
         /* XXX - flush the CPU caches for pinned objects
          * as the X server doesn't manage domains yet
          */
@@ -4382,6 +4390,9 @@ i915_gem_inactive_shrink(struct shrinker *shrinker, struct shrink_control *sc)
         if (nr_to_scan) {
                 nr_to_scan -= i915_gem_purge(dev_priv, nr_to_scan);
                 if (nr_to_scan > 0)
+                        nr_to_scan -= __i915_gem_shrink(dev_priv, nr_to_scan,
+                                                        false);
+                if (nr_to_scan > 0)
                         i915_gem_shrink_all(dev_priv);
         }
 
@@ -4389,7 +4400,7 @@ i915_gem_inactive_shrink(struct shrinker *shrinker, struct shrink_control *sc)
         list_for_each_entry(obj, &dev_priv->mm.unbound_list, gtt_list)
                 if (obj->pages_pin_count == 0)
                         cnt += obj->base.size >> PAGE_SHIFT;
-        list_for_each_entry(obj, &dev_priv->mm.bound_list, gtt_list)
+        list_for_each_entry(obj, &dev_priv->mm.inactive_list, gtt_list)
                 if (obj->pin_count == 0 && obj->pages_pin_count == 0)
                         cnt += obj->base.size >> PAGE_SHIFT;
 
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 8c36a11a9a57..8cda2ad19e26 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -6415,6 +6415,8 @@ bool intel_get_load_detect_pipe(struct drm_connector *connector,
         if (encoder->crtc) {
                 crtc = encoder->crtc;
 
+                mutex_lock(&crtc->mutex);
+
                 old->dpms_mode = connector->dpms;
                 old->load_detect_temp = false;
 
@@ -6444,6 +6446,7 @@ bool intel_get_load_detect_pipe(struct drm_connector *connector,
                 return false;
         }
 
+        mutex_lock(&crtc->mutex);
         intel_encoder->new_crtc = to_intel_crtc(crtc);
         to_intel_connector(connector)->new_encoder = intel_encoder;
 
@@ -6471,6 +6474,7 @@ bool intel_get_load_detect_pipe(struct drm_connector *connector,
                 DRM_DEBUG_KMS("reusing fbdev for load-detection framebuffer\n");
         if (IS_ERR(fb)) {
                 DRM_DEBUG_KMS("failed to allocate framebuffer for load-detection\n");
+                mutex_unlock(&crtc->mutex);
                 return false;
         }
 
@@ -6478,6 +6482,7 @@ bool intel_get_load_detect_pipe(struct drm_connector *connector,
                 DRM_DEBUG_KMS("failed to set mode on load-detect pipe\n");
                 if (old->release_fb)
                         old->release_fb->funcs->destroy(old->release_fb);
+                mutex_unlock(&crtc->mutex);
                 return false;
         }
 
@@ -6492,20 +6497,21 @@ void intel_release_load_detect_pipe(struct drm_connector *connector,
         struct intel_encoder *intel_encoder =
                 intel_attached_encoder(connector);
         struct drm_encoder *encoder = &intel_encoder->base;
+        struct drm_crtc *crtc = encoder->crtc;
 
         DRM_DEBUG_KMS("[CONNECTOR:%d:%s], [ENCODER:%d:%s]\n",
                       connector->base.id, drm_get_connector_name(connector),
                       encoder->base.id, drm_get_encoder_name(encoder));
 
         if (old->load_detect_temp) {
-                struct drm_crtc *crtc = encoder->crtc;
-
                 to_intel_connector(connector)->new_encoder = NULL;
                 intel_encoder->new_crtc = NULL;
                 intel_set_mode(crtc, NULL, 0, 0, NULL);
 
-                if (old->release_fb)
-                        old->release_fb->funcs->destroy(old->release_fb);
+                if (old->release_fb) {
+                        drm_framebuffer_unregister_private(old->release_fb);
+                        drm_framebuffer_unreference(old->release_fb);
+                }
 
                 return;
         }
@@ -6513,6 +6519,8 @@ void intel_release_load_detect_pipe(struct drm_connector *connector,
         /* Switch crtc and encoder back off if necessary */
         if (old->dpms_mode != DRM_MODE_DPMS_ON)
                 connector->funcs->dpms(connector, old->dpms_mode);
+
+        mutex_unlock(&crtc->mutex);
 }
 
 /* Returns the clock of the currently programmed mode of the given pipe. */
@@ -8318,19 +8326,30 @@ int intel_framebuffer_init(struct drm_device *dev,
 {
         int ret;
 
-        if (obj->tiling_mode == I915_TILING_Y)
+        if (obj->tiling_mode == I915_TILING_Y) {
+                DRM_DEBUG("hardware does not support tiling Y\n");
                 return -EINVAL;
+        }
 
-        if (mode_cmd->pitches[0] & 63)
+        if (mode_cmd->pitches[0] & 63) {
+                DRM_DEBUG("pitch (%d) must be at least 64 byte aligned\n",
+                          mode_cmd->pitches[0]);
                 return -EINVAL;
+        }
 
         /* FIXME <= Gen4 stride limits are bit unclear */
-        if (mode_cmd->pitches[0] > 32768)
+        if (mode_cmd->pitches[0] > 32768) {
+                DRM_DEBUG("pitch (%d) must be at less than 32768\n",
+                          mode_cmd->pitches[0]);
                 return -EINVAL;
+        }
 
         if (obj->tiling_mode != I915_TILING_NONE &&
-            mode_cmd->pitches[0] != obj->stride)
+            mode_cmd->pitches[0] != obj->stride) {
+                DRM_DEBUG("pitch (%d) must match tiling stride (%d)\n",
+                          mode_cmd->pitches[0], obj->stride);
                 return -EINVAL;
+        }
 
         /* Reject formats not supported by any plane early. */
         switch (mode_cmd->pixel_format) {
@@ -8341,8 +8360,10 @@ int intel_framebuffer_init(struct drm_device *dev,
                 break;
         case DRM_FORMAT_XRGB1555:
         case DRM_FORMAT_ARGB1555:
-                if (INTEL_INFO(dev)->gen > 3)
+                if (INTEL_INFO(dev)->gen > 3) {
+                        DRM_DEBUG("invalid format: 0x%08x\n", mode_cmd->pixel_format);
                         return -EINVAL;
+                }
                 break;
         case DRM_FORMAT_XBGR8888:
         case DRM_FORMAT_ABGR8888:
@@ -8350,18 +8371,22 @@ int intel_framebuffer_init(struct drm_device *dev,
         case DRM_FORMAT_ARGB2101010:
         case DRM_FORMAT_XBGR2101010:
         case DRM_FORMAT_ABGR2101010:
-                if (INTEL_INFO(dev)->gen < 4)
+                if (INTEL_INFO(dev)->gen < 4) {
+                        DRM_DEBUG("invalid format: 0x%08x\n", mode_cmd->pixel_format);
                         return -EINVAL;
+                }
                 break;
         case DRM_FORMAT_YUYV:
         case DRM_FORMAT_UYVY:
         case DRM_FORMAT_YVYU:
         case DRM_FORMAT_VYUY:
-                if (INTEL_INFO(dev)->gen < 6)
+                if (INTEL_INFO(dev)->gen < 5) {
+                        DRM_DEBUG("invalid format: 0x%08x\n", mode_cmd->pixel_format);
                         return -EINVAL;
+                }
                 break;
         default:
-                DRM_DEBUG_KMS("unsupported pixel format 0x%08x\n", mode_cmd->pixel_format);
+                DRM_DEBUG("unsupported pixel format 0x%08x\n", mode_cmd->pixel_format);
                 return -EINVAL;
         }
 
@@ -8369,14 +8394,15 @@ int intel_framebuffer_init(struct drm_device *dev,
         if (mode_cmd->offsets[0] != 0)
                 return -EINVAL;
 
+        drm_helper_mode_fill_fb_struct(&intel_fb->base, mode_cmd);
+        intel_fb->obj = obj;
+
         ret = drm_framebuffer_init(dev, &intel_fb->base, &intel_fb_funcs);
         if (ret) {
                 DRM_ERROR("framebuffer init failed %d\n", ret);
                 return ret;
         }
 
-        drm_helper_mode_fill_fb_struct(&intel_fb->base, mode_cmd);
-        intel_fb->obj = obj;
         return 0;
 }
 
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 5f12eb2d0fb5..e64c75727702 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -1101,6 +1101,8 @@ static void ironlake_panel_vdd_off_sync(struct intel_dp *intel_dp)
         struct drm_i915_private *dev_priv = dev->dev_private;
         u32 pp;
 
+        WARN_ON(!mutex_is_locked(&dev->mode_config.mutex));
+
         if (!intel_dp->want_panel_vdd && ironlake_edp_have_panel_vdd(intel_dp)) {
                 pp = ironlake_get_pp_control(dev_priv);
                 pp &= ~EDP_FORCE_VDD;
diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
index 71d55801c0d9..755c27450a2c 100644
--- a/drivers/gpu/drm/i915/intel_fb.c
+++ b/drivers/gpu/drm/i915/intel_fb.c
@@ -221,6 +221,7 @@ static void intel_fbdev_destroy(struct drm_device *dev,
 
         drm_fb_helper_fini(&ifbdev->helper);
 
+        drm_framebuffer_unregister_private(&ifb->base);
         drm_framebuffer_cleanup(&ifb->base);
         if (ifb->obj) {
                 drm_gem_object_unreference_unlocked(&ifb->obj->base);
@@ -297,7 +298,7 @@ void intel_fb_restore_mode(struct drm_device *dev)
         struct drm_mode_config *config = &dev->mode_config;
         struct drm_plane *plane;
 
-        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
 
         ret = drm_fb_helper_restore_fbdev_mode(&dev_priv->fbdev->helper);
         if (ret)
@@ -307,5 +308,5 @@ void intel_fb_restore_mode(struct drm_device *dev)
         list_for_each_entry(plane, &config->plane_list, head)
                 plane->funcs->disable_plane(plane);
 
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
 }
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index 8c61876dbe95..5e3f08e3fd8b 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -586,9 +586,9 @@ static int intel_lid_notify(struct notifier_block *nb, unsigned long val,
 
         dev_priv->modeset_on_lid = 0;
 
-        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
         intel_modeset_setup_hw_state(dev, true);
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
 
         return NOTIFY_OK;
 }
@@ -830,14 +830,6 @@ static const struct dmi_system_id intel_no_lvds[] = {
         },
         {
                 .callback = intel_no_lvds_dmi_callback,
-                .ident = "ZOTAC ZBOXSD-ID12/ID13",
-                .matches = {
-                        DMI_MATCH(DMI_BOARD_VENDOR, "ZOTAC"),
-                        DMI_MATCH(DMI_BOARD_NAME, "ZBOXSD-ID12/ID13"),
-                },
-        },
-        {
-                .callback = intel_no_lvds_dmi_callback,
                 .ident = "Gigabyte GA-D525TUD",
                 .matches = {
                         DMI_MATCH(DMI_BOARD_VENDOR, "Gigabyte Technology Co., Ltd."),
diff --git a/drivers/gpu/drm/i915/intel_overlay.c b/drivers/gpu/drm/i915/intel_overlay.c
index fabe0acf808d..1e901c3c18af 100644
--- a/drivers/gpu/drm/i915/intel_overlay.c
+++ b/drivers/gpu/drm/i915/intel_overlay.c
@@ -1045,13 +1045,13 @@ int intel_overlay_put_image(struct drm_device *dev, void *data,
         }
 
         if (!(put_image_rec->flags & I915_OVERLAY_ENABLE)) {
-                mutex_lock(&dev->mode_config.mutex);
+                drm_modeset_lock_all(dev);
                 mutex_lock(&dev->struct_mutex);
 
                 ret = intel_overlay_switch_off(overlay);
 
                 mutex_unlock(&dev->struct_mutex);
-                mutex_unlock(&dev->mode_config.mutex);
+                drm_modeset_unlock_all(dev);
 
                 return ret;
         }
@@ -1075,7 +1075,7 @@ int intel_overlay_put_image(struct drm_device *dev, void *data,
                 goto out_free;
         }
 
-        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
         mutex_lock(&dev->struct_mutex);
 
         if (new_bo->tiling_mode) {
@@ -1157,7 +1157,7 @@ int intel_overlay_put_image(struct drm_device *dev, void *data,
                 goto out_unlock;
 
         mutex_unlock(&dev->struct_mutex);
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
 
         kfree(params);
 
@@ -1165,7 +1165,7 @@ int intel_overlay_put_image(struct drm_device *dev, void *data,
 
 out_unlock:
         mutex_unlock(&dev->struct_mutex);
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
         drm_gem_object_unreference_unlocked(&new_bo->base);
 out_free:
         kfree(params);
@@ -1241,7 +1241,7 @@ int intel_overlay_attrs(struct drm_device *dev, void *data,
                 return -ENODEV;
         }
 
-        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
         mutex_lock(&dev->struct_mutex);
 
         ret = -EINVAL;
@@ -1307,7 +1307,7 @@ int intel_overlay_attrs(struct drm_device *dev, void *data,
         ret = 0;
 out_unlock:
         mutex_unlock(&dev->struct_mutex);
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
 
         return ret;
 }
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index 5a8a72c5a89d..ca9734529229 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -44,6 +44,14 @@
  * i915.i915_enable_fbc parameter
  */
 
+static bool intel_crtc_active(struct drm_crtc *crtc)
+{
+        /* Be paranoid as we can arrive here with only partial
+         * state retrieved from the hardware during setup.
+         */
+        return to_intel_crtc(crtc)->active && crtc->fb && crtc->mode.clock;
+}
+
 static void i8xx_disable_fbc(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
@@ -405,9 +413,8 @@ void intel_update_fbc(struct drm_device *dev)
          *   - going to an unsupported config (interlace, pixel multiply, etc.)
          */
         list_for_each_entry(tmp_crtc, &dev->mode_config.crtc_list, head) {
-                if (to_intel_crtc(tmp_crtc)->active &&
-                    !to_intel_crtc(tmp_crtc)->primary_disabled &&
-                    tmp_crtc->fb) {
+                if (intel_crtc_active(tmp_crtc) &&
+                    !to_intel_crtc(tmp_crtc)->primary_disabled) {
                         if (crtc) {
                                 DRM_DEBUG_KMS("more than one pipe active, disabling compression\n");
                                 dev_priv->no_fbc_reason = FBC_MULTIPLE_PIPES;
@@ -995,7 +1002,7 @@ static struct drm_crtc *single_enabled_crtc(struct drm_device *dev)
         struct drm_crtc *crtc, *enabled = NULL;
 
         list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
-                if (to_intel_crtc(crtc)->active && crtc->fb) {
+                if (intel_crtc_active(crtc)) {
                         if (enabled)
                                 return NULL;
                         enabled = crtc;
@@ -1089,7 +1096,7 @@ static bool g4x_compute_wm0(struct drm_device *dev,
         int entries, tlb_miss;
 
         crtc = intel_get_crtc_for_plane(dev, plane);
-        if (crtc->fb == NULL || !to_intel_crtc(crtc)->active) {
+        if (!intel_crtc_active(crtc)) {
                 *cursor_wm = cursor->guard_size;
                 *plane_wm = display->guard_size;
                 return false;
@@ -1218,7 +1225,7 @@ static bool vlv_compute_drain_latency(struct drm_device *dev,
         int entries;
 
         crtc = intel_get_crtc_for_plane(dev, plane);
-        if (crtc->fb == NULL || !to_intel_crtc(crtc)->active)
+        if (!intel_crtc_active(crtc))
                 return false;
 
         clock = crtc->mode.clock;       /* VESA DOT Clock */
@@ -1479,7 +1486,7 @@ static void i9xx_update_wm(struct drm_device *dev)
 
         fifo_size = dev_priv->display.get_fifo_size(dev, 0);
         crtc = intel_get_crtc_for_plane(dev, 0);
-        if (to_intel_crtc(crtc)->active && crtc->fb) {
+        if (intel_crtc_active(crtc)) {
                 int cpp = crtc->fb->bits_per_pixel / 8;
                 if (IS_GEN2(dev))
                         cpp = 4;
@@ -1493,7 +1500,7 @@ static void i9xx_update_wm(struct drm_device *dev)
 
         fifo_size = dev_priv->display.get_fifo_size(dev, 1);
         crtc = intel_get_crtc_for_plane(dev, 1);
-        if (to_intel_crtc(crtc)->active && crtc->fb) {
+        if (intel_crtc_active(crtc)) {
                 int cpp = crtc->fb->bits_per_pixel / 8;
                 if (IS_GEN2(dev))
                         cpp = 4;
@@ -2047,7 +2054,7 @@ sandybridge_compute_sprite_wm(struct drm_device *dev, int plane,
         int entries, tlb_miss;
 
         crtc = intel_get_crtc_for_plane(dev, plane);
-        if (crtc->fb == NULL || !to_intel_crtc(crtc)->active) {
+        if (!intel_crtc_active(crtc)) {
                 *sprite_wm = display->guard_size;
                 return false;
         }
diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
index 827dcd4edf1c..f8293061d6bd 100644
--- a/drivers/gpu/drm/i915/intel_sprite.c
+++ b/drivers/gpu/drm/i915/intel_sprite.c
@@ -120,11 +120,10 @@ ivb_update_plane(struct drm_plane *plane, struct drm_framebuffer *fb,
         I915_WRITE(SPRSTRIDE(pipe), fb->pitches[0]);
         I915_WRITE(SPRPOS(pipe), (crtc_y << 16) | crtc_x);
 
-        linear_offset = y * fb->pitches[0] + x * (fb->bits_per_pixel / 8);
+        linear_offset = y * fb->pitches[0] + x * pixel_size;
         sprsurf_offset =
                 intel_gen4_compute_offset_xtiled(&x, &y,
-                                                 fb->bits_per_pixel / 8,
-                                                 fb->pitches[0]);
+                                                 pixel_size, fb->pitches[0]);
         linear_offset -= sprsurf_offset;
 
         /* HSW consolidates SPRTILEOFF and SPRLINOFF into a single SPROFFSET
@@ -286,11 +285,10 @@ ilk_update_plane(struct drm_plane *plane, struct drm_framebuffer *fb,
         I915_WRITE(DVSSTRIDE(pipe), fb->pitches[0]);
         I915_WRITE(DVSPOS(pipe), (crtc_y << 16) | crtc_x);
 
-        linear_offset = y * fb->pitches[0] + x * (fb->bits_per_pixel / 8);
+        linear_offset = y * fb->pitches[0] + x * pixel_size;
         dvssurf_offset =
                 intel_gen4_compute_offset_xtiled(&x, &y,
-                                                 fb->bits_per_pixel / 8,
-                                                 fb->pitches[0]);
+                                                 pixel_size, fb->pitches[0]);
         linear_offset -= dvssurf_offset;
 
         if (obj->tiling_mode != I915_TILING_NONE)
@@ -595,7 +593,7 @@ int intel_sprite_set_colorkey(struct drm_device *dev, void *data,
         if ((set->flags & (I915_SET_COLORKEY_DESTINATION | I915_SET_COLORKEY_SOURCE)) == (I915_SET_COLORKEY_DESTINATION | I915_SET_COLORKEY_SOURCE))
                 return -EINVAL;
 
-        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
 
         obj = drm_mode_object_find(dev, set->plane_id, DRM_MODE_OBJECT_PLANE);
         if (!obj) {
@@ -608,7 +606,7 @@ int intel_sprite_set_colorkey(struct drm_device *dev, void *data,
         ret = intel_plane->update_colorkey(plane, set);
 
 out_unlock:
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
         return ret;
 }
 
@@ -624,7 +622,7 @@ int intel_sprite_get_colorkey(struct drm_device *dev, void *data,
         if (!drm_core_check_feature(dev, DRIVER_MODESET))
                 return -ENODEV;
 
-        mutex_lock(&dev->mode_config.mutex);
+        drm_modeset_lock_all(dev);
 
         obj = drm_mode_object_find(dev, get->plane_id, DRM_MODE_OBJECT_PLANE);
         if (!obj) {
@@ -637,7 +635,7 @@ int intel_sprite_get_colorkey(struct drm_device *dev, void *data,
         intel_plane->get_colorkey(plane, get);
 
 out_unlock:
-        mutex_unlock(&dev->mode_config.mutex);
+        drm_modeset_unlock_all(dev);
         return ret;
 }
 
diff --git a/drivers/gpu/drm/mgag200/mgag200_fb.c b/drivers/gpu/drm/mgag200/mgag200_fb.c
index 2f486481d79a..5c69b432f99a 100644
--- a/drivers/gpu/drm/mgag200/mgag200_fb.c
+++ b/drivers/gpu/drm/mgag200/mgag200_fb.c
@@ -247,6 +247,7 @@ static int mga_fbdev_destroy(struct drm_device *dev,
         }
         drm_fb_helper_fini(&mfbdev->helper);
         vfree(mfbdev->sysram);
+        drm_framebuffer_unregister_private(&mfb->base);
         drm_framebuffer_cleanup(&mfb->base);
 
         return 0;
diff --git a/drivers/gpu/drm/mgag200/mgag200_main.c b/drivers/gpu/drm/mgag200/mgag200_main.c
index 70dd3c5529d4..64297c72464f 100644
--- a/drivers/gpu/drm/mgag200/mgag200_main.c
+++ b/drivers/gpu/drm/mgag200/mgag200_main.c
@@ -23,16 +23,8 @@ static void mga_user_framebuffer_destroy(struct drm_framebuffer *fb)
         kfree(fb);
 }
 
-static int mga_user_framebuffer_create_handle(struct drm_framebuffer *fb,
-                                                 struct drm_file *file_priv,
-                                                 unsigned int *handle)
-{
-        return 0;
-}
-
 static const struct drm_framebuffer_funcs mga_fb_funcs = {
         .destroy = mga_user_framebuffer_destroy,
-        .create_handle = mga_user_framebuffer_create_handle,
 };
 
 int mgag200_framebuffer_init(struct drm_device *dev,
@@ -40,13 +32,15 @@ int mgag200_framebuffer_init(struct drm_device *dev,
                              struct drm_mode_fb_cmd2 *mode_cmd,
                              struct drm_gem_object *obj)
 {
-        int ret = drm_framebuffer_init(dev, &gfb->base, &mga_fb_funcs);
+        int ret;
+        
+        drm_helper_mode_fill_fb_struct(&gfb->base, mode_cmd);
+        gfb->obj = obj;
+        ret = drm_framebuffer_init(dev, &gfb->base, &mga_fb_funcs);
         if (ret) {
                 DRM_ERROR("drm_framebuffer_init failed: %d\n", ret);
                 return ret;
         }
-        drm_helper_mode_fill_fb_struct(&gfb->base, mode_cmd);
-        gfb->obj = obj;
         return 0;
 }
 
diff --git a/drivers/gpu/drm/nouveau/core/core/client.c b/drivers/gpu/drm/nouveau/core/core/client.c
index c617f0480071..8bbb58f94a19 100644
--- a/drivers/gpu/drm/nouveau/core/core/client.c
+++ b/drivers/gpu/drm/nouveau/core/core/client.c
@@ -66,10 +66,8 @@ nouveau_client_create_(const char *name, u64 devname, const char *cfg,
 
         ret = nouveau_handle_create(nv_object(client), ~0, ~0,
                                     nv_object(client), &client->root);
-        if (ret) {
-                nouveau_namedb_destroy(&client->base);
+        if (ret)
                 return ret;
-        }
 
         /* prevent init/fini being called, os in in charge of this */
         atomic_set(&nv_object(client)->usecount, 2);
diff --git a/drivers/gpu/drm/nouveau/core/core/handle.c b/drivers/gpu/drm/nouveau/core/core/handle.c
index b8d2cbf8a7a7..264c2b338ac3 100644
--- a/drivers/gpu/drm/nouveau/core/core/handle.c
+++ b/drivers/gpu/drm/nouveau/core/core/handle.c
@@ -109,7 +109,7 @@ nouveau_handle_create(struct nouveau_object *parent, u32 _parent, u32 _handle,
         while (!nv_iclass(namedb, NV_NAMEDB_CLASS))
                 namedb = namedb->parent;
 
-        handle = *phandle = kzalloc(sizeof(*handle), GFP_KERNEL);
+        handle = kzalloc(sizeof(*handle), GFP_KERNEL);
         if (!handle)
                 return -ENOMEM;
 
@@ -146,6 +146,9 @@ nouveau_handle_create(struct nouveau_object *parent, u32 _parent, u32 _handle,
         }
 
         hprintk(handle, TRACE, "created\n");
+
+        *phandle = handle;
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c b/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c
index 0f09af135415..ca1a7d76a95b 100644
--- a/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c
@@ -851,20 +851,23 @@ exec_script(struct nv50_disp_priv *priv, int head, int id)
         for (i = 0; !(ctrl & (1 << head)) && i < 3; i++)
                 ctrl = nv_rd32(priv, 0x610b5c + (i * 8));
 
-        if (nv_device(priv)->chipset  < 0x90 ||
-            nv_device(priv)->chipset == 0x92 ||
-            nv_device(priv)->chipset == 0xa0) {
-                for (i = 0; !(ctrl & (1 << head)) && i < 2; i++)
-                        ctrl = nv_rd32(priv, 0x610b74 + (i * 8));
-                i += 3;
-        } else {
-                for (i = 0; !(ctrl & (1 << head)) && i < 4; i++)
-                        ctrl = nv_rd32(priv, 0x610798 + (i * 8));
-                i += 3;
+        if (!(ctrl & (1 << head))) {
+                if (nv_device(priv)->chipset  < 0x90 ||
+                    nv_device(priv)->chipset == 0x92 ||
+                    nv_device(priv)->chipset == 0xa0) {
+                        for (i = 0; !(ctrl & (1 << head)) && i < 2; i++)
+                                ctrl = nv_rd32(priv, 0x610b74 + (i * 8));
+                        i += 4;
+                } else {
+                        for (i = 0; !(ctrl & (1 << head)) && i < 4; i++)
+                                ctrl = nv_rd32(priv, 0x610798 + (i * 8));
+                        i += 4;
+                }
         }
 
         if (!(ctrl & (1 << head)))
                 return false;
+        i--;
 
         data = exec_lookup(priv, head, i, ctrl, &dcb, &ver, &hdr, &cnt, &len, &info);
         if (data) {
@@ -898,20 +901,23 @@ exec_clkcmp(struct nv50_disp_priv *priv, int head, int id, u32 pclk,
         for (i = 0; !(ctrl & (1 << head)) && i < 3; i++)
                 ctrl = nv_rd32(priv, 0x610b58 + (i * 8));
 
-        if (nv_device(priv)->chipset  < 0x90 ||
-            nv_device(priv)->chipset == 0x92 ||
-            nv_device(priv)->chipset == 0xa0) {
-                for (i = 0; !(ctrl & (1 << head)) && i < 2; i++)
-                        ctrl = nv_rd32(priv, 0x610b70 + (i * 8));
-                i += 3;
-        } else {
-                for (i = 0; !(ctrl & (1 << head)) && i < 4; i++)
-                        ctrl = nv_rd32(priv, 0x610794 + (i * 8));
-                i += 3;
+        if (!(ctrl & (1 << head))) {
+                if (nv_device(priv)->chipset  < 0x90 ||
+                    nv_device(priv)->chipset == 0x92 ||
+                    nv_device(priv)->chipset == 0xa0) {
+                        for (i = 0; !(ctrl & (1 << head)) && i < 2; i++)
+                                ctrl = nv_rd32(priv, 0x610b70 + (i * 8));
+                        i += 4;
+                } else {
+                        for (i = 0; !(ctrl & (1 << head)) && i < 4; i++)
+                                ctrl = nv_rd32(priv, 0x610794 + (i * 8));
+                        i += 4;
+                }
         }
 
         if (!(ctrl & (1 << head)))
                 return 0x0000;
+        i--;
 
         data = exec_lookup(priv, head, i, ctrl, outp, &ver, &hdr, &cnt, &len, &info1);
         if (!data)
diff --git a/drivers/gpu/drm/nouveau/core/include/core/client.h b/drivers/gpu/drm/nouveau/core/include/core/client.h
index 0193532ceac9..63acc0346ff2 100644
--- a/drivers/gpu/drm/nouveau/core/include/core/client.h
+++ b/drivers/gpu/drm/nouveau/core/include/core/client.h
@@ -36,6 +36,9 @@ nouveau_client(void *obj)
 
 int  nouveau_client_create_(const char *name, u64 device, const char *cfg,
                             const char *dbg, int, void **);
+#define nouveau_client_destroy(p)                                              \
+        nouveau_namedb_destroy(&(p)->base)
+
 int  nouveau_client_init(struct nouveau_client *);
 int  nouveau_client_fini(struct nouveau_client *, bool suspend);
 
diff --git a/drivers/gpu/drm/nouveau/core/include/subdev/bios/pll.h b/drivers/gpu/drm/nouveau/core/include/subdev/bios/pll.h
index c345097592f2..b2f3d4d0aa49 100644
--- a/drivers/gpu/drm/nouveau/core/include/subdev/bios/pll.h
+++ b/drivers/gpu/drm/nouveau/core/include/subdev/bios/pll.h
@@ -38,6 +38,8 @@ enum nvbios_pll_type {
         PLL_UNK42  = 0x42,
         PLL_VPLL0  = 0x80,
         PLL_VPLL1  = 0x81,
+        PLL_VPLL2  = 0x82,
+        PLL_VPLL3  = 0x83,
         PLL_MAX    = 0xff
 };
 
diff --git a/drivers/gpu/drm/nouveau/core/subdev/bios/init.c b/drivers/gpu/drm/nouveau/core/subdev/bios/init.c
index 2917d552689b..690ed438b2ad 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/bios/init.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/bios/init.c
@@ -1534,7 +1534,6 @@ init_io(struct nvbios_init *init)
                 mdelay(10);
                 init_wr32(init, 0x614100, 0x10000018);
                 init_wr32(init, 0x614900, 0x10000018);
-                return;
         }
 
         value = init_rdport(init, port) & mask;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/clock/nvc0.c b/drivers/gpu/drm/nouveau/core/subdev/clock/nvc0.c
index f6962c9b6c36..7c9626258a46 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/clock/nvc0.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/clock/nvc0.c
@@ -52,6 +52,8 @@ nvc0_clock_pll_set(struct nouveau_clock *clk, u32 type, u32 freq)
         switch (info.type) {
         case PLL_VPLL0:
         case PLL_VPLL1:
+        case PLL_VPLL2:
+        case PLL_VPLL3:
                 nv_mask(priv, info.reg + 0x0c, 0x00000000, 0x00000100);
                 nv_wr32(priv, info.reg + 0x04, (P << 16) | (N << 8) | M);
                 nv_wr32(priv, info.reg + 0x10, fN << 16);
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/nvc0.c b/drivers/gpu/drm/nouveau/core/subdev/fb/nvc0.c
index 306bdf121452..7606ed15b6fa 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/nvc0.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/nvc0.c
@@ -145,14 +145,14 @@ nvc0_fb_vram_new(struct nouveau_fb *pfb, u64 size, u32 align, u32 ncmin,
         mem->memtype = type;
         mem->size = size;
 
-        mutex_lock(&mm->mutex);
+        mutex_lock(&pfb->base.mutex);
         do {
                 if (back)
                         ret = nouveau_mm_tail(mm, 1, size, ncmin, align, &r);
                 else
                         ret = nouveau_mm_head(mm, 1, size, ncmin, align, &r);
                 if (ret) {
-                        mutex_unlock(&mm->mutex);
+                        mutex_unlock(&pfb->base.mutex);
                         pfb->ram.put(pfb, &mem);
                         return ret;
                 }
@@ -160,7 +160,7 @@ nvc0_fb_vram_new(struct nouveau_fb *pfb, u64 size, u32 align, u32 ncmin,
                 list_add_tail(&r->rl_entry, &mem->regions);
                 size -= r->length;
         } while (size);
-        mutex_unlock(&mm->mutex);
+        mutex_unlock(&pfb->base.mutex);
 
         r = list_first_entry(&mem->regions, struct nouveau_mm_node, rl_entry);
         mem->offset = (u64)r->offset << 12;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/instmem/base.c b/drivers/gpu/drm/nouveau/core/subdev/instmem/base.c
index 1188227ca6aa..6565f3dbbe04 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/instmem/base.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/instmem/base.c
@@ -40,15 +40,21 @@ nouveau_instobj_create_(struct nouveau_object *parent,
         if (ret)
                 return ret;
 
+        mutex_lock(&imem->base.mutex);
         list_add(&iobj->head, &imem->list);
+        mutex_unlock(&imem->base.mutex);
         return 0;
 }
 
 void
 nouveau_instobj_destroy(struct nouveau_instobj *iobj)
 {
-        if (iobj->head.prev)
-                list_del(&iobj->head);
+        struct nouveau_subdev *subdev = nv_subdev(iobj->base.engine);
+
+        mutex_lock(&subdev->mutex);
+        list_del(&iobj->head);
+        mutex_unlock(&subdev->mutex);
+
         return nouveau_object_destroy(&iobj->base);
 }
 
@@ -88,6 +94,8 @@ nouveau_instmem_init(struct nouveau_instmem *imem)
         if (ret)
                 return ret;
 
+        mutex_lock(&imem->base.mutex);
+
         list_for_each_entry(iobj, &imem->list, head) {
                 if (iobj->suspend) {
                         for (i = 0; i < iobj->size; i += 4)
@@ -97,6 +105,8 @@ nouveau_instmem_init(struct nouveau_instmem *imem)
                 }
         }
 
+        mutex_unlock(&imem->base.mutex);
+
         return 0;
 }
 
@@ -104,17 +114,26 @@ int
 nouveau_instmem_fini(struct nouveau_instmem *imem, bool suspend)
 {
         struct nouveau_instobj *iobj;
-        int i;
+        int i, ret = 0;
 
         if (suspend) {
+                mutex_lock(&imem->base.mutex);
+
                 list_for_each_entry(iobj, &imem->list, head) {
                         iobj->suspend = vmalloc(iobj->size);
-                        if (iobj->suspend) {
-                                for (i = 0; i < iobj->size; i += 4)
-                                        iobj->suspend[i / 4] = nv_ro32(iobj, i);
-                        } else
-                                return -ENOMEM;
+                        if (!iobj->suspend) {
+                                ret = -ENOMEM;
+                                break;
+                        }
+
+                        for (i = 0; i < iobj->size; i += 4)
+                                iobj->suspend[i / 4] = nv_ro32(iobj, i);
                 }
+
+                mutex_unlock(&imem->base.mutex);
+
+                if (ret)
+                        return ret;
         }
 
         return nouveau_subdev_fini(&imem->base, suspend);
diff --git a/drivers/gpu/drm/nouveau/core/subdev/vm/base.c b/drivers/gpu/drm/nouveau/core/subdev/vm/base.c
index 082c11b75acb..77c67fc970e6 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/vm/base.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/vm/base.c
@@ -352,7 +352,7 @@ nouveau_vm_create(struct nouveau_vmmgr *vmm, u64 offset, u64 length,
         u64 mm_length = (offset + length) - mm_offset;
         int ret;
 
-        vm = *pvm = kzalloc(sizeof(*vm), GFP_KERNEL);
+        vm = kzalloc(sizeof(*vm), GFP_KERNEL);
         if (!vm)
                 return -ENOMEM;
 
@@ -376,6 +376,8 @@ nouveau_vm_create(struct nouveau_vmmgr *vmm, u64 offset, u64 length,
                 return ret;
         }
 
+        *pvm = vm;
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
index 69d7b1d0b9d6..64d6e3047dee 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -300,17 +300,18 @@ nouveau_bo_pin(struct nouveau_bo *nvbo, uint32_t memtype)
         struct ttm_buffer_object *bo = &nvbo->bo;
         int ret;
 
+        ret = ttm_bo_reserve(bo, false, false, false, 0);
+        if (ret)
+                goto out;
+
         if (nvbo->pin_refcnt && !(memtype & (1 << bo->mem.mem_type))) {
                 NV_ERROR(drm, "bo %p pinned elsewhere: 0x%08x vs 0x%08x\n", bo,
                          1 << bo->mem.mem_type, memtype);
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out;
         }
 
         if (nvbo->pin_refcnt++)
-                return 0;
-
-        ret = ttm_bo_reserve(bo, false, false, false, 0);
-        if (ret)
                 goto out;
 
         nouveau_bo_placement_set(nvbo, memtype, 0);
@@ -328,10 +329,8 @@ nouveau_bo_pin(struct nouveau_bo *nvbo, uint32_t memtype)
                         break;
                 }
         }
-        ttm_bo_unreserve(bo);
 out:
-        if (unlikely(ret))
-                nvbo->pin_refcnt--;
+        ttm_bo_unreserve(bo);
         return ret;
 }
 
@@ -342,13 +341,13 @@ nouveau_bo_unpin(struct nouveau_bo *nvbo)
         struct ttm_buffer_object *bo = &nvbo->bo;
         int ret;
 
-        if (--nvbo->pin_refcnt)
-                return 0;
-
         ret = ttm_bo_reserve(bo, false, false, false, 0);
         if (ret)
                 return ret;
 
+        if (--nvbo->pin_refcnt)
+                goto out;
+
         nouveau_bo_placement_set(nvbo, bo->mem.placement, 0);
 
         ret = nouveau_bo_validate(nvbo, false, false);
@@ -365,6 +364,7 @@ nouveau_bo_unpin(struct nouveau_bo *nvbo)
                 }
         }
 
+out:
         ttm_bo_unreserve(bo);
         return ret;
 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.h b/drivers/gpu/drm/nouveau/nouveau_bo.h
index 25ca37989d2c..81d00fe03b56 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.h
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.h
@@ -28,6 +28,8 @@ struct nouveau_bo {
         struct nouveau_drm_tile *tile;
 
         struct drm_gem_object *gem;
+
+        /* protect by the ttm reservation lock */
         int pin_refcnt;
 
         struct ttm_bo_kmap_obj dma_buf_vmap;
diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
index ac340ba32017..e620ba8271b4 100644
--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
@@ -127,12 +127,26 @@ nouveau_connector_ddc_detect(struct drm_connector *connector,
                              struct nouveau_encoder **pnv_encoder)
 {
         struct drm_device *dev = connector->dev;
+        struct nouveau_connector *nv_connector = nouveau_connector(connector);
         struct nouveau_drm *drm = nouveau_drm(dev);
+        struct nouveau_gpio *gpio = nouveau_gpio(drm->device);
         struct nouveau_i2c *i2c = nouveau_i2c(drm->device);
-        int i;
+        struct nouveau_i2c_port *port = NULL;
+        int i, panel = -ENODEV;
+
+        /* eDP panels need powering on by us (if the VBIOS doesn't default it
+         * to on) before doing any AUX channel transactions.  LVDS panel power
+         * is handled by the SOR itself, and not required for LVDS DDC.
+         */
+        if (nv_connector->type == DCB_CONNECTOR_eDP) {
+                panel = gpio->get(gpio, 0, DCB_GPIO_PANEL_POWER, 0xff);
+                if (panel == 0) {
+                        gpio->set(gpio, 0, DCB_GPIO_PANEL_POWER, 0xff, 1);
+                        msleep(300);
+                }
+        }
 
         for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
-                struct nouveau_i2c_port *port = NULL;
                 struct nouveau_encoder *nv_encoder;
                 struct drm_mode_object *obj;
                 int id;
@@ -150,11 +164,19 @@ nouveau_connector_ddc_detect(struct drm_connector *connector,
                         port = i2c->find(i2c, nv_encoder->dcb->i2c_index);
                 if (port && nv_probe_i2c(port, 0x50)) {
                         *pnv_encoder = nv_encoder;
-                        return port;
+                        break;
                 }
+
+                port = NULL;
         }
 
-        return NULL;
+        /* eDP panel not detected, restore panel power GPIO to previous
+         * state to avoid confusing the SOR for other output types.
+         */
+        if (!port && panel == 0)
+                gpio->set(gpio, 0, DCB_GPIO_PANEL_POWER, 0xff, panel);
+
+        return port;
 }
 
 static struct nouveau_encoder *
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index e4188f24fc75..d42c9e860c16 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -78,11 +78,6 @@ nouveau_framebuffer_init(struct drm_device *dev,
         struct drm_framebuffer *fb = &nv_fb->base;
         int ret;
 
-        ret = drm_framebuffer_init(dev, fb, &nouveau_framebuffer_funcs);
-        if (ret) {
-                return ret;
-        }
-
         drm_helper_mode_fill_fb_struct(fb, mode_cmd);
         nv_fb->nvbo = nvbo;
 
@@ -125,6 +120,11 @@ nouveau_framebuffer_init(struct drm_device *dev,
                 }
         }
 
+        ret = drm_framebuffer_init(dev, fb, &nouveau_framebuffer_funcs);
+        if (ret) {
+                return ret;
+        }
+
         return 0;
 }
 
@@ -225,15 +225,6 @@ nouveau_display_init(struct drm_device *dev)
         if (ret)
                 return ret;
 
-        /* power on internal panel if it's not already.  the init tables of
-         * some vbios default this to off for some reason, causing the
-         * panel to not work after resume
-         */
-        if (gpio && gpio->get(gpio, 0, DCB_GPIO_PANEL_POWER, 0xff) == 0) {
-                gpio->set(gpio, 0, DCB_GPIO_PANEL_POWER, 0xff, 1);
-                msleep(300);
-        }
-
         /* enable polling for external displays */
         drm_kms_helper_poll_enable(dev);
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 180a45e3b525..8b090f1eb51d 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -84,11 +84,16 @@ nouveau_cli_create(struct pci_dev *pdev, const char *name,
         struct nouveau_cli *cli;
         int ret;
 
+        *pcli = NULL;
         ret = nouveau_client_create_(name, nouveau_name(pdev), nouveau_config,
                                      nouveau_debug, size, pcli);
         cli = *pcli;
-        if (ret)
+        if (ret) {
+                if (cli)
+                        nouveau_client_destroy(&cli->base);
+                *pcli = NULL;
                 return ret;
+        }
 
         mutex_init(&cli->mutex);
         return 0;
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index 67a1a069de28..d4ecb4deb484 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -433,6 +433,7 @@ nouveau_fbcon_destroy(struct drm_device *dev, struct nouveau_fbdev *fbcon)
                 nouveau_fb->nvbo = NULL;
         }
         drm_fb_helper_fini(&fbcon->helper);
+        drm_framebuffer_unregister_private(&nouveau_fb->base);
         drm_framebuffer_cleanup(&nouveau_fb->base);
         return 0;
 }
diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.h b/drivers/gpu/drm/nouveau/nouveau_fence.h
index bedafd1c9539..cdb83acdffe2 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fence.h
+++ b/drivers/gpu/drm/nouveau/nouveau_fence.h
@@ -60,6 +60,7 @@ u32  nv10_fence_read(struct nouveau_channel *);
 void nv10_fence_context_del(struct nouveau_channel *);
 void nv10_fence_destroy(struct nouveau_drm *);
 int  nv10_fence_create(struct nouveau_drm *);
+void nv17_fence_resume(struct nouveau_drm *drm);
 
 int nv50_fence_create(struct nouveau_drm *);
 int nv84_fence_create(struct nouveau_drm *);
diff --git a/drivers/gpu/drm/nouveau/nv04_dfp.c b/drivers/gpu/drm/nouveau/nv04_dfp.c
index 184cdf806761..39ffc07f906b 100644
--- a/drivers/gpu/drm/nouveau/nv04_dfp.c
+++ b/drivers/gpu/drm/nouveau/nv04_dfp.c
@@ -505,7 +505,7 @@ static void nv04_dfp_update_backlight(struct drm_encoder *encoder, int mode)
 
 static inline bool is_powersaving_dpms(int mode)
 {
-        return (mode != DRM_MODE_DPMS_ON);
+        return mode != DRM_MODE_DPMS_ON && mode != NV_DPMS_CLEARED;
 }
 
 static void nv04_lvds_dpms(struct drm_encoder *encoder, int mode)
diff --git a/drivers/gpu/drm/nouveau/nv04_display.c b/drivers/gpu/drm/nouveau/nv04_display.c
index 2cd6fb8c548e..4c6e9f83fe82 100644
--- a/drivers/gpu/drm/nouveau/nv04_display.c
+++ b/drivers/gpu/drm/nouveau/nv04_display.c
@@ -140,7 +140,7 @@ nv04_display_destroy(struct drm_device *dev)
                         .crtc = crtc,
                 };
 
-                crtc->funcs->set_config(&modeset);
+                drm_mode_set_config_internal(&modeset);
         }
 
         /* Restore state */
diff --git a/drivers/gpu/drm/nouveau/nv10_fence.c b/drivers/gpu/drm/nouveau/nv10_fence.c
index 7ae7f97a6d4d..03017f24d593 100644
--- a/drivers/gpu/drm/nouveau/nv10_fence.c
+++ b/drivers/gpu/drm/nouveau/nv10_fence.c
@@ -162,6 +162,13 @@ nv10_fence_destroy(struct nouveau_drm *drm)
         kfree(priv);
 }
 
+void nv17_fence_resume(struct nouveau_drm *drm)
+{
+        struct nv10_fence_priv *priv = drm->fence;
+
+        nouveau_bo_wr32(priv->bo, 0, priv->sequence);
+}
+
 int
 nv10_fence_create(struct nouveau_drm *drm)
 {
@@ -197,6 +204,7 @@ nv10_fence_create(struct nouveau_drm *drm)
                 if (ret == 0) {
                         nouveau_bo_wr32(priv->bo, 0x000, 0x00000000);
                         priv->base.sync = nv17_fence_sync;
+                        priv->base.resume = nv17_fence_resume;
                 }
         }
 
diff --git a/drivers/gpu/drm/nouveau/nv17_tv.c b/drivers/gpu/drm/nouveau/nv17_tv.c
index 2ca276ada507..977e42be2050 100644
--- a/drivers/gpu/drm/nouveau/nv17_tv.c
+++ b/drivers/gpu/drm/nouveau/nv17_tv.c
@@ -768,7 +768,7 @@ static int nv17_tv_set_property(struct drm_encoder *encoder,
                                 .crtc = crtc,
                         };
 
-                        crtc->funcs->set_config(&modeset);
+                        drm_mode_set_config_internal(&modeset);
                 }
         }
 
diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c
index 35874085a61e..d4cbea19b890 100644
--- a/drivers/gpu/drm/nouveau/nv50_display.c
+++ b/drivers/gpu/drm/nouveau/nv50_display.c
@@ -128,6 +128,11 @@ struct nv50_dmac {
         struct nv50_chan base;
         dma_addr_t handle;
         u32 *ptr;
+
+        /* Protects against concurrent pushbuf access to this channel, lock is
+         * grabbed by evo_wait (if the pushbuf reservation is successful) and
+         * dropped again by evo_kick. */
+        struct mutex lock;
 };
 
 static void
@@ -271,6 +276,8 @@ nv50_dmac_create(struct nouveau_object *core, u32 bclass, u8 head,
         u32 pushbuf = *(u32 *)data;
         int ret;
 
+        mutex_init(&dmac->lock);
+
         dmac->ptr = pci_alloc_consistent(nv_device(core)->pdev, PAGE_SIZE,
                                         &dmac->handle);
         if (!dmac->ptr)
@@ -395,11 +402,13 @@ evo_wait(void *evoc, int nr)
         struct nv50_dmac *dmac = evoc;
         u32 put = nv_ro32(dmac->base.user, 0x0000) / 4;
 
+        mutex_lock(&dmac->lock);
         if (put + nr >= (PAGE_SIZE / 4) - 8) {
                 dmac->ptr[put] = 0x20000000;
 
                 nv_wo32(dmac->base.user, 0x0000, 0x00000000);
                 if (!nv_wait(dmac->base.user, 0x0004, ~0, 0x00000000)) {
+                        mutex_unlock(&dmac->lock);
                         NV_ERROR(dmac->base.user, "channel stalled\n");
                         return NULL;
                 }
@@ -415,6 +424,7 @@ evo_kick(u32 *push, void *evoc)
 {
         struct nv50_dmac *dmac = evoc;
         nv_wo32(dmac->base.user, 0x0000, (push - dmac->ptr) << 2);
+        mutex_unlock(&dmac->lock);
 }
 
 #define evo_mthd(p,m,s) *((p)++) = (((s) << 18) | (m))
diff --git a/drivers/gpu/drm/nouveau/nv50_fence.c b/drivers/gpu/drm/nouveau/nv50_fence.c
index c20f2727ea0b..d889f3ac0d41 100644
--- a/drivers/gpu/drm/nouveau/nv50_fence.c
+++ b/drivers/gpu/drm/nouveau/nv50_fence.c
@@ -122,6 +122,7 @@ nv50_fence_create(struct nouveau_drm *drm)
         if (ret == 0) {
                 nouveau_bo_wr32(priv->bo, 0x000, 0x00000000);
                 priv->base.sync = nv17_fence_sync;
+                priv->base.resume = nv17_fence_resume;
         }
 
         if (ret)
diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
index 03191a56eb44..69ec24ab8d63 100644
--- a/drivers/gpu/drm/radeon/r600_cs.c
+++ b/drivers/gpu/drm/radeon/r600_cs.c
@@ -2476,8 +2476,10 @@ static void r600_cs_parser_fini(struct radeon_cs_parser *parser, int error)
         kfree(parser->relocs);
         for (i = 0; i < parser->nchunks; i++) {
                 kfree(parser->chunks[i].kdata);
-                kfree(parser->chunks[i].kpage[0]);
-                kfree(parser->chunks[i].kpage[1]);
+                if (parser->rdev && (parser->rdev->flags & RADEON_IS_AGP)) {
+                        kfree(parser->chunks[i].kpage[0]);
+                        kfree(parser->chunks[i].kpage[1]);
+                }
         }
         kfree(parser->chunks);
         kfree(parser->chunks_array);
@@ -2561,16 +2563,16 @@ int r600_dma_cs_next_reloc(struct radeon_cs_parser *p,
         struct radeon_cs_chunk *relocs_chunk;
         unsigned idx;
 
+        *cs_reloc = NULL;
         if (p->chunk_relocs_idx == -1) {
                 DRM_ERROR("No relocation chunk !\n");
                 return -EINVAL;
         }
-        *cs_reloc = NULL;
         relocs_chunk = &p->chunks[p->chunk_relocs_idx];
         idx = p->dma_reloc_idx;
-        if (idx >= relocs_chunk->length_dw) {
+        if (idx >= p->nrelocs) {
                 DRM_ERROR("Relocs at %d after relocations chunk end %d !\n",
-                          idx, relocs_chunk->length_dw);
+                          idx, p->nrelocs);
                 return -EINVAL;
         }
         *cs_reloc = p->relocs_ptr[idx];
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index 396baba0141a..469661fd1903 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -279,13 +279,13 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
                                   p->chunks[p->chunk_ib_idx].length_dw);
                         return -EINVAL;
                 }
-                if ((p->rdev->flags & RADEON_IS_AGP)) {
+                if (p->rdev && (p->rdev->flags & RADEON_IS_AGP)) {
                         p->chunks[p->chunk_ib_idx].kpage[0] = kmalloc(PAGE_SIZE, GFP_KERNEL);
                         p->chunks[p->chunk_ib_idx].kpage[1] = kmalloc(PAGE_SIZE, GFP_KERNEL);
                         if (p->chunks[p->chunk_ib_idx].kpage[0] == NULL ||
                             p->chunks[p->chunk_ib_idx].kpage[1] == NULL) {
-                                kfree(p->chunks[i].kpage[0]);
-                                kfree(p->chunks[i].kpage[1]);
+                                kfree(p->chunks[p->chunk_ib_idx].kpage[0]);
+                                kfree(p->chunks[p->chunk_ib_idx].kpage[1]);
                                 return -ENOMEM;
                         }
                 }
@@ -583,7 +583,8 @@ static int radeon_cs_update_pages(struct radeon_cs_parser *p, int pg_idx)
         struct radeon_cs_chunk *ibc = &p->chunks[p->chunk_ib_idx];
         int i;
         int size = PAGE_SIZE;
-        bool copy1 = (p->rdev->flags & RADEON_IS_AGP) ? false : true;
+        bool copy1 = (p->rdev && (p->rdev->flags & RADEON_IS_AGP)) ?
+                false : true;
 
         for (i = ibc->last_copied_page + 1; i < pg_idx; i++) {
                 if (DRM_COPY_FROM_USER(p->ib.ptr + (i * (PAGE_SIZE/4)),
diff --git a/drivers/gpu/drm/radeon/radeon_cursor.c b/drivers/gpu/drm/radeon/radeon_cursor.c
index ad6df625e8b8..c1680e6d76ad 100644
--- a/drivers/gpu/drm/radeon/radeon_cursor.c
+++ b/drivers/gpu/drm/radeon/radeon_cursor.c
@@ -245,8 +245,14 @@ int radeon_crtc_cursor_move(struct drm_crtc *crtc,
                 int i = 0;
                 struct drm_crtc *crtc_p;
 
-                /* avivo cursor image can't end on 128 pixel boundary or
+                /*
+                 * avivo cursor image can't end on 128 pixel boundary or
                  * go past the end of the frame if both crtcs are enabled
+                 *
+                 * NOTE: It is safe to access crtc->enabled of other crtcs
+                 * without holding either the mode_config lock or the other
+                 * crtc's lock as long as write access to this flag _always_
+                 * grabs all locks.
                  */
                 list_for_each_entry(crtc_p, &crtc->dev->mode_config.crtc_list, head) {
                         if (crtc_p->enabled)
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index 1da2386d7cf7..12ec3effb409 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -1089,12 +1089,12 @@ radeon_framebuffer_init(struct drm_device *dev,
 {
         int ret;
         rfb->obj = obj;
+        drm_helper_mode_fill_fb_struct(&rfb->base, mode_cmd);
         ret = drm_framebuffer_init(dev, &rfb->base, &radeon_fb_funcs);
         if (ret) {
                 rfb->obj = NULL;
                 return ret;
         }
-        drm_helper_mode_fill_fb_struct(&rfb->base, mode_cmd);
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c
index cc8489d8c6d1..515e5ee1f9ee 100644
--- a/drivers/gpu/drm/radeon/radeon_fb.c
+++ b/drivers/gpu/drm/radeon/radeon_fb.c
@@ -293,6 +293,7 @@ out_unref:
         }
         if (fb && ret) {
                 drm_gem_object_unreference(gobj);
+                drm_framebuffer_unregister_private(fb);
                 drm_framebuffer_cleanup(fb);
                 kfree(fb);
         }
@@ -339,6 +340,7 @@ static int radeon_fbdev_destroy(struct drm_device *dev, struct radeon_fbdev *rfb
                 rfb->obj = NULL;
         }
         drm_fb_helper_fini(&rfbdev->helper);
+        drm_framebuffer_unregister_private(&rfb->base);
         drm_framebuffer_cleanup(&rfb->base);
 
         return 0;
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
index f5ba2241dacc..62cd512f5c8d 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
@@ -640,6 +640,14 @@ static enum drm_connector_status radeon_legacy_primary_dac_detect(struct drm_enc
         enum drm_connector_status found = connector_status_disconnected;
         bool color = true;
 
+        /* just don't bother on RN50 those chip are often connected to remoting
+         * console hw and often we get failure to load detect those. So to make
+         * everyone happy report the encoder as always connected.
+         */
+        if (ASIC_IS_RN50(rdev)) {
+                return connector_status_connected;
+        }
+
         /* save the regs we need */
         vclk_ecp_cntl = RREG32_PLL(RADEON_VCLK_ECP_CNTL);
         crtc_ext_cntl = RREG32(RADEON_CRTC_EXT_CNTL);
diff --git a/drivers/gpu/drm/shmobile/shmob_drm_drv.c b/drivers/gpu/drm/shmobile/shmob_drm_drv.c
index d1d5306ebf24..f6e0b5395051 100644
--- a/drivers/gpu/drm/shmobile/shmob_drm_drv.c
+++ b/drivers/gpu/drm/shmobile/shmob_drm_drv.c
@@ -313,9 +313,9 @@ static int shmob_drm_pm_resume(struct device *dev)
 {
         struct shmob_drm_device *sdev = dev_get_drvdata(dev);
 
-        mutex_lock(&sdev->ddev->mode_config.mutex);
+        drm_modeset_lock_all(sdev->ddev);
         shmob_drm_crtc_resume(&sdev->crtc);
-        mutex_unlock(&sdev->ddev->mode_config.mutex);
+        drm_modeset_unlock_all(sdev->ddev);
 
         drm_kms_helper_poll_enable(sdev->ddev);
         return 0;
diff --git a/drivers/gpu/drm/udl/udl_connector.c b/drivers/gpu/drm/udl/udl_connector.c
index 512f44add89f..fe5cdbcf2636 100644
--- a/drivers/gpu/drm/udl/udl_connector.c
+++ b/drivers/gpu/drm/udl/udl_connector.c
@@ -22,13 +22,17 @@
 static u8 *udl_get_edid(struct udl_device *udl)
 {
         u8 *block;
-        char rbuf[3];
+        char *rbuf;
         int ret, i;
 
         block = kmalloc(EDID_LENGTH, GFP_KERNEL);
         if (block == NULL)
                 return NULL;
 
+        rbuf = kmalloc(2, GFP_KERNEL);
+        if (rbuf == NULL)
+                goto error;
+
         for (i = 0; i < EDID_LENGTH; i++) {
                 ret = usb_control_msg(udl->ddev->usbdev,
                                       usb_rcvctrlpipe(udl->ddev->usbdev, 0), (0x02),
@@ -36,16 +40,17 @@ static u8 *udl_get_edid(struct udl_device *udl)
                                       HZ);
                 if (ret < 1) {
                         DRM_ERROR("Read EDID byte %d failed err %x\n", i, ret);
-                        i--;
                         goto error;
                 }
                 block[i] = rbuf[1];
         }
 
+        kfree(rbuf);
         return block;
 
 error:
         kfree(block);
+        kfree(rbuf);
         return NULL;
 }
 
@@ -57,6 +62,14 @@ static int udl_get_modes(struct drm_connector *connector)
 
         edid = (struct edid *)udl_get_edid(udl);
 
+        /*
+         * We only read the main block, but if the monitor reports extension
+         * blocks then the drm edid code expects them to be present, so patch
+         * the extension count to 0.
+         */
+        edid->checksum += edid->extensions;
+        edid->extensions = 0;
+
         drm_mode_connector_update_edid_property(connector, edid);
         ret = drm_add_edid_modes(connector, edid);
         kfree(edid);
diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
index d4ab3beaada0..caa84f1de9c1 100644
--- a/drivers/gpu/drm/udl/udl_fb.c
+++ b/drivers/gpu/drm/udl/udl_fb.c
@@ -422,7 +422,6 @@ static void udl_user_framebuffer_destroy(struct drm_framebuffer *fb)
 static const struct drm_framebuffer_funcs udlfb_funcs = {
         .destroy = udl_user_framebuffer_destroy,
         .dirty = udl_user_framebuffer_dirty,
-        .create_handle = NULL,
 };
 
 
@@ -435,8 +434,8 @@ udl_framebuffer_init(struct drm_device *dev,
         int ret;
 
         ufb->obj = obj;
-        ret = drm_framebuffer_init(dev, &ufb->base, &udlfb_funcs);
         drm_helper_mode_fill_fb_struct(&ufb->base, mode_cmd);
+        ret = drm_framebuffer_init(dev, &ufb->base, &udlfb_funcs);
         return ret;
 }
 
@@ -556,6 +555,7 @@ static void udl_fbdev_destroy(struct drm_device *dev,
                 framebuffer_release(info);
         }
         drm_fb_helper_fini(&ufbdev->helper);
+        drm_framebuffer_unregister_private(&ufbdev->ufb.base);
         drm_framebuffer_cleanup(&ufbdev->ufb.base);
         drm_gem_object_unreference_unlocked(&ufbdev->ufb.obj->base);
 }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index 161f8b2549aa..07dfd823cc30 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -829,7 +829,7 @@ static void vmw_lastclose(struct drm_device *dev)
 
         list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
                 set.crtc = crtc;
-                ret = crtc->funcs->set_config(&set);
+                ret = drm_mode_set_config_internal(&set);
                 WARN_ON(ret != 0);
         }
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
index d9fbbe191071..c509d40c4897 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
@@ -131,7 +131,7 @@ int vmw_present_ioctl(struct drm_device *dev, void *data,
         struct vmw_master *vmaster = vmw_master(file_priv->master);
         struct drm_vmw_rect __user *clips_ptr;
         struct drm_vmw_rect *clips = NULL;
-        struct drm_mode_object *obj;
+        struct drm_framebuffer *fb;
         struct vmw_framebuffer *vfb;
         struct vmw_resource *res;
         uint32_t num_clips;
@@ -163,19 +163,15 @@ int vmw_present_ioctl(struct drm_device *dev, void *data,
                 goto out_no_copy;
         }
 
-        ret = mutex_lock_interruptible(&dev->mode_config.mutex);
-        if (unlikely(ret != 0)) {
-                ret = -ERESTARTSYS;
-                goto out_no_mode_mutex;
-        }
+        drm_modeset_lock_all(dev);
 
-        obj = drm_mode_object_find(dev, arg->fb_id, DRM_MODE_OBJECT_FB);
-        if (!obj) {
+        fb = drm_framebuffer_lookup(dev, arg->fb_id);
+        if (!fb) {
                 DRM_ERROR("Invalid framebuffer id.\n");
                 ret = -EINVAL;
                 goto out_no_fb;
         }
-        vfb = vmw_framebuffer_to_vfb(obj_to_fb(obj));
+        vfb = vmw_framebuffer_to_vfb(fb);
 
         ret = ttm_read_lock(&vmaster->lock, true);
         if (unlikely(ret != 0))
@@ -199,9 +195,9 @@ int vmw_present_ioctl(struct drm_device *dev, void *data,
 out_no_surface:
         ttm_read_unlock(&vmaster->lock);
 out_no_ttm_lock:
+        drm_framebuffer_unreference(fb);
 out_no_fb:
-        mutex_unlock(&dev->mode_config.mutex);
-out_no_mode_mutex:
+        drm_modeset_unlock_all(dev);
 out_no_copy:
         kfree(clips);
 out_clips:
@@ -220,7 +216,7 @@ int vmw_present_readback_ioctl(struct drm_device *dev, void *data,
         struct vmw_master *vmaster = vmw_master(file_priv->master);
         struct drm_vmw_rect __user *clips_ptr;
         struct drm_vmw_rect *clips = NULL;
-        struct drm_mode_object *obj;
+        struct drm_framebuffer *fb;
         struct vmw_framebuffer *vfb;
         uint32_t num_clips;
         int ret;
@@ -251,24 +247,20 @@ int vmw_present_readback_ioctl(struct drm_device *dev, void *data,
                 goto out_no_copy;
         }
 
-        ret = mutex_lock_interruptible(&dev->mode_config.mutex);
-        if (unlikely(ret != 0)) {
-                ret = -ERESTARTSYS;
-                goto out_no_mode_mutex;
-        }
+        drm_modeset_lock_all(dev);
 
-        obj = drm_mode_object_find(dev, arg->fb_id, DRM_MODE_OBJECT_FB);
-        if (!obj) {
+        fb = drm_framebuffer_lookup(dev, arg->fb_id);
+        if (!fb) {
                 DRM_ERROR("Invalid framebuffer id.\n");
                 ret = -EINVAL;
                 goto out_no_fb;
         }
 
-        vfb = vmw_framebuffer_to_vfb(obj_to_fb(obj));
+        vfb = vmw_framebuffer_to_vfb(fb);
         if (!vfb->dmabuf) {
                 DRM_ERROR("Framebuffer not dmabuf backed.\n");
                 ret = -EINVAL;
-                goto out_no_fb;
+                goto out_no_ttm_lock;
         }
 
         ret = ttm_read_lock(&vmaster->lock, true);
@@ -281,9 +273,9 @@ int vmw_present_readback_ioctl(struct drm_device *dev, void *data,
 
         ttm_read_unlock(&vmaster->lock);
 out_no_ttm_lock:
+        drm_framebuffer_unreference(fb);
 out_no_fb:
-        mutex_unlock(&dev->mode_config.mutex);
-out_no_mode_mutex:
+        drm_modeset_unlock_all(dev);
 out_no_copy:
         kfree(clips);
 out_clips:
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index 54743943d8b3..3e3c7ab33ca2 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -180,16 +180,29 @@ int vmw_du_crtc_cursor_set(struct drm_crtc *crtc, struct drm_file *file_priv,
         struct vmw_dma_buffer *dmabuf = NULL;
         int ret;
 
+        /*
+         * FIXME: Unclear whether there's any global state touched by the
+         * cursor_set function, especially vmw_cursor_update_position looks
+         * suspicious. For now take the easy route and reacquire all locks. We
+         * can do this since the caller in the drm core doesn't check anything
+         * which is protected by any looks.
+         */
+        mutex_unlock(&crtc->mutex);
+        drm_modeset_lock_all(dev_priv->dev);
+
         /* A lot of the code assumes this */
-        if (handle && (width != 64 || height != 64))
-                return -EINVAL;
+        if (handle && (width != 64 || height != 64)) {
+                ret = -EINVAL;
+                goto out;
+        }
 
         if (handle) {
                 ret = vmw_user_lookup_handle(dev_priv, tfile,
                                              handle, &surface, &dmabuf);
                 if (ret) {
                         DRM_ERROR("failed to find surface or dmabuf: %i\n", ret);
-                        return -EINVAL;
+                        ret = -EINVAL;
+                        goto out;
                 }
         }
 
@@ -197,7 +210,8 @@ int vmw_du_crtc_cursor_set(struct drm_crtc *crtc, struct drm_file *file_priv,
         if (surface && !surface->snooper.image) {
                 DRM_ERROR("surface not suitable for cursor\n");
                 vmw_surface_unreference(&surface);
-                return -EINVAL;
+                ret = -EINVAL;
+                goto out;
         }
 
         /* takedown old cursor */
@@ -225,14 +239,20 @@ int vmw_du_crtc_cursor_set(struct drm_crtc *crtc, struct drm_file *file_priv,
                                                du->hotspot_x, du->hotspot_y);
         } else {
                 vmw_cursor_update_position(dev_priv, false, 0, 0);
-                return 0;
+                ret = 0;
+                goto out;
         }
 
         vmw_cursor_update_position(dev_priv, true,
                                    du->cursor_x + du->hotspot_x,
                                    du->cursor_y + du->hotspot_y);
 
-        return 0;
+        ret = 0;
+out:
+        drm_modeset_unlock_all(dev_priv->dev);
+        mutex_lock(&crtc->mutex);
+
+        return ret;
 }
 
 int vmw_du_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)
@@ -244,10 +264,23 @@ int vmw_du_crtc_cursor_move(struct drm_crtc *crtc, int x, int y)
         du->cursor_x = x + crtc->x;
         du->cursor_y = y + crtc->y;
 
+        /*
+         * FIXME: Unclear whether there's any global state touched by the
+         * cursor_set function, especially vmw_cursor_update_position looks
+         * suspicious. For now take the easy route and reacquire all locks. We
+         * can do this since the caller in the drm core doesn't check anything
+         * which is protected by any looks.
+         */
+        mutex_unlock(&crtc->mutex);
+        drm_modeset_lock_all(dev_priv->dev);
+
         vmw_cursor_update_position(dev_priv, shown,
                                    du->cursor_x + du->hotspot_x,
                                    du->cursor_y + du->hotspot_y);
 
+        drm_modeset_unlock_all(dev_priv->dev);
+        mutex_lock(&crtc->mutex);
+
         return 0;
 }
 
@@ -373,16 +406,6 @@ void vmw_kms_cursor_post_execbuf(struct vmw_private *dev_priv)
  * Generic framebuffer code
  */
 
-int vmw_framebuffer_create_handle(struct drm_framebuffer *fb,
-                                  struct drm_file *file_priv,
-                                  unsigned int *handle)
-{
-        if (handle)
-                *handle = 0;
-
-        return 0;
-}
-
 /*
  * Surface framebuffer code
  */
@@ -610,7 +633,6 @@ int vmw_framebuffer_surface_dirty(struct drm_framebuffer *framebuffer,
 static struct drm_framebuffer_funcs vmw_framebuffer_surface_funcs = {
         .destroy = vmw_framebuffer_surface_destroy,
         .dirty = vmw_framebuffer_surface_dirty,
-        .create_handle = vmw_framebuffer_create_handle,
 };
 
 static int vmw_kms_new_framebuffer_surface(struct vmw_private *dev_priv,
@@ -681,14 +703,10 @@ static int vmw_kms_new_framebuffer_surface(struct vmw_private *dev_priv,
                 goto out_err1;
         }
 
-        ret = drm_framebuffer_init(dev, &vfbs->base.base,
-                                   &vmw_framebuffer_surface_funcs);
-        if (ret)
-                goto out_err2;
-
         if (!vmw_surface_reference(surface)) {
                 DRM_ERROR("failed to reference surface %p\n", surface);
-                goto out_err3;
+                ret = -EINVAL;
+                goto out_err2;
         }
 
         /* XXX get the first 3 from the surface info */
@@ -707,10 +725,15 @@ static int vmw_kms_new_framebuffer_surface(struct vmw_private *dev_priv,
 
         *out = &vfbs->base;
 
+        ret = drm_framebuffer_init(dev, &vfbs->base.base,
+                                   &vmw_framebuffer_surface_funcs);
+        if (ret)
+                goto out_err3;
+
         return 0;
 
 out_err3:
-        drm_framebuffer_cleanup(&vfbs->base.base);
+        vmw_surface_unreference(&surface);
 out_err2:
         kfree(vfbs);
 out_err1:
@@ -960,7 +983,6 @@ int vmw_framebuffer_dmabuf_dirty(struct drm_framebuffer *framebuffer,
 static struct drm_framebuffer_funcs vmw_framebuffer_dmabuf_funcs = {
         .destroy = vmw_framebuffer_dmabuf_destroy,
         .dirty = vmw_framebuffer_dmabuf_dirty,
-        .create_handle = vmw_framebuffer_create_handle,
 };
 
 /**
@@ -1053,14 +1075,10 @@ static int vmw_kms_new_framebuffer_dmabuf(struct vmw_private *dev_priv,
                 goto out_err1;
         }
 
-        ret = drm_framebuffer_init(dev, &vfbd->base.base,
-                                   &vmw_framebuffer_dmabuf_funcs);
-        if (ret)
-                goto out_err2;
-
         if (!vmw_dmabuf_reference(dmabuf)) {
                 DRM_ERROR("failed to reference dmabuf %p\n", dmabuf);
-                goto out_err3;
+                ret = -EINVAL;
+                goto out_err2;
         }
 
         vfbd->base.base.bits_per_pixel = mode_cmd->bpp;
@@ -1077,10 +1095,15 @@ static int vmw_kms_new_framebuffer_dmabuf(struct vmw_private *dev_priv,
         vfbd->base.user_handle = mode_cmd->handle;
         *out = &vfbd->base;
 
+        ret = drm_framebuffer_init(dev, &vfbd->base.base,
+                                   &vmw_framebuffer_dmabuf_funcs);
+        if (ret)
+                goto out_err3;
+
         return 0;
 
 out_err3:
-        drm_framebuffer_cleanup(&vfbd->base.base);
+        vmw_dmabuf_unreference(&dmabuf);
 out_err2:
         kfree(vfbd);
 out_err1:
diff --git a/drivers/hwmon/vexpress.c b/drivers/hwmon/vexpress.c
index 86d7f6d858b1..d867e6bb2be1 100644
--- a/drivers/hwmon/vexpress.c
+++ b/drivers/hwmon/vexpress.c
@@ -19,6 +19,7 @@
 #include <linux/hwmon.h>
 #include <linux/hwmon-sysfs.h>
 #include <linux/module.h>
+#include <linux/of.h>
 #include <linux/of_device.h>
 #include <linux/platform_device.h>
 #include <linux/vexpress.h>
diff --git a/drivers/iio/accel/Kconfig b/drivers/iio/accel/Kconfig
index fe4bcd7c5b12..05e996fafc9d 100644
--- a/drivers/iio/accel/Kconfig
+++ b/drivers/iio/accel/Kconfig
@@ -8,6 +8,7 @@ config HID_SENSOR_ACCEL_3D
         select IIO_BUFFER
         select IIO_TRIGGERED_BUFFER
         select HID_SENSOR_IIO_COMMON
+        select HID_SENSOR_IIO_TRIGGER
         tristate "HID Accelerometers 3D"
         help
           Say yes here to build support for the HID SENSOR
diff --git a/drivers/iio/adc/ad7266.c b/drivers/iio/adc/ad7266.c
index 4a5f639bc684..bbad9b94cd75 100644
--- a/drivers/iio/adc/ad7266.c
+++ b/drivers/iio/adc/ad7266.c
@@ -411,7 +411,11 @@ static int ad7266_probe(struct spi_device *spi)
                 if (ret)
                         goto error_put_reg;
 
-                st->vref_uv = regulator_get_voltage(st->reg);
+                ret = regulator_get_voltage(st->reg);
+                if (ret < 0)
+                        goto error_disable_reg;
+
+                st->vref_uv = ret;
         } else {
                 /* Use internal reference */
                 st->vref_uv = 2500000;
diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
index 04b013561f0f..a526c0e3aaa8 100644
--- a/drivers/iio/adc/at91_adc.c
+++ b/drivers/iio/adc/at91_adc.c
@@ -80,7 +80,7 @@ static irqreturn_t at91_adc_trigger_handler(int irq, void *p)
                 *timestamp = pf->timestamp;
         }
 
-        iio_push_to_buffers(indio_dev, (u8 *)st->buffer);
+        iio_push_to_buffers(idev, (u8 *)st->buffer);
 
         iio_trigger_notify_done(idev->trig);
 
diff --git a/drivers/iio/adc/max1363.c b/drivers/iio/adc/max1363.c
index b5669be6f396..03b25b3dc71e 100644
--- a/drivers/iio/adc/max1363.c
+++ b/drivers/iio/adc/max1363.c
@@ -1605,19 +1605,20 @@ static int max1363_probe(struct i2c_client *client,
 
         return 0;
 error_free_irq:
-        free_irq(st->client->irq, indio_dev);
+        if (client->irq)
+                free_irq(st->client->irq, indio_dev);
 error_uninit_buffer:
         iio_buffer_unregister(indio_dev);
 error_cleanup_buffer:
         max1363_buffer_cleanup(indio_dev);
 error_free_available_scan_masks:
         kfree(indio_dev->available_scan_masks);
-error_unregister_map:
-        iio_map_array_unregister(indio_dev, client->dev.platform_data);
 error_disable_reg:
         regulator_disable(st->reg);
 error_put_reg:
         regulator_put(st->reg);
+error_unregister_map:
+        iio_map_array_unregister(indio_dev, client->dev.platform_data);
 error_free_device:
         iio_device_free(indio_dev);
 error_out:
@@ -1635,10 +1636,8 @@ static int max1363_remove(struct i2c_client *client)
         iio_buffer_unregister(indio_dev);
         max1363_buffer_cleanup(indio_dev);
         kfree(indio_dev->available_scan_masks);
-        if (!IS_ERR(st->reg)) {
-                regulator_disable(st->reg);
-                regulator_put(st->reg);
-        }
+        regulator_disable(st->reg);
+        regulator_put(st->reg);
         iio_map_array_unregister(indio_dev, client->dev.platform_data);
         iio_device_free(indio_dev);
 
diff --git a/drivers/iio/common/hid-sensors/Kconfig b/drivers/iio/common/hid-sensors/Kconfig
index ae10778da7aa..1178121b55b0 100644
--- a/drivers/iio/common/hid-sensors/Kconfig
+++ b/drivers/iio/common/hid-sensors/Kconfig
@@ -6,7 +6,7 @@ menu "Hid Sensor IIO Common"
 config HID_SENSOR_IIO_COMMON
         tristate "Common modules for all HID Sensor IIO drivers"
         depends on HID_SENSOR_HUB
-        select IIO_TRIGGER if IIO_BUFFER
+        select HID_SENSOR_IIO_TRIGGER if IIO_BUFFER
         help
           Say yes here to build support for HID sensor to use
           HID sensor common processing for attributes and IIO triggers.
@@ -14,6 +14,17 @@ config HID_SENSOR_IIO_COMMON
           HID sensor drivers, this module contains processing for those
           attributes.
 
+config HID_SENSOR_IIO_TRIGGER
+        tristate "Common module (trigger) for all HID Sensor IIO drivers"
+        depends on HID_SENSOR_HUB && HID_SENSOR_IIO_COMMON
+        select IIO_TRIGGER
+        help
+          Say yes here to build trigger support for HID sensors.
+          Triggers will be send if all requested attributes were read.
+
+          If this driver is compiled as a module, it will be named
+          hid-sensor-trigger.
+
 config HID_SENSOR_ENUM_BASE_QUIRKS
         bool "ENUM base quirks for HID Sensor IIO drivers"
         depends on HID_SENSOR_IIO_COMMON
diff --git a/drivers/iio/common/hid-sensors/Makefile b/drivers/iio/common/hid-sensors/Makefile
index 1f463e00c242..22e7c5a82325 100644
--- a/drivers/iio/common/hid-sensors/Makefile
+++ b/drivers/iio/common/hid-sensors/Makefile
@@ -3,4 +3,5 @@
 #
 
 obj-$(CONFIG_HID_SENSOR_IIO_COMMON) += hid-sensor-iio-common.o
-hid-sensor-iio-common-y := hid-sensor-attributes.o hid-sensor-trigger.o
+obj-$(CONFIG_HID_SENSOR_IIO_TRIGGER) += hid-sensor-trigger.o
+hid-sensor-iio-common-y := hid-sensor-attributes.o
diff --git a/drivers/iio/dac/ad5380.c b/drivers/iio/dac/ad5380.c
index 6c7898c765d9..483fc379a2da 100644
--- a/drivers/iio/dac/ad5380.c
+++ b/drivers/iio/dac/ad5380.c
@@ -406,7 +406,11 @@ static int ad5380_probe(struct device *dev, struct regmap *regmap,
                         goto error_free_reg;
                 }
 
-                st->vref = regulator_get_voltage(st->vref_reg);
+                ret = regulator_get_voltage(st->vref_reg);
+                if (ret < 0)
+                        goto error_disable_reg;
+
+                st->vref = ret;
         } else {
                 st->vref = st->chip_info->int_vref;
                 ctrl |= AD5380_CTRL_INT_VREF_EN;
diff --git a/drivers/iio/dac/ad5446.c b/drivers/iio/dac/ad5446.c
index 29f653dab2f7..f5583aedfb59 100644
--- a/drivers/iio/dac/ad5446.c
+++ b/drivers/iio/dac/ad5446.c
@@ -226,7 +226,11 @@ static int ad5446_probe(struct device *dev, const char *name,
                 if (ret)
                         goto error_put_reg;
 
-                voltage_uv = regulator_get_voltage(reg);
+                ret = regulator_get_voltage(reg);
+                if (ret < 0)
+                        goto error_disable_reg;
+
+                voltage_uv = ret;
         }
 
         indio_dev = iio_device_alloc(sizeof(*st));
diff --git a/drivers/iio/dac/ad5504.c b/drivers/iio/dac/ad5504.c
index b2a31a0468ed..0661829f2773 100644
--- a/drivers/iio/dac/ad5504.c
+++ b/drivers/iio/dac/ad5504.c
@@ -296,7 +296,11 @@ static int ad5504_probe(struct spi_device *spi)
                 if (ret)
                         goto error_put_reg;
 
-                voltage_uv = regulator_get_voltage(reg);
+                ret = regulator_get_voltage(reg);
+                if (ret < 0)
+                        goto error_disable_reg;
+
+                voltage_uv = ret;
         }
 
         spi_set_drvdata(spi, indio_dev);
diff --git a/drivers/iio/dac/ad5624r_spi.c b/drivers/iio/dac/ad5624r_spi.c
index e9947969f9fe..f6e116627b71 100644
--- a/drivers/iio/dac/ad5624r_spi.c
+++ b/drivers/iio/dac/ad5624r_spi.c
@@ -238,7 +238,11 @@ static int ad5624r_probe(struct spi_device *spi)
                 if (ret)
                         goto error_put_reg;
 
-                voltage_uv = regulator_get_voltage(st->reg);
+                ret = regulator_get_voltage(st->reg);
+                if (ret < 0)
+                        goto error_disable_reg;
+
+                voltage_uv = ret;
         }
 
         spi_set_drvdata(spi, indio_dev);
diff --git a/drivers/iio/dac/ad5686.c b/drivers/iio/dac/ad5686.c
index 36e51382ae52..ca9609d7a15c 100644
--- a/drivers/iio/dac/ad5686.c
+++ b/drivers/iio/dac/ad5686.c
@@ -332,7 +332,11 @@ static int ad5686_probe(struct spi_device *spi)
                 if (ret)
                         goto error_put_reg;
 
-                voltage_uv = regulator_get_voltage(st->reg);
+                ret = regulator_get_voltage(st->reg);
+                if (ret < 0)
+                        goto error_disable_reg;
+
+                voltage_uv = ret;
         }
 
         st->chip_info =
diff --git a/drivers/iio/dac/ad5791.c b/drivers/iio/dac/ad5791.c
index c84180f23139..6407b5407ddd 100644
--- a/drivers/iio/dac/ad5791.c
+++ b/drivers/iio/dac/ad5791.c
@@ -365,7 +365,11 @@ static int ad5791_probe(struct spi_device *spi)
                 if (ret)
                         goto error_put_reg_pos;
 
-                pos_voltage_uv = regulator_get_voltage(st->reg_vdd);
+                ret = regulator_get_voltage(st->reg_vdd);
+                if (ret < 0)
+                        goto error_disable_reg_pos;
+
+                pos_voltage_uv = ret;
         }
 
         st->reg_vss = regulator_get(&spi->dev, "vss");
@@ -374,7 +378,11 @@ static int ad5791_probe(struct spi_device *spi)
                 if (ret)
                         goto error_put_reg_neg;
 
-                neg_voltage_uv = regulator_get_voltage(st->reg_vss);
+                ret = regulator_get_voltage(st->reg_vss);
+                if (ret < 0)
+                        goto error_disable_reg_neg;
+
+                neg_voltage_uv = ret;
         }
 
         st->pwr_down = true;
@@ -428,6 +436,7 @@ error_put_reg_neg:
         if (!IS_ERR(st->reg_vss))
                 regulator_put(st->reg_vss);
 
+error_disable_reg_pos:
         if (!IS_ERR(st->reg_vdd))
                 regulator_disable(st->reg_vdd);
 error_put_reg_pos:
diff --git a/drivers/iio/frequency/adf4350.c b/drivers/iio/frequency/adf4350.c
index e5033b4cfba0..a884252ac66b 100644
--- a/drivers/iio/frequency/adf4350.c
+++ b/drivers/iio/frequency/adf4350.c
@@ -173,7 +173,7 @@ static int adf4350_set_freq(struct adf4350_state *st, unsigned long long freq)
                         } while ((st->r1_mod > ADF4350_MAX_MODULUS) && r_cnt);
                 } while (r_cnt == 0);
 
-                tmp = freq * (u64)st->r1_mod + (st->fpfd > 1);
+                tmp = freq * (u64)st->r1_mod + (st->fpfd >> 1);
                 do_div(tmp, st->fpfd); /* Div round closest (n + d/2)/d */
                 st->r0_fract = do_div(tmp, st->r1_mod);
                 st->r0_int = tmp;
diff --git a/drivers/iio/gyro/Kconfig b/drivers/iio/gyro/Kconfig
index 48ed1483ff27..96b68f63a902 100644
--- a/drivers/iio/gyro/Kconfig
+++ b/drivers/iio/gyro/Kconfig
@@ -17,6 +17,7 @@ config HID_SENSOR_GYRO_3D
         select IIO_BUFFER
         select IIO_TRIGGERED_BUFFER
         select HID_SENSOR_IIO_COMMON
+        select HID_SENSOR_IIO_TRIGGER
         tristate "HID Gyroscope 3D"
         help
           Say yes here to build support for the HID SENSOR
diff --git a/drivers/iio/light/Kconfig b/drivers/iio/light/Kconfig
index 1763c9bcb98a..dbf80abc834f 100644
--- a/drivers/iio/light/Kconfig
+++ b/drivers/iio/light/Kconfig
@@ -47,6 +47,7 @@ config HID_SENSOR_ALS
         select IIO_BUFFER
         select IIO_TRIGGERED_BUFFER
         select HID_SENSOR_IIO_COMMON
+        select HID_SENSOR_IIO_TRIGGER
         tristate "HID ALS"
         help
           Say yes here to build support for the HID SENSOR
diff --git a/drivers/iio/magnetometer/Kconfig b/drivers/iio/magnetometer/Kconfig
index c1f0cdd57037..ff11d68225cf 100644
--- a/drivers/iio/magnetometer/Kconfig
+++ b/drivers/iio/magnetometer/Kconfig
@@ -8,6 +8,7 @@ config HID_SENSOR_MAGNETOMETER_3D
         select IIO_BUFFER
         select IIO_TRIGGERED_BUFFER
         select HID_SENSOR_IIO_COMMON
+        select HID_SENSOR_IIO_TRIGGER
         tristate "HID Magenetometer 3D"
         help
           Say yes here to build support for the HID SENSOR
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index 1c0abd4dfc43..47ad4e270877 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -292,6 +292,7 @@ config TWL4030_CORE
         bool "Texas Instruments TWL4030/TWL5030/TWL6030/TPS659x0 Support"
         depends on I2C=y && GENERIC_HARDIRQS
         select IRQ_DOMAIN
+        select REGMAP_I2C
         help
           Say yes here if you have TWL4030 / TWL6030 family chip on your board.
           This core driver provides register access and IRQ handling
diff --git a/drivers/misc/atmel-ssc.c b/drivers/misc/atmel-ssc.c
index 158da5a81a66..3c09cbb70b1d 100644
--- a/drivers/misc/atmel-ssc.c
+++ b/drivers/misc/atmel-ssc.c
@@ -19,6 +19,7 @@
 #include <linux/module.h>
 
 #include <linux/of.h>
+#include <linux/pinctrl/consumer.h>
 
 /* Serialize access to ssc_list and user count */
 static DEFINE_SPINLOCK(user_lock);
@@ -131,6 +132,13 @@ static int ssc_probe(struct platform_device *pdev)
         struct resource *regs;
         struct ssc_device *ssc;
         const struct atmel_ssc_platform_data *plat_dat;
+        struct pinctrl *pinctrl;
+
+        pinctrl = devm_pinctrl_get_select_default(&pdev->dev);
+        if (IS_ERR(pinctrl)) {
+                dev_err(&pdev->dev, "Failed to request pinctrl\n");
+                return PTR_ERR(pinctrl);
+        }
 
         ssc = devm_kzalloc(&pdev->dev, sizeof(struct ssc_device), GFP_KERNEL);
         if (!ssc) {
diff --git a/drivers/misc/mei/amthif.c b/drivers/misc/mei/amthif.c
index 18794aea6062..e40ffd9502d1 100644
--- a/drivers/misc/mei/amthif.c
+++ b/drivers/misc/mei/amthif.c
@@ -187,13 +187,13 @@ int mei_amthif_read(struct mei_device *dev, struct file *file,
                 wait_ret = wait_event_interruptible(dev->iamthif_cl.wait,
                         (cb = mei_amthif_find_read_list_entry(dev, file)));
 
+                /* Locking again the Mutex */
+                mutex_lock(&dev->device_lock);
+
                 if (wait_ret)
                         return -ERESTARTSYS;
 
                 dev_dbg(&dev->pdev->dev, "woke up from sleep\n");
-
-                /* Locking again the Mutex */
-                mutex_lock(&dev->device_lock);
         }
 
 
diff --git a/drivers/net/ethernet/adi/Kconfig b/drivers/net/ethernet/adi/Kconfig
index e49c0eff040b..a9481606bbcd 100644
--- a/drivers/net/ethernet/adi/Kconfig
+++ b/drivers/net/ethernet/adi/Kconfig
@@ -61,6 +61,7 @@ config BFIN_RX_DESC_NUM
 
 config BFIN_MAC_USE_HWSTAMP
         bool "Use IEEE 1588 hwstamp"
+        depends on BFIN_MAC && BF518
         select PTP_1588_CLOCK
         default y
         ---help---
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 01588b66a38c..f771ddfba646 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -80,12 +80,37 @@ static inline void bnx2x_move_fp(struct bnx2x *bp, int from, int to)
                 new_txdata_index = new_max_eth_txqs + FCOE_TXQ_IDX_OFFSET;
         }
 
-        memcpy(&bp->bnx2x_txq[old_txdata_index],
-               &bp->bnx2x_txq[new_txdata_index],
+        memcpy(&bp->bnx2x_txq[new_txdata_index],
+               &bp->bnx2x_txq[old_txdata_index],
                sizeof(struct bnx2x_fp_txdata));
         to_fp->txdata_ptr[0] = &bp->bnx2x_txq[new_txdata_index];
 }
 
+/**
+ * bnx2x_shrink_eth_fp - guarantees fastpath structures stay intact
+ *
+ * @bp: driver handle
+ * @delta:      number of eth queues which were not allocated
+ */
+static void bnx2x_shrink_eth_fp(struct bnx2x *bp, int delta)
+{
+        int i, cos, old_eth_num = BNX2X_NUM_ETH_QUEUES(bp);
+
+        /* Queue pointer cannot be re-set on an fp-basis, as moving pointer
+         * backward along the array could cause memory to be overriden
+         */
+        for (cos = 1; cos < bp->max_cos; cos++) {
+                for (i = 0; i < old_eth_num - delta; i++) {
+                        struct bnx2x_fastpath *fp = &bp->fp[i];
+                        int new_idx = cos * (old_eth_num - delta) + i;
+
+                        memcpy(&bp->bnx2x_txq[new_idx], fp->txdata_ptr[cos],
+                               sizeof(struct bnx2x_fp_txdata));
+                        fp->txdata_ptr[cos] = &bp->bnx2x_txq[new_idx];
+                }
+        }
+}
+
 int load_count[2][3] = { {0} }; /* per-path: 0-common, 1-port0, 2-port1 */
 
 /* free skb in the packet ring at pos idx
@@ -3863,6 +3888,7 @@ int bnx2x_alloc_fp_mem(struct bnx2x *bp)
                 int delta = BNX2X_NUM_ETH_QUEUES(bp) - i;
 
                 WARN_ON(delta < 0);
+                bnx2x_shrink_eth_fp(bp, delta);
                 if (CNIC_SUPPORT(bp))
                         /* move non eth FPs next to last eth FP
                          * must be done in that order
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
index 277f17e3c8f8..a427b49a886c 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
@@ -2777,10 +2777,10 @@ static int bnx2x_set_rss_flags(struct bnx2x *bp, struct ethtool_rxnfc *info)
                 } else if ((info->flow_type == UDP_V6_FLOW) &&
                            (bp->rss_conf_obj.udp_rss_v6 != udp_rss_requested)) {
                         bp->rss_conf_obj.udp_rss_v6 = udp_rss_requested;
-                        return bnx2x_config_rss_pf(bp, &bp->rss_conf_obj, 0);
                         DP(BNX2X_MSG_ETHTOOL,
                            "rss re-configured, UDP 4-tupple %s\n",
                            udp_rss_requested ? "enabled" : "disabled");
+                        return bnx2x_config_rss_pf(bp, &bp->rss_conf_obj, 0);
                 } else {
                         return 0;
                 }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 940ef859dc60..5523da3afcdc 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -127,6 +127,17 @@ MODULE_PARM_DESC(debug, " Default debug msglevel");
 
 struct workqueue_struct *bnx2x_wq;
 
+struct bnx2x_mac_vals {
+        u32 xmac_addr;
+        u32 xmac_val;
+        u32 emac_addr;
+        u32 emac_val;
+        u32 umac_addr;
+        u32 umac_val;
+        u32 bmac_addr;
+        u32 bmac_val[2];
+};
+
 enum bnx2x_board_type {
         BCM57710 = 0,
         BCM57711,
@@ -9420,12 +9431,19 @@ static inline void bnx2x_undi_int_disable(struct bnx2x *bp)
                 bnx2x_undi_int_disable_e1h(bp);
 }
 
-static void bnx2x_prev_unload_close_mac(struct bnx2x *bp)
+static void bnx2x_prev_unload_close_mac(struct bnx2x *bp,
+                                        struct bnx2x_mac_vals *vals)
 {
         u32 val, base_addr, offset, mask, reset_reg;
         bool mac_stopped = false;
         u8 port = BP_PORT(bp);
 
+        /* reset addresses as they also mark which values were changed */
+        vals->bmac_addr = 0;
+        vals->umac_addr = 0;
+        vals->xmac_addr = 0;
+        vals->emac_addr = 0;
+
         reset_reg = REG_RD(bp, MISC_REG_RESET_REG_2);
 
         if (!CHIP_IS_E3(bp)) {
@@ -9447,14 +9465,18 @@ static void bnx2x_prev_unload_close_mac(struct bnx2x *bp)
                          */
                         wb_data[0] = REG_RD(bp, base_addr + offset);
                         wb_data[1] = REG_RD(bp, base_addr + offset + 0x4);
+                        vals->bmac_addr = base_addr + offset;
+                        vals->bmac_val[0] = wb_data[0];
+                        vals->bmac_val[1] = wb_data[1];
                         wb_data[0] &= ~BMAC_CONTROL_RX_ENABLE;
-                        REG_WR(bp, base_addr + offset, wb_data[0]);
-                        REG_WR(bp, base_addr + offset + 0x4, wb_data[1]);
+                        REG_WR(bp, vals->bmac_addr, wb_data[0]);
+                        REG_WR(bp, vals->bmac_addr + 0x4, wb_data[1]);
 
                 }
                 BNX2X_DEV_INFO("Disable emac Rx\n");
-                REG_WR(bp, NIG_REG_NIG_EMAC0_EN + BP_PORT(bp)*4, 0);
-
+                vals->emac_addr = NIG_REG_NIG_EMAC0_EN + BP_PORT(bp)*4;
+                vals->emac_val = REG_RD(bp, vals->emac_addr);
+                REG_WR(bp, vals->emac_addr, 0);
                 mac_stopped = true;
         } else {
                 if (reset_reg & MISC_REGISTERS_RESET_REG_2_XMAC) {
@@ -9465,14 +9487,18 @@ static void bnx2x_prev_unload_close_mac(struct bnx2x *bp)
                                val & ~(1 << 1));
                         REG_WR(bp, base_addr + XMAC_REG_PFC_CTRL_HI,
                                val | (1 << 1));
-                        REG_WR(bp, base_addr + XMAC_REG_CTRL, 0);
+                        vals->xmac_addr = base_addr + XMAC_REG_CTRL;
+                        vals->xmac_val = REG_RD(bp, vals->xmac_addr);
+                        REG_WR(bp, vals->xmac_addr, 0);
                         mac_stopped = true;
                 }
                 mask = MISC_REGISTERS_RESET_REG_2_UMAC0 << port;
                 if (mask & reset_reg) {
                         BNX2X_DEV_INFO("Disable umac Rx\n");
                         base_addr = BP_PORT(bp) ? GRCBASE_UMAC1 : GRCBASE_UMAC0;
-                        REG_WR(bp, base_addr + UMAC_REG_COMMAND_CONFIG, 0);
+                        vals->umac_addr = base_addr + UMAC_REG_COMMAND_CONFIG;
+                        vals->umac_val = REG_RD(bp, vals->umac_addr);
+                        REG_WR(bp, vals->umac_addr, 0);
                         mac_stopped = true;
                 }
         }
@@ -9664,12 +9690,16 @@ static int bnx2x_prev_unload_common(struct bnx2x *bp)
 {
         u32 reset_reg, tmp_reg = 0, rc;
         bool prev_undi = false;
+        struct bnx2x_mac_vals mac_vals;
+
         /* It is possible a previous function received 'common' answer,
          * but hasn't loaded yet, therefore creating a scenario of
          * multiple functions receiving 'common' on the same path.
          */
         BNX2X_DEV_INFO("Common unload Flow\n");
 
+        memset(&mac_vals, 0, sizeof(mac_vals));
+
         if (bnx2x_prev_is_path_marked(bp))
                 return bnx2x_prev_mcp_done(bp);
 
@@ -9680,7 +9710,10 @@ static int bnx2x_prev_unload_common(struct bnx2x *bp)
                 u32 timer_count = 1000;
 
                 /* Close the MAC Rx to prevent BRB from filling up */
-                bnx2x_prev_unload_close_mac(bp);
+                bnx2x_prev_unload_close_mac(bp, &mac_vals);
+
+                /* close LLH filters towards the BRB */
+                bnx2x_set_rx_filter(&bp->link_params, 0);
 
                 /* Check if the UNDI driver was previously loaded
                  * UNDI driver initializes CID offset for normal bell to 0x7
@@ -9727,6 +9760,17 @@ static int bnx2x_prev_unload_common(struct bnx2x *bp)
         /* No packets are in the pipeline, path is ready for reset */
         bnx2x_reset_common(bp);
 
+        if (mac_vals.xmac_addr)
+                REG_WR(bp, mac_vals.xmac_addr, mac_vals.xmac_val);
+        if (mac_vals.umac_addr)
+                REG_WR(bp, mac_vals.umac_addr, mac_vals.umac_val);
+        if (mac_vals.emac_addr)
+                REG_WR(bp, mac_vals.emac_addr, mac_vals.emac_val);
+        if (mac_vals.bmac_addr) {
+                REG_WR(bp, mac_vals.bmac_addr, mac_vals.bmac_val[0]);
+                REG_WR(bp, mac_vals.bmac_addr + 4, mac_vals.bmac_val[1]);
+        }
+
         rc = bnx2x_prev_mark_path(bp, prev_undi);
         if (rc) {
                 bnx2x_prev_mcp_done(bp);
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index 3bc1912afba9..4eba17b83ba8 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -190,6 +190,7 @@ struct be_eq_obj {
 
         u8 idx;                 /* array index */
         u16 tx_budget;
+        u16 spurious_intr;
         struct napi_struct napi;
         struct be_adapter *adapter;
 } ____cacheline_aligned_in_smp;
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 9dca22be8125..5c995700e534 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -2026,19 +2026,30 @@ static irqreturn_t be_intx(int irq, void *dev)
         struct be_adapter *adapter = eqo->adapter;
         int num_evts = 0;
 
-        /* On Lancer, clear-intr bit of the EQ DB does not work.
-         * INTx is de-asserted only on notifying num evts.
+        /* IRQ is not expected when NAPI is scheduled as the EQ
+         * will not be armed.
+         * But, this can happen on Lancer INTx where it takes
+         * a while to de-assert INTx or in BE2 where occasionaly
+         * an interrupt may be raised even when EQ is unarmed.
+         * If NAPI is already scheduled, then counting & notifying
+         * events will orphan them.
          */
-        if (lancer_chip(adapter))
+        if (napi_schedule_prep(&eqo->napi)) {
                 num_evts = events_get(eqo);
+                __napi_schedule(&eqo->napi);
+                if (num_evts)
+                        eqo->spurious_intr = 0;
+        }
+        be_eq_notify(adapter, eqo->q.id, false, true, num_evts);
 
-        /* The EQ-notify may not de-assert INTx rightaway, causing
-         * the ISR to be invoked again. So, return HANDLED even when
-         * num_evts is zero.
+        /* Return IRQ_HANDLED only for the the first spurious intr
+         * after a valid intr to stop the kernel from branding
+         * this irq as a bad one!
          */
-        be_eq_notify(adapter, eqo->q.id, false, true, num_evts);
-        napi_schedule(&eqo->napi);
-        return IRQ_HANDLED;
+        if (num_evts || eqo->spurious_intr++ == 0)
+                return IRQ_HANDLED;
+        else
+                return IRQ_NONE;
 }
 
 static irqreturn_t be_msix(int irq, void *dev)
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
index f80cd975daed..3e73742024b0 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
@@ -4678,7 +4678,7 @@ static int qlge_probe(struct pci_dev *pdev,
         qdev = netdev_priv(ndev);
         SET_NETDEV_DEV(ndev, &pdev->dev);
         ndev->hw_features = NETIF_F_SG | NETIF_F_IP_CSUM |
-                NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_TSO_ECN |
+                NETIF_F_TSO | NETIF_F_TSO_ECN |
                 NETIF_F_HW_VLAN_TX | NETIF_F_RXCSUM;
         ndev->features = ndev->hw_features |
                 NETIF_F_HW_VLAN_RX | NETIF_F_HW_VLAN_FILTER;
diff --git a/drivers/net/ethernet/xilinx/Kconfig b/drivers/net/ethernet/xilinx/Kconfig
index 5778a4ae1164..122d60c0481b 100644
--- a/drivers/net/ethernet/xilinx/Kconfig
+++ b/drivers/net/ethernet/xilinx/Kconfig
@@ -27,7 +27,7 @@ config XILINX_EMACLITE
 
 config XILINX_AXI_EMAC
         tristate "Xilinx 10/100/1000 AXI Ethernet support"
-        depends on (PPC32 || MICROBLAZE)
+        depends on MICROBLAZE
         select PHYLIB
         ---help---
           This driver supports the 10/100/1000 Ethernet from Xilinx for the
diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
index d9f69b82cc4f..6f47100e58d7 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
@@ -1590,7 +1590,7 @@ static int axienet_of_probe(struct platform_device *op)
         lp->rx_irq = irq_of_parse_and_map(np, 1);
         lp->tx_irq = irq_of_parse_and_map(np, 0);
         of_node_put(np);
-        if ((lp->rx_irq == NO_IRQ) || (lp->tx_irq == NO_IRQ)) {
+        if ((lp->rx_irq <= 0) || (lp->tx_irq <= 0)) {
                 dev_err(&op->dev, "could not determine irqs\n");
                 ret = -ENOMEM;
                 goto err_iounmap_2;
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index fbd106edbe59..af372d0957fe 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -404,8 +404,8 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
         struct tun_struct *tun;
         struct net_device *dev;
 
-        tun = rcu_dereference_protected(tfile->tun,
-                                        lockdep_rtnl_is_held());
+        tun = rtnl_dereference(tfile->tun);
+
         if (tun) {
                 u16 index = tfile->queue_index;
                 BUG_ON(index >= tun->numqueues);
@@ -414,8 +414,7 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
                 rcu_assign_pointer(tun->tfiles[index],
                                    tun->tfiles[tun->numqueues - 1]);
                 rcu_assign_pointer(tfile->tun, NULL);
-                ntfile = rcu_dereference_protected(tun->tfiles[index],
-                                                   lockdep_rtnl_is_held());
+                ntfile = rtnl_dereference(tun->tfiles[index]);
                 ntfile->queue_index = index;
 
                 --tun->numqueues;
@@ -429,8 +428,10 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
                 /* Drop read queue */
                 skb_queue_purge(&tfile->sk.sk_receive_queue);
                 tun_set_real_num_queues(tun);
-        } else if (tfile->detached && clean)
+        } else if (tfile->detached && clean) {
                 tun = tun_enable_queue(tfile);
+                sock_put(&tfile->sk);
+        }
 
         if (clean) {
                 if (tun && tun->numqueues == 0 && tun->numdisabled == 0 &&
@@ -458,8 +459,7 @@ static void tun_detach_all(struct net_device *dev)
         int i, n = tun->numqueues;
 
         for (i = 0; i < n; i++) {
-                tfile = rcu_dereference_protected(tun->tfiles[i],
-                                                  lockdep_rtnl_is_held());
+                tfile = rtnl_dereference(tun->tfiles[i]);
                 BUG_ON(!tfile);
                 wake_up_all(&tfile->wq.wait);
                 rcu_assign_pointer(tfile->tun, NULL);
@@ -469,8 +469,7 @@ static void tun_detach_all(struct net_device *dev)
 
         synchronize_net();
         for (i = 0; i < n; i++) {
-                tfile = rcu_dereference_protected(tun->tfiles[i],
-                                                  lockdep_rtnl_is_held());
+                tfile = rtnl_dereference(tun->tfiles[i]);
                 /* Drop read queue */
                 skb_queue_purge(&tfile->sk.sk_receive_queue);
                 sock_put(&tfile->sk);
@@ -481,6 +480,9 @@ static void tun_detach_all(struct net_device *dev)
                 sock_put(&tfile->sk);
         }
         BUG_ON(tun->numdisabled != 0);
+
+        if (tun->flags & TUN_PERSIST)
+                module_put(THIS_MODULE);
 }
 
 static int tun_attach(struct tun_struct *tun, struct file *file)
@@ -489,7 +491,7 @@ static int tun_attach(struct tun_struct *tun, struct file *file)
         int err;
 
         err = -EINVAL;
-        if (rcu_dereference_protected(tfile->tun, lockdep_rtnl_is_held()))
+        if (rtnl_dereference(tfile->tun))
                 goto out;
 
         err = -EBUSY;
@@ -1544,6 +1546,9 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
         struct net_device *dev;
         int err;
 
+        if (tfile->detached)
+                return -EINVAL;
+
         dev = __dev_get_by_name(net, ifr->ifr_name);
         if (dev) {
                 if (ifr->ifr_flags & IFF_TUN_EXCL)
@@ -1738,8 +1743,7 @@ static void tun_detach_filter(struct tun_struct *tun, int n)
         struct tun_file *tfile;
 
         for (i = 0; i < n; i++) {
-                tfile = rcu_dereference_protected(tun->tfiles[i],
-                                                  lockdep_rtnl_is_held());
+                tfile = rtnl_dereference(tun->tfiles[i]);
                 sk_detach_filter(tfile->socket.sk);
         }
 
@@ -1752,8 +1756,7 @@ static int tun_attach_filter(struct tun_struct *tun)
         struct tun_file *tfile;
 
         for (i = 0; i < tun->numqueues; i++) {
-                tfile = rcu_dereference_protected(tun->tfiles[i],
-                                                  lockdep_rtnl_is_held());
+                tfile = rtnl_dereference(tun->tfiles[i]);
                 ret = sk_attach_filter(&tun->fprog, tfile->socket.sk);
                 if (ret) {
                         tun_detach_filter(tun, i);
@@ -1771,8 +1774,7 @@ static void tun_set_sndbuf(struct tun_struct *tun)
         int i;
 
         for (i = 0; i < tun->numqueues; i++) {
-                tfile = rcu_dereference_protected(tun->tfiles[i],
-                                                lockdep_rtnl_is_held());
+                tfile = rtnl_dereference(tun->tfiles[i]);
                 tfile->socket.sk->sk_sndbuf = tun->sndbuf;
         }
 }
@@ -1789,13 +1791,10 @@ static int tun_set_queue(struct file *file, struct ifreq *ifr)
                 tun = tfile->detached;
                 if (!tun)
                         ret = -EINVAL;
-                else if (tun_not_capable(tun))
-                        ret = -EPERM;
                 else
                         ret = tun_attach(tun, file);
         } else if (ifr->ifr_flags & IFF_DETACH_QUEUE) {
-                tun = rcu_dereference_protected(tfile->tun,
-                                                lockdep_rtnl_is_held());
+                tun = rtnl_dereference(tfile->tun);
                 if (!tun || !(tun->flags & TUN_TAP_MQ))
                         ret = -EINVAL;
                 else
@@ -1880,10 +1879,11 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
                 /* Disable/Enable persist mode. Keep an extra reference to the
                  * module to prevent the module being unprobed.
                  */
-                if (arg) {
+                if (arg && !(tun->flags & TUN_PERSIST)) {
                         tun->flags |= TUN_PERSIST;
                         __module_get(THIS_MODULE);
-                } else {
+                }
+                if (!arg && (tun->flags & TUN_PERSIST)) {
                         tun->flags &= ~TUN_PERSIST;
                         module_put(THIS_MODULE);
                 }
diff --git a/drivers/net/wireless/ath/Kconfig b/drivers/net/wireless/ath/Kconfig
index 1a67a4f829fe..2c02b4e84094 100644
--- a/drivers/net/wireless/ath/Kconfig
+++ b/drivers/net/wireless/ath/Kconfig
@@ -30,5 +30,6 @@ source "drivers/net/wireless/ath/ath9k/Kconfig"
 source "drivers/net/wireless/ath/carl9170/Kconfig"
 source "drivers/net/wireless/ath/ath6kl/Kconfig"
 source "drivers/net/wireless/ath/ar5523/Kconfig"
+source "drivers/net/wireless/ath/wil6210/Kconfig"
 
 endif
diff --git a/drivers/net/wireless/ath/Makefile b/drivers/net/wireless/ath/Makefile
index 1e18621326dc..97b964ded2be 100644
--- a/drivers/net/wireless/ath/Makefile
+++ b/drivers/net/wireless/ath/Makefile
@@ -3,6 +3,7 @@ obj-$(CONFIG_ATH9K_HW)		+= ath9k/
 obj-$(CONFIG_CARL9170)          += carl9170/
 obj-$(CONFIG_ATH6KL)            += ath6kl/
 obj-$(CONFIG_AR5523)            += ar5523/
+obj-$(CONFIG_WIL6210)           += wil6210/
 
 obj-$(CONFIG_ATH_COMMON)        += ath.o
 
diff --git a/drivers/net/wireless/ath/wil6210/Kconfig b/drivers/net/wireless/ath/wil6210/Kconfig
new file mode 100644
index 000000000000..bac3d98a0cfb
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/Kconfig
@@ -0,0 +1,29 @@
+config WIL6210
+        tristate "Wilocity 60g WiFi card wil6210 support"
+        depends on CFG80211
+        depends on PCI
+        default n
+        ---help---
+          This module adds support for wireless adapter based on
+          wil6210 chip by Wilocity. It supports operation on the
+          60 GHz band, covered by the IEEE802.11ad standard.
+
+          http://wireless.kernel.org/en/users/Drivers/wil6210
+
+          If you choose to build it as a module, it will be called
+          wil6210
+
+config WIL6210_ISR_COR
+        bool "Use Clear-On-Read mode for ISR registers for wil6210"
+        depends on WIL6210
+        default y
+        ---help---
+          ISR registers on wil6210 chip may operate in either
+          COR (Clear-On-Read) or W1C (Write-1-to-Clear) mode.
+          For production code, use COR (say y); is default since
+          it saves extra target transaction;
+          For ISR debug, use W1C (say n); is allows to monitor ISR
+          registers with debugfs. If COR were used, ISR would
+          self-clear when accessed for debug purposes, it makes
+          such monitoring impossible.
+          Say y unless you debug interrupts
diff --git a/drivers/net/wireless/ath/wil6210/Makefile b/drivers/net/wireless/ath/wil6210/Makefile
new file mode 100644
index 000000000000..9396dc9fe3c5
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/Makefile
@@ -0,0 +1,13 @@
+obj-$(CONFIG_WIL6210) += wil6210.o
+
+wil6210-objs := main.o
+wil6210-objs += netdev.o
+wil6210-objs += cfg80211.o
+wil6210-objs += pcie_bus.o
+wil6210-objs += debugfs.o
+wil6210-objs += wmi.o
+wil6210-objs += interrupt.o
+wil6210-objs += txrx.o
+
+subdir-ccflags-y += -Werror
+subdir-ccflags-y += -D__CHECK_ENDIAN__
diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c
new file mode 100644
index 000000000000..116f4e807ae1
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/cfg80211.c
@@ -0,0 +1,573 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+#include <linux/sched.h>
+#include <linux/etherdevice.h>
+#include <linux/wireless.h>
+#include <linux/ieee80211.h>
+#include <linux/slab.h>
+#include <linux/version.h>
+#include <net/cfg80211.h>
+
+#include "wil6210.h"
+#include "wmi.h"
+
+#define CHAN60G(_channel, _flags) {                             \
+        .band                   = IEEE80211_BAND_60GHZ,         \
+        .center_freq            = 56160 + (2160 * (_channel)),  \
+        .hw_value               = (_channel),                   \
+        .flags                  = (_flags),                     \
+        .max_antenna_gain       = 0,                            \
+        .max_power              = 40,                           \
+}
+
+static struct ieee80211_channel wil_60ghz_channels[] = {
+        CHAN60G(1, 0),
+        CHAN60G(2, 0),
+        CHAN60G(3, 0),
+/* channel 4 not supported yet */
+};
+
+static struct ieee80211_supported_band wil_band_60ghz = {
+        .channels = wil_60ghz_channels,
+        .n_channels = ARRAY_SIZE(wil_60ghz_channels),
+        .ht_cap = {
+                .ht_supported = true,
+                .cap = 0, /* TODO */
+                .ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K, /* TODO */
+                .ampdu_density = IEEE80211_HT_MPDU_DENSITY_8, /* TODO */
+                .mcs = {
+                                /* MCS 1..12 - SC PHY */
+                        .rx_mask = {0xfe, 0x1f}, /* 1..12 */
+                        .tx_params = IEEE80211_HT_MCS_TX_DEFINED, /* TODO */
+                },
+        },
+};
+
+static const struct ieee80211_txrx_stypes
+wil_mgmt_stypes[NUM_NL80211_IFTYPES] = {
+        [NL80211_IFTYPE_STATION] = {
+                .tx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                BIT(IEEE80211_STYPE_PROBE_RESP >> 4),
+                .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
+        },
+        [NL80211_IFTYPE_AP] = {
+                .tx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                BIT(IEEE80211_STYPE_PROBE_RESP >> 4),
+                .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
+        },
+        [NL80211_IFTYPE_P2P_CLIENT] = {
+                .tx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                BIT(IEEE80211_STYPE_PROBE_RESP >> 4),
+                .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
+        },
+        [NL80211_IFTYPE_P2P_GO] = {
+                .tx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                BIT(IEEE80211_STYPE_PROBE_RESP >> 4),
+                .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
+        },
+};
+
+static const u32 wil_cipher_suites[] = {
+        WLAN_CIPHER_SUITE_GCMP,
+};
+
+int wil_iftype_nl2wmi(enum nl80211_iftype type)
+{
+        static const struct {
+                enum nl80211_iftype nl;
+                enum wmi_network_type wmi;
+        } __nl2wmi[] = {
+                {NL80211_IFTYPE_ADHOC,          WMI_NETTYPE_ADHOC},
+                {NL80211_IFTYPE_STATION,        WMI_NETTYPE_INFRA},
+                {NL80211_IFTYPE_AP,             WMI_NETTYPE_AP},
+                {NL80211_IFTYPE_P2P_CLIENT,     WMI_NETTYPE_P2P},
+                {NL80211_IFTYPE_P2P_GO,         WMI_NETTYPE_P2P},
+                {NL80211_IFTYPE_MONITOR,        WMI_NETTYPE_ADHOC}, /* FIXME */
+        };
+        uint i;
+
+        for (i = 0; i < ARRAY_SIZE(__nl2wmi); i++) {
+                if (__nl2wmi[i].nl == type)
+                        return __nl2wmi[i].wmi;
+        }
+
+        return -EOPNOTSUPP;
+}
+
+static int wil_cfg80211_get_station(struct wiphy *wiphy,
+                                    struct net_device *ndev,
+                                    u8 *mac, struct station_info *sinfo)
+{
+        struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+        int rc;
+        struct wmi_notify_req_cmd cmd = {
+                .cid = 0,
+                .interval_usec = 0,
+        };
+
+        if (memcmp(mac, wil->dst_addr[0], ETH_ALEN))
+                return -ENOENT;
+
+        /* WMI_NOTIFY_REQ_DONE_EVENTID handler fills wil->stats.bf_mcs */
+        rc = wmi_call(wil, WMI_NOTIFY_REQ_CMDID, &cmd, sizeof(cmd),
+                      WMI_NOTIFY_REQ_DONE_EVENTID, NULL, 0, 20);
+        if (rc)
+                return rc;
+
+        sinfo->generation = wil->sinfo_gen;
+
+        sinfo->filled |= STATION_INFO_TX_BITRATE;
+        sinfo->txrate.flags = RATE_INFO_FLAGS_MCS | RATE_INFO_FLAGS_60G;
+        sinfo->txrate.mcs = wil->stats.bf_mcs;
+        sinfo->filled |= STATION_INFO_RX_BITRATE;
+        sinfo->rxrate.flags = RATE_INFO_FLAGS_MCS | RATE_INFO_FLAGS_60G;
+        sinfo->rxrate.mcs = wil->stats.last_mcs_rx;
+
+        if (test_bit(wil_status_fwconnected, &wil->status)) {
+                sinfo->filled |= STATION_INFO_SIGNAL;
+                sinfo->signal = 12; /* TODO: provide real value */
+        }
+
+        return 0;
+}
+
+static int wil_cfg80211_change_iface(struct wiphy *wiphy,
+                                     struct net_device *ndev,
+                                     enum nl80211_iftype type, u32 *flags,
+                                     struct vif_params *params)
+{
+        struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+        struct wireless_dev *wdev = wil->wdev;
+
+        switch (type) {
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_P2P_CLIENT:
+        case NL80211_IFTYPE_P2P_GO:
+                break;
+        case NL80211_IFTYPE_MONITOR:
+                if (flags)
+                        wil->monitor_flags = *flags;
+                else
+                        wil->monitor_flags = 0;
+
+                break;
+        default:
+                return -EOPNOTSUPP;
+        }
+
+        wdev->iftype = type;
+
+        return 0;
+}
+
+static int wil_cfg80211_scan(struct wiphy *wiphy,
+                             struct cfg80211_scan_request *request)
+{
+        struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+        struct wireless_dev *wdev = wil->wdev;
+        struct {
+                struct wmi_start_scan_cmd cmd;
+                u16 chnl[4];
+        } __packed cmd;
+        uint i, n;
+
+        if (wil->scan_request) {
+                wil_err(wil, "Already scanning\n");
+                return -EAGAIN;
+        }
+
+        /* check we are client side */
+        switch (wdev->iftype) {
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_P2P_CLIENT:
+                break;
+        default:
+                return -EOPNOTSUPP;
+
+        }
+
+        /* FW don't support scan after connection attempt */
+        if (test_bit(wil_status_dontscan, &wil->status)) {
+                wil_err(wil, "Scan after connect attempt not supported\n");
+                return -EBUSY;
+        }
+
+        wil->scan_request = request;
+
+        memset(&cmd, 0, sizeof(cmd));
+        cmd.cmd.num_channels = 0;
+        n = min(request->n_channels, 4U);
+        for (i = 0; i < n; i++) {
+                int ch = request->channels[i]->hw_value;
+                if (ch == 0) {
+                        wil_err(wil,
+                                "Scan requested for unknown frequency %dMhz\n",
+                                request->channels[i]->center_freq);
+                        continue;
+                }
+                /* 0-based channel indexes */
+                cmd.cmd.channel_list[cmd.cmd.num_channels++].channel = ch - 1;
+                wil_dbg(wil, "Scan for ch %d  : %d MHz\n", ch,
+                        request->channels[i]->center_freq);
+        }
+
+        return wmi_send(wil, WMI_START_SCAN_CMDID, &cmd, sizeof(cmd.cmd) +
+                        cmd.cmd.num_channels * sizeof(cmd.cmd.channel_list[0]));
+}
+
+static int wil_cfg80211_connect(struct wiphy *wiphy,
+                                struct net_device *ndev,
+                                struct cfg80211_connect_params *sme)
+{
+        struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+        struct cfg80211_bss *bss;
+        struct wmi_connect_cmd conn;
+        const u8 *ssid_eid;
+        const u8 *rsn_eid;
+        int ch;
+        int rc = 0;
+
+        bss = cfg80211_get_bss(wiphy, sme->channel, sme->bssid,
+                               sme->ssid, sme->ssid_len,
+                               WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
+        if (!bss) {
+                wil_err(wil, "Unable to find BSS\n");
+                return -ENOENT;
+        }
+
+        ssid_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SSID);
+        if (!ssid_eid) {
+                wil_err(wil, "No SSID\n");
+                rc = -ENOENT;
+                goto out;
+        }
+
+        rsn_eid = sme->ie ?
+                        cfg80211_find_ie(WLAN_EID_RSN, sme->ie, sme->ie_len) :
+                        NULL;
+        if (rsn_eid) {
+                if (sme->ie_len > WMI_MAX_IE_LEN) {
+                        rc = -ERANGE;
+                        wil_err(wil, "IE too large (%td bytes)\n",
+                                sme->ie_len);
+                        goto out;
+                }
+                /*
+                 * For secure assoc, send:
+                 * (1) WMI_DELETE_CIPHER_KEY_CMD
+                 * (2) WMI_SET_APPIE_CMD
+                 */
+                rc = wmi_del_cipher_key(wil, 0, bss->bssid);
+                if (rc) {
+                        wil_err(wil, "WMI_DELETE_CIPHER_KEY_CMD failed\n");
+                        goto out;
+                }
+                /* WMI_SET_APPIE_CMD */
+                rc = wmi_set_ie(wil, WMI_FRAME_ASSOC_REQ, sme->ie_len, sme->ie);
+                if (rc) {
+                        wil_err(wil, "WMI_SET_APPIE_CMD failed\n");
+                        goto out;
+                }
+        }
+
+        /* WMI_CONNECT_CMD */
+        memset(&conn, 0, sizeof(conn));
+        switch (bss->capability & 0x03) {
+        case WLAN_CAPABILITY_DMG_TYPE_AP:
+                conn.network_type = WMI_NETTYPE_INFRA;
+                break;
+        case WLAN_CAPABILITY_DMG_TYPE_PBSS:
+                conn.network_type = WMI_NETTYPE_P2P;
+                break;
+        default:
+                wil_err(wil, "Unsupported BSS type, capability= 0x%04x\n",
+                        bss->capability);
+                goto out;
+        }
+        if (rsn_eid) {
+                conn.dot11_auth_mode = WMI_AUTH11_SHARED;
+                conn.auth_mode = WMI_AUTH_WPA2_PSK;
+                conn.pairwise_crypto_type = WMI_CRYPT_AES_GCMP;
+                conn.pairwise_crypto_len = 16;
+        } else {
+                conn.dot11_auth_mode = WMI_AUTH11_OPEN;
+                conn.auth_mode = WMI_AUTH_NONE;
+        }
+
+        conn.ssid_len = min_t(u8, ssid_eid[1], 32);
+        memcpy(conn.ssid, ssid_eid+2, conn.ssid_len);
+
+        ch = bss->channel->hw_value;
+        if (ch == 0) {
+                wil_err(wil, "BSS at unknown frequency %dMhz\n",
+                        bss->channel->center_freq);
+                rc = -EOPNOTSUPP;
+                goto out;
+        }
+        conn.channel = ch - 1;
+
+        memcpy(conn.bssid, bss->bssid, 6);
+        memcpy(conn.dst_mac, bss->bssid, 6);
+        /*
+         * FW don't support scan after connection attempt
+         */
+        set_bit(wil_status_dontscan, &wil->status);
+
+        rc = wmi_send(wil, WMI_CONNECT_CMDID, &conn, sizeof(conn));
+        if (rc == 0) {
+                /* Connect can take lots of time */
+                mod_timer(&wil->connect_timer,
+                          jiffies + msecs_to_jiffies(2000));
+        }
+
+ out:
+        cfg80211_put_bss(bss);
+
+        return rc;
+}
+
+static int wil_cfg80211_disconnect(struct wiphy *wiphy,
+                                   struct net_device *ndev,
+                                   u16 reason_code)
+{
+        int rc;
+        struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+
+        rc = wmi_send(wil, WMI_DISCONNECT_CMDID, NULL, 0);
+
+        return rc;
+}
+
+static int wil_cfg80211_set_channel(struct wiphy *wiphy,
+                                    struct cfg80211_chan_def *chandef)
+{
+        struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+        struct wireless_dev *wdev = wil->wdev;
+
+        wdev->preset_chandef = *chandef;
+
+        return 0;
+}
+
+static int wil_cfg80211_add_key(struct wiphy *wiphy,
+                                struct net_device *ndev,
+                                u8 key_index, bool pairwise,
+                                const u8 *mac_addr,
+                                struct key_params *params)
+{
+        struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+
+        /* group key is not used */
+        if (!pairwise)
+                return 0;
+
+        return wmi_add_cipher_key(wil, key_index, mac_addr,
+                                  params->key_len, params->key);
+}
+
+static int wil_cfg80211_del_key(struct wiphy *wiphy,
+                                struct net_device *ndev,
+                                u8 key_index, bool pairwise,
+                                const u8 *mac_addr)
+{
+        struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+
+        /* group key is not used */
+        if (!pairwise)
+                return 0;
+
+        return wmi_del_cipher_key(wil, key_index, mac_addr);
+}
+
+/* Need to be present or wiphy_new() will WARN */
+static int wil_cfg80211_set_default_key(struct wiphy *wiphy,
+                                        struct net_device *ndev,
+                                        u8 key_index, bool unicast,
+                                        bool multicast)
+{
+        return 0;
+}
+
+static int wil_cfg80211_start_ap(struct wiphy *wiphy,
+                                 struct net_device *ndev,
+                                 struct cfg80211_ap_settings *info)
+{
+        int rc = 0;
+        struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+        struct wireless_dev *wdev = ndev->ieee80211_ptr;
+        struct ieee80211_channel *channel = info->chandef.chan;
+        struct cfg80211_beacon_data *bcon = &info->beacon;
+        u8 wmi_nettype = wil_iftype_nl2wmi(wdev->iftype);
+
+        if (!channel) {
+                wil_err(wil, "AP: No channel???\n");
+                return -EINVAL;
+        }
+
+        wil_dbg(wil, "AP on Channel %d %d MHz, %s\n", channel->hw_value,
+                channel->center_freq, info->privacy ? "secure" : "open");
+        print_hex_dump_bytes("SSID ", DUMP_PREFIX_OFFSET,
+                             info->ssid, info->ssid_len);
+
+        rc = wil_reset(wil);
+        if (rc)
+                return rc;
+
+        rc = wmi_set_ssid(wil, info->ssid_len, info->ssid);
+        if (rc)
+                return rc;
+
+        rc = wmi_set_channel(wil, channel->hw_value);
+        if (rc)
+                return rc;
+
+        /* MAC address - pre-requisite for other commands */
+        wmi_set_mac_address(wil, ndev->dev_addr);
+
+        /* IE's */
+        /* bcon 'head IE's are not relevant for 60g band */
+        wmi_set_ie(wil, WMI_FRAME_BEACON, bcon->beacon_ies_len,
+                   bcon->beacon_ies);
+        wmi_set_ie(wil, WMI_FRAME_PROBE_RESP, bcon->proberesp_ies_len,
+                   bcon->proberesp_ies);
+        wmi_set_ie(wil, WMI_FRAME_ASSOC_RESP, bcon->assocresp_ies_len,
+                   bcon->assocresp_ies);
+
+        wil->secure_pcp = info->privacy;
+
+        rc = wmi_set_bcon(wil, info->beacon_interval, wmi_nettype);
+        if (rc)
+                return rc;
+
+        /* Rx VRING. After MAC and beacon */
+        rc = wil_rx_init(wil);
+
+        netif_carrier_on(ndev);
+
+        return rc;
+}
+
+static int wil_cfg80211_stop_ap(struct wiphy *wiphy,
+                                struct net_device *ndev)
+{
+        int rc = 0;
+        struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+        struct wireless_dev *wdev = ndev->ieee80211_ptr;
+        u8 wmi_nettype = wil_iftype_nl2wmi(wdev->iftype);
+
+        /* To stop beaconing, set BI to 0 */
+        rc = wmi_set_bcon(wil, 0, wmi_nettype);
+
+        return rc;
+}
+
+static struct cfg80211_ops wil_cfg80211_ops = {
+        .scan = wil_cfg80211_scan,
+        .connect = wil_cfg80211_connect,
+        .disconnect = wil_cfg80211_disconnect,
+        .change_virtual_intf = wil_cfg80211_change_iface,
+        .get_station = wil_cfg80211_get_station,
+        .set_monitor_channel = wil_cfg80211_set_channel,
+        .add_key = wil_cfg80211_add_key,
+        .del_key = wil_cfg80211_del_key,
+        .set_default_key = wil_cfg80211_set_default_key,
+        /* AP mode */
+        .start_ap = wil_cfg80211_start_ap,
+        .stop_ap = wil_cfg80211_stop_ap,
+};
+
+static void wil_wiphy_init(struct wiphy *wiphy)
+{
+        /* TODO: set real value */
+        wiphy->max_scan_ssids = 10;
+        wiphy->max_num_pmkids = 0 /* TODO: */;
+        wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
+                                 BIT(NL80211_IFTYPE_AP) |
+                                 BIT(NL80211_IFTYPE_MONITOR);
+        /* TODO: enable P2P when integrated with supplicant:
+         * BIT(NL80211_IFTYPE_P2P_CLIENT) | BIT(NL80211_IFTYPE_P2P_GO)
+         */
+        wiphy->flags |= WIPHY_FLAG_HAVE_AP_SME |
+                        WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD;
+        dev_warn(wiphy_dev(wiphy), "%s : flags = 0x%08x\n",
+                 __func__, wiphy->flags);
+        wiphy->probe_resp_offload =
+                NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS |
+                NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS2 |
+                NL80211_PROBE_RESP_OFFLOAD_SUPPORT_P2P;
+
+        wiphy->bands[IEEE80211_BAND_60GHZ] = &wil_band_60ghz;
+
+        /* TODO: figure this out */
+        wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
+
+        wiphy->cipher_suites = wil_cipher_suites;
+        wiphy->n_cipher_suites = ARRAY_SIZE(wil_cipher_suites);
+        wiphy->mgmt_stypes = wil_mgmt_stypes;
+}
+
+struct wireless_dev *wil_cfg80211_init(struct device *dev)
+{
+        int rc = 0;
+        struct wireless_dev *wdev;
+
+        wdev = kzalloc(sizeof(struct wireless_dev), GFP_KERNEL);
+        if (!wdev)
+                return ERR_PTR(-ENOMEM);
+
+        wdev->wiphy = wiphy_new(&wil_cfg80211_ops,
+                                sizeof(struct wil6210_priv));
+        if (!wdev->wiphy) {
+                rc = -ENOMEM;
+                goto out;
+        }
+
+        set_wiphy_dev(wdev->wiphy, dev);
+        wil_wiphy_init(wdev->wiphy);
+
+        rc = wiphy_register(wdev->wiphy);
+        if (rc < 0)
+                goto out_failed_reg;
+
+        return wdev;
+
+out_failed_reg:
+        wiphy_free(wdev->wiphy);
+out:
+        kfree(wdev);
+
+        return ERR_PTR(rc);
+}
+
+void wil_wdev_free(struct wil6210_priv *wil)
+{
+        struct wireless_dev *wdev = wil_to_wdev(wil);
+
+        if (!wdev)
+                return;
+
+        wiphy_unregister(wdev->wiphy);
+        wiphy_free(wdev->wiphy);
+        kfree(wdev);
+}
diff --git a/drivers/net/wireless/ath/wil6210/dbg_hexdump.h b/drivers/net/wireless/ath/wil6210/dbg_hexdump.h
new file mode 100644
index 000000000000..6a315ba5aa7d
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/dbg_hexdump.h
@@ -0,0 +1,30 @@
+#ifndef WIL_DBG_HEXDUMP_H_
+#define WIL_DBG_HEXDUMP_H_
+
+#if defined(CONFIG_DYNAMIC_DEBUG)
+#define wil_dynamic_hex_dump(prefix_str, prefix_type, rowsize,  \
+                             groupsize, buf, len, ascii)        \
+do {                                                            \
+        DEFINE_DYNAMIC_DEBUG_METADATA(descriptor,               \
+                __builtin_constant_p(prefix_str) ? prefix_str : "hexdump");\
+        if (unlikely(descriptor.flags & _DPRINTK_FLAGS_PRINT))  \
+                print_hex_dump(KERN_DEBUG, prefix_str,          \
+                               prefix_type, rowsize, groupsize, \
+                               buf, len, ascii);                \
+} while (0)
+
+#define wil_print_hex_dump_debug(prefix_str, prefix_type, rowsize,      \
+                                 groupsize, buf, len, ascii)            \
+        wil_dynamic_hex_dump(prefix_str, prefix_type, rowsize,          \
+                             groupsize, buf, len, ascii)
+
+#define print_hex_dump_bytes(prefix_str, prefix_type, buf, len) \
+        wil_dynamic_hex_dump(prefix_str, prefix_type, 16, 1, buf, len, true)
+#else /* defined(CONFIG_DYNAMIC_DEBUG) */
+#define wil_print_hex_dump_debug(prefix_str, prefix_type, rowsize,      \
+                                 groupsize, buf, len, ascii)            \
+        print_hex_dump(KERN_DEBUG, prefix_str, prefix_type, rowsize,    \
+                       groupsize, buf, len, ascii)
+#endif /* defined(CONFIG_DYNAMIC_DEBUG) */
+
+#endif /* WIL_DBG_HEXDUMP_H_ */
diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
new file mode 100644
index 000000000000..65fc9683bfd8
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/debugfs.c
@@ -0,0 +1,603 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/module.h>
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
+#include <linux/pci.h>
+#include <linux/rtnetlink.h>
+
+#include "wil6210.h"
+#include "txrx.h"
+
+/* Nasty hack. Better have per device instances */
+static u32 mem_addr;
+static u32 dbg_txdesc_index;
+
+static void wil_print_vring(struct seq_file *s, struct wil6210_priv *wil,
+                            const char *name, struct vring *vring)
+{
+        void __iomem *x = wmi_addr(wil, vring->hwtail);
+
+        seq_printf(s, "VRING %s = {\n", name);
+        seq_printf(s, "  pa     = 0x%016llx\n", (unsigned long long)vring->pa);
+        seq_printf(s, "  va     = 0x%p\n", vring->va);
+        seq_printf(s, "  size   = %d\n", vring->size);
+        seq_printf(s, "  swtail = %d\n", vring->swtail);
+        seq_printf(s, "  swhead = %d\n", vring->swhead);
+        seq_printf(s, "  hwtail = [0x%08x] -> ", vring->hwtail);
+        if (x)
+                seq_printf(s, "0x%08x\n", ioread32(x));
+        else
+                seq_printf(s, "???\n");
+
+        if (vring->va && (vring->size < 1025)) {
+                uint i;
+                for (i = 0; i < vring->size; i++) {
+                        volatile struct vring_tx_desc *d = &vring->va[i].tx;
+                        if ((i % 64) == 0 && (i != 0))
+                                seq_printf(s, "\n");
+                        seq_printf(s, "%s", (d->dma.status & BIT(0)) ?
+                                        "S" : (vring->ctx[i] ? "H" : "h"));
+                }
+                seq_printf(s, "\n");
+        }
+        seq_printf(s, "}\n");
+}
+
+static int wil_vring_debugfs_show(struct seq_file *s, void *data)
+{
+        uint i;
+        struct wil6210_priv *wil = s->private;
+
+        wil_print_vring(s, wil, "rx", &wil->vring_rx);
+
+        for (i = 0; i < ARRAY_SIZE(wil->vring_tx); i++) {
+                struct vring *vring = &(wil->vring_tx[i]);
+                if (vring->va) {
+                        char name[10];
+                        snprintf(name, sizeof(name), "tx_%2d", i);
+                        wil_print_vring(s, wil, name, vring);
+                }
+        }
+
+        return 0;
+}
+
+static int wil_vring_seq_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, wil_vring_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations fops_vring = {
+        .open           = wil_vring_seq_open,
+        .release        = single_release,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+};
+
+static void wil_print_ring(struct seq_file *s, const char *prefix,
+                           void __iomem *off)
+{
+        struct wil6210_priv *wil = s->private;
+        struct wil6210_mbox_ring r;
+        int rsize;
+        uint i;
+
+        wil_memcpy_fromio_32(&r, off, sizeof(r));
+        wil_mbox_ring_le2cpus(&r);
+        /*
+         * we just read memory block from NIC. This memory may be
+         * garbage. Check validity before using it.
+         */
+        rsize = r.size / sizeof(struct wil6210_mbox_ring_desc);
+
+        seq_printf(s, "ring %s = {\n", prefix);
+        seq_printf(s, "  base = 0x%08x\n", r.base);
+        seq_printf(s, "  size = 0x%04x bytes -> %d entries\n", r.size, rsize);
+        seq_printf(s, "  tail = 0x%08x\n", r.tail);
+        seq_printf(s, "  head = 0x%08x\n", r.head);
+        seq_printf(s, "  entry size = %d\n", r.entry_size);
+
+        if (r.size % sizeof(struct wil6210_mbox_ring_desc)) {
+                seq_printf(s, "  ??? size is not multiple of %zd, garbage?\n",
+                           sizeof(struct wil6210_mbox_ring_desc));
+                goto out;
+        }
+
+        if (!wmi_addr(wil, r.base) ||
+            !wmi_addr(wil, r.tail) ||
+            !wmi_addr(wil, r.head)) {
+                seq_printf(s, "  ??? pointers are garbage?\n");
+                goto out;
+        }
+
+        for (i = 0; i < rsize; i++) {
+                struct wil6210_mbox_ring_desc d;
+                struct wil6210_mbox_hdr hdr;
+                size_t delta = i * sizeof(d);
+                void __iomem *x = wil->csr + HOSTADDR(r.base) + delta;
+
+                wil_memcpy_fromio_32(&d, x, sizeof(d));
+
+                seq_printf(s, "  [%2x] %s %s%s 0x%08x", i,
+                           d.sync ? "F" : "E",
+                           (r.tail - r.base == delta) ? "t" : " ",
+                           (r.head - r.base == delta) ? "h" : " ",
+                           le32_to_cpu(d.addr));
+                if (0 == wmi_read_hdr(wil, d.addr, &hdr)) {
+                        u16 len = le16_to_cpu(hdr.len);
+                        seq_printf(s, " -> %04x %04x %04x %02x\n",
+                                   le16_to_cpu(hdr.seq), len,
+                                   le16_to_cpu(hdr.type), hdr.flags);
+                        if (len <= MAX_MBOXITEM_SIZE) {
+                                int n = 0;
+                                unsigned char printbuf[16 * 3 + 2];
+                                unsigned char databuf[MAX_MBOXITEM_SIZE];
+                                void __iomem *src = wmi_buffer(wil, d.addr) +
+                                        sizeof(struct wil6210_mbox_hdr);
+                                /*
+                                 * No need to check @src for validity -
+                                 * we already validated @d.addr while
+                                 * reading header
+                                 */
+                                wil_memcpy_fromio_32(databuf, src, len);
+                                while (n < len) {
+                                        int l = min(len - n, 16);
+                                        hex_dump_to_buffer(databuf + n, l,
+                                                           16, 1, printbuf,
+                                                           sizeof(printbuf),
+                                                           false);
+                                        seq_printf(s, "      : %s\n", printbuf);
+                                        n += l;
+                                }
+                        }
+                } else {
+                        seq_printf(s, "\n");
+                }
+        }
+ out:
+        seq_printf(s, "}\n");
+}
+
+static int wil_mbox_debugfs_show(struct seq_file *s, void *data)
+{
+        struct wil6210_priv *wil = s->private;
+
+        wil_print_ring(s, "tx", wil->csr + HOST_MBOX +
+                       offsetof(struct wil6210_mbox_ctl, tx));
+        wil_print_ring(s, "rx", wil->csr + HOST_MBOX +
+                       offsetof(struct wil6210_mbox_ctl, rx));
+
+        return 0;
+}
+
+static int wil_mbox_seq_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, wil_mbox_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations fops_mbox = {
+        .open           = wil_mbox_seq_open,
+        .release        = single_release,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+};
+
+static int wil_debugfs_iomem_x32_set(void *data, u64 val)
+{
+        iowrite32(val, (void __iomem *)data);
+        wmb(); /* make sure write propagated to HW */
+
+        return 0;
+}
+
+static int wil_debugfs_iomem_x32_get(void *data, u64 *val)
+{
+        *val = ioread32((void __iomem *)data);
+
+        return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(fops_iomem_x32, wil_debugfs_iomem_x32_get,
+                        wil_debugfs_iomem_x32_set, "0x%08llx\n");
+
+static struct dentry *wil_debugfs_create_iomem_x32(const char *name,
+                                                   mode_t mode,
+                                                   struct dentry *parent,
+                                                   void __iomem *value)
+{
+        return debugfs_create_file(name, mode, parent, (void * __force)value,
+                                   &fops_iomem_x32);
+}
+
+static int wil6210_debugfs_create_ISR(struct wil6210_priv *wil,
+                                      const char *name,
+                                      struct dentry *parent, u32 off)
+{
+        struct dentry *d = debugfs_create_dir(name, parent);
+
+        if (IS_ERR_OR_NULL(d))
+                return -ENODEV;
+
+        wil_debugfs_create_iomem_x32("ICC", S_IRUGO | S_IWUSR, d,
+                                     wil->csr + off);
+        wil_debugfs_create_iomem_x32("ICR", S_IRUGO | S_IWUSR, d,
+                                     wil->csr + off + 4);
+        wil_debugfs_create_iomem_x32("ICM", S_IRUGO | S_IWUSR, d,
+                                     wil->csr + off + 8);
+        wil_debugfs_create_iomem_x32("ICS", S_IWUSR, d,
+                                     wil->csr + off + 12);
+        wil_debugfs_create_iomem_x32("IMV", S_IRUGO | S_IWUSR, d,
+                                     wil->csr + off + 16);
+        wil_debugfs_create_iomem_x32("IMS", S_IWUSR, d,
+                                     wil->csr + off + 20);
+        wil_debugfs_create_iomem_x32("IMC", S_IWUSR, d,
+                                     wil->csr + off + 24);
+
+        return 0;
+}
+
+static int wil6210_debugfs_create_pseudo_ISR(struct wil6210_priv *wil,
+                                             struct dentry *parent)
+{
+        struct dentry *d = debugfs_create_dir("PSEUDO_ISR", parent);
+
+        if (IS_ERR_OR_NULL(d))
+                return -ENODEV;
+
+        wil_debugfs_create_iomem_x32("CAUSE", S_IRUGO, d, wil->csr +
+                                     HOSTADDR(RGF_DMA_PSEUDO_CAUSE));
+        wil_debugfs_create_iomem_x32("MASK_SW", S_IRUGO, d, wil->csr +
+                                     HOSTADDR(RGF_DMA_PSEUDO_CAUSE_MASK_SW));
+        wil_debugfs_create_iomem_x32("MASK_FW", S_IRUGO, d, wil->csr +
+                                     HOSTADDR(RGF_DMA_PSEUDO_CAUSE_MASK_FW));
+
+        return 0;
+}
+
+static int wil6210_debugfs_create_ITR_CNT(struct wil6210_priv *wil,
+                                          struct dentry *parent)
+{
+        struct dentry *d = debugfs_create_dir("ITR_CNT", parent);
+
+        if (IS_ERR_OR_NULL(d))
+                return -ENODEV;
+
+        wil_debugfs_create_iomem_x32("TRSH", S_IRUGO, d, wil->csr +
+                                     HOSTADDR(RGF_DMA_ITR_CNT_TRSH));
+        wil_debugfs_create_iomem_x32("DATA", S_IRUGO, d, wil->csr +
+                                     HOSTADDR(RGF_DMA_ITR_CNT_DATA));
+        wil_debugfs_create_iomem_x32("CTL", S_IRUGO, d, wil->csr +
+                                     HOSTADDR(RGF_DMA_ITR_CNT_CRL));
+
+        return 0;
+}
+
+static int wil_memread_debugfs_show(struct seq_file *s, void *data)
+{
+        struct wil6210_priv *wil = s->private;
+        void __iomem *a = wmi_buffer(wil, cpu_to_le32(mem_addr));
+
+        if (a)
+                seq_printf(s, "[0x%08x] = 0x%08x\n", mem_addr, ioread32(a));
+        else
+                seq_printf(s, "[0x%08x] = INVALID\n", mem_addr);
+
+        return 0;
+}
+
+static int wil_memread_seq_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, wil_memread_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations fops_memread = {
+        .open           = wil_memread_seq_open,
+        .release        = single_release,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+};
+
+static int wil_default_open(struct inode *inode, struct file *file)
+{
+        if (inode->i_private)
+                file->private_data = inode->i_private;
+
+        return 0;
+}
+
+static ssize_t wil_read_file_ioblob(struct file *file, char __user *user_buf,
+                                size_t count, loff_t *ppos)
+{
+        enum { max_count = 4096 };
+        struct debugfs_blob_wrapper *blob = file->private_data;
+        loff_t pos = *ppos;
+        size_t available = blob->size;
+        void *buf;
+        size_t ret;
+
+        if (pos < 0)
+                return -EINVAL;
+
+        if (pos >= available || !count)
+                return 0;
+
+        if (count > available - pos)
+                count = available - pos;
+        if (count > max_count)
+                count = max_count;
+
+        buf = kmalloc(count, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        wil_memcpy_fromio_32(buf, (const volatile void __iomem *)blob->data +
+                             pos, count);
+
+        ret = copy_to_user(user_buf, buf, count);
+        kfree(buf);
+        if (ret == count)
+                return -EFAULT;
+
+        count -= ret;
+        *ppos = pos + count;
+
+        return count;
+}
+
+static const struct file_operations fops_ioblob = {
+        .read =         wil_read_file_ioblob,
+        .open =         wil_default_open,
+        .llseek =       default_llseek,
+};
+
+static
+struct dentry *wil_debugfs_create_ioblob(const char *name,
+                                         mode_t mode,
+                                         struct dentry *parent,
+                                         struct debugfs_blob_wrapper *blob)
+{
+        return debugfs_create_file(name, mode, parent, blob, &fops_ioblob);
+}
+/*---reset---*/
+static ssize_t wil_write_file_reset(struct file *file, const char __user *buf,
+                                    size_t len, loff_t *ppos)
+{
+        struct wil6210_priv *wil = file->private_data;
+        struct net_device *ndev = wil_to_ndev(wil);
+
+        /**
+         * BUG:
+         * this code does NOT sync device state with the rest of system
+         * use with care, debug only!!!
+         */
+        rtnl_lock();
+        dev_close(ndev);
+        ndev->flags &= ~IFF_UP;
+        rtnl_unlock();
+        wil_reset(wil);
+
+        return len;
+}
+
+static const struct file_operations fops_reset = {
+        .write = wil_write_file_reset,
+        .open  = wil_default_open,
+};
+/*---------Tx descriptor------------*/
+
+static int wil_txdesc_debugfs_show(struct seq_file *s, void *data)
+{
+        struct wil6210_priv *wil = s->private;
+        struct vring *vring = &(wil->vring_tx[0]);
+
+        if (!vring->va) {
+                seq_printf(s, "No Tx VRING\n");
+                return 0;
+        }
+
+        if (dbg_txdesc_index < vring->size) {
+                volatile struct vring_tx_desc *d =
+                                &(vring->va[dbg_txdesc_index].tx);
+                volatile u32 *u = (volatile u32 *)d;
+                struct sk_buff *skb = vring->ctx[dbg_txdesc_index];
+
+                seq_printf(s, "Tx[%3d] = {\n", dbg_txdesc_index);
+                seq_printf(s, "  MAC = 0x%08x 0x%08x 0x%08x 0x%08x\n",
+                           u[0], u[1], u[2], u[3]);
+                seq_printf(s, "  DMA = 0x%08x 0x%08x 0x%08x 0x%08x\n",
+                           u[4], u[5], u[6], u[7]);
+                seq_printf(s, "  SKB = %p\n", skb);
+
+                if (skb) {
+                        unsigned char printbuf[16 * 3 + 2];
+                        int i = 0;
+                        int len = skb_headlen(skb);
+                        void *p = skb->data;
+
+                        seq_printf(s, "    len = %d\n", len);
+
+                        while (i < len) {
+                                int l = min(len - i, 16);
+                                hex_dump_to_buffer(p + i, l, 16, 1, printbuf,
+                                                   sizeof(printbuf), false);
+                                seq_printf(s, "      : %s\n", printbuf);
+                                i += l;
+                        }
+                }
+                seq_printf(s, "}\n");
+        } else {
+                seq_printf(s, "TxDesc index (%d) >= size (%d)\n",
+                           dbg_txdesc_index, vring->size);
+        }
+
+        return 0;
+}
+
+static int wil_txdesc_seq_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, wil_txdesc_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations fops_txdesc = {
+        .open           = wil_txdesc_seq_open,
+        .release        = single_release,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+};
+
+/*---------beamforming------------*/
+static int wil_bf_debugfs_show(struct seq_file *s, void *data)
+{
+        struct wil6210_priv *wil = s->private;
+        seq_printf(s,
+                   "TSF : 0x%016llx\n"
+                   "TxMCS : %d\n"
+                   "Sectors(rx:tx) my %2d:%2d peer %2d:%2d\n",
+                   wil->stats.tsf, wil->stats.bf_mcs,
+                   wil->stats.my_rx_sector, wil->stats.my_tx_sector,
+                   wil->stats.peer_rx_sector, wil->stats.peer_tx_sector);
+        return 0;
+}
+
+static int wil_bf_seq_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, wil_bf_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations fops_bf = {
+        .open           = wil_bf_seq_open,
+        .release        = single_release,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+};
+/*---------SSID------------*/
+static ssize_t wil_read_file_ssid(struct file *file, char __user *user_buf,
+                                  size_t count, loff_t *ppos)
+{
+        struct wil6210_priv *wil = file->private_data;
+        struct wireless_dev *wdev = wil_to_wdev(wil);
+
+        return simple_read_from_buffer(user_buf, count, ppos,
+                                       wdev->ssid, wdev->ssid_len);
+}
+
+static ssize_t wil_write_file_ssid(struct file *file, const char __user *buf,
+                                   size_t count, loff_t *ppos)
+{
+        struct wil6210_priv *wil = file->private_data;
+        struct wireless_dev *wdev = wil_to_wdev(wil);
+        struct net_device *ndev = wil_to_ndev(wil);
+
+        if (*ppos != 0) {
+                wil_err(wil, "Unable to set SSID substring from [%d]\n",
+                        (int)*ppos);
+                return -EINVAL;
+        }
+
+        if (count > sizeof(wdev->ssid)) {
+                wil_err(wil, "SSID too long, len = %d\n", (int)count);
+                return -EINVAL;
+        }
+        if (netif_running(ndev)) {
+                wil_err(wil, "Unable to change SSID on running interface\n");
+                return -EINVAL;
+        }
+
+        wdev->ssid_len = count;
+        return simple_write_to_buffer(wdev->ssid, wdev->ssid_len, ppos,
+                                      buf, count);
+}
+
+static const struct file_operations fops_ssid = {
+        .read = wil_read_file_ssid,
+        .write = wil_write_file_ssid,
+        .open  = wil_default_open,
+};
+
+/*----------------*/
+int wil6210_debugfs_init(struct wil6210_priv *wil)
+{
+        struct dentry *dbg = wil->debug = debugfs_create_dir(WIL_NAME,
+                        wil_to_wiphy(wil)->debugfsdir);
+
+        if (IS_ERR_OR_NULL(dbg))
+                return -ENODEV;
+
+        debugfs_create_file("mbox", S_IRUGO, dbg, wil, &fops_mbox);
+        debugfs_create_file("vrings", S_IRUGO, dbg, wil, &fops_vring);
+        debugfs_create_file("txdesc", S_IRUGO, dbg, wil, &fops_txdesc);
+        debugfs_create_u32("txdesc_index", S_IRUGO | S_IWUSR, dbg,
+                           &dbg_txdesc_index);
+        debugfs_create_file("bf", S_IRUGO, dbg, wil, &fops_bf);
+        debugfs_create_file("ssid", S_IRUGO | S_IWUSR, dbg, wil, &fops_ssid);
+        debugfs_create_u32("secure_pcp", S_IRUGO | S_IWUSR, dbg,
+                           &wil->secure_pcp);
+
+        wil6210_debugfs_create_ISR(wil, "USER_ICR", dbg,
+                                   HOSTADDR(RGF_USER_USER_ICR));
+        wil6210_debugfs_create_ISR(wil, "DMA_EP_TX_ICR", dbg,
+                                   HOSTADDR(RGF_DMA_EP_TX_ICR));
+        wil6210_debugfs_create_ISR(wil, "DMA_EP_RX_ICR", dbg,
+                                   HOSTADDR(RGF_DMA_EP_RX_ICR));
+        wil6210_debugfs_create_ISR(wil, "DMA_EP_MISC_ICR", dbg,
+                                   HOSTADDR(RGF_DMA_EP_MISC_ICR));
+        wil6210_debugfs_create_pseudo_ISR(wil, dbg);
+        wil6210_debugfs_create_ITR_CNT(wil, dbg);
+
+        debugfs_create_u32("mem_addr", S_IRUGO | S_IWUSR, dbg, &mem_addr);
+        debugfs_create_file("mem_val", S_IRUGO, dbg, wil, &fops_memread);
+
+        debugfs_create_file("reset", S_IWUSR, dbg, wil, &fops_reset);
+
+        wil->rgf_blob.data = (void * __force)wil->csr + 0;
+        wil->rgf_blob.size = 0xa000;
+        wil_debugfs_create_ioblob("blob_rgf", S_IRUGO, dbg, &wil->rgf_blob);
+
+        wil->fw_code_blob.data = (void * __force)wil->csr + 0x40000;
+        wil->fw_code_blob.size = 0x40000;
+        wil_debugfs_create_ioblob("blob_fw_code", S_IRUGO, dbg,
+                                  &wil->fw_code_blob);
+
+        wil->fw_data_blob.data = (void * __force)wil->csr + 0x80000;
+        wil->fw_data_blob.size = 0x8000;
+        wil_debugfs_create_ioblob("blob_fw_data", S_IRUGO, dbg,
+                                  &wil->fw_data_blob);
+
+        wil->fw_peri_blob.data = (void * __force)wil->csr + 0x88000;
+        wil->fw_peri_blob.size = 0x18000;
+        wil_debugfs_create_ioblob("blob_fw_peri", S_IRUGO, dbg,
+                                  &wil->fw_peri_blob);
+
+        wil->uc_code_blob.data = (void * __force)wil->csr + 0xa0000;
+        wil->uc_code_blob.size = 0x10000;
+        wil_debugfs_create_ioblob("blob_uc_code", S_IRUGO, dbg,
+                                  &wil->uc_code_blob);
+
+        wil->uc_data_blob.data = (void * __force)wil->csr + 0xb0000;
+        wil->uc_data_blob.size = 0x4000;
+        wil_debugfs_create_ioblob("blob_uc_data", S_IRUGO, dbg,
+                                  &wil->uc_data_blob);
+
+        return 0;
+}
+
+void wil6210_debugfs_remove(struct wil6210_priv *wil)
+{
+        debugfs_remove_recursive(wil->debug);
+        wil->debug = NULL;
+}
diff --git a/drivers/net/wireless/ath/wil6210/interrupt.c b/drivers/net/wireless/ath/wil6210/interrupt.c
new file mode 100644
index 000000000000..38049da71049
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/interrupt.c
@@ -0,0 +1,471 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/interrupt.h>
+
+#include "wil6210.h"
+
+/**
+ * Theory of operation:
+ *
+ * There is ISR pseudo-cause register,
+ * dma_rgf->DMA_RGF.PSEUDO_CAUSE.PSEUDO_CAUSE
+ * Its bits represents OR'ed bits from 3 real ISR registers:
+ * TX, RX, and MISC.
+ *
+ * Registers may be configured to either "write 1 to clear" or
+ * "clear on read" mode
+ *
+ * When handling interrupt, one have to mask/unmask interrupts for the
+ * real ISR registers, or hardware may malfunction.
+ *
+ */
+
+#define WIL6210_IRQ_DISABLE     (0xFFFFFFFFUL)
+#define WIL6210_IMC_RX          BIT_DMA_EP_RX_ICR_RX_DONE
+#define WIL6210_IMC_TX          (BIT_DMA_EP_TX_ICR_TX_DONE | \
+                                BIT_DMA_EP_TX_ICR_TX_DONE_N(0))
+#define WIL6210_IMC_MISC        (ISR_MISC_FW_READY | ISR_MISC_MBOX_EVT)
+
+#define WIL6210_IRQ_PSEUDO_MASK (u32)(~(BIT_DMA_PSEUDO_CAUSE_RX | \
+                                        BIT_DMA_PSEUDO_CAUSE_TX | \
+                                        BIT_DMA_PSEUDO_CAUSE_MISC))
+
+#if defined(CONFIG_WIL6210_ISR_COR)
+/* configure to Clear-On-Read mode */
+#define WIL_ICR_ICC_VALUE       (0xFFFFFFFFUL)
+
+static inline void wil_icr_clear(u32 x, void __iomem *addr)
+{
+
+}
+#else /* defined(CONFIG_WIL6210_ISR_COR) */
+/* configure to Write-1-to-Clear mode */
+#define WIL_ICR_ICC_VALUE       (0UL)
+
+static inline void wil_icr_clear(u32 x, void __iomem *addr)
+{
+        iowrite32(x, addr);
+}
+#endif /* defined(CONFIG_WIL6210_ISR_COR) */
+
+static inline u32 wil_ioread32_and_clear(void __iomem *addr)
+{
+        u32 x = ioread32(addr);
+
+        wil_icr_clear(x, addr);
+
+        return x;
+}
+
+static void wil6210_mask_irq_tx(struct wil6210_priv *wil)
+{
+        iowrite32(WIL6210_IRQ_DISABLE, wil->csr +
+                  HOSTADDR(RGF_DMA_EP_TX_ICR) +
+                  offsetof(struct RGF_ICR, IMS));
+}
+
+static void wil6210_mask_irq_rx(struct wil6210_priv *wil)
+{
+        iowrite32(WIL6210_IRQ_DISABLE, wil->csr +
+                  HOSTADDR(RGF_DMA_EP_RX_ICR) +
+                  offsetof(struct RGF_ICR, IMS));
+}
+
+static void wil6210_mask_irq_misc(struct wil6210_priv *wil)
+{
+        iowrite32(WIL6210_IRQ_DISABLE, wil->csr +
+                  HOSTADDR(RGF_DMA_EP_MISC_ICR) +
+                  offsetof(struct RGF_ICR, IMS));
+}
+
+static void wil6210_mask_irq_pseudo(struct wil6210_priv *wil)
+{
+        wil_dbg_IRQ(wil, "%s()\n", __func__);
+
+        iowrite32(WIL6210_IRQ_DISABLE, wil->csr +
+                  HOSTADDR(RGF_DMA_PSEUDO_CAUSE_MASK_SW));
+
+        clear_bit(wil_status_irqen, &wil->status);
+}
+
+static void wil6210_unmask_irq_tx(struct wil6210_priv *wil)
+{
+        iowrite32(WIL6210_IMC_TX, wil->csr +
+                  HOSTADDR(RGF_DMA_EP_TX_ICR) +
+                  offsetof(struct RGF_ICR, IMC));
+}
+
+static void wil6210_unmask_irq_rx(struct wil6210_priv *wil)
+{
+        iowrite32(WIL6210_IMC_RX, wil->csr +
+                  HOSTADDR(RGF_DMA_EP_RX_ICR) +
+                  offsetof(struct RGF_ICR, IMC));
+}
+
+static void wil6210_unmask_irq_misc(struct wil6210_priv *wil)
+{
+        iowrite32(WIL6210_IMC_MISC, wil->csr +
+                  HOSTADDR(RGF_DMA_EP_MISC_ICR) +
+                  offsetof(struct RGF_ICR, IMC));
+}
+
+static void wil6210_unmask_irq_pseudo(struct wil6210_priv *wil)
+{
+        wil_dbg_IRQ(wil, "%s()\n", __func__);
+
+        set_bit(wil_status_irqen, &wil->status);
+
+        iowrite32(WIL6210_IRQ_PSEUDO_MASK, wil->csr +
+                  HOSTADDR(RGF_DMA_PSEUDO_CAUSE_MASK_SW));
+}
+
+void wil6210_disable_irq(struct wil6210_priv *wil)
+{
+        wil_dbg_IRQ(wil, "%s()\n", __func__);
+
+        wil6210_mask_irq_tx(wil);
+        wil6210_mask_irq_rx(wil);
+        wil6210_mask_irq_misc(wil);
+        wil6210_mask_irq_pseudo(wil);
+}
+
+void wil6210_enable_irq(struct wil6210_priv *wil)
+{
+        wil_dbg_IRQ(wil, "%s()\n", __func__);
+
+        iowrite32(WIL_ICR_ICC_VALUE, wil->csr + HOSTADDR(RGF_DMA_EP_RX_ICR) +
+                  offsetof(struct RGF_ICR, ICC));
+        iowrite32(WIL_ICR_ICC_VALUE, wil->csr + HOSTADDR(RGF_DMA_EP_TX_ICR) +
+                  offsetof(struct RGF_ICR, ICC));
+        iowrite32(WIL_ICR_ICC_VALUE, wil->csr + HOSTADDR(RGF_DMA_EP_MISC_ICR) +
+                  offsetof(struct RGF_ICR, ICC));
+
+        wil6210_unmask_irq_pseudo(wil);
+        wil6210_unmask_irq_tx(wil);
+        wil6210_unmask_irq_rx(wil);
+        wil6210_unmask_irq_misc(wil);
+}
+
+static irqreturn_t wil6210_irq_rx(int irq, void *cookie)
+{
+        struct wil6210_priv *wil = cookie;
+        u32 isr = wil_ioread32_and_clear(wil->csr +
+                                         HOSTADDR(RGF_DMA_EP_RX_ICR) +
+                                         offsetof(struct RGF_ICR, ICR));
+
+        wil_dbg_IRQ(wil, "ISR RX 0x%08x\n", isr);
+
+        if (!isr) {
+                wil_err(wil, "spurious IRQ: RX\n");
+                return IRQ_NONE;
+        }
+
+        wil6210_mask_irq_rx(wil);
+
+        if (isr & BIT_DMA_EP_RX_ICR_RX_DONE) {
+                wil_dbg_IRQ(wil, "RX done\n");
+                isr &= ~BIT_DMA_EP_RX_ICR_RX_DONE;
+                wil_rx_handle(wil);
+        }
+
+        if (isr)
+                wil_err(wil, "un-handled RX ISR bits 0x%08x\n", isr);
+
+        wil6210_unmask_irq_rx(wil);
+
+        return IRQ_HANDLED;
+}
+
+static irqreturn_t wil6210_irq_tx(int irq, void *cookie)
+{
+        struct wil6210_priv *wil = cookie;
+        u32 isr = wil_ioread32_and_clear(wil->csr +
+                                         HOSTADDR(RGF_DMA_EP_TX_ICR) +
+                                         offsetof(struct RGF_ICR, ICR));
+
+        wil_dbg_IRQ(wil, "ISR TX 0x%08x\n", isr);
+
+        if (!isr) {
+                wil_err(wil, "spurious IRQ: TX\n");
+                return IRQ_NONE;
+        }
+
+        wil6210_mask_irq_tx(wil);
+
+        if (isr & BIT_DMA_EP_TX_ICR_TX_DONE) {
+                uint i;
+                wil_dbg_IRQ(wil, "TX done\n");
+                isr &= ~BIT_DMA_EP_TX_ICR_TX_DONE;
+                for (i = 0; i < 24; i++) {
+                        u32 mask = BIT_DMA_EP_TX_ICR_TX_DONE_N(i);
+                        if (isr & mask) {
+                                isr &= ~mask;
+                                wil_dbg_IRQ(wil, "TX done(%i)\n", i);
+                                wil_tx_complete(wil, i);
+                        }
+                }
+        }
+
+        if (isr)
+                wil_err(wil, "un-handled TX ISR bits 0x%08x\n", isr);
+
+        wil6210_unmask_irq_tx(wil);
+
+        return IRQ_HANDLED;
+}
+
+static irqreturn_t wil6210_irq_misc(int irq, void *cookie)
+{
+        struct wil6210_priv *wil = cookie;
+        u32 isr = wil_ioread32_and_clear(wil->csr +
+                                         HOSTADDR(RGF_DMA_EP_MISC_ICR) +
+                                         offsetof(struct RGF_ICR, ICR));
+
+        wil_dbg_IRQ(wil, "ISR MISC 0x%08x\n", isr);
+
+        if (!isr) {
+                wil_err(wil, "spurious IRQ: MISC\n");
+                return IRQ_NONE;
+        }
+
+        wil6210_mask_irq_misc(wil);
+
+        if (isr & ISR_MISC_FW_READY) {
+                wil_dbg_IRQ(wil, "IRQ: FW ready\n");
+                /**
+                 * Actual FW ready indicated by the
+                 * WMI_FW_READY_EVENTID
+                 */
+                isr &= ~ISR_MISC_FW_READY;
+        }
+
+        wil->isr_misc = isr;
+
+        if (isr) {
+                return IRQ_WAKE_THREAD;
+        } else {
+                wil6210_unmask_irq_misc(wil);
+                return IRQ_HANDLED;
+        }
+}
+
+static irqreturn_t wil6210_irq_misc_thread(int irq, void *cookie)
+{
+        struct wil6210_priv *wil = cookie;
+        u32 isr = wil->isr_misc;
+
+        wil_dbg_IRQ(wil, "Thread ISR MISC 0x%08x\n", isr);
+
+        if (isr & ISR_MISC_MBOX_EVT) {
+                wil_dbg_IRQ(wil, "MBOX event\n");
+                wmi_recv_cmd(wil);
+                isr &= ~ISR_MISC_MBOX_EVT;
+        }
+
+        if (isr)
+                wil_err(wil, "un-handled MISC ISR bits 0x%08x\n", isr);
+
+        wil->isr_misc = 0;
+
+        wil6210_unmask_irq_misc(wil);
+
+        return IRQ_HANDLED;
+}
+
+/**
+ * thread IRQ handler
+ */
+static irqreturn_t wil6210_thread_irq(int irq, void *cookie)
+{
+        struct wil6210_priv *wil = cookie;
+
+        wil_dbg_IRQ(wil, "Thread IRQ\n");
+        /* Discover real IRQ cause */
+        if (wil->isr_misc)
+                wil6210_irq_misc_thread(irq, cookie);
+
+        wil6210_unmask_irq_pseudo(wil);
+
+        return IRQ_HANDLED;
+}
+
+/* DEBUG
+ * There is subtle bug in hardware that causes IRQ to raise when it should be
+ * masked. It is quite rare and hard to debug.
+ *
+ * Catch irq issue if it happens and print all I can.
+ */
+static int wil6210_debug_irq_mask(struct wil6210_priv *wil, u32 pseudo_cause)
+{
+        if (!test_bit(wil_status_irqen, &wil->status)) {
+                u32 icm_rx = wil_ioread32_and_clear(wil->csr +
+                                HOSTADDR(RGF_DMA_EP_RX_ICR) +
+                                offsetof(struct RGF_ICR, ICM));
+                u32 icr_rx = wil_ioread32_and_clear(wil->csr +
+                                HOSTADDR(RGF_DMA_EP_RX_ICR) +
+                                offsetof(struct RGF_ICR, ICR));
+                u32 imv_rx = ioread32(wil->csr +
+                                HOSTADDR(RGF_DMA_EP_RX_ICR) +
+                                offsetof(struct RGF_ICR, IMV));
+                u32 icm_tx = wil_ioread32_and_clear(wil->csr +
+                                HOSTADDR(RGF_DMA_EP_TX_ICR) +
+                                offsetof(struct RGF_ICR, ICM));
+                u32 icr_tx = wil_ioread32_and_clear(wil->csr +
+                                HOSTADDR(RGF_DMA_EP_TX_ICR) +
+                                offsetof(struct RGF_ICR, ICR));
+                u32 imv_tx = ioread32(wil->csr +
+                                HOSTADDR(RGF_DMA_EP_TX_ICR) +
+                                offsetof(struct RGF_ICR, IMV));
+                u32 icm_misc = wil_ioread32_and_clear(wil->csr +
+                                HOSTADDR(RGF_DMA_EP_MISC_ICR) +
+                                offsetof(struct RGF_ICR, ICM));
+                u32 icr_misc = wil_ioread32_and_clear(wil->csr +
+                                HOSTADDR(RGF_DMA_EP_MISC_ICR) +
+                                offsetof(struct RGF_ICR, ICR));
+                u32 imv_misc = ioread32(wil->csr +
+                                HOSTADDR(RGF_DMA_EP_MISC_ICR) +
+                                offsetof(struct RGF_ICR, IMV));
+                wil_err(wil, "IRQ when it should be masked: pseudo 0x%08x\n"
+                                "Rx   icm:icr:imv 0x%08x 0x%08x 0x%08x\n"
+                                "Tx   icm:icr:imv 0x%08x 0x%08x 0x%08x\n"
+                                "Misc icm:icr:imv 0x%08x 0x%08x 0x%08x\n",
+                                pseudo_cause,
+                                icm_rx, icr_rx, imv_rx,
+                                icm_tx, icr_tx, imv_tx,
+                                icm_misc, icr_misc, imv_misc);
+
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static irqreturn_t wil6210_hardirq(int irq, void *cookie)
+{
+        irqreturn_t rc = IRQ_HANDLED;
+        struct wil6210_priv *wil = cookie;
+        u32 pseudo_cause = ioread32(wil->csr + HOSTADDR(RGF_DMA_PSEUDO_CAUSE));
+
+        /**
+         * pseudo_cause is Clear-On-Read, no need to ACK
+         */
+        if ((pseudo_cause == 0) || ((pseudo_cause & 0xff) == 0xff))
+                return IRQ_NONE;
+
+        /* FIXME: IRQ mask debug */
+        if (wil6210_debug_irq_mask(wil, pseudo_cause))
+                return IRQ_NONE;
+
+        wil6210_mask_irq_pseudo(wil);
+
+        /* Discover real IRQ cause
+         * There are 2 possible phases for every IRQ:
+         * - hard IRQ handler called right here
+         * - threaded handler called later
+         *
+         * Hard IRQ handler reads and clears ISR.
+         *
+         * If threaded handler requested, hard IRQ handler
+         * returns IRQ_WAKE_THREAD and saves ISR register value
+         * for the threaded handler use.
+         *
+         * voting for wake thread - need at least 1 vote
+         */
+        if ((pseudo_cause & BIT_DMA_PSEUDO_CAUSE_RX) &&
+            (wil6210_irq_rx(irq, cookie) == IRQ_WAKE_THREAD))
+                rc = IRQ_WAKE_THREAD;
+
+        if ((pseudo_cause & BIT_DMA_PSEUDO_CAUSE_TX) &&
+            (wil6210_irq_tx(irq, cookie) == IRQ_WAKE_THREAD))
+                rc = IRQ_WAKE_THREAD;
+
+        if ((pseudo_cause & BIT_DMA_PSEUDO_CAUSE_MISC) &&
+            (wil6210_irq_misc(irq, cookie) == IRQ_WAKE_THREAD))
+                rc = IRQ_WAKE_THREAD;
+
+        /* if thread is requested, it will unmask IRQ */
+        if (rc != IRQ_WAKE_THREAD)
+                wil6210_unmask_irq_pseudo(wil);
+
+        wil_dbg_IRQ(wil, "Hard IRQ 0x%08x\n", pseudo_cause);
+
+        return rc;
+}
+
+static int wil6210_request_3msi(struct wil6210_priv *wil, int irq)
+{
+        int rc;
+        /*
+         * IRQ's are in the following order:
+         * - Tx
+         * - Rx
+         * - Misc
+         */
+
+        rc = request_irq(irq, wil6210_irq_tx, IRQF_SHARED,
+                         WIL_NAME"_tx", wil);
+        if (rc)
+                return rc;
+
+        rc = request_irq(irq + 1, wil6210_irq_rx, IRQF_SHARED,
+                         WIL_NAME"_rx", wil);
+        if (rc)
+                goto free0;
+
+        rc = request_threaded_irq(irq + 2, wil6210_irq_misc,
+                                  wil6210_irq_misc_thread,
+                                  IRQF_SHARED, WIL_NAME"_misc", wil);
+        if (rc)
+                goto free1;
+
+        return 0;
+        /* error branch */
+free1:
+        free_irq(irq + 1, wil);
+free0:
+        free_irq(irq, wil);
+
+        return rc;
+}
+
+int wil6210_init_irq(struct wil6210_priv *wil, int irq)
+{
+        int rc;
+        if (wil->n_msi == 3)
+                rc = wil6210_request_3msi(wil, irq);
+        else
+                rc = request_threaded_irq(irq, wil6210_hardirq,
+                                          wil6210_thread_irq,
+                                          wil->n_msi ? 0 : IRQF_SHARED,
+                                          WIL_NAME, wil);
+        if (rc)
+                return rc;
+
+        wil6210_enable_irq(wil);
+
+        return 0;
+}
+
+void wil6210_fini_irq(struct wil6210_priv *wil, int irq)
+{
+        wil6210_disable_irq(wil);
+        free_irq(irq, wil);
+        if (wil->n_msi == 3) {
+                free_irq(irq + 1, wil);
+                free_irq(irq + 2, wil);
+        }
+}
diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c
new file mode 100644
index 000000000000..95fcd361322b
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/main.c
@@ -0,0 +1,407 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+#include <linux/sched.h>
+#include <linux/ieee80211.h>
+#include <linux/wireless.h>
+#include <linux/slab.h>
+#include <linux/moduleparam.h>
+#include <linux/if_arp.h>
+
+#include "wil6210.h"
+
+/*
+ * Due to a hardware issue,
+ * one has to read/write to/from NIC in 32-bit chunks;
+ * regular memcpy_fromio and siblings will
+ * not work on 64-bit platform - it uses 64-bit transactions
+ *
+ * Force 32-bit transactions to enable NIC on 64-bit platforms
+ *
+ * To avoid byte swap on big endian host, __raw_{read|write}l
+ * should be used - {read|write}l would swap bytes to provide
+ * little endian on PCI value in host endianness.
+ */
+void wil_memcpy_fromio_32(void *dst, const volatile void __iomem *src,
+                          size_t count)
+{
+        u32 *d = dst;
+        const volatile u32 __iomem *s = src;
+
+        /* size_t is unsigned, if (count%4 != 0) it will wrap */
+        for (count += 4; count > 4; count -= 4)
+                *d++ = __raw_readl(s++);
+}
+
+void wil_memcpy_toio_32(volatile void __iomem *dst, const void *src,
+                        size_t count)
+{
+        volatile u32 __iomem *d = dst;
+        const u32 *s = src;
+
+        for (count += 4; count > 4; count -= 4)
+                __raw_writel(*s++, d++);
+}
+
+static void _wil6210_disconnect(struct wil6210_priv *wil, void *bssid)
+{
+        uint i;
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct wireless_dev *wdev = wil->wdev;
+
+        wil_dbg(wil, "%s()\n", __func__);
+
+        wil_link_off(wil);
+        clear_bit(wil_status_fwconnected, &wil->status);
+
+        switch (wdev->sme_state) {
+        case CFG80211_SME_CONNECTED:
+                cfg80211_disconnected(ndev, WLAN_STATUS_UNSPECIFIED_FAILURE,
+                                      NULL, 0, GFP_KERNEL);
+                break;
+        case CFG80211_SME_CONNECTING:
+                cfg80211_connect_result(ndev, bssid, NULL, 0, NULL, 0,
+                                        WLAN_STATUS_UNSPECIFIED_FAILURE,
+                                        GFP_KERNEL);
+                break;
+        default:
+                ;
+        }
+
+        for (i = 0; i < ARRAY_SIZE(wil->vring_tx); i++)
+                wil_vring_fini_tx(wil, i);
+}
+
+static void wil_disconnect_worker(struct work_struct *work)
+{
+        struct wil6210_priv *wil = container_of(work,
+                        struct wil6210_priv, disconnect_worker);
+
+        _wil6210_disconnect(wil, NULL);
+}
+
+static void wil_connect_timer_fn(ulong x)
+{
+        struct wil6210_priv *wil = (void *)x;
+
+        wil_dbg(wil, "Connect timeout\n");
+
+        /* reschedule to thread context - disconnect won't
+         * run from atomic context
+         */
+        schedule_work(&wil->disconnect_worker);
+}
+
+int wil_priv_init(struct wil6210_priv *wil)
+{
+        wil_dbg(wil, "%s()\n", __func__);
+
+        mutex_init(&wil->mutex);
+        mutex_init(&wil->wmi_mutex);
+
+        init_completion(&wil->wmi_ready);
+
+        wil->pending_connect_cid = -1;
+        setup_timer(&wil->connect_timer, wil_connect_timer_fn, (ulong)wil);
+
+        INIT_WORK(&wil->wmi_connect_worker, wmi_connect_worker);
+        INIT_WORK(&wil->disconnect_worker, wil_disconnect_worker);
+        INIT_WORK(&wil->wmi_event_worker, wmi_event_worker);
+
+        INIT_LIST_HEAD(&wil->pending_wmi_ev);
+        spin_lock_init(&wil->wmi_ev_lock);
+
+        wil->wmi_wq = create_singlethread_workqueue(WIL_NAME"_wmi");
+        if (!wil->wmi_wq)
+                return -EAGAIN;
+
+        wil->wmi_wq_conn = create_singlethread_workqueue(WIL_NAME"_connect");
+        if (!wil->wmi_wq_conn) {
+                destroy_workqueue(wil->wmi_wq);
+                return -EAGAIN;
+        }
+
+        /* make shadow copy of registers that should not change on run time */
+        wil_memcpy_fromio_32(&wil->mbox_ctl, wil->csr + HOST_MBOX,
+                             sizeof(struct wil6210_mbox_ctl));
+        wil_mbox_ring_le2cpus(&wil->mbox_ctl.rx);
+        wil_mbox_ring_le2cpus(&wil->mbox_ctl.tx);
+
+        return 0;
+}
+
+void wil6210_disconnect(struct wil6210_priv *wil, void *bssid)
+{
+        del_timer_sync(&wil->connect_timer);
+        _wil6210_disconnect(wil, bssid);
+}
+
+void wil_priv_deinit(struct wil6210_priv *wil)
+{
+        cancel_work_sync(&wil->disconnect_worker);
+        wil6210_disconnect(wil, NULL);
+        wmi_event_flush(wil);
+        destroy_workqueue(wil->wmi_wq_conn);
+        destroy_workqueue(wil->wmi_wq);
+}
+
+static void wil_target_reset(struct wil6210_priv *wil)
+{
+        wil_dbg(wil, "Resetting...\n");
+
+        /* register write */
+#define W(a, v) iowrite32(v, wil->csr + HOSTADDR(a))
+        /* register set = read, OR, write */
+#define S(a, v) iowrite32(ioread32(wil->csr + HOSTADDR(a)) | v, \
+                wil->csr + HOSTADDR(a))
+
+        /* hpal_perst_from_pad_src_n_mask */
+        S(RGF_USER_CLKS_CTL_SW_RST_MASK_0, BIT(6));
+        /* car_perst_rst_src_n_mask */
+        S(RGF_USER_CLKS_CTL_SW_RST_MASK_0, BIT(7));
+
+        W(RGF_USER_MAC_CPU_0,  BIT(1)); /* mac_cpu_man_rst */
+        W(RGF_USER_USER_CPU_0, BIT(1)); /* user_cpu_man_rst */
+
+        msleep(100);
+
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0xFE000000);
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_1, 0x0000003F);
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, 0x00000170);
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_0, 0xFFE7FC00);
+
+        msleep(100);
+
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, 0);
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0);
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_1, 0);
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_0, 0);
+
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, 0x00000001);
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0x00000080);
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_0, 0);
+
+        msleep(2000);
+
+        W(RGF_USER_USER_CPU_0, BIT(0)); /* user_cpu_man_de_rst */
+
+        msleep(2000);
+
+        wil_dbg(wil, "Reset completed\n");
+
+#undef W
+#undef S
+}
+
+void wil_mbox_ring_le2cpus(struct wil6210_mbox_ring *r)
+{
+        le32_to_cpus(&r->base);
+        le16_to_cpus(&r->entry_size);
+        le16_to_cpus(&r->size);
+        le32_to_cpus(&r->tail);
+        le32_to_cpus(&r->head);
+}
+
+static int wil_wait_for_fw_ready(struct wil6210_priv *wil)
+{
+        ulong to = msecs_to_jiffies(1000);
+        ulong left = wait_for_completion_timeout(&wil->wmi_ready, to);
+        if (0 == left) {
+                wil_err(wil, "Firmware not ready\n");
+                return -ETIME;
+        } else {
+                wil_dbg(wil, "FW ready after %d ms\n",
+                        jiffies_to_msecs(to-left));
+        }
+        return 0;
+}
+
+/*
+ * We reset all the structures, and we reset the UMAC.
+ * After calling this routine, you're expected to reload
+ * the firmware.
+ */
+int wil_reset(struct wil6210_priv *wil)
+{
+        int rc;
+
+        cancel_work_sync(&wil->disconnect_worker);
+        wil6210_disconnect(wil, NULL);
+
+        wmi_event_flush(wil);
+
+        flush_workqueue(wil->wmi_wq);
+        flush_workqueue(wil->wmi_wq_conn);
+
+        wil6210_disable_irq(wil);
+        wil->status = 0;
+
+        /* TODO: put MAC in reset */
+        wil_target_reset(wil);
+
+        /* init after reset */
+        wil->pending_connect_cid = -1;
+        INIT_COMPLETION(wil->wmi_ready);
+
+        /* make shadow copy of registers that should not change on run time */
+        wil_memcpy_fromio_32(&wil->mbox_ctl, wil->csr + HOST_MBOX,
+                             sizeof(struct wil6210_mbox_ctl));
+        wil_mbox_ring_le2cpus(&wil->mbox_ctl.rx);
+        wil_mbox_ring_le2cpus(&wil->mbox_ctl.tx);
+
+        /* TODO: release MAC reset */
+        wil6210_enable_irq(wil);
+
+        /* we just started MAC, wait for FW ready */
+        rc = wil_wait_for_fw_ready(wil);
+
+        return rc;
+}
+
+
+void wil_link_on(struct wil6210_priv *wil)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+
+        wil_dbg(wil, "%s()\n", __func__);
+
+        netif_carrier_on(ndev);
+        netif_tx_wake_all_queues(ndev);
+}
+
+void wil_link_off(struct wil6210_priv *wil)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+
+        wil_dbg(wil, "%s()\n", __func__);
+
+        netif_tx_stop_all_queues(ndev);
+        netif_carrier_off(ndev);
+}
+
+static int __wil_up(struct wil6210_priv *wil)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct wireless_dev *wdev = wil->wdev;
+        struct ieee80211_channel *channel = wdev->preset_chandef.chan;
+        int rc;
+        int bi;
+        u16 wmi_nettype = wil_iftype_nl2wmi(wdev->iftype);
+
+        rc = wil_reset(wil);
+        if (rc)
+                return rc;
+
+        /* FIXME Firmware works now in PBSS mode(ToDS=0, FromDS=0) */
+        wmi_nettype = wil_iftype_nl2wmi(NL80211_IFTYPE_ADHOC);
+        switch (wdev->iftype) {
+        case NL80211_IFTYPE_STATION:
+                wil_dbg(wil, "type: STATION\n");
+                bi = 0;
+                ndev->type = ARPHRD_ETHER;
+                break;
+        case NL80211_IFTYPE_AP:
+                wil_dbg(wil, "type: AP\n");
+                bi = 100;
+                ndev->type = ARPHRD_ETHER;
+                break;
+        case NL80211_IFTYPE_P2P_CLIENT:
+                wil_dbg(wil, "type: P2P_CLIENT\n");
+                bi = 0;
+                ndev->type = ARPHRD_ETHER;
+                break;
+        case NL80211_IFTYPE_P2P_GO:
+                wil_dbg(wil, "type: P2P_GO\n");
+                bi = 100;
+                ndev->type = ARPHRD_ETHER;
+                break;
+        case NL80211_IFTYPE_MONITOR:
+                wil_dbg(wil, "type: Monitor\n");
+                bi = 0;
+                ndev->type = ARPHRD_IEEE80211_RADIOTAP;
+                /* ARPHRD_IEEE80211 or ARPHRD_IEEE80211_RADIOTAP ? */
+                break;
+        default:
+                return -EOPNOTSUPP;
+        }
+
+        /* Apply profile in the following order: */
+        /* SSID and channel for the AP */
+        switch (wdev->iftype) {
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_P2P_GO:
+                if (wdev->ssid_len == 0) {
+                        wil_err(wil, "SSID not set\n");
+                        return -EINVAL;
+                }
+                wmi_set_ssid(wil, wdev->ssid_len, wdev->ssid);
+                if (channel)
+                        wmi_set_channel(wil, channel->hw_value);
+                break;
+        default:
+                ;
+        }
+
+        /* MAC address - pre-requisite for other commands */
+        wmi_set_mac_address(wil, ndev->dev_addr);
+
+        /* Set up beaconing if required. */
+        rc = wmi_set_bcon(wil, bi, wmi_nettype);
+        if (rc)
+                return rc;
+
+        /* Rx VRING. After MAC and beacon */
+        wil_rx_init(wil);
+
+        return 0;
+}
+
+int wil_up(struct wil6210_priv *wil)
+{
+        int rc;
+
+        mutex_lock(&wil->mutex);
+        rc = __wil_up(wil);
+        mutex_unlock(&wil->mutex);
+
+        return rc;
+}
+
+static int __wil_down(struct wil6210_priv *wil)
+{
+        if (wil->scan_request) {
+                cfg80211_scan_done(wil->scan_request, true);
+                wil->scan_request = NULL;
+        }
+
+        wil6210_disconnect(wil, NULL);
+        wil_rx_fini(wil);
+
+        return 0;
+}
+
+int wil_down(struct wil6210_priv *wil)
+{
+        int rc;
+
+        mutex_lock(&wil->mutex);
+        rc = __wil_down(wil);
+        mutex_unlock(&wil->mutex);
+
+        return rc;
+}
diff --git a/drivers/net/wireless/ath/wil6210/netdev.c b/drivers/net/wireless/ath/wil6210/netdev.c
new file mode 100644
index 000000000000..3068b5cb53a7
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/netdev.c
@@ -0,0 +1,157 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/slab.h>
+
+#include "wil6210.h"
+
+static int wil_open(struct net_device *ndev)
+{
+        struct wil6210_priv *wil = ndev_to_wil(ndev);
+
+        return wil_up(wil);
+}
+
+static int wil_stop(struct net_device *ndev)
+{
+        struct wil6210_priv *wil = ndev_to_wil(ndev);
+
+        return wil_down(wil);
+}
+
+/*
+ * AC to queue mapping
+ *
+ * AC_VO -> queue 3
+ * AC_VI -> queue 2
+ * AC_BE -> queue 1
+ * AC_BK -> queue 0
+ */
+static u16 wil_select_queue(struct net_device *ndev, struct sk_buff *skb)
+{
+        static const u16 wil_1d_to_queue[8] = { 1, 0, 0, 1, 2, 2, 3, 3 };
+        struct wil6210_priv *wil = ndev_to_wil(ndev);
+        u16 rc;
+
+        skb->priority = cfg80211_classify8021d(skb);
+
+        rc = wil_1d_to_queue[skb->priority];
+
+        wil_dbg_TXRX(wil, "%s() %d -> %d\n", __func__, (int)skb->priority,
+                     (int)rc);
+
+        return rc;
+}
+
+static const struct net_device_ops wil_netdev_ops = {
+        .ndo_open               = wil_open,
+        .ndo_stop               = wil_stop,
+        .ndo_start_xmit         = wil_start_xmit,
+        .ndo_select_queue       = wil_select_queue,
+        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_validate_addr      = eth_validate_addr,
+};
+
+void *wil_if_alloc(struct device *dev, void __iomem *csr)
+{
+        struct net_device *ndev;
+        struct wireless_dev *wdev;
+        struct wil6210_priv *wil;
+        struct ieee80211_channel *ch;
+        int rc = 0;
+
+        wdev = wil_cfg80211_init(dev);
+        if (IS_ERR(wdev)) {
+                dev_err(dev, "wil_cfg80211_init failed\n");
+                return wdev;
+        }
+
+        wil = wdev_to_wil(wdev);
+        wil->csr = csr;
+        wil->wdev = wdev;
+
+        rc = wil_priv_init(wil);
+        if (rc) {
+                dev_err(dev, "wil_priv_init failed\n");
+                goto out_wdev;
+        }
+
+        wdev->iftype = NL80211_IFTYPE_STATION; /* TODO */
+        /* default monitor channel */
+        ch = wdev->wiphy->bands[IEEE80211_BAND_60GHZ]->channels;
+        cfg80211_chandef_create(&wdev->preset_chandef, ch, NL80211_CHAN_NO_HT);
+
+        ndev = alloc_netdev_mqs(0, "wlan%d", ether_setup, WIL6210_TX_QUEUES, 1);
+        if (!ndev) {
+                dev_err(dev, "alloc_netdev_mqs failed\n");
+                rc = -ENOMEM;
+                goto out_priv;
+        }
+
+        ndev->netdev_ops = &wil_netdev_ops;
+        ndev->ieee80211_ptr = wdev;
+        SET_NETDEV_DEV(ndev, wiphy_dev(wdev->wiphy));
+        wdev->netdev = ndev;
+
+        wil_link_off(wil);
+
+        return wil;
+
+ out_priv:
+        wil_priv_deinit(wil);
+
+ out_wdev:
+        wil_wdev_free(wil);
+
+        return ERR_PTR(rc);
+}
+
+void wil_if_free(struct wil6210_priv *wil)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        if (!ndev)
+                return;
+
+        free_netdev(ndev);
+        wil_priv_deinit(wil);
+        wil_wdev_free(wil);
+}
+
+int wil_if_add(struct wil6210_priv *wil)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        int rc;
+
+        rc = register_netdev(ndev);
+        if (rc < 0) {
+                dev_err(&ndev->dev, "Failed to register netdev: %d\n", rc);
+                return rc;
+        }
+
+        wil_link_off(wil);
+
+        return 0;
+}
+
+void wil_if_remove(struct wil6210_priv *wil)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+
+        unregister_netdev(ndev);
+}
diff --git a/drivers/net/wireless/ath/wil6210/pcie_bus.c b/drivers/net/wireless/ath/wil6210/pcie_bus.c
new file mode 100644
index 000000000000..0fc83edd6bad
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/pcie_bus.c
@@ -0,0 +1,223 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/netdevice.h>
+#include <linux/debugfs.h>
+#include <linux/pci.h>
+#include <linux/moduleparam.h>
+
+#include "wil6210.h"
+
+static int use_msi = 1;
+module_param(use_msi, int, S_IRUGO);
+MODULE_PARM_DESC(use_msi,
+                 " Use MSI interrupt: "
+                 "0 - don't, 1 - (default) - single, or 3");
+
+/* Bus ops */
+static int wil_if_pcie_enable(struct wil6210_priv *wil)
+{
+        struct pci_dev *pdev = wil->pdev;
+        int rc;
+
+        pci_set_master(pdev);
+
+        /*
+         * how many MSI interrupts to request?
+         */
+        switch (use_msi) {
+        case 3:
+        case 1:
+        case 0:
+                break;
+        default:
+                wil_err(wil, "Invalid use_msi=%d, default to 1\n",
+                        use_msi);
+                use_msi = 1;
+        }
+        wil->n_msi = use_msi;
+        if (wil->n_msi) {
+                wil_dbg(wil, "Setup %d MSI interrupts\n", use_msi);
+                rc = pci_enable_msi_block(pdev, wil->n_msi);
+                if (rc && (wil->n_msi == 3)) {
+                        wil_err(wil, "3 MSI mode failed, try 1 MSI\n");
+                        wil->n_msi = 1;
+                        rc = pci_enable_msi_block(pdev, wil->n_msi);
+                }
+                if (rc) {
+                        wil_err(wil, "pci_enable_msi failed, use INTx\n");
+                        wil->n_msi = 0;
+                }
+        } else {
+                wil_dbg(wil, "MSI interrupts disabled, use INTx\n");
+        }
+
+        rc = wil6210_init_irq(wil, pdev->irq);
+        if (rc)
+                goto stop_master;
+
+        /* need reset here to obtain MAC */
+        rc = wil_reset(wil);
+        if (rc)
+                goto release_irq;
+
+        return 0;
+
+ release_irq:
+        wil6210_fini_irq(wil, pdev->irq);
+        /* safe to call if no MSI */
+        pci_disable_msi(pdev);
+ stop_master:
+        pci_clear_master(pdev);
+        return rc;
+}
+
+static int wil_if_pcie_disable(struct wil6210_priv *wil)
+{
+        struct pci_dev *pdev = wil->pdev;
+
+        pci_clear_master(pdev);
+        /* disable and release IRQ */
+        wil6210_fini_irq(wil, pdev->irq);
+        /* safe to call if no MSI */
+        pci_disable_msi(pdev);
+        /* TODO: disable HW */
+
+        return 0;
+}
+
+static int wil_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+{
+        struct wil6210_priv *wil;
+        struct device *dev = &pdev->dev;
+        void __iomem *csr;
+        int rc;
+
+        /* check HW */
+        dev_info(&pdev->dev, WIL_NAME " device found [%04x:%04x] (rev %x)\n",
+                 (int)pdev->vendor, (int)pdev->device, (int)pdev->revision);
+
+        if (pci_resource_len(pdev, 0) != WIL6210_MEM_SIZE) {
+                dev_err(&pdev->dev, "Not " WIL_NAME "? "
+                        "BAR0 size is %lu while expecting %lu\n",
+                        (ulong)pci_resource_len(pdev, 0), WIL6210_MEM_SIZE);
+                return -ENODEV;
+        }
+
+        rc = pci_enable_device(pdev);
+        if (rc) {
+                dev_err(&pdev->dev, "pci_enable_device failed\n");
+                return -ENODEV;
+        }
+        /* rollback to err_disable_pdev */
+
+        rc = pci_request_region(pdev, 0, WIL_NAME);
+        if (rc) {
+                dev_err(&pdev->dev, "pci_request_region failed\n");
+                goto err_disable_pdev;
+        }
+        /* rollback to err_release_reg */
+
+        csr = pci_ioremap_bar(pdev, 0);
+        if (!csr) {
+                dev_err(&pdev->dev, "pci_ioremap_bar failed\n");
+                rc = -ENODEV;
+                goto err_release_reg;
+        }
+        /* rollback to err_iounmap */
+        dev_info(&pdev->dev, "CSR at %pR -> %p\n", &pdev->resource[0], csr);
+
+        wil = wil_if_alloc(dev, csr);
+        if (IS_ERR(wil)) {
+                rc = (int)PTR_ERR(wil);
+                dev_err(dev, "wil_if_alloc failed: %d\n", rc);
+                goto err_iounmap;
+        }
+        /* rollback to if_free */
+
+        pci_set_drvdata(pdev, wil);
+        wil->pdev = pdev;
+
+        /* FW should raise IRQ when ready */
+        rc = wil_if_pcie_enable(wil);
+        if (rc) {
+                wil_err(wil, "Enable device failed\n");
+                goto if_free;
+        }
+        /* rollback to bus_disable */
+
+        rc = wil_if_add(wil);
+        if (rc) {
+                wil_err(wil, "wil_if_add failed: %d\n", rc);
+                goto bus_disable;
+        }
+
+        wil6210_debugfs_init(wil);
+
+        /* check FW is alive */
+        wmi_echo(wil);
+
+        return 0;
+
+ bus_disable:
+        wil_if_pcie_disable(wil);
+ if_free:
+        wil_if_free(wil);
+ err_iounmap:
+        pci_iounmap(pdev, csr);
+ err_release_reg:
+        pci_release_region(pdev, 0);
+ err_disable_pdev:
+        pci_disable_device(pdev);
+
+        return rc;
+}
+
+static void wil_pcie_remove(struct pci_dev *pdev)
+{
+        struct wil6210_priv *wil = pci_get_drvdata(pdev);
+
+        wil6210_debugfs_remove(wil);
+        wil_if_pcie_disable(wil);
+        wil_if_remove(wil);
+        wil_if_free(wil);
+        pci_iounmap(pdev, wil->csr);
+        pci_release_region(pdev, 0);
+        pci_disable_device(pdev);
+        pci_set_drvdata(pdev, NULL);
+}
+
+static DEFINE_PCI_DEVICE_TABLE(wil6210_pcie_ids) = {
+        { PCI_DEVICE(0x1ae9, 0x0301) },
+        { /* end: all zeroes */ },
+};
+MODULE_DEVICE_TABLE(pci, wil6210_pcie_ids);
+
+static struct pci_driver wil6210_driver = {
+        .probe          = wil_pcie_probe,
+        .remove         = wil_pcie_remove,
+        .id_table       = wil6210_pcie_ids,
+        .name           = WIL_NAME,
+};
+
+module_pci_driver(wil6210_driver);
+
+MODULE_LICENSE("Dual BSD/GPL");
+MODULE_AUTHOR("Qualcomm Atheros <wil6210@qca.qualcomm.com>");
+MODULE_DESCRIPTION("Driver for 60g WiFi WIL6210 card");
diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
new file mode 100644
index 000000000000..f29c294413cf
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/txrx.c
@@ -0,0 +1,871 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/hardirq.h>
+#include <net/ieee80211_radiotap.h>
+#include <linux/if_arp.h>
+#include <linux/moduleparam.h>
+
+#include "wil6210.h"
+#include "wmi.h"
+#include "txrx.h"
+
+static bool rtap_include_phy_info;
+module_param(rtap_include_phy_info, bool, S_IRUGO);
+MODULE_PARM_DESC(rtap_include_phy_info,
+                 " Include PHY info in the radiotap header, default - no");
+
+static inline int wil_vring_is_empty(struct vring *vring)
+{
+        return vring->swhead == vring->swtail;
+}
+
+static inline u32 wil_vring_next_tail(struct vring *vring)
+{
+        return (vring->swtail + 1) % vring->size;
+}
+
+static inline void wil_vring_advance_head(struct vring *vring, int n)
+{
+        vring->swhead = (vring->swhead + n) % vring->size;
+}
+
+static inline int wil_vring_is_full(struct vring *vring)
+{
+        return wil_vring_next_tail(vring) == vring->swhead;
+}
+/*
+ * Available space in Tx Vring
+ */
+static inline int wil_vring_avail_tx(struct vring *vring)
+{
+        u32 swhead = vring->swhead;
+        u32 swtail = vring->swtail;
+        int used = (vring->size + swhead - swtail) % vring->size;
+
+        return vring->size - used - 1;
+}
+
+static int wil_vring_alloc(struct wil6210_priv *wil, struct vring *vring)
+{
+        struct device *dev = wil_to_dev(wil);
+        size_t sz = vring->size * sizeof(vring->va[0]);
+        uint i;
+
+        BUILD_BUG_ON(sizeof(vring->va[0]) != 32);
+
+        vring->swhead = 0;
+        vring->swtail = 0;
+        vring->ctx = kzalloc(vring->size * sizeof(vring->ctx[0]), GFP_KERNEL);
+        if (!vring->ctx) {
+                wil_err(wil, "vring_alloc [%d] failed to alloc ctx mem\n",
+                        vring->size);
+                vring->va = NULL;
+                return -ENOMEM;
+        }
+        /*
+         * vring->va should be aligned on its size rounded up to power of 2
+         * This is granted by the dma_alloc_coherent
+         */
+        vring->va = dma_alloc_coherent(dev, sz, &vring->pa, GFP_KERNEL);
+        if (!vring->va) {
+                wil_err(wil, "vring_alloc [%d] failed to alloc DMA mem\n",
+                        vring->size);
+                kfree(vring->ctx);
+                vring->ctx = NULL;
+                return -ENOMEM;
+        }
+        /* initially, all descriptors are SW owned
+         * For Tx and Rx, ownership bit is at the same location, thus
+         * we can use any
+         */
+        for (i = 0; i < vring->size; i++) {
+                volatile struct vring_tx_desc *d = &(vring->va[i].tx);
+                d->dma.status = TX_DMA_STATUS_DU;
+        }
+
+        wil_dbg(wil, "vring[%d] 0x%p:0x%016llx 0x%p\n", vring->size,
+                vring->va, (unsigned long long)vring->pa, vring->ctx);
+
+        return 0;
+}
+
+static void wil_vring_free(struct wil6210_priv *wil, struct vring *vring,
+                           int tx)
+{
+        struct device *dev = wil_to_dev(wil);
+        size_t sz = vring->size * sizeof(vring->va[0]);
+
+        while (!wil_vring_is_empty(vring)) {
+                if (tx) {
+                        volatile struct vring_tx_desc *d =
+                                        &vring->va[vring->swtail].tx;
+                        dma_addr_t pa = d->dma.addr_low |
+                                        ((u64)d->dma.addr_high << 32);
+                        struct sk_buff *skb = vring->ctx[vring->swtail];
+                        if (skb) {
+                                dma_unmap_single(dev, pa, d->dma.length,
+                                                 DMA_TO_DEVICE);
+                                dev_kfree_skb_any(skb);
+                                vring->ctx[vring->swtail] = NULL;
+                        } else {
+                                dma_unmap_page(dev, pa, d->dma.length,
+                                               DMA_TO_DEVICE);
+                        }
+                        vring->swtail = wil_vring_next_tail(vring);
+                } else { /* rx */
+                        volatile struct vring_rx_desc *d =
+                                        &vring->va[vring->swtail].rx;
+                        dma_addr_t pa = d->dma.addr_low |
+                                        ((u64)d->dma.addr_high << 32);
+                        struct sk_buff *skb = vring->ctx[vring->swhead];
+                        dma_unmap_single(dev, pa, d->dma.length,
+                                         DMA_FROM_DEVICE);
+                        kfree_skb(skb);
+                        wil_vring_advance_head(vring, 1);
+                }
+        }
+        dma_free_coherent(dev, sz, (void *)vring->va, vring->pa);
+        kfree(vring->ctx);
+        vring->pa = 0;
+        vring->va = NULL;
+        vring->ctx = NULL;
+}
+
+/**
+ * Allocate one skb for Rx VRING
+ *
+ * Safe to call from IRQ
+ */
+static int wil_vring_alloc_skb(struct wil6210_priv *wil, struct vring *vring,
+                               u32 i, int headroom)
+{
+        struct device *dev = wil_to_dev(wil);
+        unsigned int sz = RX_BUF_LEN;
+        volatile struct vring_rx_desc *d = &(vring->va[i].rx);
+        dma_addr_t pa;
+
+        /* TODO align */
+        struct sk_buff *skb = dev_alloc_skb(sz + headroom);
+        if (unlikely(!skb))
+                return -ENOMEM;
+
+        skb_reserve(skb, headroom);
+        skb_put(skb, sz);
+
+        pa = dma_map_single(dev, skb->data, skb->len, DMA_FROM_DEVICE);
+        if (unlikely(dma_mapping_error(dev, pa))) {
+                kfree_skb(skb);
+                return -ENOMEM;
+        }
+
+        d->dma.d0 = BIT(9) | RX_DMA_D0_CMD_DMA_IT;
+        d->dma.addr_low = lower_32_bits(pa);
+        d->dma.addr_high = (u16)upper_32_bits(pa);
+        /* ip_length don't care */
+        /* b11 don't care */
+        /* error don't care */
+        d->dma.status = 0; /* BIT(0) should be 0 for HW_OWNED */
+        d->dma.length = sz;
+        vring->ctx[i] = skb;
+
+        return 0;
+}
+
+/**
+ * Adds radiotap header
+ *
+ * Any error indicated as "Bad FCS"
+ *
+ * Vendor data for 04:ce:14-1 (Wilocity-1) consists of:
+ *  - Rx descriptor: 32 bytes
+ *  - Phy info
+ */
+static void wil_rx_add_radiotap_header(struct wil6210_priv *wil,
+                                       struct sk_buff *skb,
+                                       volatile struct vring_rx_desc *d)
+{
+        struct wireless_dev *wdev = wil->wdev;
+        struct wil6210_rtap {
+                struct ieee80211_radiotap_header rthdr;
+                /* fields should be in the order of bits in rthdr.it_present */
+                /* flags */
+                u8 flags;
+                /* channel */
+                __le16 chnl_freq __aligned(2);
+                __le16 chnl_flags;
+                /* MCS */
+                u8 mcs_present;
+                u8 mcs_flags;
+                u8 mcs_index;
+        } __packed;
+        struct wil6210_rtap_vendor {
+                struct wil6210_rtap rtap;
+                /* vendor */
+                u8 vendor_oui[3] __aligned(2);
+                u8 vendor_ns;
+                __le16 vendor_skip;
+                u8 vendor_data[0];
+        } __packed;
+        struct wil6210_rtap_vendor *rtap_vendor;
+        int rtap_len = sizeof(struct wil6210_rtap);
+        int phy_length = 0; /* phy info header size, bytes */
+        static char phy_data[128];
+        struct ieee80211_channel *ch = wdev->preset_chandef.chan;
+
+        if (rtap_include_phy_info) {
+                rtap_len = sizeof(*rtap_vendor) + sizeof(*d);
+                /* calculate additional length */
+                if (d->dma.status & RX_DMA_STATUS_PHY_INFO) {
+                        /**
+                         * PHY info starts from 8-byte boundary
+                         * there are 8-byte lines, last line may be partially
+                         * written (HW bug), thus FW configures for last line
+                         * to be excessive. Driver skips this last line.
+                         */
+                        int len = min_t(int, 8 + sizeof(phy_data),
+                                        wil_rxdesc_phy_length(d));
+                        if (len > 8) {
+                                void *p = skb_tail_pointer(skb);
+                                void *pa = PTR_ALIGN(p, 8);
+                                if (skb_tailroom(skb) >= len + (pa - p)) {
+                                        phy_length = len - 8;
+                                        memcpy(phy_data, pa, phy_length);
+                                }
+                        }
+                }
+                rtap_len += phy_length;
+        }
+
+        if (skb_headroom(skb) < rtap_len &&
+            pskb_expand_head(skb, rtap_len, 0, GFP_ATOMIC)) {
+                wil_err(wil, "Unable to expand headrom to %d\n", rtap_len);
+                return;
+        }
+
+        rtap_vendor = (void *)skb_push(skb, rtap_len);
+        memset(rtap_vendor, 0, rtap_len);
+
+        rtap_vendor->rtap.rthdr.it_version = PKTHDR_RADIOTAP_VERSION;
+        rtap_vendor->rtap.rthdr.it_len = cpu_to_le16(rtap_len);
+        rtap_vendor->rtap.rthdr.it_present = cpu_to_le32(
+                        (1 << IEEE80211_RADIOTAP_FLAGS) |
+                        (1 << IEEE80211_RADIOTAP_CHANNEL) |
+                        (1 << IEEE80211_RADIOTAP_MCS));
+        if (d->dma.status & RX_DMA_STATUS_ERROR)
+                rtap_vendor->rtap.flags |= IEEE80211_RADIOTAP_F_BADFCS;
+
+        rtap_vendor->rtap.chnl_freq = cpu_to_le16(ch ? ch->center_freq : 58320);
+        rtap_vendor->rtap.chnl_flags = cpu_to_le16(0);
+
+        rtap_vendor->rtap.mcs_present = IEEE80211_RADIOTAP_MCS_HAVE_MCS;
+        rtap_vendor->rtap.mcs_flags = 0;
+        rtap_vendor->rtap.mcs_index = wil_rxdesc_mcs(d);
+
+        if (rtap_include_phy_info) {
+                rtap_vendor->rtap.rthdr.it_present |= cpu_to_le32(1 <<
+                                IEEE80211_RADIOTAP_VENDOR_NAMESPACE);
+                /* OUI for Wilocity 04:ce:14 */
+                rtap_vendor->vendor_oui[0] = 0x04;
+                rtap_vendor->vendor_oui[1] = 0xce;
+                rtap_vendor->vendor_oui[2] = 0x14;
+                rtap_vendor->vendor_ns = 1;
+                /* Rx descriptor + PHY data  */
+                rtap_vendor->vendor_skip = cpu_to_le16(sizeof(*d) +
+                                                       phy_length);
+                memcpy(rtap_vendor->vendor_data, (void *)d, sizeof(*d));
+                memcpy(rtap_vendor->vendor_data + sizeof(*d), phy_data,
+                       phy_length);
+        }
+}
+
+/*
+ * Fast swap in place between 2 registers
+ */
+static void wil_swap_u16(u16 *a, u16 *b)
+{
+        *a ^= *b;
+        *b ^= *a;
+        *a ^= *b;
+}
+
+static void wil_swap_ethaddr(void *data)
+{
+        struct ethhdr *eth = data;
+        u16 *s = (u16 *)eth->h_source;
+        u16 *d = (u16 *)eth->h_dest;
+
+        wil_swap_u16(s++, d++);
+        wil_swap_u16(s++, d++);
+        wil_swap_u16(s, d);
+}
+
+/**
+ * reap 1 frame from @swhead
+ *
+ * Safe to call from IRQ
+ */
+static struct sk_buff *wil_vring_reap_rx(struct wil6210_priv *wil,
+                                         struct vring *vring)
+{
+        struct device *dev = wil_to_dev(wil);
+        struct net_device *ndev = wil_to_ndev(wil);
+        volatile struct vring_rx_desc *d;
+        struct sk_buff *skb;
+        dma_addr_t pa;
+        unsigned int sz = RX_BUF_LEN;
+        u8 ftype;
+        u8 ds_bits;
+
+        if (wil_vring_is_empty(vring))
+                return NULL;
+
+        d = &(vring->va[vring->swhead].rx);
+        if (!(d->dma.status & RX_DMA_STATUS_DU)) {
+                /* it is not error, we just reached end of Rx done area */
+                return NULL;
+        }
+
+        pa = d->dma.addr_low | ((u64)d->dma.addr_high << 32);
+        skb = vring->ctx[vring->swhead];
+        dma_unmap_single(dev, pa, sz, DMA_FROM_DEVICE);
+        skb_trim(skb, d->dma.length);
+
+        wil->stats.last_mcs_rx = wil_rxdesc_mcs(d);
+
+        /* use radiotap header only if required */
+        if (ndev->type == ARPHRD_IEEE80211_RADIOTAP)
+                wil_rx_add_radiotap_header(wil, skb, d);
+
+        wil_dbg_TXRX(wil, "Rx[%3d] : %d bytes\n", vring->swhead, d->dma.length);
+        wil_hex_dump_TXRX("Rx ", DUMP_PREFIX_NONE, 32, 4,
+                          (const void *)d, sizeof(*d), false);
+
+        wil_vring_advance_head(vring, 1);
+
+        /* no extra checks if in sniffer mode */
+        if (ndev->type != ARPHRD_ETHER)
+                return skb;
+        /*
+         * Non-data frames may be delivered through Rx DMA channel (ex: BAR)
+         * Driver should recognize it by frame type, that is found
+         * in Rx descriptor. If type is not data, it is 802.11 frame as is
+         */
+        ftype = wil_rxdesc_ftype(d) << 2;
+        if (ftype != IEEE80211_FTYPE_DATA) {
+                wil_dbg_TXRX(wil, "Non-data frame ftype 0x%08x\n", ftype);
+                /* TODO: process it */
+                kfree_skb(skb);
+                return NULL;
+        }
+
+        if (skb->len < ETH_HLEN) {
+                wil_err(wil, "Short frame, len = %d\n", skb->len);
+                /* TODO: process it (i.e. BAR) */
+                kfree_skb(skb);
+                return NULL;
+        }
+
+        ds_bits = wil_rxdesc_ds_bits(d);
+        if (ds_bits == 1) {
+                /*
+                 * HW bug - in ToDS mode, i.e. Rx on AP side,
+                 * addresses get swapped
+                 */
+                wil_swap_ethaddr(skb->data);
+        }
+
+        return skb;
+}
+
+/**
+ * allocate and fill up to @count buffers in rx ring
+ * buffers posted at @swtail
+ */
+static int wil_rx_refill(struct wil6210_priv *wil, int count)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct vring *v = &wil->vring_rx;
+        u32 next_tail;
+        int rc = 0;
+        int headroom = ndev->type == ARPHRD_IEEE80211_RADIOTAP ?
+                        WIL6210_RTAP_SIZE : 0;
+
+        for (; next_tail = wil_vring_next_tail(v),
+                        (next_tail != v->swhead) && (count-- > 0);
+                        v->swtail = next_tail) {
+                rc = wil_vring_alloc_skb(wil, v, v->swtail, headroom);
+                if (rc) {
+                        wil_err(wil, "Error %d in wil_rx_refill[%d]\n",
+                                rc, v->swtail);
+                        break;
+                }
+        }
+        iowrite32(v->swtail, wil->csr + HOSTADDR(v->hwtail));
+
+        return rc;
+}
+
+/*
+ * Pass Rx packet to the netif. Update statistics.
+ */
+static void wil_netif_rx_any(struct sk_buff *skb, struct net_device *ndev)
+{
+        int rc;
+        unsigned int len = skb->len;
+
+        if (in_interrupt())
+                rc = netif_rx(skb);
+        else
+                rc = netif_rx_ni(skb);
+
+        if (likely(rc == NET_RX_SUCCESS)) {
+                ndev->stats.rx_packets++;
+                ndev->stats.rx_bytes += len;
+
+        } else {
+                ndev->stats.rx_dropped++;
+        }
+}
+
+/**
+ * Proceed all completed skb's from Rx VRING
+ *
+ * Safe to call from IRQ
+ */
+void wil_rx_handle(struct wil6210_priv *wil)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct vring *v = &wil->vring_rx;
+        struct sk_buff *skb;
+
+        if (!v->va) {
+                wil_err(wil, "Rx IRQ while Rx not yet initialized\n");
+                return;
+        }
+        wil_dbg_TXRX(wil, "%s()\n", __func__);
+        while (NULL != (skb = wil_vring_reap_rx(wil, v))) {
+                wil_hex_dump_TXRX("Rx ", DUMP_PREFIX_OFFSET, 16, 1,
+                                  skb->data, skb_headlen(skb), false);
+
+                skb_orphan(skb);
+
+                if (wil->wdev->iftype == NL80211_IFTYPE_MONITOR) {
+                        skb->dev = ndev;
+                        skb_reset_mac_header(skb);
+                        skb->ip_summed = CHECKSUM_UNNECESSARY;
+                        skb->pkt_type = PACKET_OTHERHOST;
+                        skb->protocol = htons(ETH_P_802_2);
+
+                } else {
+                        skb->protocol = eth_type_trans(skb, ndev);
+                }
+
+                wil_netif_rx_any(skb, ndev);
+        }
+        wil_rx_refill(wil, v->size);
+}
+
+int wil_rx_init(struct wil6210_priv *wil)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct wireless_dev *wdev = wil->wdev;
+        struct vring *vring = &wil->vring_rx;
+        int rc;
+        struct wmi_cfg_rx_chain_cmd cmd = {
+                .action = WMI_RX_CHAIN_ADD,
+                .rx_sw_ring = {
+                        .max_mpdu_size = cpu_to_le16(RX_BUF_LEN),
+                },
+                .mid = 0, /* TODO - what is it? */
+                .decap_trans_type = WMI_DECAP_TYPE_802_3,
+        };
+        struct {
+                struct wil6210_mbox_hdr_wmi wmi;
+                struct wmi_cfg_rx_chain_done_event evt;
+        } __packed evt;
+
+        vring->size = WIL6210_RX_RING_SIZE;
+        rc = wil_vring_alloc(wil, vring);
+        if (rc)
+                return rc;
+
+        cmd.rx_sw_ring.ring_mem_base = cpu_to_le64(vring->pa);
+        cmd.rx_sw_ring.ring_size = cpu_to_le16(vring->size);
+        if (wdev->iftype == NL80211_IFTYPE_MONITOR) {
+                struct ieee80211_channel *ch = wdev->preset_chandef.chan;
+
+                cmd.sniffer_cfg.mode = cpu_to_le32(WMI_SNIFFER_ON);
+                if (ch)
+                        cmd.sniffer_cfg.channel = ch->hw_value - 1;
+                cmd.sniffer_cfg.phy_info_mode =
+                        cpu_to_le32(ndev->type == ARPHRD_IEEE80211_RADIOTAP);
+                cmd.sniffer_cfg.phy_support =
+                        cpu_to_le32((wil->monitor_flags & MONITOR_FLAG_CONTROL)
+                                    ? WMI_SNIFFER_CP : WMI_SNIFFER_DP);
+        }
+        /* typical time for secure PCP is 840ms */
+        rc = wmi_call(wil, WMI_CFG_RX_CHAIN_CMDID, &cmd, sizeof(cmd),
+                      WMI_CFG_RX_CHAIN_DONE_EVENTID, &evt, sizeof(evt), 2000);
+        if (rc)
+                goto err_free;
+
+        vring->hwtail = le32_to_cpu(evt.evt.rx_ring_tail_ptr);
+
+        wil_dbg(wil, "Rx init: status %d tail 0x%08x\n",
+                le32_to_cpu(evt.evt.status), vring->hwtail);
+
+        rc = wil_rx_refill(wil, vring->size);
+        if (rc)
+                goto err_free;
+
+        return 0;
+ err_free:
+        wil_vring_free(wil, vring, 0);
+
+        return rc;
+}
+
+void wil_rx_fini(struct wil6210_priv *wil)
+{
+        struct vring *vring = &wil->vring_rx;
+
+        if (vring->va) {
+                int rc;
+                struct wmi_cfg_rx_chain_cmd cmd = {
+                        .action = cpu_to_le32(WMI_RX_CHAIN_DEL),
+                        .rx_sw_ring = {
+                                .max_mpdu_size = cpu_to_le16(RX_BUF_LEN),
+                        },
+                };
+                struct {
+                        struct wil6210_mbox_hdr_wmi wmi;
+                        struct wmi_cfg_rx_chain_done_event cfg;
+                } __packed wmi_rx_cfg_reply;
+
+                rc = wmi_call(wil, WMI_CFG_RX_CHAIN_CMDID, &cmd, sizeof(cmd),
+                              WMI_CFG_RX_CHAIN_DONE_EVENTID,
+                              &wmi_rx_cfg_reply, sizeof(wmi_rx_cfg_reply),
+                              100);
+                wil_vring_free(wil, vring, 0);
+        }
+}
+
+int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
+                      int cid, int tid)
+{
+        int rc;
+        struct wmi_vring_cfg_cmd cmd = {
+                .action = cpu_to_le32(WMI_VRING_CMD_ADD),
+                .vring_cfg = {
+                        .tx_sw_ring = {
+                                .max_mpdu_size = cpu_to_le16(TX_BUF_LEN),
+                        },
+                        .ringid = id,
+                        .cidxtid = (cid & 0xf) | ((tid & 0xf) << 4),
+                        .encap_trans_type = WMI_VRING_ENC_TYPE_802_3,
+                        .mac_ctrl = 0,
+                        .to_resolution = 0,
+                        .agg_max_wsize = 16,
+                        .schd_params = {
+                                .priority = cpu_to_le16(0),
+                                .timeslot_us = cpu_to_le16(0xfff),
+                        },
+                },
+        };
+        struct {
+                struct wil6210_mbox_hdr_wmi wmi;
+                struct wmi_vring_cfg_done_event cmd;
+        } __packed reply;
+        struct vring *vring = &wil->vring_tx[id];
+
+        if (vring->va) {
+                wil_err(wil, "Tx ring [%d] already allocated\n", id);
+                rc = -EINVAL;
+                goto out;
+        }
+
+        vring->size = size;
+        rc = wil_vring_alloc(wil, vring);
+        if (rc)
+                goto out;
+
+        cmd.vring_cfg.tx_sw_ring.ring_mem_base = cpu_to_le64(vring->pa);
+        cmd.vring_cfg.tx_sw_ring.ring_size = cpu_to_le16(vring->size);
+
+        rc = wmi_call(wil, WMI_VRING_CFG_CMDID, &cmd, sizeof(cmd),
+                      WMI_VRING_CFG_DONE_EVENTID, &reply, sizeof(reply), 100);
+        if (rc)
+                goto out_free;
+
+        if (reply.cmd.status != WMI_VRING_CFG_SUCCESS) {
+                wil_err(wil, "Tx config failed, status 0x%02x\n",
+                        reply.cmd.status);
+                goto out_free;
+        }
+        vring->hwtail = le32_to_cpu(reply.cmd.tx_vring_tail_ptr);
+
+        return 0;
+ out_free:
+        wil_vring_free(wil, vring, 1);
+ out:
+
+        return rc;
+}
+
+void wil_vring_fini_tx(struct wil6210_priv *wil, int id)
+{
+        struct vring *vring = &wil->vring_tx[id];
+
+        if (!vring->va)
+                return;
+
+        wil_vring_free(wil, vring, 1);
+}
+
+static struct vring *wil_find_tx_vring(struct wil6210_priv *wil,
+                                       struct sk_buff *skb)
+{
+        struct vring *v = &wil->vring_tx[0];
+
+        if (v->va)
+                return v;
+
+        return NULL;
+}
+
+static int wil_tx_desc_map(volatile struct vring_tx_desc *d,
+                           dma_addr_t pa, u32 len)
+{
+        d->dma.addr_low = lower_32_bits(pa);
+        d->dma.addr_high = (u16)upper_32_bits(pa);
+        d->dma.ip_length = 0;
+        /* 0..6: mac_length; 7:ip_version 0-IP6 1-IP4*/
+        d->dma.b11 = 0/*14 | BIT(7)*/;
+        d->dma.error = 0;
+        d->dma.status = 0; /* BIT(0) should be 0 for HW_OWNED */
+        d->dma.length = len;
+        d->dma.d0 = 0;
+        d->mac.d[0] = 0;
+        d->mac.d[1] = 0;
+        d->mac.d[2] = 0;
+        d->mac.ucode_cmd = 0;
+        /* use dst index 0 */
+        d->mac.d[1] |= BIT(MAC_CFG_DESC_TX_1_DST_INDEX_EN_POS) |
+                       (0 << MAC_CFG_DESC_TX_1_DST_INDEX_POS);
+        /* translation type:  0 - bypass; 1 - 802.3; 2 - native wifi */
+        d->mac.d[2] = BIT(MAC_CFG_DESC_TX_2_SNAP_HDR_INSERTION_EN_POS) |
+                      (1 << MAC_CFG_DESC_TX_2_L2_TRANSLATION_TYPE_POS);
+
+        return 0;
+}
+
+static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
+                        struct sk_buff *skb)
+{
+        struct device *dev = wil_to_dev(wil);
+        volatile struct vring_tx_desc *d;
+        u32 swhead = vring->swhead;
+        int avail = wil_vring_avail_tx(vring);
+        int nr_frags = skb_shinfo(skb)->nr_frags;
+        uint f;
+        int vring_index = vring - wil->vring_tx;
+        uint i = swhead;
+        dma_addr_t pa;
+
+        wil_dbg_TXRX(wil, "%s()\n", __func__);
+
+        if (avail < vring->size/8)
+                netif_tx_stop_all_queues(wil_to_ndev(wil));
+        if (avail < 1 + nr_frags) {
+                wil_err(wil, "Tx ring full. No space for %d fragments\n",
+                        1 + nr_frags);
+                return -ENOMEM;
+        }
+        d = &(vring->va[i].tx);
+
+        /* FIXME FW can accept only unicast frames for the peer */
+        memcpy(skb->data, wil->dst_addr[vring_index], ETH_ALEN);
+
+        pa = dma_map_single(dev, skb->data,
+                        skb_headlen(skb), DMA_TO_DEVICE);
+
+        wil_dbg_TXRX(wil, "Tx skb %d bytes %p -> %#08llx\n", skb_headlen(skb),
+                     skb->data, (unsigned long long)pa);
+        wil_hex_dump_TXRX("Tx ", DUMP_PREFIX_OFFSET, 16, 1,
+                          skb->data, skb_headlen(skb), false);
+
+        if (unlikely(dma_mapping_error(dev, pa)))
+                return -EINVAL;
+        /* 1-st segment */
+        wil_tx_desc_map(d, pa, skb_headlen(skb));
+        d->mac.d[2] |= ((nr_frags + 1) <<
+                       MAC_CFG_DESC_TX_2_NUM_OF_DESCRIPTORS_POS);
+        /* middle segments */
+        for (f = 0; f < nr_frags; f++) {
+                const struct skb_frag_struct *frag =
+                                &skb_shinfo(skb)->frags[f];
+                int len = skb_frag_size(frag);
+                i = (swhead + f + 1) % vring->size;
+                d = &(vring->va[i].tx);
+                pa = skb_frag_dma_map(dev, frag, 0, skb_frag_size(frag),
+                                DMA_TO_DEVICE);
+                if (unlikely(dma_mapping_error(dev, pa)))
+                        goto dma_error;
+                wil_tx_desc_map(d, pa, len);
+                vring->ctx[i] = NULL;
+        }
+        /* for the last seg only */
+        d->dma.d0 |= BIT(DMA_CFG_DESC_TX_0_CMD_EOP_POS);
+        d->dma.d0 |= BIT(9); /* BUG: undocumented bit */
+        d->dma.d0 |= BIT(DMA_CFG_DESC_TX_0_CMD_DMA_IT_POS);
+        d->dma.d0 |= (vring_index << DMA_CFG_DESC_TX_0_QID_POS);
+
+        wil_hex_dump_TXRX("Tx ", DUMP_PREFIX_NONE, 32, 4,
+                          (const void *)d, sizeof(*d), false);
+
+        /* advance swhead */
+        wil_vring_advance_head(vring, nr_frags + 1);
+        wil_dbg_TXRX(wil, "Tx swhead %d -> %d\n", swhead, vring->swhead);
+        iowrite32(vring->swhead, wil->csr + HOSTADDR(vring->hwtail));
+        /* hold reference to skb
+         * to prevent skb release before accounting
+         * in case of immediate "tx done"
+         */
+        vring->ctx[i] = skb_get(skb);
+
+        return 0;
+ dma_error:
+        /* unmap what we have mapped */
+        /* Note: increment @f to operate with positive index */
+        for (f++; f > 0; f--) {
+                i = (swhead + f) % vring->size;
+                d = &(vring->va[i].tx);
+                d->dma.status = TX_DMA_STATUS_DU;
+                pa = d->dma.addr_low | ((u64)d->dma.addr_high << 32);
+                if (vring->ctx[i])
+                        dma_unmap_single(dev, pa, d->dma.length, DMA_TO_DEVICE);
+                else
+                        dma_unmap_page(dev, pa, d->dma.length, DMA_TO_DEVICE);
+        }
+
+        return -EINVAL;
+}
+
+
+netdev_tx_t wil_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+{
+        struct wil6210_priv *wil = ndev_to_wil(ndev);
+        struct vring *vring;
+        int rc;
+
+        wil_dbg_TXRX(wil, "%s()\n", __func__);
+        if (!test_bit(wil_status_fwready, &wil->status)) {
+                wil_err(wil, "FW not ready\n");
+                goto drop;
+        }
+        if (!test_bit(wil_status_fwconnected, &wil->status)) {
+                wil_err(wil, "FW not connected\n");
+                goto drop;
+        }
+        if (wil->wdev->iftype == NL80211_IFTYPE_MONITOR) {
+                wil_err(wil, "Xmit in monitor mode not supported\n");
+                goto drop;
+        }
+        if (skb->protocol == cpu_to_be16(ETH_P_PAE)) {
+                rc = wmi_tx_eapol(wil, skb);
+        } else {
+                /* find vring */
+                vring = wil_find_tx_vring(wil, skb);
+                if (!vring) {
+                        wil_err(wil, "No Tx VRING available\n");
+                        goto drop;
+                }
+                /* set up vring entry */
+                rc = wil_tx_vring(wil, vring, skb);
+        }
+        switch (rc) {
+        case 0:
+                ndev->stats.tx_packets++;
+                ndev->stats.tx_bytes += skb->len;
+                dev_kfree_skb_any(skb);
+                return NETDEV_TX_OK;
+        case -ENOMEM:
+                return NETDEV_TX_BUSY;
+        default:
+                ; /* goto drop; */
+                break;
+        }
+ drop:
+        netif_tx_stop_all_queues(ndev);
+        ndev->stats.tx_dropped++;
+        dev_kfree_skb_any(skb);
+
+        return NET_XMIT_DROP;
+}
+
+/**
+ * Clean up transmitted skb's from the Tx VRING
+ *
+ * Safe to call from IRQ
+ */
+void wil_tx_complete(struct wil6210_priv *wil, int ringid)
+{
+        struct device *dev = wil_to_dev(wil);
+        struct vring *vring = &wil->vring_tx[ringid];
+
+        if (!vring->va) {
+                wil_err(wil, "Tx irq[%d]: vring not initialized\n", ringid);
+                return;
+        }
+
+        wil_dbg_TXRX(wil, "%s(%d)\n", __func__, ringid);
+
+        while (!wil_vring_is_empty(vring)) {
+                volatile struct vring_tx_desc *d = &vring->va[vring->swtail].tx;
+                dma_addr_t pa;
+                struct sk_buff *skb;
+                if (!(d->dma.status & TX_DMA_STATUS_DU))
+                        break;
+
+                wil_dbg_TXRX(wil,
+                             "Tx[%3d] : %d bytes, status 0x%02x err 0x%02x\n",
+                             vring->swtail, d->dma.length, d->dma.status,
+                             d->dma.error);
+                wil_hex_dump_TXRX("TxC ", DUMP_PREFIX_NONE, 32, 4,
+                                  (const void *)d, sizeof(*d), false);
+
+                pa = d->dma.addr_low | ((u64)d->dma.addr_high << 32);
+                skb = vring->ctx[vring->swtail];
+                if (skb) {
+                        dma_unmap_single(dev, pa, d->dma.length, DMA_TO_DEVICE);
+                        dev_kfree_skb_any(skb);
+                        vring->ctx[vring->swtail] = NULL;
+                } else {
+                        dma_unmap_page(dev, pa, d->dma.length, DMA_TO_DEVICE);
+                }
+                d->dma.addr_low = 0;
+                d->dma.addr_high = 0;
+                d->dma.length = 0;
+                d->dma.status = TX_DMA_STATUS_DU;
+                vring->swtail = wil_vring_next_tail(vring);
+        }
+        if (wil_vring_avail_tx(vring) > vring->size/4)
+                netif_tx_wake_all_queues(wil_to_ndev(wil));
+}
diff --git a/drivers/net/wireless/ath/wil6210/txrx.h b/drivers/net/wireless/ath/wil6210/txrx.h
new file mode 100644
index 000000000000..45a61f597c5c
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/txrx.h
@@ -0,0 +1,362 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef WIL6210_TXRX_H
+#define WIL6210_TXRX_H
+
+#define BUF_SW_OWNED    (1)
+#define BUF_HW_OWNED    (0)
+
+/* size of max. Rx packet */
+#define RX_BUF_LEN      (2048)
+#define TX_BUF_LEN      (2048)
+/* how many bytes to reserve for rtap header? */
+#define WIL6210_RTAP_SIZE (128)
+
+/* Tx/Rx path */
+/*
+ * Tx descriptor - MAC part
+ * [dword 0]
+ * bit  0.. 9 : lifetime_expiry_value:10
+ * bit     10 : interrup_en:1
+ * bit     11 : status_en:1
+ * bit 12..13 : txss_override:2
+ * bit     14 : timestamp_insertion:1
+ * bit     15 : duration_preserve:1
+ * bit 16..21 : reserved0:6
+ * bit 22..26 : mcs_index:5
+ * bit     27 : mcs_en:1
+ * bit 28..29 : reserved1:2
+ * bit     30 : reserved2:1
+ * bit     31 : sn_preserved:1
+ * [dword 1]
+ * bit  0.. 3 : pkt_mode:4
+ * bit      4 : pkt_mode_en:1
+ * bit  5.. 7 : reserved0:3
+ * bit  8..13 : reserved1:6
+ * bit     14 : reserved2:1
+ * bit     15 : ack_policy_en:1
+ * bit 16..19 : dst_index:4
+ * bit     20 : dst_index_en:1
+ * bit 21..22 : ack_policy:2
+ * bit     23 : lifetime_en:1
+ * bit 24..30 : max_retry:7
+ * bit     31 : max_retry_en:1
+ * [dword 2]
+ * bit  0.. 7 : num_of_descriptors:8
+ * bit  8..17 : reserved:10
+ * bit 18..19 : l2_translation_type:2
+ * bit     20 : snap_hdr_insertion_en:1
+ * bit     21 : vlan_removal_en:1
+ * bit 22..31 : reserved0:10
+ * [dword 3]
+ * bit  0.. 31: ucode_cmd:32
+ */
+struct vring_tx_mac {
+        u32 d[3];
+        u32 ucode_cmd;
+} __packed;
+
+/* TX MAC Dword 0 */
+#define MAC_CFG_DESC_TX_0_LIFETIME_EXPIRY_VALUE_POS 0
+#define MAC_CFG_DESC_TX_0_LIFETIME_EXPIRY_VALUE_LEN 10
+#define MAC_CFG_DESC_TX_0_LIFETIME_EXPIRY_VALUE_MSK 0x3FF
+
+#define MAC_CFG_DESC_TX_0_INTERRUP_EN_POS 10
+#define MAC_CFG_DESC_TX_0_INTERRUP_EN_LEN 1
+#define MAC_CFG_DESC_TX_0_INTERRUP_EN_MSK 0x400
+
+#define MAC_CFG_DESC_TX_0_STATUS_EN_POS 11
+#define MAC_CFG_DESC_TX_0_STATUS_EN_LEN 1
+#define MAC_CFG_DESC_TX_0_STATUS_EN_MSK 0x800
+
+#define MAC_CFG_DESC_TX_0_TXSS_OVERRIDE_POS 12
+#define MAC_CFG_DESC_TX_0_TXSS_OVERRIDE_LEN 2
+#define MAC_CFG_DESC_TX_0_TXSS_OVERRIDE_MSK 0x3000
+
+#define MAC_CFG_DESC_TX_0_TIMESTAMP_INSERTION_POS 14
+#define MAC_CFG_DESC_TX_0_TIMESTAMP_INSERTION_LEN 1
+#define MAC_CFG_DESC_TX_0_TIMESTAMP_INSERTION_MSK 0x4000
+
+#define MAC_CFG_DESC_TX_0_DURATION_PRESERVE_POS 15
+#define MAC_CFG_DESC_TX_0_DURATION_PRESERVE_LEN 1
+#define MAC_CFG_DESC_TX_0_DURATION_PRESERVE_MSK 0x8000
+
+#define MAC_CFG_DESC_TX_0_MCS_INDEX_POS 22
+#define MAC_CFG_DESC_TX_0_MCS_INDEX_LEN 5
+#define MAC_CFG_DESC_TX_0_MCS_INDEX_MSK 0x7C00000
+
+#define MAC_CFG_DESC_TX_0_MCS_EN_POS 27
+#define MAC_CFG_DESC_TX_0_MCS_EN_LEN 1
+#define MAC_CFG_DESC_TX_0_MCS_EN_MSK 0x8000000
+
+#define MAC_CFG_DESC_TX_0_SN_PRESERVED_POS 31
+#define MAC_CFG_DESC_TX_0_SN_PRESERVED_LEN 1
+#define MAC_CFG_DESC_TX_0_SN_PRESERVED_MSK 0x80000000
+
+/* TX MAC Dword 1 */
+#define MAC_CFG_DESC_TX_1_PKT_MODE_POS 0
+#define MAC_CFG_DESC_TX_1_PKT_MODE_LEN 4
+#define MAC_CFG_DESC_TX_1_PKT_MODE_MSK 0xF
+
+#define MAC_CFG_DESC_TX_1_PKT_MODE_EN_POS 4
+#define MAC_CFG_DESC_TX_1_PKT_MODE_EN_LEN 1
+#define MAC_CFG_DESC_TX_1_PKT_MODE_EN_MSK 0x10
+
+#define MAC_CFG_DESC_TX_1_ACK_POLICY_EN_POS 15
+#define MAC_CFG_DESC_TX_1_ACK_POLICY_EN_LEN 1
+#define MAC_CFG_DESC_TX_1_ACK_POLICY_EN_MSK 0x8000
+
+#define MAC_CFG_DESC_TX_1_DST_INDEX_POS 16
+#define MAC_CFG_DESC_TX_1_DST_INDEX_LEN 4
+#define MAC_CFG_DESC_TX_1_DST_INDEX_MSK 0xF0000
+
+#define MAC_CFG_DESC_TX_1_DST_INDEX_EN_POS 20
+#define MAC_CFG_DESC_TX_1_DST_INDEX_EN_LEN 1
+#define MAC_CFG_DESC_TX_1_DST_INDEX_EN_MSK 0x100000
+
+#define MAC_CFG_DESC_TX_1_ACK_POLICY_POS 21
+#define MAC_CFG_DESC_TX_1_ACK_POLICY_LEN 2
+#define MAC_CFG_DESC_TX_1_ACK_POLICY_MSK 0x600000
+
+#define MAC_CFG_DESC_TX_1_LIFETIME_EN_POS 23
+#define MAC_CFG_DESC_TX_1_LIFETIME_EN_LEN 1
+#define MAC_CFG_DESC_TX_1_LIFETIME_EN_MSK 0x800000
+
+#define MAC_CFG_DESC_TX_1_MAX_RETRY_POS 24
+#define MAC_CFG_DESC_TX_1_MAX_RETRY_LEN 7
+#define MAC_CFG_DESC_TX_1_MAX_RETRY_MSK 0x7F000000
+
+#define MAC_CFG_DESC_TX_1_MAX_RETRY_EN_POS 31
+#define MAC_CFG_DESC_TX_1_MAX_RETRY_EN_LEN 1
+#define MAC_CFG_DESC_TX_1_MAX_RETRY_EN_MSK 0x80000000
+
+/* TX MAC Dword 2 */
+#define MAC_CFG_DESC_TX_2_NUM_OF_DESCRIPTORS_POS 0
+#define MAC_CFG_DESC_TX_2_NUM_OF_DESCRIPTORS_LEN 8
+#define MAC_CFG_DESC_TX_2_NUM_OF_DESCRIPTORS_MSK 0xFF
+
+#define MAC_CFG_DESC_TX_2_RESERVED_POS 8
+#define MAC_CFG_DESC_TX_2_RESERVED_LEN 10
+#define MAC_CFG_DESC_TX_2_RESERVED_MSK 0x3FF00
+
+#define MAC_CFG_DESC_TX_2_L2_TRANSLATION_TYPE_POS 18
+#define MAC_CFG_DESC_TX_2_L2_TRANSLATION_TYPE_LEN 2
+#define MAC_CFG_DESC_TX_2_L2_TRANSLATION_TYPE_MSK 0xC0000
+
+#define MAC_CFG_DESC_TX_2_SNAP_HDR_INSERTION_EN_POS 20
+#define MAC_CFG_DESC_TX_2_SNAP_HDR_INSERTION_EN_LEN 1
+#define MAC_CFG_DESC_TX_2_SNAP_HDR_INSERTION_EN_MSK 0x100000
+
+#define MAC_CFG_DESC_TX_2_VLAN_REMOVAL_EN_POS 21
+#define MAC_CFG_DESC_TX_2_VLAN_REMOVAL_EN_LEN 1
+#define MAC_CFG_DESC_TX_2_VLAN_REMOVAL_EN_MSK 0x200000
+
+/* TX MAC Dword 3 */
+#define MAC_CFG_DESC_TX_3_UCODE_CMD_POS 0
+#define MAC_CFG_DESC_TX_3_UCODE_CMD_LEN 32
+#define MAC_CFG_DESC_TX_3_UCODE_CMD_MSK 0xFFFFFFFF
+
+/* TX DMA Dword 0 */
+#define DMA_CFG_DESC_TX_0_L4_LENGTH_POS 0
+#define DMA_CFG_DESC_TX_0_L4_LENGTH_LEN 8
+#define DMA_CFG_DESC_TX_0_L4_LENGTH_MSK 0xFF
+
+#define DMA_CFG_DESC_TX_0_CMD_EOP_POS 8
+#define DMA_CFG_DESC_TX_0_CMD_EOP_LEN 1
+#define DMA_CFG_DESC_TX_0_CMD_EOP_MSK 0x100
+
+#define DMA_CFG_DESC_TX_0_CMD_DMA_IT_POS 10
+#define DMA_CFG_DESC_TX_0_CMD_DMA_IT_LEN 1
+#define DMA_CFG_DESC_TX_0_CMD_DMA_IT_MSK 0x400
+
+#define DMA_CFG_DESC_TX_0_SEGMENT_BUF_DETAILS_POS 11
+#define DMA_CFG_DESC_TX_0_SEGMENT_BUF_DETAILS_LEN 2
+#define DMA_CFG_DESC_TX_0_SEGMENT_BUF_DETAILS_MSK 0x1800
+
+#define DMA_CFG_DESC_TX_0_TCP_SEG_EN_POS 13
+#define DMA_CFG_DESC_TX_0_TCP_SEG_EN_LEN 1
+#define DMA_CFG_DESC_TX_0_TCP_SEG_EN_MSK 0x2000
+
+#define DMA_CFG_DESC_TX_0_IPV4_CHECKSUM_EN_POS 14
+#define DMA_CFG_DESC_TX_0_IPV4_CHECKSUM_EN_LEN 1
+#define DMA_CFG_DESC_TX_0_IPV4_CHECKSUM_EN_MSK 0x4000
+
+#define DMA_CFG_DESC_TX_0_TCP_UDP_CHECKSUM_EN_POS 15
+#define DMA_CFG_DESC_TX_0_TCP_UDP_CHECKSUM_EN_LEN 1
+#define DMA_CFG_DESC_TX_0_TCP_UDP_CHECKSUM_EN_MSK 0x8000
+
+#define DMA_CFG_DESC_TX_0_QID_POS 16
+#define DMA_CFG_DESC_TX_0_QID_LEN 5
+#define DMA_CFG_DESC_TX_0_QID_MSK 0x1F0000
+
+#define DMA_CFG_DESC_TX_0_PSEUDO_HEADER_CALC_EN_POS 21
+#define DMA_CFG_DESC_TX_0_PSEUDO_HEADER_CALC_EN_LEN 1
+#define DMA_CFG_DESC_TX_0_PSEUDO_HEADER_CALC_EN_MSK 0x200000
+
+#define DMA_CFG_DESC_TX_0_L4_TYPE_POS 30
+#define DMA_CFG_DESC_TX_0_L4_TYPE_LEN 2
+#define DMA_CFG_DESC_TX_0_L4_TYPE_MSK 0xC0000000
+
+
+#define TX_DMA_STATUS_DU         BIT(0)
+
+struct vring_tx_dma {
+        u32 d0;
+        u32 addr_low;
+        u16 addr_high;
+        u8  ip_length;
+        u8  b11;       /* 0..6: mac_length; 7:ip_version */
+        u8  error;     /* 0..2: err; 3..7: reserved; */
+        u8  status;    /* 0: used; 1..7; reserved */
+        u16 length;
+} __packed;
+
+/*
+ * Rx descriptor - MAC part
+ * [dword 0]
+ * bit  0.. 3 : tid:4 The QoS (b3-0) TID Field
+ * bit  4.. 6 : connection_id:3 :The Source index that  was found during
+ *  Parsing the TA.  This field is used to  define the source of the packet
+ * bit      7 : reserved:1
+ * bit  8.. 9 : mac_id:2 : The MAC virtual  Ring number (always zero)
+ * bit 10..11 : frame_type:2 : The FC Control  (b3-2) -  MPDU Type
+ *              (management, data, control  and extension)
+ * bit 12..15 : frame_subtype:4 : The FC Control  (b7-4) -  Frame Subtype
+ * bit 16..27 : seq_number:12 The received Sequence number field
+ * bit 28..31 : extended:4 extended subtype
+ * [dword 1]
+ * bit  0.. 3 : reserved
+ * bit  4.. 5 : key_id:2
+ * bit      6 : decrypt_bypass:1
+ * bit      7 : security:1
+ * bit  8.. 9 : ds_bits:2
+ * bit     10 : a_msdu_present:1  from qos header
+ * bit     11 : a_msdu_type:1  from qos header
+ * bit     12 : a_mpdu:1  part of AMPDU aggregation
+ * bit     13 : broadcast:1
+ * bit     14 : mutlicast:1
+ * bit     15 : reserved:1
+ * bit 16..20 : rx_mac_qid:5   The Queue Identifier that the packet
+ *                             is received from
+ * bit 21..24 : mcs:4
+ * bit 25..28 : mic_icr:4
+ * bit 29..31 : reserved:3
+ * [dword 2]
+ * bit  0.. 2 : time_slot:3 The timeslot that the MPDU is received
+ * bit      3 : fc_protocol_ver:1 The FC Control  (b0) - Protocol  Version
+ * bit      4 : fc_order:1 The FC Control (b15) -Order
+ * bit  5.. 7 : qos_ack_policy:3  The QoS (b6-5) ack policy Field
+ * bit      8 : esop:1 The QoS (b4) ESOP field
+ * bit      9 : qos_rdg_more_ppdu:1 The QoS (b9) RDG  field
+ * bit 10..14 : qos_reserved:5 The QoS (b14-10) Reserved  field
+ * bit     15 : qos_ac_constraint:1
+ * bit 16..31 : pn_15_0:16 low 2 bytes of PN
+ * [dword 3]
+ * bit  0..31 : pn_47_16:32 high 4 bytes of PN
+ */
+struct vring_rx_mac {
+        u32 d0;
+        u32 d1;
+        u16 w4;
+        u16 pn_15_0;
+        u32 pn_47_16;
+} __packed;
+
+/*
+ * Rx descriptor - DMA part
+ * [dword 0]
+ * bit  0.. 7 : l4_length:8 layer 4 length
+ * bit  8.. 9 : reserved:2
+ * bit     10 : cmd_dma_it:1
+ * bit 11..15 : reserved:5
+ * bit 16..29 : phy_info_length:14
+ * bit 30..31 : l4_type:2 valid if the L4I bit is set in the status field
+ * [dword 1]
+ * bit  0..31 : addr_low:32 The payload buffer low address
+ * [dword 2]
+ * bit  0..15 : addr_high:16 The payload buffer high address
+ * bit 16..23 : ip_length:8
+ * bit 24..30 : mac_length:7
+ * bit     31 : ip_version:1
+ * [dword 3]
+ *  [byte 12] error
+ *  [byte 13] status
+ * bit      0 : du:1
+ * bit      1 : eop:1
+ * bit      2 : error:1
+ * bit      3 : mi:1
+ * bit      4 : l3_identified:1
+ * bit      5 : l4_identified:1
+ * bit      6 : phy_info_included:1
+ * bit      7 : reserved:1
+ *  [word 7] length
+ *
+ */
+
+#define RX_DMA_D0_CMD_DMA_IT     BIT(10)
+
+#define RX_DMA_STATUS_DU         BIT(0)
+#define RX_DMA_STATUS_ERROR      BIT(2)
+#define RX_DMA_STATUS_PHY_INFO   BIT(6)
+
+struct vring_rx_dma {
+        u32 d0;
+        u32 addr_low;
+        u16 addr_high;
+        u8  ip_length;
+        u8  b11;
+        u8  error;
+        u8  status;
+        u16 length;
+} __packed;
+
+struct vring_tx_desc {
+        struct vring_tx_mac mac;
+        struct vring_tx_dma dma;
+} __packed;
+
+struct vring_rx_desc {
+        struct vring_rx_mac mac;
+        struct vring_rx_dma dma;
+} __packed;
+
+union vring_desc {
+        struct vring_tx_desc tx;
+        struct vring_rx_desc rx;
+} __packed;
+
+static inline int wil_rxdesc_phy_length(volatile struct vring_rx_desc *d)
+{
+        return WIL_GET_BITS(d->dma.d0, 16, 29);
+}
+
+static inline int wil_rxdesc_mcs(volatile struct vring_rx_desc *d)
+{
+        return WIL_GET_BITS(d->mac.d1, 21, 24);
+}
+
+static inline int wil_rxdesc_ds_bits(volatile struct vring_rx_desc *d)
+{
+        return WIL_GET_BITS(d->mac.d1, 8, 9);
+}
+
+static inline int wil_rxdesc_ftype(volatile struct vring_rx_desc *d)
+{
+        return WIL_GET_BITS(d->mac.d0, 10, 11);
+}
+
+#endif /* WIL6210_TXRX_H */
diff --git a/drivers/net/wireless/ath/wil6210/wil6210.h b/drivers/net/wireless/ath/wil6210/wil6210.h
new file mode 100644
index 000000000000..9bcfffa4006c
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/wil6210.h
@@ -0,0 +1,363 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef __WIL6210_H__
+#define __WIL6210_H__
+
+#include <linux/netdevice.h>
+#include <linux/wireless.h>
+#include <net/cfg80211.h>
+
+#include "dbg_hexdump.h"
+
+#define WIL_NAME "wil6210"
+
+/**
+ * extract bits [@b0:@b1] (inclusive) from the value @x
+ * it should be @b0 <= @b1, or result is incorrect
+ */
+static inline u32 WIL_GET_BITS(u32 x, int b0, int b1)
+{
+        return (x >> b0) & ((1 << (b1 - b0 + 1)) - 1);
+}
+
+#define WIL6210_MEM_SIZE (2*1024*1024UL)
+
+#define WIL6210_TX_QUEUES (4)
+
+#define WIL6210_RX_RING_SIZE (128)
+#define WIL6210_TX_RING_SIZE (128)
+#define WIL6210_MAX_TX_RINGS (24)
+
+/* Hardware definitions begin */
+
+/*
+ * Mapping
+ * RGF File      | Host addr    |  FW addr
+ *               |              |
+ * user_rgf      | 0x000000     | 0x880000
+ *  dma_rgf      | 0x001000     | 0x881000
+ * pcie_rgf      | 0x002000     | 0x882000
+ *               |              |
+ */
+
+/* Where various structures placed in host address space */
+#define WIL6210_FW_HOST_OFF      (0x880000UL)
+
+#define HOSTADDR(fwaddr)        (fwaddr - WIL6210_FW_HOST_OFF)
+
+/*
+ * Interrupt control registers block
+ *
+ * each interrupt controlled by the same bit in all registers
+ */
+struct RGF_ICR {
+        u32 ICC; /* Cause Control, RW: 0 - W1C, 1 - COR */
+        u32 ICR; /* Cause, W1C/COR depending on ICC */
+        u32 ICM; /* Cause masked (ICR & ~IMV), W1C/COR depending on ICC */
+        u32 ICS; /* Cause Set, WO */
+        u32 IMV; /* Mask, RW+S/C */
+        u32 IMS; /* Mask Set, write 1 to set */
+        u32 IMC; /* Mask Clear, write 1 to clear */
+} __packed;
+
+/* registers - FW addresses */
+#define RGF_USER_USER_SCRATCH_PAD       (0x8802bc)
+#define RGF_USER_USER_ICR               (0x880b4c) /* struct RGF_ICR */
+        #define BIT_USER_USER_ICR_SW_INT_2      BIT(18)
+#define RGF_USER_CLKS_CTL_SW_RST_MASK_0 (0x880b14)
+#define RGF_USER_MAC_CPU_0              (0x8801fc)
+#define RGF_USER_USER_CPU_0             (0x8801e0)
+#define RGF_USER_CLKS_CTL_SW_RST_VEC_0  (0x880b04)
+#define RGF_USER_CLKS_CTL_SW_RST_VEC_1  (0x880b08)
+#define RGF_USER_CLKS_CTL_SW_RST_VEC_2  (0x880b0c)
+#define RGF_USER_CLKS_CTL_SW_RST_VEC_3  (0x880b10)
+
+#define RGF_DMA_PSEUDO_CAUSE            (0x881c68)
+#define RGF_DMA_PSEUDO_CAUSE_MASK_SW    (0x881c6c)
+#define RGF_DMA_PSEUDO_CAUSE_MASK_FW    (0x881c70)
+        #define BIT_DMA_PSEUDO_CAUSE_RX         BIT(0)
+        #define BIT_DMA_PSEUDO_CAUSE_TX         BIT(1)
+        #define BIT_DMA_PSEUDO_CAUSE_MISC       BIT(2)
+
+#define RGF_DMA_EP_TX_ICR               (0x881bb4) /* struct RGF_ICR */
+        #define BIT_DMA_EP_TX_ICR_TX_DONE       BIT(0)
+        #define BIT_DMA_EP_TX_ICR_TX_DONE_N(n)  BIT(n+1) /* n = [0..23] */
+#define RGF_DMA_EP_RX_ICR               (0x881bd0) /* struct RGF_ICR */
+        #define BIT_DMA_EP_RX_ICR_RX_DONE       BIT(0)
+#define RGF_DMA_EP_MISC_ICR             (0x881bec) /* struct RGF_ICR */
+        #define BIT_DMA_EP_MISC_ICR_RX_HTRSH    BIT(0)
+        #define BIT_DMA_EP_MISC_ICR_TX_NO_ACT   BIT(1)
+        #define BIT_DMA_EP_MISC_ICR_FW_INT0     BIT(28)
+        #define BIT_DMA_EP_MISC_ICR_FW_INT1     BIT(29)
+
+/* Interrupt moderation control */
+#define RGF_DMA_ITR_CNT_TRSH            (0x881c5c)
+#define RGF_DMA_ITR_CNT_DATA            (0x881c60)
+#define RGF_DMA_ITR_CNT_CRL             (0x881C64)
+        #define BIT_DMA_ITR_CNT_CRL_EN          BIT(0)
+        #define BIT_DMA_ITR_CNT_CRL_EXT_TICK    BIT(1)
+        #define BIT_DMA_ITR_CNT_CRL_FOREVER     BIT(2)
+        #define BIT_DMA_ITR_CNT_CRL_CLR         BIT(3)
+        #define BIT_DMA_ITR_CNT_CRL_REACH_TRSH  BIT(4)
+
+/* popular locations */
+#define HOST_MBOX   HOSTADDR(RGF_USER_USER_SCRATCH_PAD)
+#define HOST_SW_INT (HOSTADDR(RGF_USER_USER_ICR) + \
+        offsetof(struct RGF_ICR, ICS))
+#define SW_INT_MBOX BIT_USER_USER_ICR_SW_INT_2
+
+/* ISR register bits */
+#define ISR_MISC_FW_READY BIT_DMA_EP_MISC_ICR_FW_INT0
+#define ISR_MISC_MBOX_EVT BIT_DMA_EP_MISC_ICR_FW_INT1
+
+/* Hardware definitions end */
+
+struct wil6210_mbox_ring {
+        u32 base;
+        u16 entry_size; /* max. size of mbox entry, incl. all headers */
+        u16 size;
+        u32 tail;
+        u32 head;
+} __packed;
+
+struct wil6210_mbox_ring_desc {
+        __le32 sync;
+        __le32 addr;
+} __packed;
+
+/* at HOST_OFF_WIL6210_MBOX_CTL */
+struct wil6210_mbox_ctl {
+        struct wil6210_mbox_ring tx;
+        struct wil6210_mbox_ring rx;
+} __packed;
+
+struct wil6210_mbox_hdr {
+        __le16 seq;
+        __le16 len; /* payload, bytes after this header */
+        __le16 type;
+        u8 flags;
+        u8 reserved;
+} __packed;
+
+#define WIL_MBOX_HDR_TYPE_WMI (0)
+
+/* max. value for wil6210_mbox_hdr.len */
+#define MAX_MBOXITEM_SIZE   (240)
+
+struct wil6210_mbox_hdr_wmi {
+        u8 reserved0[2];
+        __le16 id;
+        __le16 info1; /* bits [0..3] - device_id, rest - unused */
+        u8 reserved1[2];
+} __packed;
+
+struct pending_wmi_event {
+        struct list_head list;
+        struct {
+                struct wil6210_mbox_hdr hdr;
+                struct wil6210_mbox_hdr_wmi wmi;
+                u8 data[0];
+        } __packed event;
+};
+
+union vring_desc;
+
+struct vring {
+        dma_addr_t pa;
+        volatile union vring_desc *va; /* vring_desc[size], WriteBack by DMA */
+        u16 size; /* number of vring_desc elements */
+        u32 swtail;
+        u32 swhead;
+        u32 hwtail; /* write here to inform hw */
+        void **ctx; /* void *ctx[size] - software context */
+};
+
+enum { /* for wil6210_priv.status */
+        wil_status_fwready = 0,
+        wil_status_fwconnected,
+        wil_status_dontscan,
+        wil_status_irqen, /* FIXME: interrupts enabled - for debug */
+};
+
+struct pci_dev;
+
+struct wil6210_stats {
+        u64 tsf;
+        u32 snr;
+        u16 last_mcs_rx;
+        u16 bf_mcs; /* last BF, used for Tx */
+        u16 my_rx_sector;
+        u16 my_tx_sector;
+        u16 peer_rx_sector;
+        u16 peer_tx_sector;
+};
+
+struct wil6210_priv {
+        struct pci_dev *pdev;
+        int n_msi;
+        struct wireless_dev *wdev;
+        void __iomem *csr;
+        ulong status;
+        /* profile */
+        u32 monitor_flags;
+        u32 secure_pcp; /* create secure PCP? */
+        int sinfo_gen;
+        /* cached ISR registers */
+        u32 isr_misc;
+        /* mailbox related */
+        struct mutex wmi_mutex;
+        struct wil6210_mbox_ctl mbox_ctl;
+        struct completion wmi_ready;
+        u16 wmi_seq;
+        u16 reply_id; /**< wait for this WMI event */
+        void *reply_buf;
+        u16 reply_size;
+        struct workqueue_struct *wmi_wq; /* for deferred calls */
+        struct work_struct wmi_event_worker;
+        struct workqueue_struct *wmi_wq_conn; /* for connect worker */
+        struct work_struct wmi_connect_worker;
+        struct work_struct disconnect_worker;
+        struct timer_list connect_timer;
+        int pending_connect_cid;
+        struct list_head pending_wmi_ev;
+        /*
+         * protect pending_wmi_ev
+         * - fill in IRQ from wil6210_irq_misc,
+         * - consumed in thread by wmi_event_worker
+         */
+        spinlock_t wmi_ev_lock;
+        /* DMA related */
+        struct vring vring_rx;
+        struct vring vring_tx[WIL6210_MAX_TX_RINGS];
+        u8 dst_addr[WIL6210_MAX_TX_RINGS][ETH_ALEN];
+        /* scan */
+        struct cfg80211_scan_request *scan_request;
+
+        struct mutex mutex; /* for wil6210_priv access in wil_{up|down} */
+        /* statistics */
+        struct wil6210_stats stats;
+        /* debugfs */
+        struct dentry *debug;
+        struct debugfs_blob_wrapper fw_code_blob;
+        struct debugfs_blob_wrapper fw_data_blob;
+        struct debugfs_blob_wrapper fw_peri_blob;
+        struct debugfs_blob_wrapper uc_code_blob;
+        struct debugfs_blob_wrapper uc_data_blob;
+        struct debugfs_blob_wrapper rgf_blob;
+};
+
+#define wil_to_wiphy(i) (i->wdev->wiphy)
+#define wil_to_dev(i) (wiphy_dev(wil_to_wiphy(i)))
+#define wiphy_to_wil(w) (struct wil6210_priv *)(wiphy_priv(w))
+#define wil_to_wdev(i) (i->wdev)
+#define wdev_to_wil(w) (struct wil6210_priv *)(wdev_priv(w))
+#define wil_to_ndev(i) (wil_to_wdev(i)->netdev)
+#define ndev_to_wil(n) (wdev_to_wil(n->ieee80211_ptr))
+
+#define wil_dbg(wil, fmt, arg...) netdev_dbg(wil_to_ndev(wil), fmt, ##arg)
+#define wil_info(wil, fmt, arg...) netdev_info(wil_to_ndev(wil), fmt, ##arg)
+#define wil_err(wil, fmt, arg...) netdev_err(wil_to_ndev(wil), fmt, ##arg)
+
+#define wil_dbg_IRQ(wil, fmt, arg...) wil_dbg(wil, "DBG[ IRQ]" fmt, ##arg)
+#define wil_dbg_TXRX(wil, fmt, arg...) wil_dbg(wil, "DBG[TXRX]" fmt, ##arg)
+#define wil_dbg_WMI(wil, fmt, arg...) wil_dbg(wil, "DBG[ WMI]" fmt, ##arg)
+
+#define wil_hex_dump_TXRX(prefix_str, prefix_type, rowsize,     \
+                          groupsize, buf, len, ascii)           \
+                          wil_print_hex_dump_debug("DBG[TXRX]" prefix_str,\
+                                         prefix_type, rowsize,  \
+                                         groupsize, buf, len, ascii)
+
+#define wil_hex_dump_WMI(prefix_str, prefix_type, rowsize,      \
+                         groupsize, buf, len, ascii)            \
+                         wil_print_hex_dump_debug("DBG[ WMI]" prefix_str,\
+                                        prefix_type, rowsize,   \
+                                        groupsize, buf, len, ascii)
+
+void wil_memcpy_fromio_32(void *dst, const volatile void __iomem *src,
+                          size_t count);
+void wil_memcpy_toio_32(volatile void __iomem *dst, const void *src,
+                        size_t count);
+
+void *wil_if_alloc(struct device *dev, void __iomem *csr);
+void wil_if_free(struct wil6210_priv *wil);
+int wil_if_add(struct wil6210_priv *wil);
+void wil_if_remove(struct wil6210_priv *wil);
+int wil_priv_init(struct wil6210_priv *wil);
+void wil_priv_deinit(struct wil6210_priv *wil);
+int wil_reset(struct wil6210_priv *wil);
+void wil_link_on(struct wil6210_priv *wil);
+void wil_link_off(struct wil6210_priv *wil);
+int wil_up(struct wil6210_priv *wil);
+int wil_down(struct wil6210_priv *wil);
+void wil_mbox_ring_le2cpus(struct wil6210_mbox_ring *r);
+
+void __iomem *wmi_buffer(struct wil6210_priv *wil, __le32 ptr);
+void __iomem *wmi_addr(struct wil6210_priv *wil, u32 ptr);
+int wmi_read_hdr(struct wil6210_priv *wil, __le32 ptr,
+                 struct wil6210_mbox_hdr *hdr);
+int wmi_send(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len);
+void wmi_recv_cmd(struct wil6210_priv *wil);
+int wmi_call(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len,
+             u16 reply_id, void *reply, u8 reply_size, int to_msec);
+void wmi_connect_worker(struct work_struct *work);
+void wmi_event_worker(struct work_struct *work);
+void wmi_event_flush(struct wil6210_priv *wil);
+int wmi_set_ssid(struct wil6210_priv *wil, u8 ssid_len, const void *ssid);
+int wmi_get_ssid(struct wil6210_priv *wil, u8 *ssid_len, void *ssid);
+int wmi_set_channel(struct wil6210_priv *wil, int channel);
+int wmi_get_channel(struct wil6210_priv *wil, int *channel);
+int wmi_tx_eapol(struct wil6210_priv *wil, struct sk_buff *skb);
+int wmi_del_cipher_key(struct wil6210_priv *wil, u8 key_index,
+                       const void *mac_addr);
+int wmi_add_cipher_key(struct wil6210_priv *wil, u8 key_index,
+                       const void *mac_addr, int key_len, const void *key);
+int wmi_echo(struct wil6210_priv *wil);
+int wmi_set_ie(struct wil6210_priv *wil, u8 type, u16 ie_len, const void *ie);
+
+int wil6210_init_irq(struct wil6210_priv *wil, int irq);
+void wil6210_fini_irq(struct wil6210_priv *wil, int irq);
+void wil6210_disable_irq(struct wil6210_priv *wil);
+void wil6210_enable_irq(struct wil6210_priv *wil);
+
+int wil6210_debugfs_init(struct wil6210_priv *wil);
+void wil6210_debugfs_remove(struct wil6210_priv *wil);
+
+struct wireless_dev *wil_cfg80211_init(struct device *dev);
+void wil_wdev_free(struct wil6210_priv *wil);
+
+int wmi_set_mac_address(struct wil6210_priv *wil, void *addr);
+int wmi_set_bcon(struct wil6210_priv *wil, int bi, u8 wmi_nettype);
+void wil6210_disconnect(struct wil6210_priv *wil, void *bssid);
+
+int wil_rx_init(struct wil6210_priv *wil);
+void wil_rx_fini(struct wil6210_priv *wil);
+
+/* TX API */
+int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
+                      int cid, int tid);
+void wil_vring_fini_tx(struct wil6210_priv *wil, int id);
+
+netdev_tx_t wil_start_xmit(struct sk_buff *skb, struct net_device *ndev);
+void wil_tx_complete(struct wil6210_priv *wil, int ringid);
+
+/* RX API */
+void wil_rx_handle(struct wil6210_priv *wil);
+
+int wil_iftype_nl2wmi(enum nl80211_iftype type);
+
+#endif /* __WIL6210_H__ */
diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c
new file mode 100644
index 000000000000..12915f6e7617
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/wmi.c
@@ -0,0 +1,975 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/pci.h>
+#include <linux/io.h>
+#include <linux/list.h>
+#include <linux/etherdevice.h>
+
+#include "wil6210.h"
+#include "wmi.h"
+
+/**
+ * WMI event receiving - theory of operations
+ *
+ * When firmware about to report WMI event, it fills memory area
+ * in the mailbox and raises misc. IRQ. Thread interrupt handler invoked for
+ * the misc IRQ, function @wmi_recv_cmd called by thread IRQ handler.
+ *
+ * @wmi_recv_cmd reads event, allocates memory chunk  and attaches it to the
+ * event list @wil->pending_wmi_ev. Then, work queue @wil->wmi_wq wakes up
+ * and handles events within the @wmi_event_worker. Every event get detached
+ * from list, processed and deleted.
+ *
+ * Purpose for this mechanism is to release IRQ thread; otherwise,
+ * if WMI event handling involves another WMI command flow, this 2-nd flow
+ * won't be completed because of blocked IRQ thread.
+ */
+
+/**
+ * Addressing - theory of operations
+ *
+ * There are several buses present on the WIL6210 card.
+ * Same memory areas are visible at different address on
+ * the different busses. There are 3 main bus masters:
+ *  - MAC CPU (ucode)
+ *  - User CPU (firmware)
+ *  - AHB (host)
+ *
+ * On the PCI bus, there is one BAR (BAR0) of 2Mb size, exposing
+ * AHB addresses starting from 0x880000
+ *
+ * Internally, firmware uses addresses that allows faster access but
+ * are invisible from the host. To read from these addresses, alternative
+ * AHB address must be used.
+ *
+ * Memory mapping
+ * Linker address         PCI/Host address
+ *                        0x880000 .. 0xa80000  2Mb BAR0
+ * 0x800000 .. 0x807000   0x900000 .. 0x907000  28k DCCM
+ * 0x840000 .. 0x857000   0x908000 .. 0x91f000  92k PERIPH
+ */
+
+/**
+ * @fw_mapping provides memory remapping table
+ */
+static const struct {
+        u32 from; /* linker address - from, inclusive */
+        u32 to;   /* linker address - to, exclusive */
+        u32 host; /* PCI/Host address - BAR0 + 0x880000 */
+} fw_mapping[] = {
+        {0x000000, 0x040000, 0x8c0000}, /* FW code RAM 256k */
+        {0x800000, 0x808000, 0x900000}, /* FW data RAM 32k */
+        {0x840000, 0x860000, 0x908000}, /* peripheral data RAM 128k/96k used */
+        {0x880000, 0x88a000, 0x880000}, /* various RGF */
+        {0x8c0000, 0x932000, 0x8c0000}, /* trivial mapping for upper area */
+        /*
+         * 920000..930000 ucode code RAM
+         * 930000..932000 ucode data RAM
+         */
+};
+
+/**
+ * return AHB address for given firmware/ucode internal (linker) address
+ * @x - internal address
+ * If address have no valid AHB mapping, return 0
+ */
+static u32 wmi_addr_remap(u32 x)
+{
+        uint i;
+
+        for (i = 0; i < ARRAY_SIZE(fw_mapping); i++) {
+                if ((x >= fw_mapping[i].from) && (x < fw_mapping[i].to))
+                        return x + fw_mapping[i].host - fw_mapping[i].from;
+        }
+
+        return 0;
+}
+
+/**
+ * Check address validity for WMI buffer; remap if needed
+ * @ptr - internal (linker) fw/ucode address
+ *
+ * Valid buffer should be DWORD aligned
+ *
+ * return address for accessing buffer from the host;
+ * if buffer is not valid, return NULL.
+ */
+void __iomem *wmi_buffer(struct wil6210_priv *wil, __le32 ptr_)
+{
+        u32 off;
+        u32 ptr = le32_to_cpu(ptr_);
+
+        if (ptr % 4)
+                return NULL;
+
+        ptr = wmi_addr_remap(ptr);
+        if (ptr < WIL6210_FW_HOST_OFF)
+                return NULL;
+
+        off = HOSTADDR(ptr);
+        if (off > WIL6210_MEM_SIZE - 4)
+                return NULL;
+
+        return wil->csr + off;
+}
+
+/**
+ * Check address validity
+ */
+void __iomem *wmi_addr(struct wil6210_priv *wil, u32 ptr)
+{
+        u32 off;
+
+        if (ptr % 4)
+                return NULL;
+
+        if (ptr < WIL6210_FW_HOST_OFF)
+                return NULL;
+
+        off = HOSTADDR(ptr);
+        if (off > WIL6210_MEM_SIZE - 4)
+                return NULL;
+
+        return wil->csr + off;
+}
+
+int wmi_read_hdr(struct wil6210_priv *wil, __le32 ptr,
+                 struct wil6210_mbox_hdr *hdr)
+{
+        void __iomem *src = wmi_buffer(wil, ptr);
+        if (!src)
+                return -EINVAL;
+
+        wil_memcpy_fromio_32(hdr, src, sizeof(*hdr));
+
+        return 0;
+}
+
+static int __wmi_send(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len)
+{
+        struct {
+                struct wil6210_mbox_hdr hdr;
+                struct wil6210_mbox_hdr_wmi wmi;
+        } __packed cmd = {
+                .hdr = {
+                        .type = WIL_MBOX_HDR_TYPE_WMI,
+                        .flags = 0,
+                        .len = cpu_to_le16(sizeof(cmd.wmi) + len),
+                },
+                .wmi = {
+                        .id = cpu_to_le16(cmdid),
+                        .info1 = 0,
+                },
+        };
+        struct wil6210_mbox_ring *r = &wil->mbox_ctl.tx;
+        struct wil6210_mbox_ring_desc d_head;
+        u32 next_head;
+        void __iomem *dst;
+        void __iomem *head = wmi_addr(wil, r->head);
+        uint retry;
+
+        if (sizeof(cmd) + len > r->entry_size) {
+                wil_err(wil, "WMI size too large: %d bytes, max is %d\n",
+                        (int)(sizeof(cmd) + len), r->entry_size);
+                return -ERANGE;
+
+        }
+
+        might_sleep();
+
+        if (!test_bit(wil_status_fwready, &wil->status)) {
+                wil_err(wil, "FW not ready\n");
+                return -EAGAIN;
+        }
+
+        if (!head) {
+                wil_err(wil, "WMI head is garbage: 0x%08x\n", r->head);
+                return -EINVAL;
+        }
+        /* read Tx head till it is not busy */
+        for (retry = 5; retry > 0; retry--) {
+                wil_memcpy_fromio_32(&d_head, head, sizeof(d_head));
+                if (d_head.sync == 0)
+                        break;
+                msleep(20);
+        }
+        if (d_head.sync != 0) {
+                wil_err(wil, "WMI head busy\n");
+                return -EBUSY;
+        }
+        /* next head */
+        next_head = r->base + ((r->head - r->base + sizeof(d_head)) % r->size);
+        wil_dbg_WMI(wil, "Head 0x%08x -> 0x%08x\n", r->head, next_head);
+        /* wait till FW finish with previous command */
+        for (retry = 5; retry > 0; retry--) {
+                r->tail = ioread32(wil->csr + HOST_MBOX +
+                                   offsetof(struct wil6210_mbox_ctl, tx.tail));
+                if (next_head != r->tail)
+                        break;
+                msleep(20);
+        }
+        if (next_head == r->tail) {
+                wil_err(wil, "WMI ring full\n");
+                return -EBUSY;
+        }
+        dst = wmi_buffer(wil, d_head.addr);
+        if (!dst) {
+                wil_err(wil, "invalid WMI buffer: 0x%08x\n",
+                        le32_to_cpu(d_head.addr));
+                return -EINVAL;
+        }
+        cmd.hdr.seq = cpu_to_le16(++wil->wmi_seq);
+        /* set command */
+        wil_dbg_WMI(wil, "WMI command 0x%04x [%d]\n", cmdid, len);
+        wil_hex_dump_WMI("Cmd ", DUMP_PREFIX_OFFSET, 16, 1, &cmd,
+                         sizeof(cmd), true);
+        wil_hex_dump_WMI("cmd ", DUMP_PREFIX_OFFSET, 16, 1, buf,
+                         len, true);
+        wil_memcpy_toio_32(dst, &cmd, sizeof(cmd));
+        wil_memcpy_toio_32(dst + sizeof(cmd), buf, len);
+        /* mark entry as full */
+        iowrite32(1, wil->csr + HOSTADDR(r->head) +
+                  offsetof(struct wil6210_mbox_ring_desc, sync));
+        /* advance next ptr */
+        iowrite32(r->head = next_head, wil->csr + HOST_MBOX +
+                  offsetof(struct wil6210_mbox_ctl, tx.head));
+
+        /* interrupt to FW */
+        iowrite32(SW_INT_MBOX, wil->csr + HOST_SW_INT);
+
+        return 0;
+}
+
+int wmi_send(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len)
+{
+        int rc;
+
+        mutex_lock(&wil->wmi_mutex);
+        rc = __wmi_send(wil, cmdid, buf, len);
+        mutex_unlock(&wil->wmi_mutex);
+
+        return rc;
+}
+
+/*=== Event handlers ===*/
+static void wmi_evt_ready(struct wil6210_priv *wil, int id, void *d, int len)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct wireless_dev *wdev = wil->wdev;
+        struct wmi_ready_event *evt = d;
+        u32 ver = le32_to_cpu(evt->sw_version);
+
+        wil_dbg_WMI(wil, "FW ver. %d; MAC %pM\n", ver, evt->mac);
+
+        if (!is_valid_ether_addr(ndev->dev_addr)) {
+                memcpy(ndev->dev_addr, evt->mac, ETH_ALEN);
+                memcpy(ndev->perm_addr, evt->mac, ETH_ALEN);
+        }
+        snprintf(wdev->wiphy->fw_version, sizeof(wdev->wiphy->fw_version),
+                 "%d", ver);
+}
+
+static void wmi_evt_fw_ready(struct wil6210_priv *wil, int id, void *d,
+                             int len)
+{
+        wil_dbg_WMI(wil, "WMI: FW ready\n");
+
+        set_bit(wil_status_fwready, &wil->status);
+        /* reuse wmi_ready for the firmware ready indication */
+        complete(&wil->wmi_ready);
+}
+
+static void wmi_evt_rx_mgmt(struct wil6210_priv *wil, int id, void *d, int len)
+{
+        struct wmi_rx_mgmt_packet_event *data = d;
+        struct wiphy *wiphy = wil_to_wiphy(wil);
+        struct ieee80211_mgmt *rx_mgmt_frame =
+                        (struct ieee80211_mgmt *)data->payload;
+        int ch_no = data->info.channel+1;
+        u32 freq = ieee80211_channel_to_frequency(ch_no,
+                        IEEE80211_BAND_60GHZ);
+        struct ieee80211_channel *channel = ieee80211_get_channel(wiphy, freq);
+        /* TODO convert LE to CPU */
+        s32 signal = 0; /* TODO */
+        __le16 fc = rx_mgmt_frame->frame_control;
+        u32 d_len = le32_to_cpu(data->info.len);
+        u16 d_status = le16_to_cpu(data->info.status);
+
+        wil_dbg_WMI(wil, "MGMT: channel %d MCS %d SNR %d\n",
+                    data->info.channel, data->info.mcs, data->info.snr);
+        wil_dbg_WMI(wil, "status 0x%04x len %d stype %04x\n", d_status, d_len,
+                    le16_to_cpu(data->info.stype));
+        wil_dbg_WMI(wil, "qid %d mid %d cid %d\n",
+                    data->info.qid, data->info.mid, data->info.cid);
+
+        if (!channel) {
+                wil_err(wil, "Frame on unsupported channel\n");
+                return;
+        }
+
+        if (ieee80211_is_beacon(fc) || ieee80211_is_probe_resp(fc)) {
+                struct cfg80211_bss *bss;
+                u64 tsf = le64_to_cpu(rx_mgmt_frame->u.beacon.timestamp);
+                u16 cap = le16_to_cpu(rx_mgmt_frame->u.beacon.capab_info);
+                u16 bi = le16_to_cpu(rx_mgmt_frame->u.beacon.beacon_int);
+                const u8 *ie_buf = rx_mgmt_frame->u.beacon.variable;
+                size_t ie_len = d_len - offsetof(struct ieee80211_mgmt,
+                                                 u.beacon.variable);
+                wil_dbg_WMI(wil, "Capability info : 0x%04x\n", cap);
+
+                bss = cfg80211_inform_bss(wiphy, channel, rx_mgmt_frame->bssid,
+                                          tsf, cap, bi, ie_buf, ie_len,
+                                          signal, GFP_KERNEL);
+                if (bss) {
+                        wil_dbg_WMI(wil, "Added BSS %pM\n",
+                                    rx_mgmt_frame->bssid);
+                        cfg80211_put_bss(bss);
+                } else {
+                        wil_err(wil, "cfg80211_inform_bss() failed\n");
+                }
+        }
+}
+
+static void wmi_evt_scan_complete(struct wil6210_priv *wil, int id,
+                                  void *d, int len)
+{
+        if (wil->scan_request) {
+                struct wmi_scan_complete_event *data = d;
+                bool aborted = (data->status != 0);
+
+                wil_dbg_WMI(wil, "SCAN_COMPLETE(0x%08x)\n", data->status);
+                cfg80211_scan_done(wil->scan_request, aborted);
+                wil->scan_request = NULL;
+        } else {
+                wil_err(wil, "SCAN_COMPLETE while not scanning\n");
+        }
+}
+
+static void wmi_evt_connect(struct wil6210_priv *wil, int id, void *d, int len)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct wireless_dev *wdev = wil->wdev;
+        struct wmi_connect_event *evt = d;
+        int ch; /* channel number */
+        struct station_info sinfo;
+        u8 *assoc_req_ie, *assoc_resp_ie;
+        size_t assoc_req_ielen, assoc_resp_ielen;
+        /* capinfo(u16) + listen_interval(u16) + IEs */
+        const size_t assoc_req_ie_offset = sizeof(u16) * 2;
+        /* capinfo(u16) + status_code(u16) + associd(u16) + IEs */
+        const size_t assoc_resp_ie_offset = sizeof(u16) * 3;
+
+        if (len < sizeof(*evt)) {
+                wil_err(wil, "Connect event too short : %d bytes\n", len);
+                return;
+        }
+        if (len != sizeof(*evt) + evt->beacon_ie_len + evt->assoc_req_len +
+                   evt->assoc_resp_len) {
+                wil_err(wil,
+                        "Connect event corrupted : %d != %d + %d + %d + %d\n",
+                        len, (int)sizeof(*evt), evt->beacon_ie_len,
+                        evt->assoc_req_len, evt->assoc_resp_len);
+                return;
+        }
+        ch = evt->channel + 1;
+        wil_dbg_WMI(wil, "Connect %pM channel [%d] cid %d\n",
+                    evt->bssid, ch, evt->cid);
+        wil_hex_dump_WMI("connect AI : ", DUMP_PREFIX_OFFSET, 16, 1,
+                         evt->assoc_info, len - sizeof(*evt), true);
+
+        /* figure out IE's */
+        assoc_req_ie = &evt->assoc_info[evt->beacon_ie_len +
+                                        assoc_req_ie_offset];
+        assoc_req_ielen = evt->assoc_req_len - assoc_req_ie_offset;
+        if (evt->assoc_req_len <= assoc_req_ie_offset) {
+                assoc_req_ie = NULL;
+                assoc_req_ielen = 0;
+        }
+
+        assoc_resp_ie = &evt->assoc_info[evt->beacon_ie_len +
+                                         evt->assoc_req_len +
+                                         assoc_resp_ie_offset];
+        assoc_resp_ielen = evt->assoc_resp_len - assoc_resp_ie_offset;
+        if (evt->assoc_resp_len <= assoc_resp_ie_offset) {
+                assoc_resp_ie = NULL;
+                assoc_resp_ielen = 0;
+        }
+
+        if ((wdev->iftype == NL80211_IFTYPE_STATION) ||
+            (wdev->iftype == NL80211_IFTYPE_P2P_CLIENT)) {
+                if (wdev->sme_state != CFG80211_SME_CONNECTING) {
+                        wil_err(wil, "Not in connecting state\n");
+                        return;
+                }
+                del_timer_sync(&wil->connect_timer);
+                cfg80211_connect_result(ndev, evt->bssid,
+                                        assoc_req_ie, assoc_req_ielen,
+                                        assoc_resp_ie, assoc_resp_ielen,
+                                        WLAN_STATUS_SUCCESS, GFP_KERNEL);
+
+        } else if ((wdev->iftype == NL80211_IFTYPE_AP) ||
+                   (wdev->iftype == NL80211_IFTYPE_P2P_GO)) {
+                memset(&sinfo, 0, sizeof(sinfo));
+
+                sinfo.generation = wil->sinfo_gen++;
+
+                if (assoc_req_ie) {
+                        sinfo.assoc_req_ies = assoc_req_ie;
+                        sinfo.assoc_req_ies_len = assoc_req_ielen;
+                        sinfo.filled |= STATION_INFO_ASSOC_REQ_IES;
+                }
+
+                cfg80211_new_sta(ndev, evt->bssid, &sinfo, GFP_KERNEL);
+        }
+        set_bit(wil_status_fwconnected, &wil->status);
+
+        /* FIXME FW can transmit only ucast frames to peer */
+        /* FIXME real ring_id instead of hard coded 0 */
+        memcpy(wil->dst_addr[0], evt->bssid, ETH_ALEN);
+
+        wil->pending_connect_cid = evt->cid;
+        queue_work(wil->wmi_wq_conn, &wil->wmi_connect_worker);
+}
+
+static void wmi_evt_disconnect(struct wil6210_priv *wil, int id,
+                               void *d, int len)
+{
+        struct wmi_disconnect_event *evt = d;
+
+        wil_dbg_WMI(wil, "Disconnect %pM reason %d proto %d wmi\n",
+                    evt->bssid,
+                    evt->protocol_reason_status, evt->disconnect_reason);
+
+        wil->sinfo_gen++;
+
+        wil6210_disconnect(wil, evt->bssid);
+        clear_bit(wil_status_dontscan, &wil->status);
+}
+
+static void wmi_evt_notify(struct wil6210_priv *wil, int id, void *d, int len)
+{
+        struct wmi_notify_req_done_event *evt = d;
+
+        if (len < sizeof(*evt)) {
+                wil_err(wil, "Short NOTIFY event\n");
+                return;
+        }
+
+        wil->stats.tsf = le64_to_cpu(evt->tsf);
+        wil->stats.snr = le32_to_cpu(evt->snr_val);
+        wil->stats.bf_mcs = le16_to_cpu(evt->bf_mcs);
+        wil->stats.my_rx_sector = le16_to_cpu(evt->my_rx_sector);
+        wil->stats.my_tx_sector = le16_to_cpu(evt->my_tx_sector);
+        wil->stats.peer_rx_sector = le16_to_cpu(evt->other_rx_sector);
+        wil->stats.peer_tx_sector = le16_to_cpu(evt->other_tx_sector);
+        wil_dbg_WMI(wil, "Link status, MCS %d TSF 0x%016llx\n"
+                    "BF status 0x%08x SNR 0x%08x\n"
+                    "Tx Tpt %d goodput %d Rx goodput %d\n"
+                    "Sectors(rx:tx) my %d:%d peer %d:%d\n",
+                    wil->stats.bf_mcs, wil->stats.tsf, evt->status,
+                    wil->stats.snr, le32_to_cpu(evt->tx_tpt),
+                    le32_to_cpu(evt->tx_goodput), le32_to_cpu(evt->rx_goodput),
+                    wil->stats.my_rx_sector, wil->stats.my_tx_sector,
+                    wil->stats.peer_rx_sector, wil->stats.peer_tx_sector);
+}
+
+/*
+ * Firmware reports EAPOL frame using WME event.
+ * Reconstruct Ethernet frame and deliver it via normal Rx
+ */
+static void wmi_evt_eapol_rx(struct wil6210_priv *wil, int id,
+                             void *d, int len)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct wmi_eapol_rx_event *evt = d;
+        u16 eapol_len = le16_to_cpu(evt->eapol_len);
+        int sz = eapol_len + ETH_HLEN;
+        struct sk_buff *skb;
+        struct ethhdr *eth;
+
+        wil_dbg_WMI(wil, "EAPOL len %d from %pM\n", eapol_len,
+                    evt->src_mac);
+
+        if (eapol_len > 196) { /* TODO: revisit size limit */
+                wil_err(wil, "EAPOL too large\n");
+                return;
+        }
+
+        skb = alloc_skb(sz, GFP_KERNEL);
+        if (!skb) {
+                wil_err(wil, "Failed to allocate skb\n");
+                return;
+        }
+        eth = (struct ethhdr *)skb_put(skb, ETH_HLEN);
+        memcpy(eth->h_dest, ndev->dev_addr, ETH_ALEN);
+        memcpy(eth->h_source, evt->src_mac, ETH_ALEN);
+        eth->h_proto = cpu_to_be16(ETH_P_PAE);
+        memcpy(skb_put(skb, eapol_len), evt->eapol, eapol_len);
+        skb->protocol = eth_type_trans(skb, ndev);
+        if (likely(netif_rx_ni(skb) == NET_RX_SUCCESS)) {
+                ndev->stats.rx_packets++;
+                ndev->stats.rx_bytes += skb->len;
+        } else {
+                ndev->stats.rx_dropped++;
+        }
+}
+
+static const struct {
+        int eventid;
+        void (*handler)(struct wil6210_priv *wil, int eventid,
+                        void *data, int data_len);
+} wmi_evt_handlers[] = {
+        {WMI_READY_EVENTID,             wmi_evt_ready},
+        {WMI_FW_READY_EVENTID,          wmi_evt_fw_ready},
+        {WMI_RX_MGMT_PACKET_EVENTID,    wmi_evt_rx_mgmt},
+        {WMI_SCAN_COMPLETE_EVENTID,     wmi_evt_scan_complete},
+        {WMI_CONNECT_EVENTID,           wmi_evt_connect},
+        {WMI_DISCONNECT_EVENTID,        wmi_evt_disconnect},
+        {WMI_NOTIFY_REQ_DONE_EVENTID,   wmi_evt_notify},
+        {WMI_EAPOL_RX_EVENTID,          wmi_evt_eapol_rx},
+};
+
+/*
+ * Run in IRQ context
+ * Extract WMI command from mailbox. Queue it to the @wil->pending_wmi_ev
+ * that will be eventually handled by the @wmi_event_worker in the thread
+ * context of thread "wil6210_wmi"
+ */
+void wmi_recv_cmd(struct wil6210_priv *wil)
+{
+        struct wil6210_mbox_ring_desc d_tail;
+        struct wil6210_mbox_hdr hdr;
+        struct wil6210_mbox_ring *r = &wil->mbox_ctl.rx;
+        struct pending_wmi_event *evt;
+        u8 *cmd;
+        void __iomem *src;
+        ulong flags;
+
+        for (;;) {
+                u16 len;
+
+                r->head = ioread32(wil->csr + HOST_MBOX +
+                                   offsetof(struct wil6210_mbox_ctl, rx.head));
+                if (r->tail == r->head)
+                        return;
+
+                /* read cmd from tail */
+                wil_memcpy_fromio_32(&d_tail, wil->csr + HOSTADDR(r->tail),
+                                     sizeof(struct wil6210_mbox_ring_desc));
+                if (d_tail.sync == 0) {
+                        wil_err(wil, "Mbox evt not owned by FW?\n");
+                        return;
+                }
+
+                if (0 != wmi_read_hdr(wil, d_tail.addr, &hdr)) {
+                        wil_err(wil, "Mbox evt at 0x%08x?\n",
+                                le32_to_cpu(d_tail.addr));
+                        return;
+                }
+
+                len = le16_to_cpu(hdr.len);
+                src = wmi_buffer(wil, d_tail.addr) +
+                      sizeof(struct wil6210_mbox_hdr);
+                evt = kmalloc(ALIGN(offsetof(struct pending_wmi_event,
+                                             event.wmi) + len, 4),
+                              GFP_KERNEL);
+                if (!evt) {
+                        wil_err(wil, "kmalloc for WMI event (%d) failed\n",
+                                len);
+                        return;
+                }
+                evt->event.hdr = hdr;
+                cmd = (void *)&evt->event.wmi;
+                wil_memcpy_fromio_32(cmd, src, len);
+                /* mark entry as empty */
+                iowrite32(0, wil->csr + HOSTADDR(r->tail) +
+                          offsetof(struct wil6210_mbox_ring_desc, sync));
+                /* indicate */
+                wil_dbg_WMI(wil, "Mbox evt %04x %04x %04x %02x\n",
+                            le16_to_cpu(hdr.seq), len, le16_to_cpu(hdr.type),
+                            hdr.flags);
+                if ((hdr.type == WIL_MBOX_HDR_TYPE_WMI) &&
+                    (len >= sizeof(struct wil6210_mbox_hdr_wmi))) {
+                        wil_dbg_WMI(wil, "WMI event 0x%04x\n",
+                                    evt->event.wmi.id);
+                }
+                wil_hex_dump_WMI("evt ", DUMP_PREFIX_OFFSET, 16, 1,
+                                 &evt->event.hdr, sizeof(hdr) + len, true);
+
+                /* advance tail */
+                r->tail = r->base + ((r->tail - r->base +
+                          sizeof(struct wil6210_mbox_ring_desc)) % r->size);
+                iowrite32(r->tail, wil->csr + HOST_MBOX +
+                          offsetof(struct wil6210_mbox_ctl, rx.tail));
+
+                /* add to the pending list */
+                spin_lock_irqsave(&wil->wmi_ev_lock, flags);
+                list_add_tail(&evt->list, &wil->pending_wmi_ev);
+                spin_unlock_irqrestore(&wil->wmi_ev_lock, flags);
+                {
+                        int q = queue_work(wil->wmi_wq,
+                                           &wil->wmi_event_worker);
+                        wil_dbg_WMI(wil, "queue_work -> %d\n", q);
+                }
+        }
+}
+
+int wmi_call(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len,
+             u16 reply_id, void *reply, u8 reply_size, int to_msec)
+{
+        int rc;
+        int remain;
+
+        mutex_lock(&wil->wmi_mutex);
+
+        rc = __wmi_send(wil, cmdid, buf, len);
+        if (rc)
+                goto out;
+
+        wil->reply_id = reply_id;
+        wil->reply_buf = reply;
+        wil->reply_size = reply_size;
+        remain = wait_for_completion_timeout(&wil->wmi_ready,
+                        msecs_to_jiffies(to_msec));
+        if (0 == remain) {
+                wil_err(wil, "wmi_call(0x%04x->0x%04x) timeout %d msec\n",
+                        cmdid, reply_id, to_msec);
+                rc = -ETIME;
+        } else {
+                wil_dbg_WMI(wil,
+                            "wmi_call(0x%04x->0x%04x) completed in %d msec\n",
+                            cmdid, reply_id,
+                            to_msec - jiffies_to_msecs(remain));
+        }
+        wil->reply_id = 0;
+        wil->reply_buf = NULL;
+        wil->reply_size = 0;
+ out:
+        mutex_unlock(&wil->wmi_mutex);
+
+        return rc;
+}
+
+int wmi_echo(struct wil6210_priv *wil)
+{
+        struct wmi_echo_cmd cmd = {
+                .value = cpu_to_le32(0x12345678),
+        };
+
+        return wmi_call(wil, WMI_ECHO_CMDID, &cmd, sizeof(cmd),
+                         WMI_ECHO_RSP_EVENTID, NULL, 0, 20);
+}
+
+int wmi_set_mac_address(struct wil6210_priv *wil, void *addr)
+{
+        struct wmi_set_mac_address_cmd cmd;
+
+        memcpy(cmd.mac, addr, ETH_ALEN);
+
+        wil_dbg_WMI(wil, "Set MAC %pM\n", addr);
+
+        return wmi_send(wil, WMI_SET_MAC_ADDRESS_CMDID, &cmd, sizeof(cmd));
+}
+
+int wmi_set_bcon(struct wil6210_priv *wil, int bi, u8 wmi_nettype)
+{
+        struct wmi_bcon_ctrl_cmd cmd = {
+                .bcon_interval = cpu_to_le16(bi),
+                .network_type = wmi_nettype,
+                .disable_sec_offload = 1,
+        };
+
+        if (!wil->secure_pcp)
+                cmd.disable_sec = 1;
+
+        return wmi_send(wil, WMI_BCON_CTRL_CMDID, &cmd, sizeof(cmd));
+}
+
+int wmi_set_ssid(struct wil6210_priv *wil, u8 ssid_len, const void *ssid)
+{
+        struct wmi_set_ssid_cmd cmd = {
+                .ssid_len = cpu_to_le32(ssid_len),
+        };
+
+        if (ssid_len > sizeof(cmd.ssid))
+                return -EINVAL;
+
+        memcpy(cmd.ssid, ssid, ssid_len);
+
+        return wmi_send(wil, WMI_SET_SSID_CMDID, &cmd, sizeof(cmd));
+}
+
+int wmi_get_ssid(struct wil6210_priv *wil, u8 *ssid_len, void *ssid)
+{
+        int rc;
+        struct {
+                struct wil6210_mbox_hdr_wmi wmi;
+                struct wmi_set_ssid_cmd cmd;
+        } __packed reply;
+        int len; /* reply.cmd.ssid_len in CPU order */
+
+        rc = wmi_call(wil, WMI_GET_SSID_CMDID, NULL, 0, WMI_GET_SSID_EVENTID,
+                      &reply, sizeof(reply), 20);
+        if (rc)
+                return rc;
+
+        len = le32_to_cpu(reply.cmd.ssid_len);
+        if (len > sizeof(reply.cmd.ssid))
+                return -EINVAL;
+
+        *ssid_len = len;
+        memcpy(ssid, reply.cmd.ssid, len);
+
+        return 0;
+}
+
+int wmi_set_channel(struct wil6210_priv *wil, int channel)
+{
+        struct wmi_set_pcp_channel_cmd cmd = {
+                .channel = channel - 1,
+        };
+
+        return wmi_send(wil, WMI_SET_PCP_CHANNEL_CMDID, &cmd, sizeof(cmd));
+}
+
+int wmi_get_channel(struct wil6210_priv *wil, int *channel)
+{
+        int rc;
+        struct {
+                struct wil6210_mbox_hdr_wmi wmi;
+                struct wmi_set_pcp_channel_cmd cmd;
+        } __packed reply;
+
+        rc = wmi_call(wil, WMI_GET_PCP_CHANNEL_CMDID, NULL, 0,
+                      WMI_GET_PCP_CHANNEL_EVENTID, &reply, sizeof(reply), 20);
+        if (rc)
+                return rc;
+
+        if (reply.cmd.channel > 3)
+                return -EINVAL;
+
+        *channel = reply.cmd.channel + 1;
+
+        return 0;
+}
+
+int wmi_tx_eapol(struct wil6210_priv *wil, struct sk_buff *skb)
+{
+        struct wmi_eapol_tx_cmd *cmd;
+        struct ethhdr *eth;
+        u16 eapol_len = skb->len - ETH_HLEN;
+        void *eapol = skb->data + ETH_HLEN;
+        uint i;
+        int rc;
+
+        skb_set_mac_header(skb, 0);
+        eth = eth_hdr(skb);
+        wil_dbg_WMI(wil, "EAPOL %d bytes to %pM\n", eapol_len, eth->h_dest);
+        for (i = 0; i < ARRAY_SIZE(wil->vring_tx); i++) {
+                if (memcmp(wil->dst_addr[i], eth->h_dest, ETH_ALEN) == 0)
+                        goto found_dest;
+        }
+
+        return -EINVAL;
+
+ found_dest:
+        /* find out eapol data & len */
+        cmd = kzalloc(sizeof(*cmd) + eapol_len, GFP_KERNEL);
+        if (!cmd)
+                return -EINVAL;
+
+        memcpy(cmd->dst_mac, eth->h_dest, ETH_ALEN);
+        cmd->eapol_len = cpu_to_le16(eapol_len);
+        memcpy(cmd->eapol, eapol, eapol_len);
+        rc = wmi_send(wil, WMI_EAPOL_TX_CMDID, cmd, sizeof(*cmd) + eapol_len);
+        kfree(cmd);
+
+        return rc;
+}
+
+int wmi_del_cipher_key(struct wil6210_priv *wil, u8 key_index,
+                       const void *mac_addr)
+{
+        struct wmi_delete_cipher_key_cmd cmd = {
+                .key_index = key_index,
+        };
+
+        if (mac_addr)
+                memcpy(cmd.mac, mac_addr, WMI_MAC_LEN);
+
+        return wmi_send(wil, WMI_DELETE_CIPHER_KEY_CMDID, &cmd, sizeof(cmd));
+}
+
+int wmi_add_cipher_key(struct wil6210_priv *wil, u8 key_index,
+                       const void *mac_addr, int key_len, const void *key)
+{
+        struct wmi_add_cipher_key_cmd cmd = {
+                .key_index = key_index,
+                .key_usage = WMI_KEY_USE_PAIRWISE,
+                .key_len = key_len,
+        };
+
+        if (!key || (key_len > sizeof(cmd.key)))
+                return -EINVAL;
+
+        memcpy(cmd.key, key, key_len);
+        if (mac_addr)
+                memcpy(cmd.mac, mac_addr, WMI_MAC_LEN);
+
+        return wmi_send(wil, WMI_ADD_CIPHER_KEY_CMDID, &cmd, sizeof(cmd));
+}
+
+int wmi_set_ie(struct wil6210_priv *wil, u8 type, u16 ie_len, const void *ie)
+{
+        int rc;
+        u16 len = sizeof(struct wmi_set_appie_cmd) + ie_len;
+        struct wmi_set_appie_cmd *cmd = kzalloc(len, GFP_KERNEL);
+        if (!cmd) {
+                wil_err(wil, "kmalloc(%d) failed\n", len);
+                return -ENOMEM;
+        }
+
+        cmd->mgmt_frm_type = type;
+        /* BUG: FW API define ieLen as u8. Will fix FW */
+        cmd->ie_len = cpu_to_le16(ie_len);
+        memcpy(cmd->ie_info, ie, ie_len);
+        rc = wmi_send(wil, WMI_SET_APPIE_CMDID, &cmd, len);
+        kfree(cmd);
+
+        return rc;
+}
+
+void wmi_event_flush(struct wil6210_priv *wil)
+{
+        struct pending_wmi_event *evt, *t;
+
+        wil_dbg_WMI(wil, "%s()\n", __func__);
+
+        list_for_each_entry_safe(evt, t, &wil->pending_wmi_ev, list) {
+                list_del(&evt->list);
+                kfree(evt);
+        }
+}
+
+static bool wmi_evt_call_handler(struct wil6210_priv *wil, int id,
+                                 void *d, int len)
+{
+        uint i;
+
+        for (i = 0; i < ARRAY_SIZE(wmi_evt_handlers); i++) {
+                if (wmi_evt_handlers[i].eventid == id) {
+                        wmi_evt_handlers[i].handler(wil, id, d, len);
+                        return true;
+                }
+        }
+
+        return false;
+}
+
+static void wmi_event_handle(struct wil6210_priv *wil,
+                             struct wil6210_mbox_hdr *hdr)
+{
+        u16 len = le16_to_cpu(hdr->len);
+
+        if ((hdr->type == WIL_MBOX_HDR_TYPE_WMI) &&
+            (len >= sizeof(struct wil6210_mbox_hdr_wmi))) {
+                struct wil6210_mbox_hdr_wmi *wmi = (void *)(&hdr[1]);
+                void *evt_data = (void *)(&wmi[1]);
+                u16 id = le16_to_cpu(wmi->id);
+                /* check if someone waits for this event */
+                if (wil->reply_id && wil->reply_id == id) {
+                        if (wil->reply_buf) {
+                                memcpy(wil->reply_buf, wmi,
+                                       min(len, wil->reply_size));
+                        } else {
+                                wmi_evt_call_handler(wil, id, evt_data,
+                                                     len - sizeof(*wmi));
+                        }
+                        wil_dbg_WMI(wil, "Complete WMI 0x%04x\n", id);
+                        complete(&wil->wmi_ready);
+                        return;
+                }
+                /* unsolicited event */
+                /* search for handler */
+                if (!wmi_evt_call_handler(wil, id, evt_data,
+                                          len - sizeof(*wmi))) {
+                        wil_err(wil, "Unhandled event 0x%04x\n", id);
+                }
+        } else {
+                wil_err(wil, "Unknown event type\n");
+                print_hex_dump(KERN_ERR, "evt?? ", DUMP_PREFIX_OFFSET, 16, 1,
+                               hdr, sizeof(*hdr) + len, true);
+        }
+}
+
+/*
+ * Retrieve next WMI event from the pending list
+ */
+static struct list_head *next_wmi_ev(struct wil6210_priv *wil)
+{
+        ulong flags;
+        struct list_head *ret = NULL;
+
+        spin_lock_irqsave(&wil->wmi_ev_lock, flags);
+
+        if (!list_empty(&wil->pending_wmi_ev)) {
+                ret = wil->pending_wmi_ev.next;
+                list_del(ret);
+        }
+
+        spin_unlock_irqrestore(&wil->wmi_ev_lock, flags);
+
+        return ret;
+}
+
+/*
+ * Handler for the WMI events
+ */
+void wmi_event_worker(struct work_struct *work)
+{
+        struct wil6210_priv *wil = container_of(work, struct wil6210_priv,
+                                                 wmi_event_worker);
+        struct pending_wmi_event *evt;
+        struct list_head *lh;
+
+        while ((lh = next_wmi_ev(wil)) != NULL) {
+                evt = list_entry(lh, struct pending_wmi_event, list);
+                wmi_event_handle(wil, &evt->event.hdr);
+                kfree(evt);
+        }
+}
+
+void wmi_connect_worker(struct work_struct *work)
+{
+        int rc;
+        struct wil6210_priv *wil = container_of(work, struct wil6210_priv,
+                                                wmi_connect_worker);
+
+        if (wil->pending_connect_cid < 0) {
+                wil_err(wil, "No connection pending\n");
+                return;
+        }
+
+        wil_dbg_WMI(wil, "Configure for connection CID %d\n",
+                    wil->pending_connect_cid);
+
+        rc = wil_vring_init_tx(wil, 0, WIL6210_TX_RING_SIZE,
+                               wil->pending_connect_cid, 0);
+        wil->pending_connect_cid = -1;
+        if (rc == 0)
+                wil_link_on(wil);
+}
diff --git a/drivers/net/wireless/ath/wil6210/wmi.h b/drivers/net/wireless/ath/wil6210/wmi.h
new file mode 100644
index 000000000000..3bbf87572b07
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/wmi.h
@@ -0,0 +1,1116 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ * Copyright (c) 2006-2012 Wilocity .
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * This file contains the definitions of the WMI protocol specified in the
+ * Wireless Module Interface (WMI) for the Wilocity
+ * MARLON 60 Gigabit wireless solution.
+ * It includes definitions of all the commands and events.
+ * Commands are messages from the host to the WM.
+ * Events are messages from the WM to the host.
+ */
+
+#ifndef __WILOCITY_WMI_H__
+#define __WILOCITY_WMI_H__
+
+/* General */
+
+#define WMI_MAC_LEN             (6)
+#define WMI_PROX_RANGE_NUM      (3)
+
+/* List of Commands */
+enum wmi_command_id {
+        WMI_CONNECT_CMDID               = 0x0001,
+        WMI_DISCONNECT_CMDID            = 0x0003,
+        WMI_START_SCAN_CMDID            = 0x0007,
+        WMI_SET_BSS_FILTER_CMDID        = 0x0009,
+        WMI_SET_PROBED_SSID_CMDID       = 0x000a,
+        WMI_SET_LISTEN_INT_CMDID        = 0x000b,
+        WMI_BCON_CTRL_CMDID             = 0x000f,
+        WMI_ADD_CIPHER_KEY_CMDID        = 0x0016,
+        WMI_DELETE_CIPHER_KEY_CMDID     = 0x0017,
+        WMI_SET_APPIE_CMDID             = 0x003f,
+        WMI_GET_APPIE_CMDID             = 0x0040,
+        WMI_SET_WSC_STATUS_CMDID        = 0x0041,
+        WMI_PXMT_RANGE_CFG_CMDID        = 0x0042,
+        WMI_PXMT_SNR2_RANGE_CFG_CMDID   = 0x0043,
+        WMI_FAST_MEM_ACC_MODE_CMDID     = 0x0300,
+        WMI_MEM_READ_CMDID              = 0x0800,
+        WMI_MEM_WR_CMDID                = 0x0801,
+        WMI_ECHO_CMDID                  = 0x0803,
+        WMI_DEEP_ECHO_CMDID             = 0x0804,
+        WMI_CONFIG_MAC_CMDID            = 0x0805,
+        WMI_CONFIG_PHY_DEBUG_CMDID      = 0x0806,
+        WMI_ADD_STATION_CMDID           = 0x0807,
+        WMI_ADD_DEBUG_TX_PCKT_CMDID     = 0x0808,
+        WMI_PHY_GET_STATISTICS_CMDID    = 0x0809,
+        WMI_FS_TUNE_CMDID               = 0x080a,
+        WMI_CORR_MEASURE_CMDID          = 0x080b,
+        WMI_TEMP_SENSE_CMDID            = 0x080e,
+        WMI_DC_CALIB_CMDID              = 0x080f,
+        WMI_SEND_TONE_CMDID             = 0x0810,
+        WMI_IQ_TX_CALIB_CMDID           = 0x0811,
+        WMI_IQ_RX_CALIB_CMDID           = 0x0812,
+        WMI_SET_UCODE_IDLE_CMDID        = 0x0813,
+        WMI_SET_WORK_MODE_CMDID         = 0x0815,
+        WMI_LO_LEAKAGE_CALIB_CMDID      = 0x0816,
+        WMI_MARLON_R_ACTIVATE_CMDID     = 0x0817,
+        WMI_MARLON_R_READ_CMDID         = 0x0818,
+        WMI_MARLON_R_WRITE_CMDID        = 0x0819,
+        WMI_MARLON_R_TXRX_SEL_CMDID     = 0x081a,
+        MAC_IO_STATIC_PARAMS_CMDID      = 0x081b,
+        MAC_IO_DYNAMIC_PARAMS_CMDID     = 0x081c,
+        WMI_SILENT_RSSI_CALIB_CMDID     = 0x081d,
+        WMI_CFG_RX_CHAIN_CMDID          = 0x0820,
+        WMI_VRING_CFG_CMDID             = 0x0821,
+        WMI_RX_ON_CMDID                 = 0x0822,
+        WMI_VRING_BA_EN_CMDID           = 0x0823,
+        WMI_VRING_BA_DIS_CMDID          = 0x0824,
+        WMI_RCP_ADDBA_RESP_CMDID        = 0x0825,
+        WMI_RCP_DELBA_CMDID             = 0x0826,
+        WMI_SET_SSID_CMDID              = 0x0827,
+        WMI_GET_SSID_CMDID              = 0x0828,
+        WMI_SET_PCP_CHANNEL_CMDID       = 0x0829,
+        WMI_GET_PCP_CHANNEL_CMDID       = 0x082a,
+        WMI_SW_TX_REQ_CMDID             = 0x082b,
+        WMI_RX_OFF_CMDID                = 0x082c,
+        WMI_READ_MAC_RXQ_CMDID          = 0x0830,
+        WMI_READ_MAC_TXQ_CMDID          = 0x0831,
+        WMI_WRITE_MAC_RXQ_CMDID         = 0x0832,
+        WMI_WRITE_MAC_TXQ_CMDID         = 0x0833,
+        WMI_WRITE_MAC_XQ_FIELD_CMDID    = 0x0834,
+        WMI_MLME_PUSH_CMDID             = 0x0835,
+        WMI_BEAMFORMING_MGMT_CMDID      = 0x0836,
+        WMI_BF_TXSS_MGMT_CMDID          = 0x0837,
+        WMI_BF_SM_MGMT_CMDID            = 0x0838,
+        WMI_BF_RXSS_MGMT_CMDID          = 0x0839,
+        WMI_SET_SECTORS_CMDID           = 0x0849,
+        WMI_MAINTAIN_PAUSE_CMDID        = 0x0850,
+        WMI_MAINTAIN_RESUME_CMDID       = 0x0851,
+        WMI_RS_MGMT_CMDID               = 0x0852,
+        WMI_RF_MGMT_CMDID               = 0x0853,
+        /* Performance monitoring commands */
+        WMI_BF_CTRL_CMDID               = 0x0862,
+        WMI_NOTIFY_REQ_CMDID            = 0x0863,
+        WMI_GET_STATUS_CMDID            = 0x0864,
+        WMI_UNIT_TEST_CMDID             = 0x0900,
+        WMI_HICCUP_CMDID                = 0x0901,
+        WMI_FLASH_READ_CMDID            = 0x0902,
+        WMI_FLASH_WRITE_CMDID           = 0x0903,
+        WMI_SECURITY_UNIT_TEST_CMDID    = 0x0904,
+
+        WMI_SET_MAC_ADDRESS_CMDID       = 0xf003,
+        WMI_ABORT_SCAN_CMDID            = 0xf007,
+        WMI_SET_PMK_CMDID               = 0xf028,
+
+        WMI_SET_PROMISCUOUS_MODE_CMDID  = 0xf041,
+        WMI_GET_PMK_CMDID               = 0xf048,
+        WMI_SET_PASSPHRASE_CMDID        = 0xf049,
+        WMI_SEND_ASSOC_RES_CMDID        = 0xf04a,
+        WMI_SET_ASSOC_REQ_RELAY_CMDID   = 0xf04b,
+        WMI_EAPOL_TX_CMDID              = 0xf04c,
+        WMI_MAC_ADDR_REQ_CMDID          = 0xf04d,
+        WMI_FW_VER_CMDID                = 0xf04e,
+};
+
+/*
+ * Commands data structures
+ */
+
+/*
+ * Frame Types
+ */
+enum wmi_mgmt_frame_type {
+        WMI_FRAME_BEACON        = 0,
+        WMI_FRAME_PROBE_REQ     = 1,
+        WMI_FRAME_PROBE_RESP    = 2,
+        WMI_FRAME_ASSOC_REQ     = 3,
+        WMI_FRAME_ASSOC_RESP    = 4,
+        WMI_NUM_MGMT_FRAME,
+};
+
+/*
+ * WMI_CONNECT_CMDID
+ */
+enum wmi_network_type {
+        WMI_NETTYPE_INFRA               = 0x01,
+        WMI_NETTYPE_ADHOC               = 0x02,
+        WMI_NETTYPE_ADHOC_CREATOR       = 0x04,
+        WMI_NETTYPE_AP                  = 0x10,
+        WMI_NETTYPE_P2P                 = 0x20,
+        WMI_NETTYPE_WBE                 = 0x40, /* PCIE over 60g */
+};
+
+enum wmi_dot11_auth_mode {
+        WMI_AUTH11_OPEN                 = 0x01,
+        WMI_AUTH11_SHARED               = 0x02,
+        WMI_AUTH11_LEAP                 = 0x04,
+        WMI_AUTH11_WSC                  = 0x08,
+};
+
+enum wmi_auth_mode {
+        WMI_AUTH_NONE                   = 0x01,
+        WMI_AUTH_WPA                    = 0x02,
+        WMI_AUTH_WPA2                   = 0x04,
+        WMI_AUTH_WPA_PSK                = 0x08,
+        WMI_AUTH_WPA2_PSK               = 0x10,
+        WMI_AUTH_WPA_CCKM               = 0x20,
+        WMI_AUTH_WPA2_CCKM              = 0x40,
+};
+
+enum wmi_crypto_type {
+        WMI_CRYPT_NONE                  = 0x01,
+        WMI_CRYPT_WEP                   = 0x02,
+        WMI_CRYPT_TKIP                  = 0x04,
+        WMI_CRYPT_AES                   = 0x08,
+        WMI_CRYPT_AES_GCMP              = 0x20,
+};
+
+
+enum wmi_connect_ctrl_flag_bits {
+        WMI_CONNECT_ASSOC_POLICY_USER           = 0x0001,
+        WMI_CONNECT_SEND_REASSOC                = 0x0002,
+        WMI_CONNECT_IGNORE_WPAx_GROUP_CIPHER    = 0x0004,
+        WMI_CONNECT_PROFILE_MATCH_DONE          = 0x0008,
+        WMI_CONNECT_IGNORE_AAC_BEACON           = 0x0010,
+        WMI_CONNECT_CSA_FOLLOW_BSS              = 0x0020,
+        WMI_CONNECT_DO_WPA_OFFLOAD              = 0x0040,
+        WMI_CONNECT_DO_NOT_DEAUTH               = 0x0080,
+};
+
+#define WMI_MAX_SSID_LEN    (32)
+
+struct wmi_connect_cmd {
+        u8 network_type;
+        u8 dot11_auth_mode;
+        u8 auth_mode;
+        u8 pairwise_crypto_type;
+        u8 pairwise_crypto_len;
+        u8 group_crypto_type;
+        u8 group_crypto_len;
+        u8 ssid_len;
+        u8 ssid[WMI_MAX_SSID_LEN];
+        u8 channel;
+        u8 reserved0;
+        u8 bssid[WMI_MAC_LEN];
+        __le32 ctrl_flags;
+        u8 dst_mac[WMI_MAC_LEN];
+        u8 reserved1[2];
+} __packed;
+
+
+/*
+ * WMI_RECONNECT_CMDID
+ */
+struct wmi_reconnect_cmd {
+        u8 channel;                     /* hint */
+        u8 reserved;
+        u8 bssid[WMI_MAC_LEN];          /* mandatory if set */
+} __packed;
+
+
+/*
+ * WMI_SET_PMK_CMDID
+ */
+
+#define WMI_MIN_KEY_INDEX       (0)
+#define WMI_MAX_KEY_INDEX       (3)
+#define WMI_MAX_KEY_LEN         (32)
+#define WMI_PASSPHRASE_LEN      (64)
+#define WMI_PMK_LEN             (32)
+
+struct  wmi_set_pmk_cmd {
+        u8 pmk[WMI_PMK_LEN];
+} __packed;
+
+
+/*
+ * WMI_SET_PASSPHRASE_CMDID
+ */
+struct wmi_set_passphrase_cmd {
+        u8 ssid[WMI_MAX_SSID_LEN];
+        u8 passphrase[WMI_PASSPHRASE_LEN];
+        u8 ssid_len;
+        u8 passphrase_len;
+} __packed;
+
+/*
+ * WMI_ADD_CIPHER_KEY_CMDID
+ */
+enum wmi_key_usage {
+        WMI_KEY_USE_PAIRWISE    = 0,
+        WMI_KEY_USE_GROUP       = 1,
+        WMI_KEY_USE_TX          = 2,  /* default Tx Key - Static WEP only */
+};
+
+struct wmi_add_cipher_key_cmd {
+        u8 key_index;
+        u8 key_type;
+        u8 key_usage;           /* enum wmi_key_usage */
+        u8 key_len;
+        u8 key_rsc[8];          /* key replay sequence counter */
+        u8 key[WMI_MAX_KEY_LEN];
+        u8 key_op_ctrl;         /* Additional Key Control information */
+        u8 mac[WMI_MAC_LEN];
+} __packed;
+
+/*
+ * WMI_DELETE_CIPHER_KEY_CMDID
+ */
+struct wmi_delete_cipher_key_cmd {
+        u8 key_index;
+        u8 mac[WMI_MAC_LEN];
+} __packed;
+
+
+/*
+ * WMI_START_SCAN_CMDID
+ *
+ * Start L1 scan operation
+ *
+ * Returned events:
+ * - WMI_RX_MGMT_PACKET_EVENTID - for every probe resp.
+ * - WMI_SCAN_COMPLETE_EVENTID
+ */
+enum wmi_scan_type {
+        WMI_LONG_SCAN           = 0,
+        WMI_SHORT_SCAN          = 1,
+};
+
+struct wmi_start_scan_cmd {
+        u8 reserved[8];
+        __le32 home_dwell_time; /* Max duration in the home channel(ms) */
+        __le32 force_scan_interval;     /* Time interval between scans (ms)*/
+        u8 scan_type;           /* wmi_scan_type */
+        u8 num_channels;                /* how many channels follow */
+        struct {
+                u8 channel;
+                u8 reserved;
+        } channel_list[0];      /* channels ID's */
+                                /* 0 - 58320 MHz */
+                                /* 1 - 60480 MHz */
+                                /* 2 - 62640 MHz */
+} __packed;
+
+/*
+ * WMI_SET_PROBED_SSID_CMDID
+ */
+#define MAX_PROBED_SSID_INDEX   (15)
+
+enum wmi_ssid_flag {
+        WMI_SSID_FLAG_DISABLE   = 0,    /* disables entry */
+        WMI_SSID_FLAG_SPECIFIC  = 1,    /* probes specified ssid */
+        WMI_SSID_FLAG_ANY       = 2,    /* probes for any ssid */
+};
+
+struct wmi_probed_ssid_cmd {
+        u8 entry_index;                 /* 0 to MAX_PROBED_SSID_INDEX */
+        u8 flag;                        /* enum wmi_ssid_flag */
+        u8 ssid_len;
+        u8 ssid[WMI_MAX_SSID_LEN];
+} __packed;
+
+/*
+ * WMI_SET_APPIE_CMDID
+ * Add Application specified IE to a management frame
+ */
+struct wmi_set_appie_cmd {
+        u8 mgmt_frm_type;       /* enum wmi_mgmt_frame_type */
+        u8 reserved;
+        __le16 ie_len;  /* Length of the IE to be added to MGMT frame */
+        u8 ie_info[0];
+} __packed;
+
+#define WMI_MAX_IE_LEN (1024)
+
+struct wmi_pxmt_range_cfg_cmd {
+        u8 dst_mac[WMI_MAC_LEN];
+        __le16 range;
+} __packed;
+
+struct wmi_pxmt_snr2_range_cfg_cmd {
+        s8 snr2range_arr[WMI_PROX_RANGE_NUM-1];
+} __packed;
+
+/*
+ * WMI_RF_MGMT_CMDID
+ */
+enum wmi_rf_mgmt_type {
+        WMI_RF_MGMT_W_DISABLE   = 0,
+        WMI_RF_MGMT_W_ENABLE    = 1,
+        WMI_RF_MGMT_GET_STATUS  = 2,
+};
+
+struct wmi_rf_mgmt_cmd {
+        __le32 rf_mgmt_type;
+} __packed;
+
+/*
+ * WMI_SET_SSID_CMDID
+ */
+struct wmi_set_ssid_cmd {
+        __le32 ssid_len;
+        u8 ssid[WMI_MAX_SSID_LEN];
+} __packed;
+
+/*
+ * WMI_SET_PCP_CHANNEL_CMDID
+ */
+struct wmi_set_pcp_channel_cmd {
+        u8 channel;
+        u8 reserved[3];
+} __packed;
+
+/*
+ * WMI_BCON_CTRL_CMDID
+ */
+struct wmi_bcon_ctrl_cmd {
+        __le16 bcon_interval;
+        __le16 frag_num;
+        __le64 ss_mask;
+        u8 network_type;
+        u8 reserved;
+        u8 disable_sec_offload;
+        u8 disable_sec;
+} __packed;
+
+/*
+ * WMI_SW_TX_REQ_CMDID
+ */
+struct wmi_sw_tx_req_cmd {
+        u8 dst_mac[WMI_MAC_LEN];
+        __le16 len;
+        u8 payload[0];
+} __packed;
+
+/*
+ * WMI_VRING_CFG_CMDID
+ */
+
+struct wmi_sw_ring_cfg {
+        __le64 ring_mem_base;
+        __le16 ring_size;
+        __le16 max_mpdu_size;
+} __packed;
+
+struct wmi_vring_cfg_schd {
+        __le16 priority;
+        __le16 timeslot_us;
+} __packed;
+
+enum wmi_vring_cfg_encap_trans_type {
+        WMI_VRING_ENC_TYPE_802_3                = 0,
+        WMI_VRING_ENC_TYPE_NATIVE_WIFI          = 1,
+};
+
+enum wmi_vring_cfg_ds_cfg {
+        WMI_VRING_DS_PBSS                       = 0,
+        WMI_VRING_DS_STATION                    = 1,
+        WMI_VRING_DS_AP                         = 2,
+        WMI_VRING_DS_ADDR4                      = 3,
+};
+
+enum wmi_vring_cfg_nwifi_ds_trans_type {
+        WMI_NWIFI_TX_TRANS_MODE_NO              = 0,
+        WMI_NWIFI_TX_TRANS_MODE_AP2PBSS         = 1,
+        WMI_NWIFI_TX_TRANS_MODE_STA2PBSS        = 2,
+};
+
+enum wmi_vring_cfg_schd_params_priority {
+        WMI_SCH_PRIO_REGULAR                    = 0,
+        WMI_SCH_PRIO_HIGH                       = 1,
+};
+
+struct wmi_vring_cfg {
+        struct wmi_sw_ring_cfg tx_sw_ring;
+        u8 ringid;                              /* 0-23 vrings */
+
+        #define CIDXTID_CID_POS (0)
+        #define CIDXTID_CID_LEN (4)
+        #define CIDXTID_CID_MSK (0xF)
+        #define CIDXTID_TID_POS (4)
+        #define CIDXTID_TID_LEN (4)
+        #define CIDXTID_TID_MSK (0xF0)
+        u8 cidxtid;
+
+        u8 encap_trans_type;
+        u8 ds_cfg;                              /* 802.3 DS cfg */
+        u8 nwifi_ds_trans_type;
+
+        #define VRING_CFG_MAC_CTRL_LIFETIME_EN_POS (0)
+        #define VRING_CFG_MAC_CTRL_LIFETIME_EN_LEN (1)
+        #define VRING_CFG_MAC_CTRL_LIFETIME_EN_MSK (0x1)
+        #define VRING_CFG_MAC_CTRL_AGGR_EN_POS (1)
+        #define VRING_CFG_MAC_CTRL_AGGR_EN_LEN (1)
+        #define VRING_CFG_MAC_CTRL_AGGR_EN_MSK (0x2)
+        u8 mac_ctrl;
+
+        #define VRING_CFG_TO_RESOLUTION_VALUE_POS (0)
+        #define VRING_CFG_TO_RESOLUTION_VALUE_LEN (6)
+        #define VRING_CFG_TO_RESOLUTION_VALUE_MSK (0x3F)
+        u8 to_resolution;
+        u8 agg_max_wsize;
+        struct wmi_vring_cfg_schd schd_params;
+} __packed;
+
+enum wmi_vring_cfg_cmd_action {
+        WMI_VRING_CMD_ADD                       = 0,
+        WMI_VRING_CMD_MODIFY                    = 1,
+        WMI_VRING_CMD_DELETE                    = 2,
+};
+
+struct wmi_vring_cfg_cmd {
+        __le32 action;
+        struct wmi_vring_cfg vring_cfg;
+} __packed;
+
+/*
+ * WMI_VRING_BA_EN_CMDID
+ */
+struct wmi_vring_ba_en_cmd {
+        u8 ringid;
+        u8 agg_max_wsize;
+        __le16 ba_timeout;
+} __packed;
+
+/*
+ * WMI_VRING_BA_DIS_CMDID
+ */
+struct wmi_vring_ba_dis_cmd {
+        u8 ringid;
+        u8 reserved;
+        __le16 reason;
+} __packed;
+
+/*
+ * WMI_NOTIFY_REQ_CMDID
+ */
+struct wmi_notify_req_cmd {
+        u8 cid;
+        u8 reserved[3];
+        __le32 interval_usec;
+} __packed;
+
+/*
+ * WMI_CFG_RX_CHAIN_CMDID
+ */
+enum wmi_sniffer_cfg_mode {
+        WMI_SNIFFER_OFF                         = 0,
+        WMI_SNIFFER_ON                          = 1,
+};
+
+enum wmi_sniffer_cfg_phy_info_mode {
+        WMI_SNIFFER_PHY_INFO_DISABLED           = 0,
+        WMI_SNIFFER_PHY_INFO_ENABLED            = 1,
+};
+
+enum wmi_sniffer_cfg_phy_support {
+        WMI_SNIFFER_CP                          = 0,
+        WMI_SNIFFER_DP                          = 1,
+        WMI_SNIFFER_BOTH_PHYS                   = 2,
+};
+
+struct wmi_sniffer_cfg {
+        __le32 mode;            /* enum wmi_sniffer_cfg_mode */
+        __le32 phy_info_mode;   /* enum wmi_sniffer_cfg_phy_info_mode */
+        __le32 phy_support;     /* enum wmi_sniffer_cfg_phy_support */
+        u8 channel;
+        u8 reserved[3];
+} __packed;
+
+enum wmi_cfg_rx_chain_cmd_action {
+        WMI_RX_CHAIN_ADD                        = 0,
+        WMI_RX_CHAIN_DEL                        = 1,
+};
+
+enum wmi_cfg_rx_chain_cmd_decap_trans_type {
+        WMI_DECAP_TYPE_802_3                    = 0,
+        WMI_DECAP_TYPE_NATIVE_WIFI              = 1,
+};
+
+enum wmi_cfg_rx_chain_cmd_nwifi_ds_trans_type {
+        WMI_NWIFI_RX_TRANS_MODE_NO              = 0,
+        WMI_NWIFI_RX_TRANS_MODE_PBSS2AP         = 1,
+        WMI_NWIFI_RX_TRANS_MODE_PBSS2STA        = 2,
+};
+
+struct wmi_cfg_rx_chain_cmd {
+        __le32 action;
+        struct wmi_sw_ring_cfg rx_sw_ring;
+        u8 mid;
+        u8 decap_trans_type;
+
+        #define L2_802_3_OFFLOAD_CTRL_VLAN_TAG_INSERTION_POS (0)
+        #define L2_802_3_OFFLOAD_CTRL_VLAN_TAG_INSERTION_LEN (1)
+        #define L2_802_3_OFFLOAD_CTRL_VLAN_TAG_INSERTION_MSK (0x1)
+        u8 l2_802_3_offload_ctrl;
+
+        #define L2_NWIFI_OFFLOAD_CTRL_REMOVE_QOS_POS (0)
+        #define L2_NWIFI_OFFLOAD_CTRL_REMOVE_QOS_LEN (1)
+        #define L2_NWIFI_OFFLOAD_CTRL_REMOVE_QOS_MSK (0x1)
+        #define L2_NWIFI_OFFLOAD_CTRL_REMOVE_PN_POS (1)
+        #define L2_NWIFI_OFFLOAD_CTRL_REMOVE_PN_LEN (1)
+        #define L2_NWIFI_OFFLOAD_CTRL_REMOVE_PN_MSK (0x2)
+        u8 l2_nwifi_offload_ctrl;
+
+        u8 vlan_id;
+        u8 nwifi_ds_trans_type;
+
+        #define L3_L4_CTRL_IPV4_CHECKSUM_EN_POS (0)
+        #define L3_L4_CTRL_IPV4_CHECKSUM_EN_LEN (1)
+        #define L3_L4_CTRL_IPV4_CHECKSUM_EN_MSK (0x1)
+        #define L3_L4_CTRL_TCPIP_CHECKSUM_EN_POS (1)
+        #define L3_L4_CTRL_TCPIP_CHECKSUM_EN_LEN (1)
+        #define L3_L4_CTRL_TCPIP_CHECKSUM_EN_MSK (0x2)
+        u8 l3_l4_ctrl;
+
+        #define RING_CTRL_OVERRIDE_PREFETCH_THRSH_POS (0)
+        #define RING_CTRL_OVERRIDE_PREFETCH_THRSH_LEN (1)
+        #define RING_CTRL_OVERRIDE_PREFETCH_THRSH_MSK (0x1)
+        #define RING_CTRL_OVERRIDE_WB_THRSH_POS (1)
+        #define RING_CTRL_OVERRIDE_WB_THRSH_LEN (1)
+        #define RING_CTRL_OVERRIDE_WB_THRSH_MSK (0x2)
+        #define RING_CTRL_OVERRIDE_ITR_THRSH_POS (2)
+        #define RING_CTRL_OVERRIDE_ITR_THRSH_LEN (1)
+        #define RING_CTRL_OVERRIDE_ITR_THRSH_MSK (0x4)
+        #define RING_CTRL_OVERRIDE_HOST_THRSH_POS (3)
+        #define RING_CTRL_OVERRIDE_HOST_THRSH_LEN (1)
+        #define RING_CTRL_OVERRIDE_HOST_THRSH_MSK (0x8)
+        u8 ring_ctrl;
+
+        __le16 prefetch_thrsh;
+        __le16 wb_thrsh;
+        __le32 itr_value;
+        __le16 host_thrsh;
+        u8 reserved[2];
+        struct wmi_sniffer_cfg sniffer_cfg;
+} __packed;
+
+/*
+ * WMI_RCP_ADDBA_RESP_CMDID
+ */
+struct wmi_rcp_addba_resp_cmd {
+
+        #define CIDXTID_CID_POS (0)
+        #define CIDXTID_CID_LEN (4)
+        #define CIDXTID_CID_MSK (0xF)
+        #define CIDXTID_TID_POS (4)
+        #define CIDXTID_TID_LEN (4)
+        #define CIDXTID_TID_MSK (0xF0)
+        u8 cidxtid;
+
+        u8 dialog_token;
+        __le16 status_code;
+        __le16 ba_param_set;    /* ieee80211_ba_parameterset field to send */
+        __le16 ba_timeout;
+} __packed;
+
+/*
+ * WMI_RCP_DELBA_CMDID
+ */
+struct wmi_rcp_delba_cmd {
+
+        #define CIDXTID_CID_POS (0)
+        #define CIDXTID_CID_LEN (4)
+        #define CIDXTID_CID_MSK (0xF)
+        #define CIDXTID_TID_POS (4)
+        #define CIDXTID_TID_LEN (4)
+        #define CIDXTID_TID_MSK (0xF0)
+        u8 cidxtid;
+
+        u8 reserved;
+        __le16 reason;
+} __packed;
+
+/*
+ * WMI_RCP_ADDBA_REQ_CMDID
+ */
+struct wmi_rcp_addba_req_cmd {
+
+        #define CIDXTID_CID_POS (0)
+        #define CIDXTID_CID_LEN (4)
+        #define CIDXTID_CID_MSK (0xF)
+        #define CIDXTID_TID_POS (4)
+        #define CIDXTID_TID_LEN (4)
+        #define CIDXTID_TID_MSK (0xF0)
+        u8 cidxtid;
+
+        u8 dialog_token;
+        /* ieee80211_ba_parameterset field as it received */
+        __le16 ba_param_set;
+        __le16 ba_timeout;
+        /* ieee80211_ba_seqstrl field as it received */
+        __le16 ba_seq_ctrl;
+} __packed;
+
+/*
+ * WMI_SET_MAC_ADDRESS_CMDID
+ */
+struct wmi_set_mac_address_cmd {
+        u8 mac[WMI_MAC_LEN];
+        u8 reserved[2];
+} __packed;
+
+
+/*
+* WMI_EAPOL_TX_CMDID
+*/
+struct wmi_eapol_tx_cmd {
+        u8 dst_mac[WMI_MAC_LEN];
+        __le16 eapol_len;
+        u8 eapol[0];
+} __packed;
+
+/*
+ * WMI_ECHO_CMDID
+ *
+ * Check FW is alive
+ *
+ * WMI_DEEP_ECHO_CMDID
+ *
+ * Check FW and ucode are alive
+ *
+ * Returned event: WMI_ECHO_RSP_EVENTID
+ * same event for both commands
+ */
+struct wmi_echo_cmd {
+        __le32 value;
+} __packed;
+
+/*
+ * WMI Events
+ */
+
+/*
+ * List of Events (target to host)
+ */
+enum wmi_event_id {
+        WMI_IMM_RSP_EVENTID                     = 0x0000,
+        WMI_READY_EVENTID                       = 0x1001,
+        WMI_CONNECT_EVENTID                     = 0x1002,
+        WMI_DISCONNECT_EVENTID                  = 0x1003,
+        WMI_SCAN_COMPLETE_EVENTID               = 0x100a,
+        WMI_REPORT_STATISTICS_EVENTID           = 0x100b,
+        WMI_RD_MEM_RSP_EVENTID                  = 0x1800,
+        WMI_FW_READY_EVENTID                    = 0x1801,
+        WMI_EXIT_FAST_MEM_ACC_MODE_EVENTID      = 0x0200,
+        WMI_ECHO_RSP_EVENTID                    = 0x1803,
+        WMI_CONFIG_MAC_DONE_EVENTID             = 0x1805,
+        WMI_CONFIG_PHY_DEBUG_DONE_EVENTID       = 0x1806,
+        WMI_ADD_STATION_DONE_EVENTID            = 0x1807,
+        WMI_ADD_DEBUG_TX_PCKT_DONE_EVENTID      = 0x1808,
+        WMI_PHY_GET_STATISTICS_EVENTID          = 0x1809,
+        WMI_FS_TUNE_DONE_EVENTID                = 0x180a,
+        WMI_CORR_MEASURE_DONE_EVENTID           = 0x180b,
+        WMI_TEMP_SENSE_DONE_EVENTID             = 0x180e,
+        WMI_DC_CALIB_DONE_EVENTID               = 0x180f,
+        WMI_IQ_TX_CALIB_DONE_EVENTID            = 0x1811,
+        WMI_IQ_RX_CALIB_DONE_EVENTID            = 0x1812,
+        WMI_SET_WORK_MODE_DONE_EVENTID          = 0x1815,
+        WMI_LO_LEAKAGE_CALIB_DONE_EVENTID       = 0x1816,
+        WMI_MARLON_R_ACTIVATE_DONE_EVENTID      = 0x1817,
+        WMI_MARLON_R_READ_DONE_EVENTID          = 0x1818,
+        WMI_MARLON_R_WRITE_DONE_EVENTID         = 0x1819,
+        WMI_MARLON_R_TXRX_SEL_DONE_EVENTID      = 0x181a,
+        WMI_SILENT_RSSI_CALIB_DONE_EVENTID      = 0x181d,
+
+        WMI_CFG_RX_CHAIN_DONE_EVENTID           = 0x1820,
+        WMI_VRING_CFG_DONE_EVENTID              = 0x1821,
+        WMI_RX_ON_DONE_EVENTID                  = 0x1822,
+        WMI_BA_STATUS_EVENTID                   = 0x1823,
+        WMI_RCP_ADDBA_REQ_EVENTID               = 0x1824,
+        WMI_ADDBA_RESP_SENT_EVENTID             = 0x1825,
+        WMI_DELBA_EVENTID                       = 0x1826,
+        WMI_GET_SSID_EVENTID                    = 0x1828,
+        WMI_GET_PCP_CHANNEL_EVENTID             = 0x182a,
+        WMI_SW_TX_COMPLETE_EVENTID              = 0x182b,
+        WMI_RX_OFF_DONE_EVENTID                 = 0x182c,
+
+        WMI_READ_MAC_RXQ_EVENTID                = 0x1830,
+        WMI_READ_MAC_TXQ_EVENTID                = 0x1831,
+        WMI_WRITE_MAC_RXQ_EVENTID               = 0x1832,
+        WMI_WRITE_MAC_TXQ_EVENTID               = 0x1833,
+        WMI_WRITE_MAC_XQ_FIELD_EVENTID          = 0x1834,
+
+        WMI_BEAFORMING_MGMT_DONE_EVENTID        = 0x1836,
+        WMI_BF_TXSS_MGMT_DONE_EVENTID           = 0x1837,
+        WMI_BF_RXSS_MGMT_DONE_EVENTID           = 0x1839,
+        WMI_RS_MGMT_DONE_EVENTID                = 0x1852,
+        WMI_RF_MGMT_STATUS_EVENTID              = 0x1853,
+        WMI_BF_SM_MGMT_DONE_EVENTID             = 0x1838,
+        WMI_RX_MGMT_PACKET_EVENTID              = 0x1840,
+
+        /* Performance monitoring events */
+        WMI_DATA_PORT_OPEN_EVENTID              = 0x1860,
+        WMI_WBE_LINKDOWN_EVENTID                = 0x1861,
+
+        WMI_BF_CTRL_DONE_EVENTID                = 0x1862,
+        WMI_NOTIFY_REQ_DONE_EVENTID             = 0x1863,
+        WMI_GET_STATUS_DONE_EVENTID             = 0x1864,
+
+        WMI_UNIT_TEST_EVENTID                   = 0x1900,
+        WMI_FLASH_READ_DONE_EVENTID             = 0x1902,
+        WMI_FLASH_WRITE_DONE_EVENTID            = 0x1903,
+
+        WMI_SET_CHANNEL_EVENTID                 = 0x9000,
+        WMI_ASSOC_REQ_EVENTID                   = 0x9001,
+        WMI_EAPOL_RX_EVENTID                    = 0x9002,
+        WMI_MAC_ADDR_RESP_EVENTID               = 0x9003,
+        WMI_FW_VER_EVENTID                      = 0x9004,
+};
+
+/*
+ * Events data structures
+ */
+
+/*
+ * WMI_RF_MGMT_STATUS_EVENTID
+ */
+enum wmi_rf_status {
+        WMI_RF_ENABLED                  = 0,
+        WMI_RF_DISABLED_HW              = 1,
+        WMI_RF_DISABLED_SW              = 2,
+        WMI_RF_DISABLED_HW_SW           = 3,
+};
+
+struct wmi_rf_mgmt_status_event {
+        __le32 rf_status;
+} __packed;
+
+/*
+ * WMI_GET_STATUS_DONE_EVENTID
+ */
+struct wmi_get_status_done_event {
+        __le32 is_associated;
+        u8 cid;
+        u8 reserved0[3];
+        u8 bssid[WMI_MAC_LEN];
+        u8 channel;
+        u8 reserved1;
+        u8 network_type;
+        u8 reserved2[3];
+        __le32 ssid_len;
+        u8 ssid[WMI_MAX_SSID_LEN];
+        __le32 rf_status;
+        __le32 is_secured;
+} __packed;
+
+/*
+ * WMI_FW_VER_EVENTID
+ */
+struct wmi_fw_ver_event {
+        u8 major;
+        u8 minor;
+        __le16 subminor;
+        __le16 build;
+} __packed;
+
+/*
+* WMI_MAC_ADDR_RESP_EVENTID
+*/
+struct wmi_mac_addr_resp_event {
+        u8 mac[WMI_MAC_LEN];
+        u8 auth_mode;
+        u8 crypt_mode;
+        __le32 offload_mode;
+} __packed;
+
+/*
+* WMI_EAPOL_RX_EVENTID
+*/
+struct wmi_eapol_rx_event {
+        u8 src_mac[WMI_MAC_LEN];
+        __le16 eapol_len;
+        u8 eapol[0];
+} __packed;
+
+/*
+* WMI_READY_EVENTID
+*/
+enum wmi_phy_capability {
+        WMI_11A_CAPABILITY              = 1,
+        WMI_11G_CAPABILITY              = 2,
+        WMI_11AG_CAPABILITY             = 3,
+        WMI_11NA_CAPABILITY             = 4,
+        WMI_11NG_CAPABILITY             = 5,
+        WMI_11NAG_CAPABILITY            = 6,
+        WMI_11AD_CAPABILITY             = 7,
+        WMI_11N_CAPABILITY_OFFSET = WMI_11NA_CAPABILITY - WMI_11A_CAPABILITY,
+};
+
+struct wmi_ready_event {
+        __le32 sw_version;
+        __le32 abi_version;
+        u8 mac[WMI_MAC_LEN];
+        u8 phy_capability;              /* enum wmi_phy_capability */
+        u8 reserved;
+} __packed;
+
+/*
+ * WMI_NOTIFY_REQ_DONE_EVENTID
+ */
+struct wmi_notify_req_done_event {
+        __le32 status;
+        __le64 tsf;
+        __le32 snr_val;
+        __le32 tx_tpt;
+        __le32 tx_goodput;
+        __le32 rx_goodput;
+        __le16 bf_mcs;
+        __le16 my_rx_sector;
+        __le16 my_tx_sector;
+        __le16 other_rx_sector;
+        __le16 other_tx_sector;
+        __le16 range;
+} __packed;
+
+/*
+ * WMI_CONNECT_EVENTID
+ */
+struct wmi_connect_event {
+        u8 channel;
+        u8 reserved0;
+        u8 bssid[WMI_MAC_LEN];
+        __le16 listen_interval;
+        __le16 beacon_interval;
+        u8 network_type;
+        u8 reserved1[3];
+        u8 beacon_ie_len;
+        u8 assoc_req_len;
+        u8 assoc_resp_len;
+        u8 cid;
+        u8 reserved2[3];
+        u8 assoc_info[0];
+} __packed;
+
+/*
+ * WMI_DISCONNECT_EVENTID
+ */
+enum wmi_disconnect_reason {
+        WMI_DIS_REASON_NO_NETWORK_AVAIL         = 1,
+        WMI_DIS_REASON_LOST_LINK                = 2, /* bmiss */
+        WMI_DIS_REASON_DISCONNECT_CMD           = 3,
+        WMI_DIS_REASON_BSS_DISCONNECTED         = 4,
+        WMI_DIS_REASON_AUTH_FAILED              = 5,
+        WMI_DIS_REASON_ASSOC_FAILED             = 6,
+        WMI_DIS_REASON_NO_RESOURCES_AVAIL       = 7,
+        WMI_DIS_REASON_CSERV_DISCONNECT         = 8,
+        WMI_DIS_REASON_INVALID_PROFILE          = 10,
+        WMI_DIS_REASON_DOT11H_CHANNEL_SWITCH    = 11,
+        WMI_DIS_REASON_PROFILE_MISMATCH         = 12,
+        WMI_DIS_REASON_CONNECTION_EVICTED       = 13,
+        WMI_DIS_REASON_IBSS_MERGE               = 14,
+};
+
+struct wmi_disconnect_event {
+        __le16 protocol_reason_status;  /* reason code, see 802.11 spec. */
+        u8 bssid[WMI_MAC_LEN];          /* set if known */
+        u8 disconnect_reason;           /* see wmi_disconnect_reason_e */
+        u8 assoc_resp_len;
+        u8 assoc_info[0];
+} __packed;
+
+/*
+ * WMI_SCAN_COMPLETE_EVENTID
+ */
+struct wmi_scan_complete_event {
+        __le32 status;
+} __packed;
+
+/*
+ * WMI_BA_STATUS_EVENTID
+ */
+enum wmi_vring_ba_status {
+        WMI_BA_AGREED                   = 0,
+        WMI_BA_NON_AGREED               = 1,
+};
+
+struct wmi_vring_ba_status_event {
+        __le16 status;
+        u8 reserved[2];
+        u8 ringid;
+        u8 agg_wsize;
+        __le16 ba_timeout;
+} __packed;
+
+/*
+ * WMI_DELBA_EVENTID
+ */
+struct wmi_delba_event {
+
+        #define CIDXTID_CID_POS (0)
+        #define CIDXTID_CID_LEN (4)
+        #define CIDXTID_CID_MSK (0xF)
+        #define CIDXTID_TID_POS (4)
+        #define CIDXTID_TID_LEN (4)
+        #define CIDXTID_TID_MSK (0xF0)
+        u8 cidxtid;
+
+        u8 from_initiator;
+        __le16 reason;
+} __packed;
+
+/*
+ * WMI_VRING_CFG_DONE_EVENTID
+ */
+enum wmi_vring_cfg_done_event_status {
+        WMI_VRING_CFG_SUCCESS           = 0,
+        WMI_VRING_CFG_FAILURE           = 1,
+};
+
+struct wmi_vring_cfg_done_event {
+        u8 ringid;
+        u8 status;
+        u8 reserved[2];
+        __le32 tx_vring_tail_ptr;
+} __packed;
+
+/*
+ * WMI_ADDBA_RESP_SENT_EVENTID
+ */
+enum wmi_rcp_addba_resp_sent_event_status {
+        WMI_ADDBA_SUCCESS               = 0,
+        WMI_ADDBA_FAIL                  = 1,
+};
+
+struct wmi_rcp_addba_resp_sent_event {
+
+        #define CIDXTID_CID_POS (0)
+        #define CIDXTID_CID_LEN (4)
+        #define CIDXTID_CID_MSK (0xF)
+        #define CIDXTID_TID_POS (4)
+        #define CIDXTID_TID_LEN (4)
+        #define CIDXTID_TID_MSK (0xF0)
+        u8 cidxtid;
+
+        u8 reserved;
+        __le16 status;
+} __packed;
+
+/*
+ * WMI_RCP_ADDBA_REQ_EVENTID
+ */
+struct wmi_rcp_addba_req_event {
+
+        #define CIDXTID_CID_POS (0)
+        #define CIDXTID_CID_LEN (4)
+        #define CIDXTID_CID_MSK (0xF)
+        #define CIDXTID_TID_POS (4)
+        #define CIDXTID_TID_LEN (4)
+        #define CIDXTID_TID_MSK (0xF0)
+        u8 cidxtid;
+
+        u8 dialog_token;
+        __le16 ba_param_set;    /* ieee80211_ba_parameterset as it received */
+        __le16 ba_timeout;
+        __le16 ba_seq_ctrl;     /* ieee80211_ba_seqstrl field as it received */
+} __packed;
+
+/*
+ * WMI_CFG_RX_CHAIN_DONE_EVENTID
+ */
+enum wmi_cfg_rx_chain_done_event_status {
+        WMI_CFG_RX_CHAIN_SUCCESS        = 1,
+};
+
+struct wmi_cfg_rx_chain_done_event {
+        __le32 rx_ring_tail_ptr;        /* Rx V-Ring Tail pointer */
+        __le32 status;
+} __packed;
+
+/*
+ * WMI_WBE_LINKDOWN_EVENTID
+ */
+enum wmi_wbe_link_down_event_reason {
+        WMI_WBE_REASON_USER_REQUEST     = 0,
+        WMI_WBE_REASON_RX_DISASSOC      = 1,
+        WMI_WBE_REASON_BAD_PHY_LINK     = 2,
+};
+
+struct wmi_wbe_link_down_event {
+        u8 cid;
+        u8 reserved[3];
+        __le32 reason;
+} __packed;
+
+/*
+ * WMI_DATA_PORT_OPEN_EVENTID
+ */
+struct wmi_data_port_open_event {
+        u8 cid;
+        u8 reserved[3];
+} __packed;
+
+/*
+ * WMI_GET_PCP_CHANNEL_EVENTID
+ */
+struct wmi_get_pcp_channel_event {
+        u8 channel;
+        u8 reserved[3];
+} __packed;
+
+/*
+ * WMI_SW_TX_COMPLETE_EVENTID
+ */
+enum wmi_sw_tx_status {
+        WMI_TX_SW_STATUS_SUCCESS                = 0,
+        WMI_TX_SW_STATUS_FAILED_NO_RESOURCES    = 1,
+        WMI_TX_SW_STATUS_FAILED_TX              = 2,
+};
+
+struct wmi_sw_tx_complete_event {
+        u8 status;      /* enum wmi_sw_tx_status */
+        u8 reserved[3];
+} __packed;
+
+/*
+ * WMI_GET_SSID_EVENTID
+ */
+struct wmi_get_ssid_event {
+        __le32 ssid_len;
+        u8 ssid[WMI_MAX_SSID_LEN];
+} __packed;
+
+/*
+ * WMI_RX_MGMT_PACKET_EVENTID
+ */
+struct wmi_rx_mgmt_info {
+        u8 mcs;
+        s8 snr;
+        __le16 range;
+        __le16 stype;
+        __le16 status;
+        __le32 len;
+        u8 qid;
+        u8 mid;
+        u8 cid;
+        u8 channel;     /* From Radio MNGR */
+} __packed;
+
+struct wmi_rx_mgmt_packet_event {
+        struct wmi_rx_mgmt_info info;
+        u8 payload[0];
+} __packed;
+
+/*
+ * WMI_ECHO_RSP_EVENTID
+ */
+struct wmi_echo_event {
+        __le32 echoed_value;
+} __packed;
+
+#endif /* __WILOCITY_WMI_H__ */
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index b298e5d68be2..10e288d470e7 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -7,6 +7,7 @@
 #include <linux/hw_random.h>
 #include <linux/bcma/bcma.h>
 #include <linux/ssb/ssb.h>
+#include <linux/completion.h>
 #include <net/mac80211.h>
 
 #include "debugfs.h"
@@ -722,6 +723,10 @@ enum b43_firmware_file_type {
 struct b43_request_fw_context {
         /* The device we are requesting the fw for. */
         struct b43_wldev *dev;
+        /* a completion event structure needed if this call is asynchronous */
+        struct completion fw_load_complete;
+        /* a pointer to the firmware object */
+        const struct firmware *blob;
         /* The type of firmware to request. */
         enum b43_firmware_file_type req_type;
         /* Error messages for each firmware type. */
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 16ab280359bd..806e34c19281 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -2088,11 +2088,18 @@ static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
                 b43warn(wl, text);
 }
 
+static void b43_fw_cb(const struct firmware *firmware, void *context)
+{
+        struct b43_request_fw_context *ctx = context;
+
+        ctx->blob = firmware;
+        complete(&ctx->fw_load_complete);
+}
+
 int b43_do_request_fw(struct b43_request_fw_context *ctx,
                       const char *name,
-                      struct b43_firmware_file *fw)
+                      struct b43_firmware_file *fw, bool async)
 {
-        const struct firmware *blob;
         struct b43_fw_header *hdr;
         u32 size;
         int err;
@@ -2131,11 +2138,31 @@ int b43_do_request_fw(struct b43_request_fw_context *ctx,
                 B43_WARN_ON(1);
                 return -ENOSYS;
         }
-        err = request_firmware(&blob, ctx->fwname, ctx->dev->dev->dev);
+        if (async) {
+                /* do this part asynchronously */
+                init_completion(&ctx->fw_load_complete);
+                err = request_firmware_nowait(THIS_MODULE, 1, ctx->fwname,
+                                              ctx->dev->dev->dev, GFP_KERNEL,
+                                              ctx, b43_fw_cb);
+                if (err < 0) {
+                        pr_err("Unable to load firmware\n");
+                        return err;
+                }
+                /* stall here until fw ready */
+                wait_for_completion(&ctx->fw_load_complete);
+                if (ctx->blob)
+                        goto fw_ready;
+        /* On some ARM systems, the async request will fail, but the next sync
+         * request works. For this reason, we dall through here
+         */
+        }
+        err = request_firmware(&ctx->blob, ctx->fwname,
+                               ctx->dev->dev->dev);
         if (err == -ENOENT) {
                 snprintf(ctx->errors[ctx->req_type],
                          sizeof(ctx->errors[ctx->req_type]),
-                         "Firmware file \"%s\" not found\n", ctx->fwname);
+                         "Firmware file \"%s\" not found\n",
+                         ctx->fwname);
                 return err;
         } else if (err) {
                 snprintf(ctx->errors[ctx->req_type],
@@ -2144,14 +2171,15 @@ int b43_do_request_fw(struct b43_request_fw_context *ctx,
                          ctx->fwname, err);
                 return err;
         }
-        if (blob->size < sizeof(struct b43_fw_header))
+fw_ready:
+        if (ctx->blob->size < sizeof(struct b43_fw_header))
                 goto err_format;
-        hdr = (struct b43_fw_header *)(blob->data);
+        hdr = (struct b43_fw_header *)(ctx->blob->data);
         switch (hdr->type) {
         case B43_FW_TYPE_UCODE:
         case B43_FW_TYPE_PCM:
                 size = be32_to_cpu(hdr->size);
-                if (size != blob->size - sizeof(struct b43_fw_header))
+                if (size != ctx->blob->size - sizeof(struct b43_fw_header))
                         goto err_format;
                 /* fallthrough */
         case B43_FW_TYPE_IV:
@@ -2162,7 +2190,7 @@ int b43_do_request_fw(struct b43_request_fw_context *ctx,
                 goto err_format;
         }
 
-        fw->data = blob;
+        fw->data = ctx->blob;
         fw->filename = name;
         fw->type = ctx->req_type;
 
@@ -2172,7 +2200,7 @@ err_format:
         snprintf(ctx->errors[ctx->req_type],
                  sizeof(ctx->errors[ctx->req_type]),
                  "Firmware file \"%s\" format error.\n", ctx->fwname);
-        release_firmware(blob);
+        release_firmware(ctx->blob);
 
         return -EPROTO;
 }
@@ -2223,7 +2251,7 @@ static int b43_try_request_fw(struct b43_request_fw_context *ctx)
                         goto err_no_ucode;
                 }
         }
-        err = b43_do_request_fw(ctx, filename, &fw->ucode);
+        err = b43_do_request_fw(ctx, filename, &fw->ucode, true);
         if (err)
                 goto err_load;
 
@@ -2235,7 +2263,7 @@ static int b43_try_request_fw(struct b43_request_fw_context *ctx)
         else
                 goto err_no_pcm;
         fw->pcm_request_failed = false;
-        err = b43_do_request_fw(ctx, filename, &fw->pcm);
+        err = b43_do_request_fw(ctx, filename, &fw->pcm, false);
         if (err == -ENOENT) {
                 /* We did not find a PCM file? Not fatal, but
                  * core rev <= 10 must do without hwcrypto then. */
@@ -2296,7 +2324,7 @@ static int b43_try_request_fw(struct b43_request_fw_context *ctx)
         default:
                 goto err_no_initvals;
         }
-        err = b43_do_request_fw(ctx, filename, &fw->initvals);
+        err = b43_do_request_fw(ctx, filename, &fw->initvals, false);
         if (err)
                 goto err_load;
 
@@ -2355,7 +2383,7 @@ static int b43_try_request_fw(struct b43_request_fw_context *ctx)
         default:
                 goto err_no_initvals;
         }
-        err = b43_do_request_fw(ctx, filename, &fw->initvals_band);
+        err = b43_do_request_fw(ctx, filename, &fw->initvals_band, false);
         if (err)
                 goto err_load;
 
diff --git a/drivers/net/wireless/b43/main.h b/drivers/net/wireless/b43/main.h
index 8c684cd33529..abac25ee958d 100644
--- a/drivers/net/wireless/b43/main.h
+++ b/drivers/net/wireless/b43/main.h
@@ -137,9 +137,8 @@ void b43_mac_phy_clock_set(struct b43_wldev *dev, bool on);
 
 
 struct b43_request_fw_context;
-int b43_do_request_fw(struct b43_request_fw_context *ctx,
-                      const char *name,
-                      struct b43_firmware_file *fw);
+int b43_do_request_fw(struct b43_request_fw_context *ctx, const char *name,
+                      struct b43_firmware_file *fw, bool async);
 void b43_do_release_fw(struct b43_firmware_file *fw);
 
 #endif /* B43_MAIN_H_ */
diff --git a/drivers/net/wireless/iwlegacy/3945-mac.c b/drivers/net/wireless/iwlegacy/3945-mac.c
index d604b4036a76..3726cd6fcd75 100644
--- a/drivers/net/wireless/iwlegacy/3945-mac.c
+++ b/drivers/net/wireless/iwlegacy/3945-mac.c
@@ -3273,7 +3273,7 @@ il3945_store_measurement(struct device *d, struct device_attribute *attr,
 
         if (count) {
                 char *p = buffer;
-                strncpy(buffer, buf, min(sizeof(buffer), count));
+                strlcpy(buffer, buf, sizeof(buffer));
                 channel = simple_strtoul(p, NULL, 0);
                 if (channel)
                         params.channel = channel;
diff --git a/drivers/net/wireless/iwlwifi/dvm/tx.c b/drivers/net/wireless/iwlwifi/dvm/tx.c
index da21328ca8ed..a790599fe2c2 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tx.c
@@ -1151,13 +1151,6 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb,
                         next_reclaimed = ssn;
                 }
 
-                if (tid != IWL_TID_NON_QOS) {
-                        priv->tid_data[sta_id][tid].next_reclaimed =
-                                next_reclaimed;
-                        IWL_DEBUG_TX_REPLY(priv, "Next reclaimed packet:%d\n",
-                                                  next_reclaimed);
-                }
-
                 iwl_trans_reclaim(priv->trans, txq_id, ssn, &skbs);
 
                 iwlagn_check_ratid_empty(priv, sta_id, tid);
@@ -1208,11 +1201,28 @@ int iwlagn_rx_reply_tx(struct iwl_priv *priv, struct iwl_rx_cmd_buffer *rxb,
                         if (!is_agg)
                                 iwlagn_non_agg_tx_status(priv, ctx, hdr->addr1);
 
+                        /*
+                         * W/A for FW bug - the seq_ctl isn't updated when the
+                         * queues are flushed. Fetch it from the packet itself
+                         */
+                        if (!is_agg && status == TX_STATUS_FAIL_FIFO_FLUSHED) {
+                                next_reclaimed = le16_to_cpu(hdr->seq_ctrl);
+                                next_reclaimed =
+                                        SEQ_TO_SN(next_reclaimed + 0x10);
+                        }
+
                         is_offchannel_skb =
                                 (info->flags & IEEE80211_TX_CTL_TX_OFFCHAN);
                         freed++;
                 }
 
+                if (tid != IWL_TID_NON_QOS) {
+                        priv->tid_data[sta_id][tid].next_reclaimed =
+                                next_reclaimed;
+                        IWL_DEBUG_TX_REPLY(priv, "Next reclaimed packet:%d\n",
+                                           next_reclaimed);
+                }
+
                 WARN_ON(!is_agg && freed != 1);
 
                 /*
diff --git a/drivers/net/wireless/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
index dad4c4aad91f..8389cd38338b 100644
--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -1166,6 +1166,7 @@ static irqreturn_t iwl_pcie_isr(int irq, void *data)
         else if (test_bit(STATUS_INT_ENABLED, &trans_pcie->status) &&
                  !trans_pcie->inta)
                 iwl_enable_interrupts(trans);
+        return IRQ_HANDLED;
 
 none:
         /* re-enable interrupts here since we don't have anything to service. */
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index a875499f8945..efe525be27dd 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -1709,7 +1709,7 @@ static int mwifiex_set_ibss_params(struct mwifiex_private *priv,
                                                 NL80211_CHAN_NO_HT)
                         config_bands |= BAND_GN;
         } else {
-                if (cfg80211_get_chandef_type(&params->chandef) !=
+                if (cfg80211_get_chandef_type(&params->chandef) ==
                                                 NL80211_CHAN_NO_HT)
                         config_bands = BAND_A;
                 else
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index cb682561c438..60e88b58039d 100644
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -56,7 +56,6 @@ int mwifiex_copy_mcast_addr(struct mwifiex_multicast_list *mlist,
  */
 int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter)
 {
-        bool cancel_flag = false;
         int status;
         struct cmd_ctrl_node *cmd_queued;
 
@@ -70,14 +69,11 @@ int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter)
         atomic_inc(&adapter->cmd_pending);
 
         /* Wait for completion */
-        wait_event_interruptible(adapter->cmd_wait_q.wait,
-                                 *(cmd_queued->condition));
-        if (!*(cmd_queued->condition))
-                cancel_flag = true;
-
-        if (cancel_flag) {
-                mwifiex_cancel_pending_ioctl(adapter);
-                dev_dbg(adapter->dev, "cmd cancel\n");
+        status = wait_event_interruptible(adapter->cmd_wait_q.wait,
+                                          *(cmd_queued->condition));
+        if (status) {
+                dev_err(adapter->dev, "cmd_wait_q terminated: %d\n", status);
+                return status;
         }
 
         status = adapter->cmd_wait_q.status;
@@ -496,8 +492,11 @@ int mwifiex_enable_hs(struct mwifiex_adapter *adapter)
                 return false;
         }
 
-        wait_event_interruptible(adapter->hs_activate_wait_q,
-                                 adapter->hs_activate_wait_q_woken);
+        if (wait_event_interruptible(adapter->hs_activate_wait_q,
+                                     adapter->hs_activate_wait_q_woken)) {
+                dev_err(adapter->dev, "hs_activate_wait_q terminated\n");
+                return false;
+        }
 
         return true;
 }
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index f221b95b90b3..83564d36e801 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -4250,9 +4250,11 @@ static int mwl8k_cmd_update_stadb_add(struct ieee80211_hw *hw,
         p->amsdu_enabled = 0;
 
         rc = mwl8k_post_cmd(hw, &cmd->header);
+        if (!rc)
+                rc = p->station_id;
         kfree(cmd);
 
-        return rc ? rc : p->station_id;
+        return rc;
 }
 
 static int mwl8k_cmd_update_stadb_del(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
index 1d5d3604e3e0..246e5352f2e1 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
@@ -692,7 +692,7 @@ u8 rtl92c_phy_sw_chnl(struct ieee80211_hw *hw)
         if (!(is_hal_stop(rtlhal)) && !(RT_CANNOT_IO(hw))) {
                 rtl92c_phy_sw_chnl_callback(hw);
                 RT_TRACE(rtlpriv, COMP_CHAN, DBG_LOUD,
-                         "sw_chnl_inprogress false schdule workitem\n");
+                         "sw_chnl_inprogress false schedule workitem\n");
                 rtlphy->sw_chnl_inprogress = false;
         } else {
                 RT_TRACE(rtlpriv, COMP_CHAN, DBG_LOUD,
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/phy.c b/drivers/net/wireless/rtlwifi/rtl8723ae/phy.c
index 39cc7938eedf..3d8536bb0d2b 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/phy.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/phy.c
@@ -1106,7 +1106,7 @@ u8 rtl8723ae_phy_sw_chnl(struct ieee80211_hw *hw)
         if (!(is_hal_stop(rtlhal)) && !(RT_CANNOT_IO(hw))) {
                 rtl8723ae_phy_sw_chnl_callback(hw);
                 RT_TRACE(rtlpriv, COMP_CHAN, DBG_LOUD,
-                         "sw_chnl_inprogress false schdule workitem\n");
+                         "sw_chnl_inprogress false schedule workitem\n");
                 rtlphy->sw_chnl_inprogress = false;
         } else {
                 RT_TRACE(rtlpriv, COMP_CHAN, DBG_LOUD,
diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c
index bafd2bbcaf65..c18e5bf444fa 100644
--- a/drivers/pci/iov.c
+++ b/drivers/pci/iov.c
@@ -739,7 +739,7 @@ EXPORT_SYMBOL_GPL(pci_num_vf);
 /**
  * pci_sriov_set_totalvfs -- reduce the TotalVFs available
  * @dev: the PCI PF device
- * numvfs: number that should be used for TotalVFs supported
+ * @numvfs: number that should be used for TotalVFs supported
  *
  * Should be called from PF driver's probe routine with
  * device's mutex held.
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index 06f4eb7ab87e..afed7018a2b5 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -125,8 +125,11 @@ static const struct key_entry acer_wmi_keymap[] = {
         {KE_IGNORE, 0x63, {KEY_BRIGHTNESSDOWN} },
         {KE_KEY, 0x64, {KEY_SWITCHVIDEOMODE} }, /* Display Switch */
         {KE_IGNORE, 0x81, {KEY_SLEEP} },
-        {KE_KEY, 0x82, {KEY_TOUCHPAD_TOGGLE} }, /* Touch Pad On/Off */
+        {KE_KEY, 0x82, {KEY_TOUCHPAD_TOGGLE} }, /* Touch Pad Toggle */
+        {KE_KEY, KEY_TOUCHPAD_ON, {KEY_TOUCHPAD_ON} },
+        {KE_KEY, KEY_TOUCHPAD_OFF, {KEY_TOUCHPAD_OFF} },
         {KE_IGNORE, 0x83, {KEY_TOUCHPAD_TOGGLE} },
+        {KE_KEY, 0x85, {KEY_TOUCHPAD_TOGGLE} },
         {KE_END, 0}
 };
 
@@ -147,6 +150,7 @@ struct event_return_value {
 #define ACER_WMID3_GDS_THREEG           (1<<6)  /* 3G */
 #define ACER_WMID3_GDS_WIMAX            (1<<7)  /* WiMAX */
 #define ACER_WMID3_GDS_BLUETOOTH        (1<<11) /* BT */
+#define ACER_WMID3_GDS_TOUCHPAD         (1<<1)  /* Touchpad */
 
 struct lm_input_params {
         u8 function_num;        /* Function Number */
@@ -875,7 +879,7 @@ WMI_execute_u32(u32 method_id, u32 in, u32 *out)
         struct acpi_buffer input = { (acpi_size) sizeof(u32), (void *)(&in) };
         struct acpi_buffer result = { ACPI_ALLOCATE_BUFFER, NULL };
         union acpi_object *obj;
-        u32 tmp;
+        u32 tmp = 0;
         acpi_status status;
 
         status = wmi_evaluate_method(WMID_GUID1, 1, method_id, &input, &result);
@@ -884,14 +888,14 @@ WMI_execute_u32(u32 method_id, u32 in, u32 *out)
                 return status;
 
         obj = (union acpi_object *) result.pointer;
-        if (obj && obj->type == ACPI_TYPE_BUFFER &&
-                (obj->buffer.length == sizeof(u32) ||
-                obj->buffer.length == sizeof(u64))) {
-                tmp = *((u32 *) obj->buffer.pointer);
-        } else if (obj->type == ACPI_TYPE_INTEGER) {
-                tmp = (u32) obj->integer.value;
-        } else {
-                tmp = 0;
+        if (obj) {
+                if (obj->type == ACPI_TYPE_BUFFER &&
+                        (obj->buffer.length == sizeof(u32) ||
+                        obj->buffer.length == sizeof(u64))) {
+                        tmp = *((u32 *) obj->buffer.pointer);
+                } else if (obj->type == ACPI_TYPE_INTEGER) {
+                        tmp = (u32) obj->integer.value;
+                }
         }
 
         if (out)
@@ -1193,12 +1197,14 @@ static acpi_status WMID_set_capabilities(void)
                 return status;
 
         obj = (union acpi_object *) out.pointer;
-        if (obj && obj->type == ACPI_TYPE_BUFFER &&
-                (obj->buffer.length == sizeof(u32) ||
-                obj->buffer.length == sizeof(u64))) {
-                devices = *((u32 *) obj->buffer.pointer);
-        } else if (obj->type == ACPI_TYPE_INTEGER) {
-                devices = (u32) obj->integer.value;
+        if (obj) {
+                if (obj->type == ACPI_TYPE_BUFFER &&
+                        (obj->buffer.length == sizeof(u32) ||
+                        obj->buffer.length == sizeof(u64))) {
+                        devices = *((u32 *) obj->buffer.pointer);
+                } else if (obj->type == ACPI_TYPE_INTEGER) {
+                        devices = (u32) obj->integer.value;
+                }
         } else {
                 kfree(out.pointer);
                 return AE_ERROR;
@@ -1676,6 +1682,7 @@ static void acer_wmi_notify(u32 value, void *context)
         acpi_status status;
         u16 device_state;
         const struct key_entry *key;
+        u32 scancode;
 
         status = wmi_get_event_data(value, &response);
         if (status != AE_OK) {
@@ -1712,6 +1719,7 @@ static void acer_wmi_notify(u32 value, void *context)
                         pr_warn("Unknown key number - 0x%x\n",
                                 return_value.key_num);
                 } else {
+                        scancode = return_value.key_num;
                         switch (key->keycode) {
                         case KEY_WLAN:
                         case KEY_BLUETOOTH:
@@ -1725,9 +1733,11 @@ static void acer_wmi_notify(u32 value, void *context)
                                         rfkill_set_sw_state(bluetooth_rfkill,
                                                 !(device_state & ACER_WMID3_GDS_BLUETOOTH));
                                 break;
+                        case KEY_TOUCHPAD_TOGGLE:
+                                scancode = (device_state & ACER_WMID3_GDS_TOUCHPAD) ?
+                                                KEY_TOUCHPAD_ON : KEY_TOUCHPAD_OFF;
                         }
-                        sparse_keymap_report_entry(acer_wmi_input_dev, key,
-                                                   1, true);
+                        sparse_keymap_report_event(acer_wmi_input_dev, scancode, 1, true);
                 }
                 break;
         case WMID_ACCEL_EVENT:
@@ -1946,12 +1956,14 @@ static u32 get_wmid_devices(void)
                 return 0;
 
         obj = (union acpi_object *) out.pointer;
-        if (obj && obj->type == ACPI_TYPE_BUFFER &&
-                (obj->buffer.length == sizeof(u32) ||
-                obj->buffer.length == sizeof(u64))) {
-                devices = *((u32 *) obj->buffer.pointer);
-        } else if (obj->type == ACPI_TYPE_INTEGER) {
-                devices = (u32) obj->integer.value;
+        if (obj) {
+                if (obj->type == ACPI_TYPE_BUFFER &&
+                        (obj->buffer.length == sizeof(u32) ||
+                        obj->buffer.length == sizeof(u64))) {
+                        devices = *((u32 *) obj->buffer.pointer);
+                } else if (obj->type == ACPI_TYPE_INTEGER) {
+                        devices = (u32) obj->integer.value;
+                }
         }
 
         kfree(out.pointer);
diff --git a/drivers/platform/x86/asus-laptop.c b/drivers/platform/x86/asus-laptop.c
index ec1d3bc2dbe2..fcde4e528819 100644
--- a/drivers/platform/x86/asus-laptop.c
+++ b/drivers/platform/x86/asus-laptop.c
@@ -860,8 +860,10 @@ static ssize_t show_infos(struct device *dev,
         /*
          * The HWRS method return informations about the hardware.
          * 0x80 bit is for WLAN, 0x100 for Bluetooth.
+         * 0x40 for WWAN, 0x10 for WIMAX.
          * The significance of others is yet to be found.
-         * If we don't find the method, we assume the device are present.
+         * We don't currently use this for device detection, and it
+         * takes several seconds to run on some systems.
          */
         rv = acpi_evaluate_integer(asus->handle, "HWRS", NULL, &temp);
         if (!ACPI_FAILURE(rv))
@@ -1682,7 +1684,7 @@ static int asus_laptop_get_info(struct asus_laptop *asus)
 {
         struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
         union acpi_object *model = NULL;
-        unsigned long long bsts_result, hwrs_result;
+        unsigned long long bsts_result;
         char *string = NULL;
         acpi_status status;
 
@@ -1741,20 +1743,9 @@ static int asus_laptop_get_info(struct asus_laptop *asus)
                 return -ENOMEM;
         }
 
-        if (*string)
+        if (string)
                 pr_notice("  %s model detected\n", string);
 
-        /*
-         * The HWRS method return informations about the hardware.
-         * 0x80 bit is for WLAN, 0x100 for Bluetooth,
-         * 0x40 for WWAN, 0x10 for WIMAX.
-         * The significance of others is yet to be found.
-         */
-        status =
-            acpi_evaluate_integer(asus->handle, "HWRS", NULL, &hwrs_result);
-        if (!ACPI_FAILURE(status))
-                pr_notice("  HWRS returned %x", (int)hwrs_result);
-
         if (!acpi_check_handle(asus->handle, METHOD_WL_STATUS, NULL))
                 asus->have_rsts = true;
 
diff --git a/drivers/platform/x86/samsung-laptop.c b/drivers/platform/x86/samsung-laptop.c
index dd90d15f5210..71623a2ff3e8 100644
--- a/drivers/platform/x86/samsung-laptop.c
+++ b/drivers/platform/x86/samsung-laptop.c
@@ -1523,6 +1523,16 @@ static struct dmi_system_id __initdata samsung_dmi_table[] = {
                 },
          .driver_data = &samsung_broken_acpi_video,
         },
+        {
+         .callback = samsung_dmi_matched,
+         .ident = "N250P",
+         .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
+                DMI_MATCH(DMI_PRODUCT_NAME, "N250P"),
+                DMI_MATCH(DMI_BOARD_NAME, "N250P"),
+                },
+         .driver_data = &samsung_broken_acpi_video,
+        },
         { },
 };
 MODULE_DEVICE_TABLE(dmi, samsung_dmi_table);
diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
index daaddec68def..b8ad71f7863f 100644
--- a/drivers/platform/x86/sony-laptop.c
+++ b/drivers/platform/x86/sony-laptop.c
@@ -786,28 +786,29 @@ static int sony_nc_int_call(acpi_handle handle, char *name, int *value,
 static int sony_nc_buffer_call(acpi_handle handle, char *name, u64 *value,
                 void *buffer, size_t buflen)
 {
+        int ret = 0;
         size_t len = len;
         union acpi_object *object = __call_snc_method(handle, name, value);
 
         if (!object)
                 return -EINVAL;
 
-        if (object->type == ACPI_TYPE_BUFFER)
+        if (object->type == ACPI_TYPE_BUFFER) {
                 len = MIN(buflen, object->buffer.length);
+                memcpy(buffer, object->buffer.pointer, len);
 
-        else if (object->type == ACPI_TYPE_INTEGER)
+        } else if (object->type == ACPI_TYPE_INTEGER) {
                 len = MIN(buflen, sizeof(object->integer.value));
+                memcpy(buffer, &object->integer.value, len);
 
-        else {
+        } else {
                 pr_warn("Invalid acpi_object: expected 0x%x got 0x%x\n",
                                 ACPI_TYPE_BUFFER, object->type);
-                kfree(object);
-                return -EINVAL;
+                ret = -EINVAL;
         }
 
-        memcpy(buffer, object->buffer.pointer, len);
         kfree(object);
-        return 0;
+        return ret;
 }
 
 struct sony_nc_handles {
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 0f65b246cc0c..278584302f2d 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -1885,9 +1885,15 @@ int regulator_can_change_voltage(struct regulator *regulator)
         struct regulator_dev    *rdev = regulator->rdev;
 
         if (rdev->constraints &&
-            rdev->constraints->valid_ops_mask & REGULATOR_CHANGE_VOLTAGE &&
-            (rdev->desc->n_voltages - rdev->desc->linear_min_sel) > 1)
-                return 1;
+            (rdev->constraints->valid_ops_mask & REGULATOR_CHANGE_VOLTAGE)) {
+                if (rdev->desc->n_voltages - rdev->desc->linear_min_sel > 1)
+                        return 1;
+
+                if (rdev->desc->continuous_voltage_range &&
+                    rdev->constraints->min_uV && rdev->constraints->max_uV &&
+                    rdev->constraints->min_uV != rdev->constraints->max_uV)
+                        return 1;
+        }
 
         return 0;
 }
@@ -3315,7 +3321,8 @@ static void rdev_init_debugfs(struct regulator_dev *rdev)
  * @config: runtime configuration for regulator
  *
  * Called by regulator drivers to register a regulator.
- * Returns 0 on success.
+ * Returns a valid pointer to struct regulator_dev on success
+ * or an ERR_PTR() on error.
  */
 struct regulator_dev *
 regulator_register(const struct regulator_desc *regulator_desc,
diff --git a/drivers/regulator/max8997.c b/drivers/regulator/max8997.c
index df0eafb0dc7e..02be7fcae32f 100644
--- a/drivers/regulator/max8997.c
+++ b/drivers/regulator/max8997.c
@@ -71,26 +71,26 @@ struct voltage_map_desc {
         int step;
 };
 
-/* Voltage maps in mV */
+/* Voltage maps in uV */
 static const struct voltage_map_desc ldo_voltage_map_desc = {
-        .min = 800,     .max = 3950,    .step = 50,
+        .min = 800000,  .max = 3950000, .step = 50000,
 }; /* LDO1 ~ 18, 21 all */
 
 static const struct voltage_map_desc buck1245_voltage_map_desc = {
-        .min = 650,     .max = 2225,    .step = 25,
+        .min = 650000,  .max = 2225000, .step = 25000,
 }; /* Buck1, 2, 4, 5 */
 
 static const struct voltage_map_desc buck37_voltage_map_desc = {
-        .min = 750,     .max = 3900,    .step = 50,
+        .min = 750000,  .max = 3900000, .step = 50000,
 }; /* Buck3, 7 */
 
-/* current map in mA */
+/* current map in uA */
 static const struct voltage_map_desc charger_current_map_desc = {
-        .min = 200,     .max = 950,     .step = 50,
+        .min = 200000,  .max = 950000,  .step = 50000,
 };
 
 static const struct voltage_map_desc topoff_current_map_desc = {
-        .min = 50,      .max = 200,     .step = 10,
+        .min = 50000,   .max = 200000,  .step = 10000,
 };
 
 static const struct voltage_map_desc *reg_voltage_map[] = {
@@ -194,7 +194,7 @@ static int max8997_list_voltage(struct regulator_dev *rdev,
         if (val > desc->max)
                 return -EINVAL;
 
-        return val * 1000;
+        return val;
 }
 
 static int max8997_get_enable_register(struct regulator_dev *rdev,
@@ -485,7 +485,6 @@ static int max8997_set_voltage_ldobuck(struct regulator_dev *rdev,
 {
         struct max8997_data *max8997 = rdev_get_drvdata(rdev);
         struct i2c_client *i2c = max8997->iodev->i2c;
-        int min_vol = min_uV / 1000, max_vol = max_uV / 1000;
         const struct voltage_map_desc *desc;
         int rid = rdev_get_id(rdev);
         int i, reg, shift, mask, ret;
@@ -509,7 +508,7 @@ static int max8997_set_voltage_ldobuck(struct regulator_dev *rdev,
 
         desc = reg_voltage_map[rid];
 
-        i = max8997_get_voltage_proper_val(desc, min_vol, max_vol);
+        i = max8997_get_voltage_proper_val(desc, min_uV, max_uV);
         if (i < 0)
                 return i;
 
@@ -557,7 +556,7 @@ static int max8997_set_voltage_ldobuck_time_sel(struct regulator_dev *rdev,
         case MAX8997_BUCK4:
         case MAX8997_BUCK5:
                 return DIV_ROUND_UP(desc->step * (new_selector - old_selector),
-                                    max8997->ramp_delay);
+                                    max8997->ramp_delay * 1000);
         }
 
         return 0;
@@ -656,7 +655,6 @@ static int max8997_set_voltage_buck(struct regulator_dev *rdev,
         const struct voltage_map_desc *desc;
         int new_val, new_idx, damage, tmp_val, tmp_idx, tmp_dmg;
         bool gpio_dvs_mode = false;
-        int min_vol = min_uV / 1000, max_vol = max_uV / 1000;
 
         if (rid < MAX8997_BUCK1 || rid > MAX8997_BUCK7)
                 return -EINVAL;
@@ -681,7 +679,7 @@ static int max8997_set_voltage_buck(struct regulator_dev *rdev,
                                                 selector);
 
         desc = reg_voltage_map[rid];
-        new_val = max8997_get_voltage_proper_val(desc, min_vol, max_vol);
+        new_val = max8997_get_voltage_proper_val(desc, min_uV, max_uV);
         if (new_val < 0)
                 return new_val;
 
@@ -1123,8 +1121,8 @@ static int max8997_pmic_probe(struct platform_device *pdev)
                 max8997->buck1_vol[i] = ret =
                         max8997_get_voltage_proper_val(
                                         &buck1245_voltage_map_desc,
-                                        pdata->buck1_voltage[i] / 1000,
-                                        pdata->buck1_voltage[i] / 1000 +
+                                        pdata->buck1_voltage[i],
+                                        pdata->buck1_voltage[i] +
                                         buck1245_voltage_map_desc.step);
                 if (ret < 0)
                         goto err_out;
@@ -1132,8 +1130,8 @@ static int max8997_pmic_probe(struct platform_device *pdev)
                 max8997->buck2_vol[i] = ret =
                         max8997_get_voltage_proper_val(
                                         &buck1245_voltage_map_desc,
-                                        pdata->buck2_voltage[i] / 1000,
-                                        pdata->buck2_voltage[i] / 1000 +
+                                        pdata->buck2_voltage[i],
+                                        pdata->buck2_voltage[i] +
                                         buck1245_voltage_map_desc.step);
                 if (ret < 0)
                         goto err_out;
@@ -1141,8 +1139,8 @@ static int max8997_pmic_probe(struct platform_device *pdev)
                 max8997->buck5_vol[i] = ret =
                         max8997_get_voltage_proper_val(
                                         &buck1245_voltage_map_desc,
-                                        pdata->buck5_voltage[i] / 1000,
-                                        pdata->buck5_voltage[i] / 1000 +
+                                        pdata->buck5_voltage[i],
+                                        pdata->buck5_voltage[i] +
                                         buck1245_voltage_map_desc.step);
                 if (ret < 0)
                         goto err_out;
diff --git a/drivers/regulator/max8998.c b/drivers/regulator/max8998.c
index b821d08eb64a..1f0df4046b86 100644
--- a/drivers/regulator/max8998.c
+++ b/drivers/regulator/max8998.c
@@ -51,39 +51,39 @@ struct voltage_map_desc {
         int step;
 };
 
-/* Voltage maps */
+/* Voltage maps in uV*/
 static const struct voltage_map_desc ldo23_voltage_map_desc = {
-        .min = 800,     .step = 50,     .max = 1300,
+        .min = 800000,  .step = 50000,  .max = 1300000,
 };
 static const struct voltage_map_desc ldo456711_voltage_map_desc = {
-        .min = 1600,    .step = 100,    .max = 3600,
+        .min = 1600000, .step = 100000, .max = 3600000,
 };
 static const struct voltage_map_desc ldo8_voltage_map_desc = {
-        .min = 3000,    .step = 100,    .max = 3600,
+        .min = 3000000, .step = 100000, .max = 3600000,
 };
 static const struct voltage_map_desc ldo9_voltage_map_desc = {
-        .min = 2800,    .step = 100,    .max = 3100,
+        .min = 2800000, .step = 100000, .max = 3100000,
 };
 static const struct voltage_map_desc ldo10_voltage_map_desc = {
-        .min = 950,     .step = 50,     .max = 1300,
+        .min = 95000,   .step = 50000,  .max = 1300000,
 };
 static const struct voltage_map_desc ldo1213_voltage_map_desc = {
-        .min = 800,     .step = 100,    .max = 3300,
+        .min = 800000,  .step = 100000, .max = 3300000,
 };
 static const struct voltage_map_desc ldo1415_voltage_map_desc = {
-        .min = 1200,    .step = 100,    .max = 3300,
+        .min = 1200000, .step = 100000, .max = 3300000,
 };
 static const struct voltage_map_desc ldo1617_voltage_map_desc = {
-        .min = 1600,    .step = 100,    .max = 3600,
+        .min = 1600000, .step = 100000, .max = 3600000,
 };
 static const struct voltage_map_desc buck12_voltage_map_desc = {
-        .min = 750,     .step = 25,     .max = 1525,
+        .min = 750000,  .step = 25000,  .max = 1525000,
 };
 static const struct voltage_map_desc buck3_voltage_map_desc = {
-        .min = 1600,    .step = 100,    .max = 3600,
+        .min = 1600000, .step = 100000, .max = 3600000,
 };
 static const struct voltage_map_desc buck4_voltage_map_desc = {
-        .min = 800,     .step = 100,    .max = 2300,
+        .min = 800000,  .step = 100000, .max = 2300000,
 };
 
 static const struct voltage_map_desc *ldo_voltage_map[] = {
@@ -445,9 +445,9 @@ static int max8998_set_voltage_buck_time_sel(struct regulator_dev *rdev,
         if (max8998->iodev->type == TYPE_MAX8998 && !(val & MAX8998_ENRAMP))
                 return 0;
 
-        difference = (new_selector - old_selector) * desc->step;
+        difference = (new_selector - old_selector) * desc->step / 1000;
         if (difference > 0)
-                return difference / ((val & 0x0f) + 1);
+                return DIV_ROUND_UP(difference, (val & 0x0f) + 1);
 
         return 0;
 }
@@ -702,7 +702,7 @@ static int max8998_pmic_probe(struct platform_device *pdev)
                 i = 0;
                 while (buck12_voltage_map_desc.min +
                        buck12_voltage_map_desc.step*i
-                       < (pdata->buck1_voltage1 / 1000))
+                       < pdata->buck1_voltage1)
                         i++;
                 max8998->buck1_vol[0] = i;
                 ret = max8998_write_reg(i2c, MAX8998_REG_BUCK1_VOLTAGE1, i);
@@ -713,7 +713,7 @@ static int max8998_pmic_probe(struct platform_device *pdev)
                 i = 0;
                 while (buck12_voltage_map_desc.min +
                        buck12_voltage_map_desc.step*i
-                       < (pdata->buck1_voltage2 / 1000))
+                       < pdata->buck1_voltage2)
                         i++;
 
                 max8998->buck1_vol[1] = i;
@@ -725,7 +725,7 @@ static int max8998_pmic_probe(struct platform_device *pdev)
                 i = 0;
                 while (buck12_voltage_map_desc.min +
                        buck12_voltage_map_desc.step*i
-                       < (pdata->buck1_voltage3 / 1000))
+                       < pdata->buck1_voltage3)
                         i++;
 
                 max8998->buck1_vol[2] = i;
@@ -737,7 +737,7 @@ static int max8998_pmic_probe(struct platform_device *pdev)
                 i = 0;
                 while (buck12_voltage_map_desc.min +
                        buck12_voltage_map_desc.step*i
-                       < (pdata->buck1_voltage4 / 1000))
+                       < pdata->buck1_voltage4)
                         i++;
 
                 max8998->buck1_vol[3] = i;
@@ -763,7 +763,7 @@ static int max8998_pmic_probe(struct platform_device *pdev)
                 i = 0;
                 while (buck12_voltage_map_desc.min +
                        buck12_voltage_map_desc.step*i
-                       < (pdata->buck2_voltage1 / 1000))
+                       < pdata->buck2_voltage1)
                         i++;
                 max8998->buck2_vol[0] = i;
                 ret = max8998_write_reg(i2c, MAX8998_REG_BUCK2_VOLTAGE1, i);
@@ -774,7 +774,7 @@ static int max8998_pmic_probe(struct platform_device *pdev)
                 i = 0;
                 while (buck12_voltage_map_desc.min +
                        buck12_voltage_map_desc.step*i
-                       < (pdata->buck2_voltage2 / 1000))
+                       < pdata->buck2_voltage2)
                         i++;
                 max8998->buck2_vol[1] = i;
                 ret = max8998_write_reg(i2c, MAX8998_REG_BUCK2_VOLTAGE2, i);
@@ -792,8 +792,8 @@ static int max8998_pmic_probe(struct platform_device *pdev)
                         int count = (desc->max - desc->min) / desc->step + 1;
 
                         regulators[index].n_voltages = count;
-                        regulators[index].min_uV = desc->min * 1000;
-                        regulators[index].uV_step = desc->step * 1000;
+                        regulators[index].min_uV = desc->min;
+                        regulators[index].uV_step = desc->step;
                 }
 
                 config.dev = max8998->dev;
diff --git a/drivers/regulator/s5m8767.c b/drivers/regulator/s5m8767.c
index 9f991f2c525a..33b65c9ad5d5 100644
--- a/drivers/regulator/s5m8767.c
+++ b/drivers/regulator/s5m8767.c
@@ -214,7 +214,7 @@ static int s5m8767_reg_is_enabled(struct regulator_dev *rdev)
         struct s5m8767_info *s5m8767 = rdev_get_drvdata(rdev);
         int ret, reg;
         int mask = 0xc0, enable_ctrl;
-        u8 val;
+        unsigned int val;
 
         ret = s5m8767_get_register(rdev, &reg, &enable_ctrl);
         if (ret == -EINVAL)
@@ -306,7 +306,7 @@ static int s5m8767_get_voltage_sel(struct regulator_dev *rdev)
         struct s5m8767_info *s5m8767 = rdev_get_drvdata(rdev);
         int reg, mask, ret;
         int reg_id = rdev_get_id(rdev);
-        u8 val;
+        unsigned int val;
 
         ret = s5m8767_get_voltage_register(rdev, &reg);
         if (ret)
diff --git a/drivers/rtc/rtc-da9055.c b/drivers/rtc/rtc-da9055.c
index 96bafc5c3bf8..8f0dcfedb83c 100644
--- a/drivers/rtc/rtc-da9055.c
+++ b/drivers/rtc/rtc-da9055.c
@@ -227,7 +227,7 @@ static const struct rtc_class_ops da9055_rtc_ops = {
         .alarm_irq_enable = da9055_rtc_alarm_irq_enable,
 };
 
-static int __init da9055_rtc_device_init(struct da9055 *da9055,
+static int da9055_rtc_device_init(struct da9055 *da9055,
                                         struct da9055_pdata *pdata)
 {
         int ret;
diff --git a/drivers/s390/block/dasd_diag.c b/drivers/s390/block/dasd_diag.c
index 9bd5da36f99e..704488d0f819 100644
--- a/drivers/s390/block/dasd_diag.c
+++ b/drivers/s390/block/dasd_diag.c
@@ -248,7 +248,7 @@ static void dasd_ext_handler(struct ext_code ext_code,
         default:
                 return;
         }
-        kstat_cpu(smp_processor_id()).irqs[EXTINT_DSD]++;
+        inc_irq_stat(IRQEXT_DSD);
         if (!ip) {              /* no intparm: unsolicited interrupt */
                 DBF_EVENT(DBF_NOTICE, "%s", "caught unsolicited "
                               "interrupt");
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 806fe912d6e7..e37bc1620d14 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -4274,7 +4274,7 @@ static struct ccw_driver dasd_eckd_driver = {
         .thaw        = dasd_generic_restore_device,
         .restore     = dasd_generic_restore_device,
         .uc_handler  = dasd_generic_uc_handler,
-        .int_class   = IOINT_DAS,
+        .int_class   = IRQIO_DAS,
 };
 
 /*
diff --git a/drivers/s390/block/dasd_fba.c b/drivers/s390/block/dasd_fba.c
index eb748507c7fa..414698584344 100644
--- a/drivers/s390/block/dasd_fba.c
+++ b/drivers/s390/block/dasd_fba.c
@@ -78,7 +78,7 @@ static struct ccw_driver dasd_fba_driver = {
         .freeze      = dasd_generic_pm_freeze,
         .thaw        = dasd_generic_restore_device,
         .restore     = dasd_generic_restore_device,
-        .int_class   = IOINT_DAS,
+        .int_class   = IRQIO_DAS,
 };
 
 static void
diff --git a/drivers/s390/char/con3215.c b/drivers/s390/char/con3215.c
index 40084501c31b..33b7141a182f 100644
--- a/drivers/s390/char/con3215.c
+++ b/drivers/s390/char/con3215.c
@@ -44,6 +44,7 @@
 #define RAW3215_NR_CCWS     3
 #define RAW3215_TIMEOUT     HZ/10     /* time for delayed output */
 
+#define RAW3215_FIXED       1         /* 3215 console device is not be freed */
 #define RAW3215_WORKING     4         /* set if a request is being worked on */
 #define RAW3215_THROTTLED   8         /* set if reading is disabled */
 #define RAW3215_STOPPED     16        /* set if writing is disabled */
@@ -630,7 +631,8 @@ static void raw3215_shutdown(struct raw3215_info *raw)
         DECLARE_WAITQUEUE(wait, current);
         unsigned long flags;
 
-        if (!(raw->port.flags & ASYNC_INITIALIZED))
+        if (!(raw->port.flags & ASYNC_INITIALIZED) ||
+            (raw->flags & RAW3215_FIXED))
                 return;
         /* Wait for outstanding requests, then free irq */
         spin_lock_irqsave(get_ccwdev_lock(raw->cdev), flags);
@@ -805,7 +807,7 @@ static struct ccw_driver raw3215_ccw_driver = {
         .freeze         = &raw3215_pm_stop,
         .thaw           = &raw3215_pm_start,
         .restore        = &raw3215_pm_start,
-        .int_class      = IOINT_C15,
+        .int_class      = IRQIO_C15,
 };
 
 #ifdef CONFIG_TN3215_CONSOLE
@@ -927,6 +929,8 @@ static int __init con3215_init(void)
         dev_set_drvdata(&cdev->dev, raw);
         cdev->handler = raw3215_irq;
 
+        raw->flags |= RAW3215_FIXED;
+
         /* Request the console irq */
         if (raw3215_startup(raw) != 0) {
                 raw3215_free_info(raw);
diff --git a/drivers/s390/char/raw3270.c b/drivers/s390/char/raw3270.c
index f3b8bb84faf2..9a6c140c5f07 100644
--- a/drivers/s390/char/raw3270.c
+++ b/drivers/s390/char/raw3270.c
@@ -1396,7 +1396,7 @@ static struct ccw_driver raw3270_ccw_driver = {
         .freeze         = &raw3270_pm_stop,
         .thaw           = &raw3270_pm_start,
         .restore        = &raw3270_pm_start,
-        .int_class      = IOINT_C70,
+        .int_class      = IRQIO_C70,
 };
 
 static int
diff --git a/drivers/s390/char/sclp.c b/drivers/s390/char/sclp.c
index 4fa21f7e2308..12c16a65dd25 100644
--- a/drivers/s390/char/sclp.c
+++ b/drivers/s390/char/sclp.c
@@ -400,7 +400,7 @@ static void sclp_interrupt_handler(struct ext_code ext_code,
         u32 finished_sccb;
         u32 evbuf_pending;
 
-        kstat_cpu(smp_processor_id()).irqs[EXTINT_SCP]++;
+        inc_irq_stat(IRQEXT_SCP);
         spin_lock(&sclp_lock);
         finished_sccb = param32 & 0xfffffff8;
         evbuf_pending = param32 & 0x3;
@@ -813,7 +813,7 @@ static void sclp_check_handler(struct ext_code ext_code,
 {
         u32 finished_sccb;
 
-        kstat_cpu(smp_processor_id()).irqs[EXTINT_SCP]++;
+        inc_irq_stat(IRQEXT_SCP);
         finished_sccb = param32 & 0xfffffff8;
         /* Is this the interrupt we are waiting for? */
         if (finished_sccb == 0)
diff --git a/drivers/s390/char/tape_34xx.c b/drivers/s390/char/tape_34xx.c
index 6ae929c024ae..9aa79702b370 100644
--- a/drivers/s390/char/tape_34xx.c
+++ b/drivers/s390/char/tape_34xx.c
@@ -1193,7 +1193,7 @@ static struct ccw_driver tape_34xx_driver = {
         .set_online = tape_34xx_online,
         .set_offline = tape_generic_offline,
         .freeze = tape_generic_pm_suspend,
-        .int_class = IOINT_TAP,
+        .int_class = IRQIO_TAP,
 };
 
 static int
diff --git a/drivers/s390/char/tape_3590.c b/drivers/s390/char/tape_3590.c
index 1b0eb49f739c..327cb19ad0b0 100644
--- a/drivers/s390/char/tape_3590.c
+++ b/drivers/s390/char/tape_3590.c
@@ -1656,7 +1656,7 @@ static struct ccw_driver tape_3590_driver = {
         .set_offline = tape_generic_offline,
         .set_online = tape_3590_online,
         .freeze = tape_generic_pm_suspend,
-        .int_class = IOINT_TAP,
+        .int_class = IRQIO_TAP,
 };
 
 /*
diff --git a/drivers/s390/char/vmur.c b/drivers/s390/char/vmur.c
index 73bef0bd394c..483f72ba030d 100644
--- a/drivers/s390/char/vmur.c
+++ b/drivers/s390/char/vmur.c
@@ -74,7 +74,7 @@ static struct ccw_driver ur_driver = {
         .set_online     = ur_set_online,
         .set_offline    = ur_set_offline,
         .freeze         = ur_pm_suspend,
-        .int_class      = IOINT_VMR,
+        .int_class      = IRQIO_VMR,
 };
 
 static DEFINE_MUTEX(vmur_mutex);
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index 68e80e2734a4..10729bbceced 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -283,7 +283,7 @@ struct chsc_sei_nt2_area {
         u8  ccdf[PAGE_SIZE - 24 - 56];  /* content-code dependent field */
 } __packed;
 
-#define CHSC_SEI_NT0    0ULL
+#define CHSC_SEI_NT0    (1ULL << 63)
 #define CHSC_SEI_NT2    (1ULL << 61)
 
 struct chsc_sei {
@@ -291,7 +291,8 @@ struct chsc_sei {
         u32 reserved1;
         u64 ntsm;                       /* notification type mask */
         struct chsc_header response;
-        u32 reserved2;
+        u32 :24;
+        u8 nt;
         union {
                 struct chsc_sei_nt0_area nt0_area;
                 struct chsc_sei_nt2_area nt2_area;
@@ -496,17 +497,17 @@ static int __chsc_process_crw(struct chsc_sei *sei, u64 ntsm)
                                 css_schedule_eval_all();
                         }
 
-                        switch (sei->ntsm) {
-                        case CHSC_SEI_NT0:
+                        switch (sei->nt) {
+                        case 0:
                                 chsc_process_sei_nt0(&sei->u.nt0_area);
-                                return 1;
-                        case CHSC_SEI_NT2:
+                                break;
+                        case 2:
                                 chsc_process_sei_nt2(&sei->u.nt2_area);
-                                return 1;
+                                break;
                         default:
-                                CIO_CRW_EVENT(2, "chsc: unhandled nt (nt=%08Lx)\n",
-                                              sei->ntsm);
-                                return 0;
+                                CIO_CRW_EVENT(2, "chsc: unhandled nt=%d\n",
+                                              sei->nt);
+                                break;
                         }
                 } else {
                         CIO_CRW_EVENT(2, "chsc: sei failed (rc=%04x)\n",
@@ -537,15 +538,7 @@ static void chsc_process_crw(struct crw *crw0, struct crw *crw1, int overflow)
         sei = sei_page;
 
         CIO_TRACE_EVENT(2, "prcss");
-
-        /*
-         * The ntsm does not allow to select NT0 and NT2 together. We need to
-         * first check for NT2, than additionally for NT0...
-         */
-#ifdef CONFIG_PCI
-        if (!__chsc_process_crw(sei, CHSC_SEI_NT2))
-#endif
-                __chsc_process_crw(sei, CHSC_SEI_NT0);
+        __chsc_process_crw(sei, CHSC_SEI_NT0 | CHSC_SEI_NT2);
 }
 
 void chsc_chp_online(struct chp_id chpid)
diff --git a/drivers/s390/cio/chsc_sch.c b/drivers/s390/cio/chsc_sch.c
index 8f9a1a384496..facdf809113f 100644
--- a/drivers/s390/cio/chsc_sch.c
+++ b/drivers/s390/cio/chsc_sch.c
@@ -58,7 +58,7 @@ static void chsc_subchannel_irq(struct subchannel *sch)
 
         CHSC_LOG(4, "irb");
         CHSC_LOG_HEX(4, irb, sizeof(*irb));
-        kstat_cpu(smp_processor_id()).irqs[IOINT_CSC]++;
+        inc_irq_stat(IRQIO_CSC);
 
         /* Copy irb to provided request and set done. */
         if (!request) {
diff --git a/drivers/s390/cio/cio.c b/drivers/s390/cio/cio.c
index 8e927b9f285f..c8faf6230b0f 100644
--- a/drivers/s390/cio/cio.c
+++ b/drivers/s390/cio/cio.c
@@ -611,7 +611,7 @@ void __irq_entry do_IRQ(struct pt_regs *regs)
         tpi_info = (struct tpi_info *)&S390_lowcore.subchannel_id;
         irb = (struct irb *)&S390_lowcore.irb;
         do {
-                kstat_cpu(smp_processor_id()).irqs[IO_INTERRUPT]++;
+                kstat_incr_irqs_this_cpu(IO_INTERRUPT, NULL);
                 if (tpi_info->adapter_IO) {
                         do_adapter_IO(tpi_info->isc);
                         continue;
@@ -619,7 +619,7 @@ void __irq_entry do_IRQ(struct pt_regs *regs)
                 sch = (struct subchannel *)(unsigned long)tpi_info->intparm;
                 if (!sch) {
                         /* Clear pending interrupt condition. */
-                        kstat_cpu(smp_processor_id()).irqs[IOINT_CIO]++;
+                        inc_irq_stat(IRQIO_CIO);
                         tsch(tpi_info->schid, irb);
                         continue;
                 }
@@ -633,9 +633,9 @@ void __irq_entry do_IRQ(struct pt_regs *regs)
                         if (sch->driver && sch->driver->irq)
                                 sch->driver->irq(sch);
                         else
-                                kstat_cpu(smp_processor_id()).irqs[IOINT_CIO]++;
+                                inc_irq_stat(IRQIO_CIO);
                 } else
-                        kstat_cpu(smp_processor_id()).irqs[IOINT_CIO]++;
+                        inc_irq_stat(IRQIO_CIO);
                 spin_unlock(sch->lock);
                 /*
                  * Are more interrupts pending?
@@ -678,7 +678,7 @@ static void cio_tsch(struct subchannel *sch)
         if (sch->driver && sch->driver->irq)
                 sch->driver->irq(sch);
         else
-                kstat_cpu(smp_processor_id()).irqs[IOINT_CIO]++;
+                inc_irq_stat(IRQIO_CIO);
         if (!irq_context) {
                 irq_exit();
                 _local_bh_enable();
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index 6995cff44636..7cd5c6812ac7 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -758,7 +758,7 @@ static int io_subchannel_initialize_dev(struct subchannel *sch,
                                         struct ccw_device *cdev)
 {
         cdev->private->cdev = cdev;
-        cdev->private->int_class = IOINT_CIO;
+        cdev->private->int_class = IRQIO_CIO;
         atomic_set(&cdev->private->onoff, 0);
         cdev->dev.parent = &sch->dev;
         cdev->dev.release = ccw_device_release;
@@ -1023,7 +1023,7 @@ static void io_subchannel_irq(struct subchannel *sch)
         if (cdev)
                 dev_fsm_event(cdev, DEV_EVENT_INTERRUPT);
         else
-                kstat_cpu(smp_processor_id()).irqs[IOINT_CIO]++;
+                inc_irq_stat(IRQIO_CIO);
 }
 
 void io_subchannel_init_config(struct subchannel *sch)
@@ -1634,7 +1634,7 @@ ccw_device_probe_console(void)
         memset(&console_private, 0, sizeof(struct ccw_device_private));
         console_cdev.private = &console_private;
         console_private.cdev = &console_cdev;
-        console_private.int_class = IOINT_CIO;
+        console_private.int_class = IRQIO_CIO;
         ret = ccw_device_console_enable(&console_cdev, sch);
         if (ret) {
                 cio_release_console();
@@ -1715,13 +1715,13 @@ ccw_device_probe (struct device *dev)
         if (cdrv->int_class != 0)
                 cdev->private->int_class = cdrv->int_class;
         else
-                cdev->private->int_class = IOINT_CIO;
+                cdev->private->int_class = IRQIO_CIO;
 
         ret = cdrv->probe ? cdrv->probe(cdev) : -ENODEV;
 
         if (ret) {
                 cdev->drv = NULL;
-                cdev->private->int_class = IOINT_CIO;
+                cdev->private->int_class = IRQIO_CIO;
                 return ret;
         }
 
@@ -1755,7 +1755,7 @@ ccw_device_remove (struct device *dev)
         }
         ccw_device_set_timeout(cdev, 0);
         cdev->drv = NULL;
-        cdev->private->int_class = IOINT_CIO;
+        cdev->private->int_class = IRQIO_CIO;
         return 0;
 }
 
diff --git a/drivers/s390/cio/device.h b/drivers/s390/cio/device.h
index 2e575cff9845..7d4ecb65db00 100644
--- a/drivers/s390/cio/device.h
+++ b/drivers/s390/cio/device.h
@@ -61,11 +61,10 @@ dev_fsm_event(struct ccw_device *cdev, enum dev_event dev_event)
 
         if (dev_event == DEV_EVENT_INTERRUPT) {
                 if (state == DEV_STATE_ONLINE)
-                        kstat_cpu(smp_processor_id()).
-                                irqs[cdev->private->int_class]++;
+                        inc_irq_stat(cdev->private->int_class);
                 else if (state != DEV_STATE_CMFCHANGE &&
                          state != DEV_STATE_CMFUPDATE)
-                        kstat_cpu(smp_processor_id()).irqs[IOINT_CIO]++;
+                        inc_irq_stat(IRQIO_CIO);
         }
         dev_jumptable[state][dev_event](cdev, dev_event);
 }
diff --git a/drivers/s390/cio/eadm_sch.c b/drivers/s390/cio/eadm_sch.c
index 6c9673400464..d9eddcba7e88 100644
--- a/drivers/s390/cio/eadm_sch.c
+++ b/drivers/s390/cio/eadm_sch.c
@@ -139,7 +139,7 @@ static void eadm_subchannel_irq(struct subchannel *sch)
         EADM_LOG(6, "irq");
         EADM_LOG_HEX(6, irb, sizeof(*irb));
 
-        kstat_cpu(smp_processor_id()).irqs[IOINT_ADM]++;
+        inc_irq_stat(IRQIO_ADM);
 
         if ((scsw->stctl & (SCSW_STCTL_ALERT_STATUS | SCSW_STCTL_STATUS_PEND))
             && scsw->eswf == 1 && irb->esw.eadm.erw.r)
diff --git a/drivers/s390/cio/qdio_thinint.c b/drivers/s390/cio/qdio_thinint.c
index bdb394b066fc..bde5255200dc 100644
--- a/drivers/s390/cio/qdio_thinint.c
+++ b/drivers/s390/cio/qdio_thinint.c
@@ -182,7 +182,7 @@ static void tiqdio_thinint_handler(void *alsi, void *data)
         struct qdio_q *q;
 
         last_ai_time = S390_lowcore.int_clock;
-        kstat_cpu(smp_processor_id()).irqs[IOINT_QAI]++;
+        inc_irq_stat(IRQIO_QAI);
 
         /* protect tiq_list entries, only changed in activate or shutdown */
         rcu_read_lock();
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index 7b865a7300e6..b8b340ac5332 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -1272,7 +1272,7 @@ out:
 
 static void ap_interrupt_handler(void *unused1, void *unused2)
 {
-        kstat_cpu(smp_processor_id()).irqs[IOINT_APB]++;
+        inc_irq_stat(IRQIO_APB);
         tasklet_schedule(&ap_tasklet);
 }
 
diff --git a/drivers/s390/kvm/kvm_virtio.c b/drivers/s390/kvm/kvm_virtio.c
index 7dabef624da3..8491111aec12 100644
--- a/drivers/s390/kvm/kvm_virtio.c
+++ b/drivers/s390/kvm/kvm_virtio.c
@@ -392,7 +392,7 @@ static void kvm_extint_handler(struct ext_code ext_code,
 
         if ((ext_code.subcode & 0xff00) != VIRTIO_SUBCODE_64)
                 return;
-        kstat_cpu(smp_processor_id()).irqs[EXTINT_VRT]++;
+        inc_irq_stat(IRQEXT_VRT);
 
         /* The LSB might be overloaded, we have to mask it */
         vq = (struct virtqueue *)(param64 & ~1UL);
diff --git a/drivers/s390/net/claw.c b/drivers/s390/net/claw.c
index 5c70a6599578..83bc9c5fa0c1 100644
--- a/drivers/s390/net/claw.c
+++ b/drivers/s390/net/claw.c
@@ -282,7 +282,7 @@ static struct ccw_driver claw_ccw_driver = {
         .ids    = claw_ids,
         .probe  = ccwgroup_probe_ccwdev,
         .remove = ccwgroup_remove_ccwdev,
-        .int_class = IOINT_CLW,
+        .int_class = IRQIO_CLW,
 };
 
 static ssize_t claw_driver_group_store(struct device_driver *ddrv,
diff --git a/drivers/s390/net/ctcm_main.c b/drivers/s390/net/ctcm_main.c
index 817b68925ddd..676f12049a36 100644
--- a/drivers/s390/net/ctcm_main.c
+++ b/drivers/s390/net/ctcm_main.c
@@ -1755,7 +1755,7 @@ static struct ccw_driver ctcm_ccw_driver = {
         .ids    = ctcm_ids,
         .probe  = ccwgroup_probe_ccwdev,
         .remove = ccwgroup_remove_ccwdev,
-        .int_class = IOINT_CTC,
+        .int_class = IRQIO_CTC,
 };
 
 static struct ccwgroup_driver ctcm_group_driver = {
diff --git a/drivers/s390/net/lcs.c b/drivers/s390/net/lcs.c
index 2ca0f1dd7a00..c645dc9e98af 100644
--- a/drivers/s390/net/lcs.c
+++ b/drivers/s390/net/lcs.c
@@ -2384,7 +2384,7 @@ static struct ccw_driver lcs_ccw_driver = {
         .ids    = lcs_ids,
         .probe  = ccwgroup_probe_ccwdev,
         .remove = ccwgroup_remove_ccwdev,
-        .int_class = IOINT_LCS,
+        .int_class = IRQIO_LCS,
 };
 
 /**
diff --git a/drivers/sh/clk/cpg.c b/drivers/sh/clk/cpg.c
index 5aedcdf4ac5c..1ebe67cd1833 100644
--- a/drivers/sh/clk/cpg.c
+++ b/drivers/sh/clk/cpg.c
@@ -126,6 +126,12 @@ static int sh_clk_div_set_rate(struct clk *clk, unsigned long rate)
 
 static int sh_clk_div_enable(struct clk *clk)
 {
+        if (clk->div_mask == SH_CLK_DIV6_MSK) {
+                int ret = sh_clk_div_set_rate(clk, clk->rate);
+                if (ret < 0)
+                        return ret;
+        }
+
         sh_clk_write(sh_clk_read(clk) & ~CPG_CKSTP_BIT, clk);
         return 0;
 }
diff --git a/drivers/staging/comedi/Kconfig b/drivers/staging/comedi/Kconfig
index 7de2a10213bd..36eec320569c 100644
--- a/drivers/staging/comedi/Kconfig
+++ b/drivers/staging/comedi/Kconfig
@@ -444,6 +444,7 @@ config COMEDI_ADQ12B
 
 config COMEDI_NI_AT_A2150
         tristate "NI AT-A2150 ISA card support"
+        select COMEDI_FC
         depends on VIRT_TO_BUS
         ---help---
           Enable support for National Instruments AT-A2150 cards
diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
index b7bba1790a20..9b038e4a7e71 100644
--- a/drivers/staging/comedi/comedi_fops.c
+++ b/drivers/staging/comedi/comedi_fops.c
@@ -1549,6 +1549,9 @@ static long comedi_unlocked_ioctl(struct file *file, unsigned int cmd,
         if (cmd == COMEDI_DEVCONFIG) {
                 rc = do_devconfig_ioctl(dev,
                                         (struct comedi_devconfig __user *)arg);
+                if (rc == 0)
+                        /* Evade comedi_auto_unconfig(). */
+                        dev_file_info->hardware_device = NULL;
                 goto done;
         }
 
diff --git a/drivers/staging/comedi/drivers/comedi_test.c b/drivers/staging/comedi/drivers/comedi_test.c
index fb3d09323ba1..01de996239f1 100644
--- a/drivers/staging/comedi/drivers/comedi_test.c
+++ b/drivers/staging/comedi/drivers/comedi_test.c
@@ -345,7 +345,7 @@ static int waveform_ai_cancel(struct comedi_device *dev,
         struct waveform_private *devpriv = dev->private;
 
         devpriv->timer_running = 0;
-        del_timer(&devpriv->timer);
+        del_timer_sync(&devpriv->timer);
         return 0;
 }
 
diff --git a/drivers/staging/comedi/drivers/ni_pcimio.c b/drivers/staging/comedi/drivers/ni_pcimio.c
index aaac0b2cc9eb..fd1662b4175d 100644
--- a/drivers/staging/comedi/drivers/ni_pcimio.c
+++ b/drivers/staging/comedi/drivers/ni_pcimio.c
@@ -963,7 +963,7 @@ static const struct ni_board_struct ni_boards[] = {
          .ao_range_table = &range_ni_M_625x_ao,
          .reg_type = ni_reg_625x,
          .ao_unipolar = 0,
-         .ao_speed = 357,
+         .ao_speed = 350,
          .num_p0_dio_channels = 8,
          .caldac = {caldac_none},
          .has_8255 = 0,
@@ -982,7 +982,7 @@ static const struct ni_board_struct ni_boards[] = {
          .ao_range_table = &range_ni_M_625x_ao,
          .reg_type = ni_reg_625x,
          .ao_unipolar = 0,
-         .ao_speed = 357,
+         .ao_speed = 350,
          .num_p0_dio_channels = 8,
          .caldac = {caldac_none},
          .has_8255 = 0,
@@ -1001,7 +1001,7 @@ static const struct ni_board_struct ni_boards[] = {
          .ao_range_table = &range_ni_M_625x_ao,
          .reg_type = ni_reg_625x,
          .ao_unipolar = 0,
-         .ao_speed = 357,
+         .ao_speed = 350,
          .num_p0_dio_channels = 8,
          .caldac = {caldac_none},
          .has_8255 = 0,
@@ -1037,7 +1037,7 @@ static const struct ni_board_struct ni_boards[] = {
          .ao_range_table = &range_ni_M_625x_ao,
          .reg_type = ni_reg_625x,
          .ao_unipolar = 0,
-         .ao_speed = 357,
+         .ao_speed = 350,
          .num_p0_dio_channels = 32,
          .caldac = {caldac_none},
          .has_8255 = 0,
@@ -1056,7 +1056,7 @@ static const struct ni_board_struct ni_boards[] = {
          .ao_range_table = &range_ni_M_625x_ao,
          .reg_type = ni_reg_625x,
          .ao_unipolar = 0,
-         .ao_speed = 357,
+         .ao_speed = 350,
          .num_p0_dio_channels = 32,
          .caldac = {caldac_none},
          .has_8255 = 0,
@@ -1092,7 +1092,7 @@ static const struct ni_board_struct ni_boards[] = {
          .ao_range_table = &range_ni_M_628x_ao,
          .reg_type = ni_reg_628x,
          .ao_unipolar = 1,
-         .ao_speed = 357,
+         .ao_speed = 350,
          .num_p0_dio_channels = 8,
          .caldac = {caldac_none},
          .has_8255 = 0,
@@ -1111,7 +1111,7 @@ static const struct ni_board_struct ni_boards[] = {
          .ao_range_table = &range_ni_M_628x_ao,
          .reg_type = ni_reg_628x,
          .ao_unipolar = 1,
-         .ao_speed = 357,
+         .ao_speed = 350,
          .num_p0_dio_channels = 8,
          .caldac = {caldac_none},
          .has_8255 = 0,
@@ -1147,7 +1147,7 @@ static const struct ni_board_struct ni_boards[] = {
          .ao_range_table = &range_ni_M_628x_ao,
          .reg_type = ni_reg_628x,
          .ao_unipolar = 1,
-         .ao_speed = 357,
+         .ao_speed = 350,
          .num_p0_dio_channels = 32,
          .caldac = {caldac_none},
          .has_8255 = 0,
diff --git a/drivers/staging/fwserial/Kconfig b/drivers/staging/fwserial/Kconfig
index 580406cb1808..b2f8331e4acf 100644
--- a/drivers/staging/fwserial/Kconfig
+++ b/drivers/staging/fwserial/Kconfig
@@ -3,7 +3,9 @@ config FIREWIRE_SERIAL
        depends on FIREWIRE
        help
           This enables TTY over IEEE 1394, providing high-speed serial
-          connectivity to cabled peers.
+          connectivity to cabled peers. This driver implements a
+          ad-hoc transport protocol and is currently limited to
+          Linux-to-Linux communication.
 
           To compile this driver as a module, say M here:  the module will
           be called firewire-serial.
diff --git a/drivers/staging/fwserial/TODO b/drivers/staging/fwserial/TODO
index 726900548eae..8dae8fb25223 100644
--- a/drivers/staging/fwserial/TODO
+++ b/drivers/staging/fwserial/TODO
@@ -1,5 +1,5 @@
-TODOs
------
+TODOs prior to this driver moving out of staging
+------------------------------------------------
 1. Implement retries for RCODE_BUSY, RCODE_NO_ACK and RCODE_SEND_ERROR
    - I/O is handled asynchronously which presents some issues when error
      conditions occur.
@@ -11,17 +11,9 @@ TODOs
 -- Issues with firewire stack --
 1. This driver uses the same unregistered vendor id that the firewire core does
      (0xd00d1e). Perhaps this could be exposed as a define in
-     firewire-constants.h?
-2. MAX_ASYNC_PAYLOAD needs to be publicly exposed by core/ohci
-   - otherwise how will this driver know the max size of address window to
-     open for one packet write?
+     firewire.h?
 3. Maybe device_max_receive() and link_speed_to_max_payload() should be
      taken up by the firewire core?
-4. To avoid dropping rx data while still limiting the maximum buffering,
-     the size of the AR context must be known. How to expose this to drivers?
-5. Explore if bigger AR context will reduce RCODE_BUSY responses
-   (or auto-grow to certain max size -- but this would require major surgery
-    as the current AR is contiguously mapped)
 
 -- Issues with TTY core --
   1. Hack for alternate device name scheme
diff --git a/drivers/staging/fwserial/fwserial.c b/drivers/staging/fwserial/fwserial.c
index 61ee29083b26..d03a7f57e8d4 100644
--- a/drivers/staging/fwserial/fwserial.c
+++ b/drivers/staging/fwserial/fwserial.c
@@ -179,7 +179,7 @@ static void dump_profile(struct seq_file *m, struct stats *stats)
 /* Returns the max receive packet size for the given card */
 static inline int device_max_receive(struct fw_device *fw_device)
 {
-        return 1 <<  (clamp_t(int, fw_device->max_rec, 8U, 13U) + 1);
+        return 1 <<  (clamp_t(int, fw_device->max_rec, 8U, 11U) + 1);
 }
 
 static void fwtty_log_tx_error(struct fwtty_port *port, int rcode)
diff --git a/drivers/staging/fwserial/fwserial.h b/drivers/staging/fwserial/fwserial.h
index 8b572edf9563..caa1c1ea82d5 100644
--- a/drivers/staging/fwserial/fwserial.h
+++ b/drivers/staging/fwserial/fwserial.h
@@ -374,10 +374,10 @@ static inline void fwtty_bind_console(struct fwtty_port *port,
  */
 static inline int link_speed_to_max_payload(unsigned speed)
 {
-        static const int max_async[] = { 307, 614, 1229, 2458, 4916, 9832, };
-        BUILD_BUG_ON(ARRAY_SIZE(max_async) - 1 != SCODE_3200);
+        static const int max_async[] = { 307, 614, 1229, 2458, };
+        BUILD_BUG_ON(ARRAY_SIZE(max_async) - 1 != SCODE_800);
 
-        speed = clamp(speed, (unsigned) SCODE_100, (unsigned) SCODE_3200);
+        speed = clamp(speed, (unsigned) SCODE_100, (unsigned) SCODE_800);
         if (limit_bw)
                 return max_async[speed];
         else
diff --git a/drivers/staging/iio/gyro/Kconfig b/drivers/staging/iio/gyro/Kconfig
index ea295b25308c..87979a0d03a9 100644
--- a/drivers/staging/iio/gyro/Kconfig
+++ b/drivers/staging/iio/gyro/Kconfig
@@ -27,8 +27,8 @@ config ADIS16130
 config ADIS16260
         tristate "Analog Devices ADIS16260 Digital Gyroscope Sensor SPI driver"
         depends on SPI
-        select IIO_TRIGGER if IIO_BUFFER
-        select IIO_SW_RING if IIO_BUFFER
+        select IIO_ADIS_LIB
+        select IIO_ADIS_LIB_BUFFER if IIO_BUFFER
         help
           Say yes here to build support for Analog Devices ADIS16260 ADIS16265
           ADIS16250 ADIS16255 and ADIS16251 programmable digital gyroscope sensors.
diff --git a/drivers/staging/imx-drm/imx-drm-core.c b/drivers/staging/imx-drm/imx-drm-core.c
index ecf0f44bc70e..cec19f1cf56c 100644
--- a/drivers/staging/imx-drm/imx-drm-core.c
+++ b/drivers/staging/imx-drm/imx-drm-core.c
@@ -584,7 +584,6 @@ int imx_drm_add_encoder(struct drm_encoder *encoder,
 
         ret = imx_drm_encoder_register(imx_drm_encoder);
         if (ret) {
-                kfree(imx_drm_encoder);
                 ret = -ENOMEM;
                 goto err_register;
         }
diff --git a/drivers/staging/imx-drm/ipu-v3/ipu-common.c b/drivers/staging/imx-drm/ipu-v3/ipu-common.c
index 677e665ca86d..f7059cddd7fd 100644
--- a/drivers/staging/imx-drm/ipu-v3/ipu-common.c
+++ b/drivers/staging/imx-drm/ipu-v3/ipu-common.c
@@ -1104,7 +1104,9 @@ static int ipu_probe(struct platform_device *pdev)
         if (ret)
                 goto out_failed_irq;
 
-        ipu_reset(ipu);
+        ret = ipu_reset(ipu);
+        if (ret)
+                goto out_failed_reset;
 
         /* Set MCU_T to divide MCU access window into 2 */
         ipu_cm_write(ipu, 0x00400000L | (IPU_MCU_T_DEFAULT << 18),
@@ -1129,6 +1131,7 @@ failed_add_clients:
         ipu_submodules_exit(ipu);
 failed_submodules_init:
         ipu_irq_exit(ipu);
+out_failed_reset:
 out_failed_irq:
         clk_disable_unprepare(ipu->clk);
 failed_clk_get:
diff --git a/drivers/staging/imx-drm/ipuv3-crtc.c b/drivers/staging/imx-drm/ipuv3-crtc.c
index 1892006526b5..4b3a019409b5 100644
--- a/drivers/staging/imx-drm/ipuv3-crtc.c
+++ b/drivers/staging/imx-drm/ipuv3-crtc.c
@@ -452,7 +452,7 @@ static int ipu_get_resources(struct ipu_crtc *ipu_crtc,
         int ret;
 
         ipu_crtc->ipu_ch = ipu_idmac_get(ipu, pdata->dma[0]);
-        if (IS_ERR_OR_NULL(ipu_crtc->ipu_ch)) {
+        if (IS_ERR(ipu_crtc->ipu_ch)) {
                 ret = PTR_ERR(ipu_crtc->ipu_ch);
                 goto err_out;
         }
@@ -472,7 +472,7 @@ static int ipu_get_resources(struct ipu_crtc *ipu_crtc,
         if (pdata->dp >= 0) {
                 ipu_crtc->dp = ipu_dp_get(ipu, pdata->dp);
                 if (IS_ERR(ipu_crtc->dp)) {
-                        ret = PTR_ERR(ipu_crtc->ipu_ch);
+                        ret = PTR_ERR(ipu_crtc->dp);
                         goto err_out;
                 }
         }
@@ -548,6 +548,8 @@ static int ipu_drm_probe(struct platform_device *pdev)
         ipu_crtc->dev = &pdev->dev;
 
         ret = ipu_crtc_init(ipu_crtc, pdata);
+        if (ret)
+                return ret;
 
         platform_set_drvdata(pdev, ipu_crtc);
 
diff --git a/drivers/staging/omapdrm/Makefile b/drivers/staging/omapdrm/Makefile
index 1ca0e0016de4..d85e058f2845 100644
--- a/drivers/staging/omapdrm/Makefile
+++ b/drivers/staging/omapdrm/Makefile
@@ -5,6 +5,7 @@
 
 ccflags-y := -Iinclude/drm -Werror
 omapdrm-y := omap_drv.o \
+        omap_irq.o \
         omap_debugfs.o \
         omap_crtc.o \
         omap_plane.o \
diff --git a/drivers/staging/omapdrm/TODO b/drivers/staging/omapdrm/TODO
index 938c7888ca31..abeeb00aaa12 100644
--- a/drivers/staging/omapdrm/TODO
+++ b/drivers/staging/omapdrm/TODO
@@ -17,9 +17,6 @@ TODO
 . Revisit GEM sync object infrastructure.. TTM has some framework for this
   already.  Possibly this could be refactored out and made more common?
   There should be some way to do this with less wheel-reinvention.
-. Review DSS vs KMS mismatches.  The omap_dss_device is sort of part encoder,
-  part connector.  Which results in a bit of duct tape to fwd calls from
-  encoder to connector.  Possibly this could be done a bit better.
 . Solve PM sequencing on resume.  DMM/TILER must be reloaded before any
   access is made from any component in the system.  Which means on suspend
   CRTC's should be disabled, and on resume the LUT should be reprogrammed
diff --git a/drivers/staging/omapdrm/omap_connector.c b/drivers/staging/omapdrm/omap_connector.c
index 91edb3f96972..4cc9ee733c5f 100644
--- a/drivers/staging/omapdrm/omap_connector.c
+++ b/drivers/staging/omapdrm/omap_connector.c
@@ -31,9 +31,10 @@
 struct omap_connector {
         struct drm_connector base;
         struct omap_dss_device *dssdev;
+        struct drm_encoder *encoder;
 };
 
-static inline void copy_timings_omap_to_drm(struct drm_display_mode *mode,
+void copy_timings_omap_to_drm(struct drm_display_mode *mode,
                 struct omap_video_timings *timings)
 {
         mode->clock = timings->pixel_clock;
@@ -64,7 +65,7 @@ static inline void copy_timings_omap_to_drm(struct drm_display_mode *mode,
                 mode->flags |= DRM_MODE_FLAG_NVSYNC;
 }
 
-static inline void copy_timings_drm_to_omap(struct omap_video_timings *timings,
+void copy_timings_drm_to_omap(struct omap_video_timings *timings,
                 struct drm_display_mode *mode)
 {
         timings->pixel_clock = mode->clock;
@@ -96,48 +97,7 @@ static inline void copy_timings_drm_to_omap(struct omap_video_timings *timings,
         timings->sync_pclk_edge = OMAPDSS_DRIVE_SIG_OPPOSITE_EDGES;
 }
 
-static void omap_connector_dpms(struct drm_connector *connector, int mode)
-{
-        struct omap_connector *omap_connector = to_omap_connector(connector);
-        struct omap_dss_device *dssdev = omap_connector->dssdev;
-        int old_dpms;
-
-        DBG("%s: %d", dssdev->name, mode);
-
-        old_dpms = connector->dpms;
-
-        /* from off to on, do from crtc to connector */
-        if (mode < old_dpms)
-                drm_helper_connector_dpms(connector, mode);
-
-        if (mode == DRM_MODE_DPMS_ON) {
-                /* store resume info for suspended displays */
-                switch (dssdev->state) {
-                case OMAP_DSS_DISPLAY_SUSPENDED:
-                        dssdev->activate_after_resume = true;
-                        break;
-                case OMAP_DSS_DISPLAY_DISABLED: {
-                        int ret = dssdev->driver->enable(dssdev);
-                        if (ret) {
-                                DBG("%s: failed to enable: %d",
-                                                dssdev->name, ret);
-                                dssdev->driver->disable(dssdev);
-                        }
-                        break;
-                }
-                default:
-                        break;
-                }
-        } else {
-                /* TODO */
-        }
-
-        /* from on to off, do from connector to crtc */
-        if (mode > old_dpms)
-                drm_helper_connector_dpms(connector, mode);
-}
-
-enum drm_connector_status omap_connector_detect(
+static enum drm_connector_status omap_connector_detect(
                 struct drm_connector *connector, bool force)
 {
         struct omap_connector *omap_connector = to_omap_connector(connector);
@@ -164,8 +124,6 @@ static void omap_connector_destroy(struct drm_connector *connector)
         struct omap_connector *omap_connector = to_omap_connector(connector);
         struct omap_dss_device *dssdev = omap_connector->dssdev;
 
-        dssdev->driver->disable(dssdev);
-
         DBG("%s", omap_connector->dssdev->name);
         drm_sysfs_connector_remove(connector);
         drm_connector_cleanup(connector);
@@ -261,36 +219,12 @@ static int omap_connector_mode_valid(struct drm_connector *connector,
 struct drm_encoder *omap_connector_attached_encoder(
                 struct drm_connector *connector)
 {
-        int i;
         struct omap_connector *omap_connector = to_omap_connector(connector);
-
-        for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
-                struct drm_mode_object *obj;
-
-                if (connector->encoder_ids[i] == 0)
-                        break;
-
-                obj = drm_mode_object_find(connector->dev,
-                                connector->encoder_ids[i],
-                                DRM_MODE_OBJECT_ENCODER);
-
-                if (obj) {
-                        struct drm_encoder *encoder = obj_to_encoder(obj);
-                        struct omap_overlay_manager *mgr =
-                                        omap_encoder_get_manager(encoder);
-                        DBG("%s: found %s", omap_connector->dssdev->name,
-                                        mgr->name);
-                        return encoder;
-                }
-        }
-
-        DBG("%s: no encoder", omap_connector->dssdev->name);
-
-        return NULL;
+        return omap_connector->encoder;
 }
 
 static const struct drm_connector_funcs omap_connector_funcs = {
-        .dpms = omap_connector_dpms,
+        .dpms = drm_helper_connector_dpms,
         .detect = omap_connector_detect,
         .fill_modes = drm_helper_probe_single_connector_modes,
         .destroy = omap_connector_destroy,
@@ -302,34 +236,6 @@ static const struct drm_connector_helper_funcs omap_connector_helper_funcs = {
         .best_encoder = omap_connector_attached_encoder,
 };
 
-/* called from encoder when mode is set, to propagate settings to the dssdev */
-void omap_connector_mode_set(struct drm_connector *connector,
-                struct drm_display_mode *mode)
-{
-        struct drm_device *dev = connector->dev;
-        struct omap_connector *omap_connector = to_omap_connector(connector);
-        struct omap_dss_device *dssdev = omap_connector->dssdev;
-        struct omap_dss_driver *dssdrv = dssdev->driver;
-        struct omap_video_timings timings = {0};
-
-        copy_timings_drm_to_omap(&timings, mode);
-
-        DBG("%s: set mode: %d:\"%s\" %d %d %d %d %d %d %d %d %d %d 0x%x 0x%x",
-                        omap_connector->dssdev->name,
-                        mode->base.id, mode->name, mode->vrefresh, mode->clock,
-                        mode->hdisplay, mode->hsync_start,
-                        mode->hsync_end, mode->htotal,
-                        mode->vdisplay, mode->vsync_start,
-                        mode->vsync_end, mode->vtotal, mode->type, mode->flags);
-
-        if (dssdrv->check_timings(dssdev, &timings)) {
-                dev_err(dev->dev, "could not set timings\n");
-                return;
-        }
-
-        dssdrv->set_timings(dssdev, &timings);
-}
-
 /* flush an area of the framebuffer (in case of manual update display that
  * is not automatically flushed)
  */
@@ -344,7 +250,8 @@ void omap_connector_flush(struct drm_connector *connector,
 
 /* initialize connector */
 struct drm_connector *omap_connector_init(struct drm_device *dev,
-                int connector_type, struct omap_dss_device *dssdev)
+                int connector_type, struct omap_dss_device *dssdev,
+                struct drm_encoder *encoder)
 {
         struct drm_connector *connector = NULL;
         struct omap_connector *omap_connector;
@@ -360,6 +267,8 @@ struct drm_connector *omap_connector_init(struct drm_device *dev,
         }
 
         omap_connector->dssdev = dssdev;
+        omap_connector->encoder = encoder;
+
         connector = &omap_connector->base;
 
         drm_connector_init(dev, connector, &omap_connector_funcs,
diff --git a/drivers/staging/omapdrm/omap_crtc.c b/drivers/staging/omapdrm/omap_crtc.c
index d87bd84257bd..510942e67020 100644
--- a/drivers/staging/omapdrm/omap_crtc.c
+++ b/drivers/staging/omapdrm/omap_crtc.c
@@ -28,19 +28,131 @@
 struct omap_crtc {
         struct drm_crtc base;
         struct drm_plane *plane;
+
         const char *name;
-        int id;
+        int pipe;
+        enum omap_channel channel;
+        struct omap_overlay_manager_info info;
+
+        /*
+         * Temporary: eventually this will go away, but it is needed
+         * for now to keep the output's happy.  (They only need
+         * mgr->id.)  Eventually this will be replaced w/ something
+         * more common-panel-framework-y
+         */
+        struct omap_overlay_manager mgr;
+
+        struct omap_video_timings timings;
+        bool enabled;
+        bool full_update;
+
+        struct omap_drm_apply apply;
+
+        struct omap_drm_irq apply_irq;
+        struct omap_drm_irq error_irq;
+
+        /* list of in-progress apply's: */
+        struct list_head pending_applies;
+
+        /* list of queued apply's: */
+        struct list_head queued_applies;
+
+        /* for handling queued and in-progress applies: */
+        struct work_struct apply_work;
 
         /* if there is a pending flip, these will be non-null: */
         struct drm_pending_vblank_event *event;
         struct drm_framebuffer *old_fb;
+
+        /* for handling page flips without caring about what
+         * the callback is called from.  Possibly we should just
+         * make omap_gem always call the cb from the worker so
+         * we don't have to care about this..
+         *
+         * XXX maybe fold into apply_work??
+         */
+        struct work_struct page_flip_work;
+};
+
+/*
+ * Manager-ops, callbacks from output when they need to configure
+ * the upstream part of the video pipe.
+ *
+ * Most of these we can ignore until we add support for command-mode
+ * panels.. for video-mode the crtc-helpers already do an adequate
+ * job of sequencing the setup of the video pipe in the proper order
+ */
+
+/* we can probably ignore these until we support command-mode panels: */
+static void omap_crtc_start_update(struct omap_overlay_manager *mgr)
+{
+}
+
+static int omap_crtc_enable(struct omap_overlay_manager *mgr)
+{
+        return 0;
+}
+
+static void omap_crtc_disable(struct omap_overlay_manager *mgr)
+{
+}
+
+static void omap_crtc_set_timings(struct omap_overlay_manager *mgr,
+                const struct omap_video_timings *timings)
+{
+        struct omap_crtc *omap_crtc = container_of(mgr, struct omap_crtc, mgr);
+        DBG("%s", omap_crtc->name);
+        omap_crtc->timings = *timings;
+        omap_crtc->full_update = true;
+}
+
+static void omap_crtc_set_lcd_config(struct omap_overlay_manager *mgr,
+                const struct dss_lcd_mgr_config *config)
+{
+        struct omap_crtc *omap_crtc = container_of(mgr, struct omap_crtc, mgr);
+        DBG("%s", omap_crtc->name);
+        dispc_mgr_set_lcd_config(omap_crtc->channel, config);
+}
+
+static int omap_crtc_register_framedone_handler(
+                struct omap_overlay_manager *mgr,
+                void (*handler)(void *), void *data)
+{
+        return 0;
+}
+
+static void omap_crtc_unregister_framedone_handler(
+                struct omap_overlay_manager *mgr,
+                void (*handler)(void *), void *data)
+{
+}
+
+static const struct dss_mgr_ops mgr_ops = {
+                .start_update = omap_crtc_start_update,
+                .enable = omap_crtc_enable,
+                .disable = omap_crtc_disable,
+                .set_timings = omap_crtc_set_timings,
+                .set_lcd_config = omap_crtc_set_lcd_config,
+                .register_framedone_handler = omap_crtc_register_framedone_handler,
+                .unregister_framedone_handler = omap_crtc_unregister_framedone_handler,
 };
 
+/*
+ * CRTC funcs:
+ */
+
 static void omap_crtc_destroy(struct drm_crtc *crtc)
 {
         struct omap_crtc *omap_crtc = to_omap_crtc(crtc);
+
+        DBG("%s", omap_crtc->name);
+
+        WARN_ON(omap_crtc->apply_irq.registered);
+        omap_irq_unregister(crtc->dev, &omap_crtc->error_irq);
+
         omap_crtc->plane->funcs->destroy(omap_crtc->plane);
         drm_crtc_cleanup(crtc);
+
         kfree(omap_crtc);
 }
 
@@ -48,14 +160,25 @@ static void omap_crtc_dpms(struct drm_crtc *crtc, int mode)
 {
         struct omap_drm_private *priv = crtc->dev->dev_private;
         struct omap_crtc *omap_crtc = to_omap_crtc(crtc);
+        bool enabled = (mode == DRM_MODE_DPMS_ON);
         int i;
 
-        WARN_ON(omap_plane_dpms(omap_crtc->plane, mode));
+        DBG("%s: %d", omap_crtc->name, mode);
+
+        if (enabled != omap_crtc->enabled) {
+                omap_crtc->enabled = enabled;
+                omap_crtc->full_update = true;
+                omap_crtc_apply(crtc, &omap_crtc->apply);
 
-        for (i = 0; i < priv->num_planes; i++) {
-                struct drm_plane *plane = priv->planes[i];
-                if (plane->crtc == crtc)
-                        WARN_ON(omap_plane_dpms(plane, mode));
+                /* also enable our private plane: */
+                WARN_ON(omap_plane_dpms(omap_crtc->plane, mode));
+
+                /* and any attached overlay planes: */
+                for (i = 0; i < priv->num_planes; i++) {
+                        struct drm_plane *plane = priv->planes[i];
+                        if (plane->crtc == crtc)
+                                WARN_ON(omap_plane_dpms(plane, mode));
+                }
         }
 }
 
@@ -73,12 +196,26 @@ static int omap_crtc_mode_set(struct drm_crtc *crtc,
                 struct drm_framebuffer *old_fb)
 {
         struct omap_crtc *omap_crtc = to_omap_crtc(crtc);
-        struct drm_plane *plane = omap_crtc->plane;
 
-        return omap_plane_mode_set(plane, crtc, crtc->fb,
+        mode = adjusted_mode;
+
+        DBG("%s: set mode: %d:\"%s\" %d %d %d %d %d %d %d %d %d %d 0x%x 0x%x",
+                        omap_crtc->name, mode->base.id, mode->name,
+                        mode->vrefresh, mode->clock,
+                        mode->hdisplay, mode->hsync_start,
+                        mode->hsync_end, mode->htotal,
+                        mode->vdisplay, mode->vsync_start,
+                        mode->vsync_end, mode->vtotal,
+                        mode->type, mode->flags);
+
+        copy_timings_drm_to_omap(&omap_crtc->timings, mode);
+        omap_crtc->full_update = true;
+
+        return omap_plane_mode_set(omap_crtc->plane, crtc, crtc->fb,
                         0, 0, mode->hdisplay, mode->vdisplay,
                         x << 16, y << 16,
-                        mode->hdisplay << 16, mode->vdisplay << 16);
+                        mode->hdisplay << 16, mode->vdisplay << 16,
+                        NULL, NULL);
 }
 
 static void omap_crtc_prepare(struct drm_crtc *crtc)
@@ -102,10 +239,11 @@ static int omap_crtc_mode_set_base(struct drm_crtc *crtc, int x, int y,
         struct drm_plane *plane = omap_crtc->plane;
         struct drm_display_mode *mode = &crtc->mode;
 
-        return plane->funcs->update_plane(plane, crtc, crtc->fb,
+        return omap_plane_mode_set(plane, crtc, crtc->fb,
                         0, 0, mode->hdisplay, mode->vdisplay,
                         x << 16, y << 16,
-                        mode->hdisplay << 16, mode->vdisplay << 16);
+                        mode->hdisplay << 16, mode->vdisplay << 16,
+                        NULL, NULL);
 }
 
 static void omap_crtc_load_lut(struct drm_crtc *crtc)
@@ -114,63 +252,54 @@ static void omap_crtc_load_lut(struct drm_crtc *crtc)
 
 static void vblank_cb(void *arg)
 {
-        static uint32_t sequence;
         struct drm_crtc *crtc = arg;
         struct drm_device *dev = crtc->dev;
         struct omap_crtc *omap_crtc = to_omap_crtc(crtc);
-        struct drm_pending_vblank_event *event = omap_crtc->event;
         unsigned long flags;
-        struct timeval now;
 
-        WARN_ON(!event);
+        spin_lock_irqsave(&dev->event_lock, flags);
+
+        /* wakeup userspace */
+        if (omap_crtc->event)
+                drm_send_vblank_event(dev, omap_crtc->pipe, omap_crtc->event);
 
         omap_crtc->event = NULL;
+        omap_crtc->old_fb = NULL;
 
-        /* wakeup userspace */
-        if (event) {
-                do_gettimeofday(&now);
-
-                spin_lock_irqsave(&dev->event_lock, flags);
-                /* TODO: we can't yet use the vblank time accounting,
-                 * because omapdss lower layer is the one that knows
-                 * the irq # and registers the handler, which more or
-                 * less defeats how drm_irq works.. for now just fake
-                 * the sequence number and use gettimeofday..
-                 *
-                event->event.sequence = drm_vblank_count_and_time(
-                                dev, omap_crtc->id, &now);
-                 */
-                event->event.sequence = sequence++;
-                event->event.tv_sec = now.tv_sec;
-                event->event.tv_usec = now.tv_usec;
-                list_add_tail(&event->base.link,
-                                &event->base.file_priv->event_list);
-                wake_up_interruptible(&event->base.file_priv->event_wait);
-                spin_unlock_irqrestore(&dev->event_lock, flags);
-        }
+        spin_unlock_irqrestore(&dev->event_lock, flags);
 }
 
-static void page_flip_cb(void *arg)
+static void page_flip_worker(struct work_struct *work)
 {
-        struct drm_crtc *crtc = arg;
-        struct omap_crtc *omap_crtc = to_omap_crtc(crtc);
-        struct drm_framebuffer *old_fb = omap_crtc->old_fb;
+        struct omap_crtc *omap_crtc =
+                        container_of(work, struct omap_crtc, page_flip_work);
+        struct drm_crtc *crtc = &omap_crtc->base;
+        struct drm_device *dev = crtc->dev;
+        struct drm_display_mode *mode = &crtc->mode;
         struct drm_gem_object *bo;
 
-        omap_crtc->old_fb = NULL;
-
-        omap_crtc_mode_set_base(crtc, crtc->x, crtc->y, old_fb);
-
-        /* really we'd like to setup the callback atomically w/ setting the
-         * new scanout buffer to avoid getting stuck waiting an extra vblank
-         * cycle.. for now go for correctness and later figure out speed..
-         */
-        omap_plane_on_endwin(omap_crtc->plane, vblank_cb, crtc);
+        drm_modeset_lock_all(dev);
+        omap_plane_mode_set(omap_crtc->plane, crtc, crtc->fb,
+                        0, 0, mode->hdisplay, mode->vdisplay,
+                        crtc->x << 16, crtc->y << 16,
+                        mode->hdisplay << 16, mode->vdisplay << 16,
+                        vblank_cb, crtc);
+        drm_modeset_unlock_all(dev);
 
         bo = omap_framebuffer_bo(crtc->fb, 0);
         drm_gem_object_unreference_unlocked(bo);
 }
 
+static void page_flip_cb(void *arg)
+{
+        struct drm_crtc *crtc = arg;
+        struct omap_crtc *omap_crtc = to_omap_crtc(crtc);
+        struct omap_drm_private *priv = crtc->dev->dev_private;
+
+        /* avoid assumptions about what ctxt we are called from: */
+        queue_work(priv->wq, &omap_crtc->page_flip_work);
+}
+
 static int omap_crtc_page_flip_locked(struct drm_crtc *crtc,
                  struct drm_framebuffer *fb,
                  struct drm_pending_vblank_event *event)
@@ -179,14 +308,14 @@ static int omap_crtc_page_flip_locked(struct drm_crtc *crtc,
         struct omap_crtc *omap_crtc = to_omap_crtc(crtc);
         struct drm_gem_object *bo;
 
-        DBG("%d -> %d", crtc->fb ? crtc->fb->base.id : -1, fb->base.id);
+        DBG("%d -> %d (event=%p)", crtc->fb ? crtc->fb->base.id : -1,
+                        fb->base.id, event);
 
-        if (omap_crtc->event) {
+        if (omap_crtc->old_fb) {
                 dev_err(dev->dev, "already a pending flip\n");
                 return -EINVAL;
         }
 
-        omap_crtc->old_fb = crtc->fb;
         omap_crtc->event = event;
         crtc->fb = fb;
 
@@ -234,14 +363,244 @@ static const struct drm_crtc_helper_funcs omap_crtc_helper_funcs = {
         .load_lut = omap_crtc_load_lut,
 };
 
+const struct omap_video_timings *omap_crtc_timings(struct drm_crtc *crtc)
+{
+        struct omap_crtc *omap_crtc = to_omap_crtc(crtc);
+        return &omap_crtc->timings;
+}
+
+enum omap_channel omap_crtc_channel(struct drm_crtc *crtc)
+{
+        struct omap_crtc *omap_crtc = to_omap_crtc(crtc);
+        return omap_crtc->channel;
+}
+
+static void omap_crtc_error_irq(struct omap_drm_irq *irq, uint32_t irqstatus)
+{
+        struct omap_crtc *omap_crtc =
+                        container_of(irq, struct omap_crtc, error_irq);
+        struct drm_crtc *crtc = &omap_crtc->base;
+        DRM_ERROR("%s: errors: %08x\n", omap_crtc->name, irqstatus);
+        /* avoid getting in a flood, unregister the irq until next vblank */
+        omap_irq_unregister(crtc->dev, &omap_crtc->error_irq);
+}
+
+static void omap_crtc_apply_irq(struct omap_drm_irq *irq, uint32_t irqstatus)
+{
+        struct omap_crtc *omap_crtc =
+                        container_of(irq, struct omap_crtc, apply_irq);
+        struct drm_crtc *crtc = &omap_crtc->base;
+
+        if (!omap_crtc->error_irq.registered)
+                omap_irq_register(crtc->dev, &omap_crtc->error_irq);
+
+        if (!dispc_mgr_go_busy(omap_crtc->channel)) {
+                struct omap_drm_private *priv =
+                                crtc->dev->dev_private;
+                DBG("%s: apply done", omap_crtc->name);
+                omap_irq_unregister(crtc->dev, &omap_crtc->apply_irq);
+                queue_work(priv->wq, &omap_crtc->apply_work);
+        }
+}
+
+static void apply_worker(struct work_struct *work)
+{
+        struct omap_crtc *omap_crtc =
+                        container_of(work, struct omap_crtc, apply_work);
+        struct drm_crtc *crtc = &omap_crtc->base;
+        struct drm_device *dev = crtc->dev;
+        struct omap_drm_apply *apply, *n;
+        bool need_apply;
+
+        /*
+         * Synchronize everything on mode_config.mutex, to keep
+         * the callbacks and list modification all serialized
+         * with respect to modesetting ioctls from userspace.
+         */
+        drm_modeset_lock_all(dev);
+        dispc_runtime_get();
+
+        /*
+         * If we are still pending a previous update, wait.. when the
+         * pending update completes, we get kicked again.
+         */
+        if (omap_crtc->apply_irq.registered)
+                goto out;
+
+        /* finish up previous apply's: */
+        list_for_each_entry_safe(apply, n,
+                        &omap_crtc->pending_applies, pending_node) {
+                apply->post_apply(apply);
+                list_del(&apply->pending_node);
+        }
+
+        need_apply = !list_empty(&omap_crtc->queued_applies);
+
+        /* then handle the next round of of queued apply's: */
+        list_for_each_entry_safe(apply, n,
+                        &omap_crtc->queued_applies, queued_node) {
+                apply->pre_apply(apply);
+                list_del(&apply->queued_node);
+                apply->queued = false;
+                list_add_tail(&apply->pending_node,
+                                &omap_crtc->pending_applies);
+        }
+
+        if (need_apply) {
+                enum omap_channel channel = omap_crtc->channel;
+
+                DBG("%s: GO", omap_crtc->name);
+
+                if (dispc_mgr_is_enabled(channel)) {
+                        omap_irq_register(dev, &omap_crtc->apply_irq);
+                        dispc_mgr_go(channel);
+                } else {
+                        struct omap_drm_private *priv = dev->dev_private;
+                        queue_work(priv->wq, &omap_crtc->apply_work);
+                }
+        }
+
+out:
+        dispc_runtime_put();
+        drm_modeset_unlock_all(dev);
+}
+
+int omap_crtc_apply(struct drm_crtc *crtc,
+                struct omap_drm_apply *apply)
+{
+        struct omap_crtc *omap_crtc = to_omap_crtc(crtc);
+        struct drm_device *dev = crtc->dev;
+
+        WARN_ON(!mutex_is_locked(&dev->mode_config.mutex));
+
+        /* no need to queue it again if it is already queued: */
+        if (apply->queued)
+                return 0;
+
+        apply->queued = true;
+        list_add_tail(&apply->queued_node, &omap_crtc->queued_applies);
+
+        /*
+         * If there are no currently pending updates, then go ahead and
+         * kick the worker immediately, otherwise it will run again when
+         * the current update finishes.
+         */
+        if (list_empty(&omap_crtc->pending_applies)) {
+                struct omap_drm_private *priv = crtc->dev->dev_private;
+                queue_work(priv->wq, &omap_crtc->apply_work);
+        }
+
+        return 0;
+}
+
+/* called only from apply */
+static void set_enabled(struct drm_crtc *crtc, bool enable)
+{
+        struct drm_device *dev = crtc->dev;
+        struct omap_crtc *omap_crtc = to_omap_crtc(crtc);
+        enum omap_channel channel = omap_crtc->channel;
+        struct omap_irq_wait *wait = NULL;
+
+        if (dispc_mgr_is_enabled(channel) == enable)
+                return;
+
+        /* ignore sync-lost irqs during enable/disable */
+        omap_irq_unregister(crtc->dev, &omap_crtc->error_irq);
+
+        if (dispc_mgr_get_framedone_irq(channel)) {
+                if (!enable) {
+                        wait = omap_irq_wait_init(dev,
+                                        dispc_mgr_get_framedone_irq(channel), 1);
+                }
+        } else {
+                /*
+                 * When we disable digit output, we need to wait until fields
+                 * are done.  Otherwise the DSS is still working, and turning
+                 * off the clocks prevents DSS from going to OFF mode. And when
+                 * enabling, we need to wait for the extra sync losts
+                 */
+                wait = omap_irq_wait_init(dev,
+                                dispc_mgr_get_vsync_irq(channel), 2);
+        }
+
+        dispc_mgr_enable(channel, enable);
+
+        if (wait) {
+                int ret = omap_irq_wait(dev, wait, msecs_to_jiffies(100));
+                if (ret) {
+                        dev_err(dev->dev, "%s: timeout waiting for %s\n",
+                                        omap_crtc->name, enable ? "enable" : "disable");
+                }
+        }
+
+        omap_irq_register(crtc->dev, &omap_crtc->error_irq);
+}
+
+static void omap_crtc_pre_apply(struct omap_drm_apply *apply)
+{
+        struct omap_crtc *omap_crtc =
+                        container_of(apply, struct omap_crtc, apply);
+        struct drm_crtc *crtc = &omap_crtc->base;
+        struct drm_encoder *encoder = NULL;
+
+        DBG("%s: enabled=%d, full=%d", omap_crtc->name,
+                        omap_crtc->enabled, omap_crtc->full_update);
+
+        if (omap_crtc->full_update) {
+                struct omap_drm_private *priv = crtc->dev->dev_private;
+                int i;
+                for (i = 0; i < priv->num_encoders; i++) {
+                        if (priv->encoders[i]->crtc == crtc) {
+                                encoder = priv->encoders[i];
+                                break;
+                        }
+                }
+        }
+
+        if (!omap_crtc->enabled) {
+                set_enabled(&omap_crtc->base, false);
+                if (encoder)
+                        omap_encoder_set_enabled(encoder, false);
+        } else {
+                if (encoder) {
+                        omap_encoder_set_enabled(encoder, false);
+                        omap_encoder_update(encoder, &omap_crtc->mgr,
+                                        &omap_crtc->timings);
+                        omap_encoder_set_enabled(encoder, true);
+                        omap_crtc->full_update = false;
+                }
+
+                dispc_mgr_setup(omap_crtc->channel, &omap_crtc->info);
+                dispc_mgr_set_timings(omap_crtc->channel,
+                                &omap_crtc->timings);
+                set_enabled(&omap_crtc->base, true);
+        }
+
+        omap_crtc->full_update = false;
+}
+
+static void omap_crtc_post_apply(struct omap_drm_apply *apply)
+{
+        /* nothing needed for post-apply */
+}
+
+static const char *channel_names[] = {
+                [OMAP_DSS_CHANNEL_LCD] = "lcd",
+                [OMAP_DSS_CHANNEL_DIGIT] = "tv",
+                [OMAP_DSS_CHANNEL_LCD2] = "lcd2",
+};
+
 /* initialize crtc */
 struct drm_crtc *omap_crtc_init(struct drm_device *dev,
-                struct omap_overlay *ovl, int id)
+                struct drm_plane *plane, enum omap_channel channel, int id)
 {
         struct drm_crtc *crtc = NULL;
-        struct omap_crtc *omap_crtc = kzalloc(sizeof(*omap_crtc), GFP_KERNEL);
+        struct omap_crtc *omap_crtc;
+        struct omap_overlay_manager_info *info;
+
+        DBG("%s", channel_names[channel]);
 
-        DBG("%s", ovl->name);
+        omap_crtc = kzalloc(sizeof(*omap_crtc), GFP_KERNEL);
 
         if (!omap_crtc) {
                 dev_err(dev->dev, "could not allocate CRTC\n");
@@ -250,10 +609,40 @@ struct drm_crtc *omap_crtc_init(struct drm_device *dev,
 
         crtc = &omap_crtc->base;
 
-        omap_crtc->plane = omap_plane_init(dev, ovl, (1 << id), true);
+        INIT_WORK(&omap_crtc->page_flip_work, page_flip_worker);
+        INIT_WORK(&omap_crtc->apply_work, apply_worker);
+
+        INIT_LIST_HEAD(&omap_crtc->pending_applies);
+        INIT_LIST_HEAD(&omap_crtc->queued_applies);
+
+        omap_crtc->apply.pre_apply  = omap_crtc_pre_apply;
+        omap_crtc->apply.post_apply = omap_crtc_post_apply;
+
+        omap_crtc->apply_irq.irqmask = pipe2vbl(id);
+        omap_crtc->apply_irq.irq = omap_crtc_apply_irq;
+
+        omap_crtc->error_irq.irqmask =
+                        dispc_mgr_get_sync_lost_irq(channel);
+        omap_crtc->error_irq.irq = omap_crtc_error_irq;
+        omap_irq_register(dev, &omap_crtc->error_irq);
+
+        omap_crtc->channel = channel;
+        omap_crtc->plane = plane;
         omap_crtc->plane->crtc = crtc;
-        omap_crtc->name = ovl->name;
-        omap_crtc->id = id;
+        omap_crtc->name = channel_names[channel];
+        omap_crtc->pipe = id;
+
+        /* temporary: */
+        omap_crtc->mgr.id = channel;
+
+        dss_install_mgr_ops(&mgr_ops);
+
+        /* TODO: fix hard-coded setup.. add properties! */
+        info = &omap_crtc->info;
+        info->default_color = 0x00000000;
+        info->trans_key = 0x00000000;
+        info->trans_key_type = OMAP_DSS_COLOR_KEY_GFX_DST;
+        info->trans_enabled = false;
 
         drm_crtc_init(dev, crtc, &omap_crtc_funcs);
         drm_crtc_helper_add(crtc, &omap_crtc_helper_funcs);
diff --git a/drivers/staging/omapdrm/omap_debugfs.c b/drivers/staging/omapdrm/omap_debugfs.c
index 2f122e00b51d..e95540b3e2f6 100644
--- a/drivers/staging/omapdrm/omap_debugfs.c
+++ b/drivers/staging/omapdrm/omap_debugfs.c
@@ -72,6 +72,7 @@ static int fb_show(struct seq_file *m, void *arg)
         seq_printf(m, "fbcon ");
         omap_framebuffer_describe(priv->fbdev->fb, m);
 
+        mutex_lock(&dev->mode_config.fb_lock);
         list_for_each_entry(fb, &dev->mode_config.fb_list, head) {
                 if (fb == priv->fbdev->fb)
                         continue;
@@ -79,6 +80,7 @@ static int fb_show(struct seq_file *m, void *arg)
                 seq_printf(m, "user ");
                 omap_framebuffer_describe(fb, m);
         }
+        mutex_unlock(&dev->mode_config.fb_lock);
 
         mutex_unlock(&dev->struct_mutex);
         mutex_unlock(&dev->mode_config.mutex);
diff --git a/drivers/staging/omapdrm/omap_drv.c b/drivers/staging/omapdrm/omap_drv.c
index 84943e5ba1d6..dfdb4ba1e7c6 100644
--- a/drivers/staging/omapdrm/omap_drv.c
+++ b/drivers/staging/omapdrm/omap_drv.c
@@ -74,320 +74,99 @@ static int get_connector_type(struct omap_dss_device *dssdev)
         }
 }
 
-#if 0 /* enable when dss2 supports hotplug */
-static int omap_drm_notifier(struct notifier_block *nb,
-                unsigned long evt, void *arg)
-{
-        switch (evt) {
-        case OMAP_DSS_SIZE_CHANGE:
-        case OMAP_DSS_HOTPLUG_CONNECT:
-        case OMAP_DSS_HOTPLUG_DISCONNECT: {
-                struct drm_device *dev = drm_device;
-                DBG("hotplug event: evt=%d, dev=%p", evt, dev);
-                if (dev)
-                        drm_sysfs_hotplug_event(dev);
-
-                return NOTIFY_OK;
-        }
-        default:  /* don't care about other events for now */
-                return NOTIFY_DONE;
-        }
-}
-#endif
-
-static void dump_video_chains(void)
-{
-        int i;
-
-        DBG("dumping video chains: ");
-        for (i = 0; i < omap_dss_get_num_overlays(); i++) {
-                struct omap_overlay *ovl = omap_dss_get_overlay(i);
-                struct omap_overlay_manager *mgr = ovl->manager;
-                struct omap_dss_device *dssdev = mgr ?
-                                        mgr->get_device(mgr) : NULL;
-                if (dssdev) {
-                        DBG("%d: %s -> %s -> %s", i, ovl->name, mgr->name,
-                                                dssdev->name);
-                } else if (mgr) {
-                        DBG("%d: %s -> %s", i, ovl->name, mgr->name);
-                } else {
-                        DBG("%d: %s", i, ovl->name);
-                }
-        }
-}
-
-/* create encoders for each manager */
-static int create_encoder(struct drm_device *dev,
-                struct omap_overlay_manager *mgr)
-{
-        struct omap_drm_private *priv = dev->dev_private;
-        struct drm_encoder *encoder = omap_encoder_init(dev, mgr);
-
-        if (!encoder) {
-                dev_err(dev->dev, "could not create encoder: %s\n",
-                                mgr->name);
-                return -ENOMEM;
-        }
-
-        BUG_ON(priv->num_encoders >= ARRAY_SIZE(priv->encoders));
-
-        priv->encoders[priv->num_encoders++] = encoder;
-
-        return 0;
-}
-
-/* create connectors for each display device */
-static int create_connector(struct drm_device *dev,
-                struct omap_dss_device *dssdev)
+static int omap_modeset_init(struct drm_device *dev)
 {
         struct omap_drm_private *priv = dev->dev_private;
-        static struct notifier_block *notifier;
-        struct drm_connector *connector;
-        int j;
-
-        if (!dssdev->driver) {
-                dev_warn(dev->dev, "%s has no driver.. skipping it\n",
-                                dssdev->name);
-                return 0;
-        }
+        struct omap_dss_device *dssdev = NULL;
+        int num_ovls = dss_feat_get_num_ovls();
+        int id;
 
-        if (!(dssdev->driver->get_timings ||
-                                dssdev->driver->read_edid)) {
-                dev_warn(dev->dev, "%s driver does not support "
-                        "get_timings or read_edid.. skipping it!\n",
-                        dssdev->name);
-                return 0;
-        }
+        drm_mode_config_init(dev);
 
-        connector = omap_connector_init(dev,
-                        get_connector_type(dssdev), dssdev);
+        omap_drm_irq_install(dev);
 
-        if (!connector) {
-                dev_err(dev->dev, "could not create connector: %s\n",
-                                dssdev->name);
-                return -ENOMEM;
-        }
-
-        BUG_ON(priv->num_connectors >= ARRAY_SIZE(priv->connectors));
+        /*
+         * Create private planes and CRTCs for the last NUM_CRTCs overlay
+         * plus manager:
+         */
+        for (id = 0; id < min(num_crtc, num_ovls); id++) {
+                struct drm_plane *plane;
+                struct drm_crtc *crtc;
 
-        priv->connectors[priv->num_connectors++] = connector;
+                plane = omap_plane_init(dev, id, true);
+                crtc = omap_crtc_init(dev, plane, pipe2chan(id), id);
 
-#if 0 /* enable when dss2 supports hotplug */
-        notifier = kzalloc(sizeof(struct notifier_block), GFP_KERNEL);
-        notifier->notifier_call = omap_drm_notifier;
-        omap_dss_add_notify(dssdev, notifier);
-#else
-        notifier = NULL;
-#endif
+                BUG_ON(priv->num_crtcs >= ARRAY_SIZE(priv->crtcs));
+                priv->crtcs[id] = crtc;
+                priv->num_crtcs++;
 
-        for (j = 0; j < priv->num_encoders; j++) {
-                struct omap_overlay_manager *mgr =
-                        omap_encoder_get_manager(priv->encoders[j]);
-                if (mgr->get_device(mgr) == dssdev) {
-                        drm_mode_connector_attach_encoder(connector,
-                                        priv->encoders[j]);
-                }
+                priv->planes[id] = plane;
+                priv->num_planes++;
         }
 
-        return 0;
-}
-
-/* create up to max_overlays CRTCs mapping to overlays.. by default,
- * connect the overlays to different managers/encoders, giving priority
- * to encoders connected to connectors with a detected connection
- */
-static int create_crtc(struct drm_device *dev, struct omap_overlay *ovl,
-                int *j, unsigned int connected_connectors)
-{
-        struct omap_drm_private *priv = dev->dev_private;
-        struct omap_overlay_manager *mgr = NULL;
-        struct drm_crtc *crtc;
-
-        /* find next best connector, ones with detected connection first
+        /*
+         * Create normal planes for the remaining overlays:
          */
-        while (*j < priv->num_connectors && !mgr) {
-                if (connected_connectors & (1 << *j)) {
-                        struct drm_encoder *encoder =
-                                omap_connector_attached_encoder(
-                                                priv->connectors[*j]);
-                        if (encoder)
-                                mgr = omap_encoder_get_manager(encoder);
+        for (; id < num_ovls; id++) {
+                struct drm_plane *plane = omap_plane_init(dev, id, false);
 
-                }
-                (*j)++;
+                BUG_ON(priv->num_planes >= ARRAY_SIZE(priv->planes));
+                priv->planes[priv->num_planes++] = plane;
         }
 
-        /* if we couldn't find another connected connector, lets start
-         * looking at the unconnected connectors:
-         *
-         * note: it might not be immediately apparent, but thanks to
-         * the !mgr check in both this loop and the one above, the only
-         * way to enter this loop is with *j == priv->num_connectors,
-         * so idx can never go negative.
-         */
-        while (*j < 2 * priv->num_connectors && !mgr) {
-                int idx = *j - priv->num_connectors;
-                if (!(connected_connectors & (1 << idx))) {
-                        struct drm_encoder *encoder =
-                                omap_connector_attached_encoder(
-                                                priv->connectors[idx]);
-                        if (encoder)
-                                mgr = omap_encoder_get_manager(encoder);
+        for_each_dss_dev(dssdev) {
+                struct drm_connector *connector;
+                struct drm_encoder *encoder;
 
+                if (!dssdev->driver) {
+                        dev_warn(dev->dev, "%s has no driver.. skipping it\n",
+                                        dssdev->name);
+                        return 0;
                 }
-                (*j)++;
-        }
-
-        crtc = omap_crtc_init(dev, ovl, priv->num_crtcs);
-
-        if (!crtc) {
-                dev_err(dev->dev, "could not create CRTC: %s\n",
-                                ovl->name);
-                return -ENOMEM;
-        }
 
-        BUG_ON(priv->num_crtcs >= ARRAY_SIZE(priv->crtcs));
-
-        priv->crtcs[priv->num_crtcs++] = crtc;
-
-        return 0;
-}
-
-static int create_plane(struct drm_device *dev, struct omap_overlay *ovl,
-                unsigned int possible_crtcs)
-{
-        struct omap_drm_private *priv = dev->dev_private;
-        struct drm_plane *plane =
-                        omap_plane_init(dev, ovl, possible_crtcs, false);
-
-        if (!plane) {
-                dev_err(dev->dev, "could not create plane: %s\n",
-                                ovl->name);
-                return -ENOMEM;
-        }
-
-        BUG_ON(priv->num_planes >= ARRAY_SIZE(priv->planes));
-
-        priv->planes[priv->num_planes++] = plane;
-
-        return 0;
-}
-
-static int match_dev_name(struct omap_dss_device *dssdev, void *data)
-{
-        return !strcmp(dssdev->name, data);
-}
-
-static unsigned int detect_connectors(struct drm_device *dev)
-{
-        struct omap_drm_private *priv = dev->dev_private;
-        unsigned int connected_connectors = 0;
-        int i;
-
-        for (i = 0; i < priv->num_connectors; i++) {
-                struct drm_connector *connector = priv->connectors[i];
-                if (omap_connector_detect(connector, true) ==
-                                connector_status_connected) {
-                        connected_connectors |= (1 << i);
+                if (!(dssdev->driver->get_timings ||
+                                        dssdev->driver->read_edid)) {
+                        dev_warn(dev->dev, "%s driver does not support "
+                                "get_timings or read_edid.. skipping it!\n",
+                                dssdev->name);
+                        return 0;
                 }
-        }
-
-        return connected_connectors;
-}
 
-static int omap_modeset_init(struct drm_device *dev)
-{
-        const struct omap_drm_platform_data *pdata = dev->dev->platform_data;
-        struct omap_kms_platform_data *kms_pdata = NULL;
-        struct omap_drm_private *priv = dev->dev_private;
-        struct omap_dss_device *dssdev = NULL;
-        int i, j;
-        unsigned int connected_connectors = 0;
+                encoder = omap_encoder_init(dev, dssdev);
 
-        drm_mode_config_init(dev);
-
-        if (pdata && pdata->kms_pdata) {
-                kms_pdata = pdata->kms_pdata;
-
-                /* if platform data is provided by the board file, use it to
-                 * control which overlays, managers, and devices we own.
-                 */
-                for (i = 0; i < kms_pdata->mgr_cnt; i++) {
-                        struct omap_overlay_manager *mgr =
-                                omap_dss_get_overlay_manager(
-                                                kms_pdata->mgr_ids[i]);
-                        create_encoder(dev, mgr);
-                }
-
-                for (i = 0; i < kms_pdata->dev_cnt; i++) {
-                        struct omap_dss_device *dssdev =
-                                omap_dss_find_device(
-                                        (void *)kms_pdata->dev_names[i],
-                                        match_dev_name);
-                        if (!dssdev) {
-                                dev_warn(dev->dev, "no such dssdev: %s\n",
-                                                kms_pdata->dev_names[i]);
-                                continue;
-                        }
-                        create_connector(dev, dssdev);
+                if (!encoder) {
+                        dev_err(dev->dev, "could not create encoder: %s\n",
+                                        dssdev->name);
+                        return -ENOMEM;
                 }
 
-                connected_connectors = detect_connectors(dev);
+                connector = omap_connector_init(dev,
+                                get_connector_type(dssdev), dssdev, encoder);
 
-                j = 0;
-                for (i = 0; i < kms_pdata->ovl_cnt; i++) {
-                        struct omap_overlay *ovl =
-                                omap_dss_get_overlay(kms_pdata->ovl_ids[i]);
-                        create_crtc(dev, ovl, &j, connected_connectors);
+                if (!connector) {
+                        dev_err(dev->dev, "could not create connector: %s\n",
+                                        dssdev->name);
+                        return -ENOMEM;
                 }
 
-                for (i = 0; i < kms_pdata->pln_cnt; i++) {
-                        struct omap_overlay *ovl =
-                                omap_dss_get_overlay(kms_pdata->pln_ids[i]);
-                        create_plane(dev, ovl, (1 << priv->num_crtcs) - 1);
-                }
-        } else {
-                /* otherwise just grab up to CONFIG_DRM_OMAP_NUM_CRTCS and try
-                 * to make educated guesses about everything else
-                 */
-                int max_overlays = min(omap_dss_get_num_overlays(), num_crtc);
+                BUG_ON(priv->num_encoders >= ARRAY_SIZE(priv->encoders));
+                BUG_ON(priv->num_connectors >= ARRAY_SIZE(priv->connectors));
 
-                for (i = 0; i < omap_dss_get_num_overlay_managers(); i++)
-                        create_encoder(dev, omap_dss_get_overlay_manager(i));
-
-                for_each_dss_dev(dssdev) {
-                        create_connector(dev, dssdev);
-                }
+                priv->encoders[priv->num_encoders++] = encoder;
+                priv->connectors[priv->num_connectors++] = connector;
 
-                connected_connectors = detect_connectors(dev);
+                drm_mode_connector_attach_encoder(connector, encoder);
 
-                j = 0;
-                for (i = 0; i < max_overlays; i++) {
-                        create_crtc(dev, omap_dss_get_overlay(i),
-                                        &j, connected_connectors);
-                }
-
-                /* use any remaining overlays as drm planes */
-                for (; i < omap_dss_get_num_overlays(); i++) {
-                        struct omap_overlay *ovl = omap_dss_get_overlay(i);
-                        create_plane(dev, ovl, (1 << priv->num_crtcs) - 1);
+                /* figure out which crtc's we can connect the encoder to: */
+                encoder->possible_crtcs = 0;
+                for (id = 0; id < priv->num_crtcs; id++) {
+                        enum omap_dss_output_id supported_outputs =
+                                        dss_feat_get_supported_outputs(pipe2chan(id));
+                        if (supported_outputs & dssdev->output->id)
+                                encoder->possible_crtcs |= (1 << id);
                 }
         }
 
-        /* for now keep the mapping of CRTCs and encoders static.. */
-        for (i = 0; i < priv->num_encoders; i++) {
-                struct drm_encoder *encoder = priv->encoders[i];
-                struct omap_overlay_manager *mgr =
-                                omap_encoder_get_manager(encoder);
-
-                encoder->possible_crtcs = (1 << priv->num_crtcs) - 1;
-
-                DBG("%s: possible_crtcs=%08x", mgr->name,
-                                        encoder->possible_crtcs);
-        }
-
-        dump_video_chains();
-
         dev->mode_config.min_width = 32;
         dev->mode_config.min_height = 32;
 
@@ -450,7 +229,7 @@ static int ioctl_gem_new(struct drm_device *dev, void *data,
                 struct drm_file *file_priv)
 {
         struct drm_omap_gem_new *args = data;
-        DBG("%p:%p: size=0x%08x, flags=%08x", dev, file_priv,
+        VERB("%p:%p: size=0x%08x, flags=%08x", dev, file_priv,
                         args->size.bytes, args->flags);
         return omap_gem_new_handle(dev, file_priv, args->size,
                         args->flags, &args->handle);
@@ -510,7 +289,7 @@ static int ioctl_gem_info(struct drm_device *dev, void *data,
         struct drm_gem_object *obj;
         int ret = 0;
 
-        DBG("%p:%p: handle=%d", dev, file_priv, args->handle);
+        VERB("%p:%p: handle=%d", dev, file_priv, args->handle);
 
         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
         if (!obj)
@@ -565,14 +344,6 @@ static int dev_load(struct drm_device *dev, unsigned long flags)
 
         dev->dev_private = priv;
 
-        ret = omapdss_compat_init();
-        if (ret) {
-                dev_err(dev->dev, "coult not init omapdss\n");
-                dev->dev_private = NULL;
-                kfree(priv);
-                return ret;
-        }
-
         priv->wq = alloc_ordered_workqueue("omapdrm", 0);
 
         INIT_LIST_HEAD(&priv->obj_list);
@@ -584,10 +355,13 @@ static int dev_load(struct drm_device *dev, unsigned long flags)
                 dev_err(dev->dev, "omap_modeset_init failed: ret=%d\n", ret);
                 dev->dev_private = NULL;
                 kfree(priv);
-                omapdss_compat_uninit();
                 return ret;
         }
 
+        ret = drm_vblank_init(dev, priv->num_crtcs);
+        if (ret)
+                dev_warn(dev->dev, "could not init vblank\n");
+
         priv->fbdev = omap_fbdev_init(dev);
         if (!priv->fbdev) {
                 dev_warn(dev->dev, "omap_fbdev_init failed\n");
@@ -596,10 +370,6 @@ static int dev_load(struct drm_device *dev, unsigned long flags)
 
         drm_kms_helper_poll_init(dev);
 
-        ret = drm_vblank_init(dev, priv->num_crtcs);
-        if (ret)
-                dev_warn(dev->dev, "could not init vblank\n");
-
         return 0;
 }
 
@@ -609,8 +379,9 @@ static int dev_unload(struct drm_device *dev)
 
         DBG("unload: dev=%p", dev);
 
-        drm_vblank_cleanup(dev);
         drm_kms_helper_poll_fini(dev);
+        drm_vblank_cleanup(dev);
+        omap_drm_irq_uninstall(dev);
 
         omap_fbdev_free(dev);
         omap_modeset_free(dev);
@@ -619,8 +390,6 @@ static int dev_unload(struct drm_device *dev)
         flush_workqueue(priv->wq);
         destroy_workqueue(priv->wq);
 
-        omapdss_compat_uninit();
-
         kfree(dev->dev_private);
         dev->dev_private = NULL;
 
@@ -680,7 +449,9 @@ static void dev_lastclose(struct drm_device *dev)
                 }
         }
 
+        drm_modeset_lock_all(dev);
         ret = drm_fb_helper_restore_fbdev_mode(priv->fbdev);
+        drm_modeset_unlock_all(dev);
         if (ret)
                 DBG("failed to restore crtc mode");
 }
@@ -695,60 +466,6 @@ static void dev_postclose(struct drm_device *dev, struct drm_file *file)
         DBG("postclose: dev=%p, file=%p", dev, file);
 }
 
-/**
- * enable_vblank - enable vblank interrupt events
- * @dev: DRM device
- * @crtc: which irq to enable
- *
- * Enable vblank interrupts for @crtc.  If the device doesn't have
- * a hardware vblank counter, this routine should be a no-op, since
- * interrupts will have to stay on to keep the count accurate.
- *
- * RETURNS
- * Zero on success, appropriate errno if the given @crtc's vblank
- * interrupt cannot be enabled.
- */
-static int dev_enable_vblank(struct drm_device *dev, int crtc)
-{
-        DBG("enable_vblank: dev=%p, crtc=%d", dev, crtc);
-        return 0;
-}
-
-/**
- * disable_vblank - disable vblank interrupt events
- * @dev: DRM device
- * @crtc: which irq to enable
- *
- * Disable vblank interrupts for @crtc.  If the device doesn't have
- * a hardware vblank counter, this routine should be a no-op, since
- * interrupts will have to stay on to keep the count accurate.
- */
-static void dev_disable_vblank(struct drm_device *dev, int crtc)
-{
-        DBG("disable_vblank: dev=%p, crtc=%d", dev, crtc);
-}
-
-static irqreturn_t dev_irq_handler(DRM_IRQ_ARGS)
-{
-        return IRQ_HANDLED;
-}
-
-static void dev_irq_preinstall(struct drm_device *dev)
-{
-        DBG("irq_preinstall: dev=%p", dev);
-}
-
-static int dev_irq_postinstall(struct drm_device *dev)
-{
-        DBG("irq_postinstall: dev=%p", dev);
-        return 0;
-}
-
-static void dev_irq_uninstall(struct drm_device *dev)
-{
-        DBG("irq_uninstall: dev=%p", dev);
-}
-
 static const struct vm_operations_struct omap_gem_vm_ops = {
         .fault = omap_gem_fault,
         .open = drm_gem_vm_open,
@@ -778,12 +495,12 @@ static struct drm_driver omap_drm_driver = {
                 .preclose = dev_preclose,
                 .postclose = dev_postclose,
                 .get_vblank_counter = drm_vblank_count,
-                .enable_vblank = dev_enable_vblank,
-                .disable_vblank = dev_disable_vblank,
-                .irq_preinstall = dev_irq_preinstall,
-                .irq_postinstall = dev_irq_postinstall,
-                .irq_uninstall = dev_irq_uninstall,
-                .irq_handler = dev_irq_handler,
+                .enable_vblank = omap_irq_enable_vblank,
+                .disable_vblank = omap_irq_disable_vblank,
+                .irq_preinstall = omap_irq_preinstall,
+                .irq_postinstall = omap_irq_postinstall,
+                .irq_uninstall = omap_irq_uninstall,
+                .irq_handler = omap_irq_handler,
 #ifdef CONFIG_DEBUG_FS
                 .debugfs_init = omap_debugfs_init,
                 .debugfs_cleanup = omap_debugfs_cleanup,
diff --git a/drivers/staging/omapdrm/omap_drv.h b/drivers/staging/omapdrm/omap_drv.h
index 1d4aea53b75d..cd1f22b0b124 100644
--- a/drivers/staging/omapdrm/omap_drv.h
+++ b/drivers/staging/omapdrm/omap_drv.h
@@ -28,6 +28,7 @@
 #include <linux/platform_data/omap_drm.h>
 #include "omap_drm.h"
 
+
 #define DBG(fmt, ...) DRM_DEBUG(fmt"\n", ##__VA_ARGS__)
 #define VERB(fmt, ...) if (0) DRM_DEBUG(fmt, ##__VA_ARGS__) /* verbose debug */
 
@@ -39,6 +40,51 @@
  */
 #define MAX_MAPPERS 2
 
+/* parameters which describe (unrotated) coordinates of scanout within a fb: */
+struct omap_drm_window {
+        uint32_t rotation;
+        int32_t  crtc_x, crtc_y;                /* signed because can be offscreen */
+        uint32_t crtc_w, crtc_h;
+        uint32_t src_x, src_y;
+        uint32_t src_w, src_h;
+};
+
+/* Once GO bit is set, we can't make further updates to shadowed registers
+ * until the GO bit is cleared.  So various parts in the kms code that need
+ * to update shadowed registers queue up a pair of callbacks, pre_apply
+ * which is called before setting GO bit, and post_apply that is called
+ * after GO bit is cleared.  The crtc manages the queuing, and everyone
+ * else goes thru omap_crtc_apply() using these callbacks so that the
+ * code which has to deal w/ GO bit state is centralized.
+ */
+struct omap_drm_apply {
+        struct list_head pending_node, queued_node;
+        bool queued;
+        void (*pre_apply)(struct omap_drm_apply *apply);
+        void (*post_apply)(struct omap_drm_apply *apply);
+};
+
+/* For transiently registering for different DSS irqs that various parts
+ * of the KMS code need during setup/configuration.  We these are not
+ * necessarily the same as what drm_vblank_get/put() are requesting, and
+ * the hysteresis in drm_vblank_put() is not necessarily desirable for
+ * internal housekeeping related irq usage.
+ */
+struct omap_drm_irq {
+        struct list_head node;
+        uint32_t irqmask;
+        bool registered;
+        void (*irq)(struct omap_drm_irq *irq, uint32_t irqstatus);
+};
+
+/* For KMS code that needs to wait for a certain # of IRQs:
+ */
+struct omap_irq_wait;
+struct omap_irq_wait * omap_irq_wait_init(struct drm_device *dev,
+                uint32_t irqmask, int count);
+int omap_irq_wait(struct drm_device *dev, struct omap_irq_wait *wait,
+                unsigned long timeout);
+
 struct omap_drm_private {
         uint32_t omaprev;
 
@@ -58,6 +104,7 @@ struct omap_drm_private {
 
         struct workqueue_struct *wq;
 
+        /* list of GEM objects: */
         struct list_head obj_list;
 
         bool has_dmm;
@@ -65,6 +112,11 @@ struct omap_drm_private {
         /* properties: */
         struct drm_property *rotation_prop;
         struct drm_property *zorder_prop;
+
+        /* irq handling: */
+        struct list_head irq_list;    /* list of omap_drm_irq */
+        uint32_t vblank_mask;         /* irq bits set for userspace vblank */
+        struct omap_drm_irq error_handler;
 };
 
 /* this should probably be in drm-core to standardize amongst drivers */
@@ -75,15 +127,6 @@ struct omap_drm_private {
 #define DRM_REFLECT_X   4
 #define DRM_REFLECT_Y   5
 
-/* parameters which describe (unrotated) coordinates of scanout within a fb: */
-struct omap_drm_window {
-        uint32_t rotation;
-        int32_t  crtc_x, crtc_y;                /* signed because can be offscreen */
-        uint32_t crtc_w, crtc_h;
-        uint32_t src_x, src_y;
-        uint32_t src_w, src_h;
-};
-
 #ifdef CONFIG_DEBUG_FS
 int omap_debugfs_init(struct drm_minor *minor);
 void omap_debugfs_cleanup(struct drm_minor *minor);
@@ -92,23 +135,36 @@ void omap_gem_describe(struct drm_gem_object *obj, struct seq_file *m);
 void omap_gem_describe_objects(struct list_head *list, struct seq_file *m);
 #endif
 
+int omap_irq_enable_vblank(struct drm_device *dev, int crtc);
+void omap_irq_disable_vblank(struct drm_device *dev, int crtc);
+irqreturn_t omap_irq_handler(DRM_IRQ_ARGS);
+void omap_irq_preinstall(struct drm_device *dev);
+int omap_irq_postinstall(struct drm_device *dev);
+void omap_irq_uninstall(struct drm_device *dev);
+void omap_irq_register(struct drm_device *dev, struct omap_drm_irq *irq);
+void omap_irq_unregister(struct drm_device *dev, struct omap_drm_irq *irq);
+int omap_drm_irq_uninstall(struct drm_device *dev);
+int omap_drm_irq_install(struct drm_device *dev);
+
 struct drm_fb_helper *omap_fbdev_init(struct drm_device *dev);
 void omap_fbdev_free(struct drm_device *dev);
 
+const struct omap_video_timings *omap_crtc_timings(struct drm_crtc *crtc);
+enum omap_channel omap_crtc_channel(struct drm_crtc *crtc);
+int omap_crtc_apply(struct drm_crtc *crtc,
+                struct omap_drm_apply *apply);
 struct drm_crtc *omap_crtc_init(struct drm_device *dev,
-                struct omap_overlay *ovl, int id);
+                struct drm_plane *plane, enum omap_channel channel, int id);
 
 struct drm_plane *omap_plane_init(struct drm_device *dev,
-                struct omap_overlay *ovl, unsigned int possible_crtcs,
-                bool priv);
+                int plane_id, bool private_plane);
 int omap_plane_dpms(struct drm_plane *plane, int mode);
 int omap_plane_mode_set(struct drm_plane *plane,
                 struct drm_crtc *crtc, struct drm_framebuffer *fb,
                 int crtc_x, int crtc_y,
                 unsigned int crtc_w, unsigned int crtc_h,
                 uint32_t src_x, uint32_t src_y,
-                uint32_t src_w, uint32_t src_h);
-void omap_plane_on_endwin(struct drm_plane *plane,
+                uint32_t src_w, uint32_t src_h,
                 void (*fxn)(void *), void *arg);
 void omap_plane_install_properties(struct drm_plane *plane,
                 struct drm_mode_object *obj);
@@ -116,21 +172,25 @@ int omap_plane_set_property(struct drm_plane *plane,
                 struct drm_property *property, uint64_t val);
 
 struct drm_encoder *omap_encoder_init(struct drm_device *dev,
-                struct omap_overlay_manager *mgr);
-struct omap_overlay_manager *omap_encoder_get_manager(
+                struct omap_dss_device *dssdev);
+int omap_encoder_set_enabled(struct drm_encoder *encoder, bool enabled);
+int omap_encoder_update(struct drm_encoder *encoder,
+                struct omap_overlay_manager *mgr,
+                struct omap_video_timings *timings);
+
+struct drm_connector *omap_connector_init(struct drm_device *dev,
+                int connector_type, struct omap_dss_device *dssdev,
                 struct drm_encoder *encoder);
 struct drm_encoder *omap_connector_attached_encoder(
                 struct drm_connector *connector);
-enum drm_connector_status omap_connector_detect(
-                struct drm_connector *connector, bool force);
-
-struct drm_connector *omap_connector_init(struct drm_device *dev,
-                int connector_type, struct omap_dss_device *dssdev);
-void omap_connector_mode_set(struct drm_connector *connector,
-                struct drm_display_mode *mode);
 void omap_connector_flush(struct drm_connector *connector,
                 int x, int y, int w, int h);
 
+void copy_timings_omap_to_drm(struct drm_display_mode *mode,
+                struct omap_video_timings *timings);
+void copy_timings_drm_to_omap(struct omap_video_timings *timings,
+                struct drm_display_mode *mode);
+
 uint32_t omap_framebuffer_get_formats(uint32_t *pixel_formats,
                 uint32_t max_formats, enum omap_color_mode supported_modes);
 struct drm_framebuffer *omap_framebuffer_create(struct drm_device *dev,
@@ -207,6 +267,40 @@ static inline int align_pitch(int pitch, int width, int bpp)
         return ALIGN(pitch, 8 * bytespp);
 }
 
+static inline enum omap_channel pipe2chan(int pipe)
+{
+        int num_mgrs = dss_feat_get_num_mgrs();
+
+        /*
+         * We usually don't want to create a CRTC for each manager,
+         * at least not until we have a way to expose private planes
+         * to userspace.  Otherwise there would not be enough video
+         * pipes left for drm planes.  The higher #'d managers tend
+         * to have more features so start in reverse order.
+         */
+        return num_mgrs - pipe - 1;
+}
+
+/* map crtc to vblank mask */
+static inline uint32_t pipe2vbl(int crtc)
+{
+        enum omap_channel channel = pipe2chan(crtc);
+        return dispc_mgr_get_vsync_irq(channel);
+}
+
+static inline int crtc2pipe(struct drm_device *dev, struct drm_crtc *crtc)
+{
+        struct omap_drm_private *priv = dev->dev_private;
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(priv->crtcs); i++)
+                if (priv->crtcs[i] == crtc)
+                        return i;
+
+        BUG();  /* bogus CRTC ptr */
+        return -1;
+}
+
 /* should these be made into common util helpers?
  */
 
diff --git a/drivers/staging/omapdrm/omap_encoder.c b/drivers/staging/omapdrm/omap_encoder.c
index 5341d5e3e317..e053160d2db3 100644
--- a/drivers/staging/omapdrm/omap_encoder.c
+++ b/drivers/staging/omapdrm/omap_encoder.c
@@ -22,37 +22,56 @@
 #include "drm_crtc.h"
 #include "drm_crtc_helper.h"
 
+#include <linux/list.h>
+
+
 /*
  * encoder funcs
  */
 
 #define to_omap_encoder(x) container_of(x, struct omap_encoder, base)
 
+/* The encoder and connector both map to same dssdev.. the encoder
+ * handles the 'active' parts, ie. anything the modifies the state
+ * of the hw, and the connector handles the 'read-only' parts, like
+ * detecting connection and reading edid.
+ */
 struct omap_encoder {
         struct drm_encoder base;
-        struct omap_overlay_manager *mgr;
+        struct omap_dss_device *dssdev;
 };
 
 static void omap_encoder_destroy(struct drm_encoder *encoder)
 {
         struct omap_encoder *omap_encoder = to_omap_encoder(encoder);
-        DBG("%s", omap_encoder->mgr->name);
         drm_encoder_cleanup(encoder);
         kfree(omap_encoder);
 }
 
+static const struct drm_encoder_funcs omap_encoder_funcs = {
+        .destroy = omap_encoder_destroy,
+};
+
+/*
+ * The CRTC drm_crtc_helper_set_mode() doesn't really give us the right
+ * order.. the easiest way to work around this for now is to make all
+ * the encoder-helper's no-op's and have the omap_crtc code take care
+ * of the sequencing and call us in the right points.
+ *
+ * Eventually to handle connecting CRTCs to different encoders properly,
+ * either the CRTC helpers need to change or we need to replace
+ * drm_crtc_helper_set_mode(), but lets wait until atomic-modeset for
+ * that.
+ */
+
 static void omap_encoder_dpms(struct drm_encoder *encoder, int mode)
 {
-        struct omap_encoder *omap_encoder = to_omap_encoder(encoder);
-        DBG("%s: %d", omap_encoder->mgr->name, mode);
 }
 
 static bool omap_encoder_mode_fixup(struct drm_encoder *encoder,
                                   const struct drm_display_mode *mode,
                                   struct drm_display_mode *adjusted_mode)
 {
-        struct omap_encoder *omap_encoder = to_omap_encoder(encoder);
-        DBG("%s", omap_encoder->mgr->name);
         return true;
 }
 
@@ -60,47 +79,16 @@ static void omap_encoder_mode_set(struct drm_encoder *encoder,
                                 struct drm_display_mode *mode,
                                 struct drm_display_mode *adjusted_mode)
 {
-        struct omap_encoder *omap_encoder = to_omap_encoder(encoder);
-        struct drm_device *dev = encoder->dev;
-        struct omap_drm_private *priv = dev->dev_private;
-        int i;
-
-        mode = adjusted_mode;
-
-        DBG("%s: set mode: %dx%d", omap_encoder->mgr->name,
-                        mode->hdisplay, mode->vdisplay);
-
-        for (i = 0; i < priv->num_connectors; i++) {
-                struct drm_connector *connector = priv->connectors[i];
-                if (connector->encoder == encoder)
-                        omap_connector_mode_set(connector, mode);
-
-        }
 }
 
 static void omap_encoder_prepare(struct drm_encoder *encoder)
 {
-        struct omap_encoder *omap_encoder = to_omap_encoder(encoder);
-        struct drm_encoder_helper_funcs *encoder_funcs =
-                                encoder->helper_private;
-        DBG("%s", omap_encoder->mgr->name);
-        encoder_funcs->dpms(encoder, DRM_MODE_DPMS_OFF);
 }
 
 static void omap_encoder_commit(struct drm_encoder *encoder)
 {
-        struct omap_encoder *omap_encoder = to_omap_encoder(encoder);
-        struct drm_encoder_helper_funcs *encoder_funcs =
-                                encoder->helper_private;
-        DBG("%s", omap_encoder->mgr->name);
-        omap_encoder->mgr->apply(omap_encoder->mgr);
-        encoder_funcs->dpms(encoder, DRM_MODE_DPMS_ON);
 }
 
-static const struct drm_encoder_funcs omap_encoder_funcs = {
-        .destroy = omap_encoder_destroy,
-};
-
 static const struct drm_encoder_helper_funcs omap_encoder_helper_funcs = {
         .dpms = omap_encoder_dpms,
         .mode_fixup = omap_encoder_mode_fixup,
@@ -109,23 +97,54 @@ static const struct drm_encoder_helper_funcs omap_encoder_helper_funcs = {
         .commit = omap_encoder_commit,
 };
 
-struct omap_overlay_manager *omap_encoder_get_manager(
-                struct drm_encoder *encoder)
+/*
+ * Instead of relying on the helpers for modeset, the omap_crtc code
+ * calls these functions in the proper sequence.
+ */
+
+int omap_encoder_set_enabled(struct drm_encoder *encoder, bool enabled)
 {
         struct omap_encoder *omap_encoder = to_omap_encoder(encoder);
-        return omap_encoder->mgr;
+        struct omap_dss_device *dssdev = omap_encoder->dssdev;
+        struct omap_dss_driver *dssdrv = dssdev->driver;
+
+        if (enabled) {
+                return dssdrv->enable(dssdev);
+        } else {
+                dssdrv->disable(dssdev);
+                return 0;
+        }
+}
+
+int omap_encoder_update(struct drm_encoder *encoder,
+                struct omap_overlay_manager *mgr,
+                struct omap_video_timings *timings)
+{
+        struct drm_device *dev = encoder->dev;
+        struct omap_encoder *omap_encoder = to_omap_encoder(encoder);
+        struct omap_dss_device *dssdev = omap_encoder->dssdev;
+        struct omap_dss_driver *dssdrv = dssdev->driver;
+        int ret;
+
+        dssdev->output->manager = mgr;
+
+        ret = dssdrv->check_timings(dssdev, timings);
+        if (ret) {
+                dev_err(dev->dev, "could not set timings: %d\n", ret);
+                return ret;
+        }
+
+        dssdrv->set_timings(dssdev, timings);
+
+        return 0;
 }
 
 /* initialize encoder */
 struct drm_encoder *omap_encoder_init(struct drm_device *dev,
-                struct omap_overlay_manager *mgr)
+                struct omap_dss_device *dssdev)
 {
         struct drm_encoder *encoder = NULL;
         struct omap_encoder *omap_encoder;
-        struct omap_overlay_manager_info info;
-        int ret;
-
-        DBG("%s", mgr->name);
 
         omap_encoder = kzalloc(sizeof(*omap_encoder), GFP_KERNEL);
         if (!omap_encoder) {
@@ -133,33 +152,14 @@ struct drm_encoder *omap_encoder_init(struct drm_device *dev,
                 goto fail;
         }
 
-        omap_encoder->mgr = mgr;
+        omap_encoder->dssdev = dssdev;
+
         encoder = &omap_encoder->base;
 
         drm_encoder_init(dev, encoder, &omap_encoder_funcs,
                          DRM_MODE_ENCODER_TMDS);
         drm_encoder_helper_add(encoder, &omap_encoder_helper_funcs);
 
-        mgr->get_manager_info(mgr, &info);
-
-        /* TODO: fix hard-coded setup.. */
-        info.default_color = 0x00000000;
-        info.trans_key = 0x00000000;
-        info.trans_key_type = OMAP_DSS_COLOR_KEY_GFX_DST;
-        info.trans_enabled = false;
-
-        ret = mgr->set_manager_info(mgr, &info);
-        if (ret) {
-                dev_err(dev->dev, "could not set manager info\n");
-                goto fail;
-        }
-
-        ret = mgr->apply(mgr);
-        if (ret) {
-                dev_err(dev->dev, "could not apply\n");
-                goto fail;
-        }
-
         return encoder;
 
 fail:
diff --git a/drivers/staging/omapdrm/omap_fb.c b/drivers/staging/omapdrm/omap_fb.c
index 09028e9c1093..bf6421f26c40 100644
--- a/drivers/staging/omapdrm/omap_fb.c
+++ b/drivers/staging/omapdrm/omap_fb.c
@@ -424,14 +424,6 @@ struct drm_framebuffer *omap_framebuffer_init(struct drm_device *dev,
         }
 
         fb = &omap_fb->base;
-        ret = drm_framebuffer_init(dev, fb, &omap_framebuffer_funcs);
-        if (ret) {
-                dev_err(dev->dev, "framebuffer init failed: %d\n", ret);
-                goto fail;
-        }
-
-        DBG("create: FB ID: %d (%p)", fb->base.id, fb);
-
         omap_fb->format = format;
 
         for (i = 0; i < n; i++) {
@@ -462,6 +454,14 @@ struct drm_framebuffer *omap_framebuffer_init(struct drm_device *dev,
 
         drm_helper_mode_fill_fb_struct(fb, mode_cmd);
 
+        ret = drm_framebuffer_init(dev, fb, &omap_framebuffer_funcs);
+        if (ret) {
+                dev_err(dev->dev, "framebuffer init failed: %d\n", ret);
+                goto fail;
+        }
+
+        DBG("create: FB ID: %d (%p)", fb->base.id, fb);
+
         return fb;
 
 fail:
diff --git a/drivers/staging/omapdrm/omap_fbdev.c b/drivers/staging/omapdrm/omap_fbdev.c
index 8a027bb77d97..2728e37e02be 100644
--- a/drivers/staging/omapdrm/omap_fbdev.c
+++ b/drivers/staging/omapdrm/omap_fbdev.c
@@ -275,8 +275,10 @@ fail:
         if (ret) {
                 if (fbi)
                         framebuffer_release(fbi);
-                if (fb)
+                if (fb) {
+                        drm_framebuffer_unregister_private(fb);
                         drm_framebuffer_remove(fb);
+                }
         }
 
         return ret;
@@ -400,8 +402,10 @@ void omap_fbdev_free(struct drm_device *dev)
         fbdev = to_omap_fbdev(priv->fbdev);
 
         /* this will free the backing object */
-        if (fbdev->fb)
+        if (fbdev->fb) {
+                drm_framebuffer_unregister_private(fbdev->fb);
                 drm_framebuffer_remove(fbdev->fb);
+        }
 
         kfree(fbdev);
 
diff --git a/drivers/staging/omapdrm/omap_gem_dmabuf.c b/drivers/staging/omapdrm/omap_gem_dmabuf.c
index ea3840038250..b6c5b5c6c8c5 100644
--- a/drivers/staging/omapdrm/omap_gem_dmabuf.c
+++ b/drivers/staging/omapdrm/omap_gem_dmabuf.c
@@ -194,7 +194,7 @@ struct dma_buf_ops omap_dmabuf_ops = {
 struct dma_buf *omap_gem_prime_export(struct drm_device *dev,
                 struct drm_gem_object *obj, int flags)
 {
-        return dma_buf_export(obj, &omap_dmabuf_ops, obj->size, 0600);
+        return dma_buf_export(obj, &omap_dmabuf_ops, obj->size, flags);
 }
 
 struct drm_gem_object *omap_gem_prime_import(struct drm_device *dev,
diff --git a/drivers/staging/omapdrm/omap_irq.c b/drivers/staging/omapdrm/omap_irq.c
new file mode 100644
index 000000000000..2629ba7be6c8
--- /dev/null
+++ b/drivers/staging/omapdrm/omap_irq.c
@@ -0,0 +1,322 @@
+/*
+ * drivers/staging/omapdrm/omap_irq.c
+ *
+ * Copyright (C) 2012 Texas Instruments
+ * Author: Rob Clark <rob.clark@linaro.org>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "omap_drv.h"
+
+static DEFINE_SPINLOCK(list_lock);
+
+static void omap_irq_error_handler(struct omap_drm_irq *irq,
+                uint32_t irqstatus)
+{
+        DRM_ERROR("errors: %08x\n", irqstatus);
+}
+
+/* call with list_lock and dispc runtime held */
+static void omap_irq_update(struct drm_device *dev)
+{
+        struct omap_drm_private *priv = dev->dev_private;
+        struct omap_drm_irq *irq;
+        uint32_t irqmask = priv->vblank_mask;
+
+        BUG_ON(!spin_is_locked(&list_lock));
+
+        list_for_each_entry(irq, &priv->irq_list, node)
+                irqmask |= irq->irqmask;
+
+        DBG("irqmask=%08x", irqmask);
+
+        dispc_write_irqenable(irqmask);
+        dispc_read_irqenable();        /* flush posted write */
+}
+
+void omap_irq_register(struct drm_device *dev, struct omap_drm_irq *irq)
+{
+        struct omap_drm_private *priv = dev->dev_private;
+        unsigned long flags;
+
+        dispc_runtime_get();
+        spin_lock_irqsave(&list_lock, flags);
+
+        if (!WARN_ON(irq->registered)) {
+                irq->registered = true;
+                list_add(&irq->node, &priv->irq_list);
+                omap_irq_update(dev);
+        }
+
+        spin_unlock_irqrestore(&list_lock, flags);
+        dispc_runtime_put();
+}
+
+void omap_irq_unregister(struct drm_device *dev, struct omap_drm_irq *irq)
+{
+        unsigned long flags;
+
+        dispc_runtime_get();
+        spin_lock_irqsave(&list_lock, flags);
+
+        if (!WARN_ON(!irq->registered)) {
+                irq->registered = false;
+                list_del(&irq->node);
+                omap_irq_update(dev);
+        }
+
+        spin_unlock_irqrestore(&list_lock, flags);
+        dispc_runtime_put();
+}
+
+struct omap_irq_wait {
+        struct omap_drm_irq irq;
+        int count;
+};
+
+static DECLARE_WAIT_QUEUE_HEAD(wait_event);
+
+static void wait_irq(struct omap_drm_irq *irq, uint32_t irqstatus)
+{
+        struct omap_irq_wait *wait =
+                        container_of(irq, struct omap_irq_wait, irq);
+        wait->count--;
+        wake_up_all(&wait_event);
+}
+
+struct omap_irq_wait * omap_irq_wait_init(struct drm_device *dev,
+                uint32_t irqmask, int count)
+{
+        struct omap_irq_wait *wait = kzalloc(sizeof(*wait), GFP_KERNEL);
+        wait->irq.irq = wait_irq;
+        wait->irq.irqmask = irqmask;
+        wait->count = count;
+        omap_irq_register(dev, &wait->irq);
+        return wait;
+}
+
+int omap_irq_wait(struct drm_device *dev, struct omap_irq_wait *wait,
+                unsigned long timeout)
+{
+        int ret = wait_event_timeout(wait_event, (wait->count <= 0), timeout);
+        omap_irq_unregister(dev, &wait->irq);
+        kfree(wait);
+        if (ret == 0)
+                return -1;
+        return 0;
+}
+
+/**
+ * enable_vblank - enable vblank interrupt events
+ * @dev: DRM device
+ * @crtc: which irq to enable
+ *
+ * Enable vblank interrupts for @crtc.  If the device doesn't have
+ * a hardware vblank counter, this routine should be a no-op, since
+ * interrupts will have to stay on to keep the count accurate.
+ *
+ * RETURNS
+ * Zero on success, appropriate errno if the given @crtc's vblank
+ * interrupt cannot be enabled.
+ */
+int omap_irq_enable_vblank(struct drm_device *dev, int crtc)
+{
+        struct omap_drm_private *priv = dev->dev_private;
+        unsigned long flags;
+
+        DBG("dev=%p, crtc=%d", dev, crtc);
+
+        dispc_runtime_get();
+        spin_lock_irqsave(&list_lock, flags);
+        priv->vblank_mask |= pipe2vbl(crtc);
+        omap_irq_update(dev);
+        spin_unlock_irqrestore(&list_lock, flags);
+        dispc_runtime_put();
+
+        return 0;
+}
+
+/**
+ * disable_vblank - disable vblank interrupt events
+ * @dev: DRM device
+ * @crtc: which irq to enable
+ *
+ * Disable vblank interrupts for @crtc.  If the device doesn't have
+ * a hardware vblank counter, this routine should be a no-op, since
+ * interrupts will have to stay on to keep the count accurate.
+ */
+void omap_irq_disable_vblank(struct drm_device *dev, int crtc)
+{
+        struct omap_drm_private *priv = dev->dev_private;
+        unsigned long flags;
+
+        DBG("dev=%p, crtc=%d", dev, crtc);
+
+        dispc_runtime_get();
+        spin_lock_irqsave(&list_lock, flags);
+        priv->vblank_mask &= ~pipe2vbl(crtc);
+        omap_irq_update(dev);
+        spin_unlock_irqrestore(&list_lock, flags);
+        dispc_runtime_put();
+}
+
+irqreturn_t omap_irq_handler(DRM_IRQ_ARGS)
+{
+        struct drm_device *dev = (struct drm_device *) arg;
+        struct omap_drm_private *priv = dev->dev_private;
+        struct omap_drm_irq *handler, *n;
+        unsigned long flags;
+        unsigned int id;
+        u32 irqstatus;
+
+        irqstatus = dispc_read_irqstatus();
+        dispc_clear_irqstatus(irqstatus);
+        dispc_read_irqstatus();        /* flush posted write */
+
+        VERB("irqs: %08x", irqstatus);
+
+        for (id = 0; id < priv->num_crtcs; id++)
+                if (irqstatus & pipe2vbl(id))
+                        drm_handle_vblank(dev, id);
+
+        spin_lock_irqsave(&list_lock, flags);
+        list_for_each_entry_safe(handler, n, &priv->irq_list, node) {
+                if (handler->irqmask & irqstatus) {
+                        spin_unlock_irqrestore(&list_lock, flags);
+                        handler->irq(handler, handler->irqmask & irqstatus);
+                        spin_lock_irqsave(&list_lock, flags);
+                }
+        }
+        spin_unlock_irqrestore(&list_lock, flags);
+
+        return IRQ_HANDLED;
+}
+
+void omap_irq_preinstall(struct drm_device *dev)
+{
+        DBG("dev=%p", dev);
+        dispc_runtime_get();
+        dispc_clear_irqstatus(0xffffffff);
+        dispc_runtime_put();
+}
+
+int omap_irq_postinstall(struct drm_device *dev)
+{
+        struct omap_drm_private *priv = dev->dev_private;
+        struct omap_drm_irq *error_handler = &priv->error_handler;
+
+        DBG("dev=%p", dev);
+
+        INIT_LIST_HEAD(&priv->irq_list);
+
+        error_handler->irq = omap_irq_error_handler;
+        error_handler->irqmask = DISPC_IRQ_OCP_ERR;
+
+        /* for now ignore DISPC_IRQ_SYNC_LOST_DIGIT.. really I think
+         * we just need to ignore it while enabling tv-out
+         */
+        error_handler->irqmask &= ~DISPC_IRQ_SYNC_LOST_DIGIT;
+
+        omap_irq_register(dev, error_handler);
+
+        return 0;
+}
+
+void omap_irq_uninstall(struct drm_device *dev)
+{
+        DBG("dev=%p", dev);
+        // TODO prolly need to call drm_irq_uninstall() somewhere too
+}
+
+/*
+ * We need a special version, instead of just using drm_irq_install(),
+ * because we need to register the irq via omapdss.  Once omapdss and
+ * omapdrm are merged together we can assign the dispc hwmod data to
+ * ourselves and drop these and just use drm_irq_{install,uninstall}()
+ */
+
+int omap_drm_irq_install(struct drm_device *dev)
+{
+        int ret;
+
+        mutex_lock(&dev->struct_mutex);
+
+        if (dev->irq_enabled) {
+                mutex_unlock(&dev->struct_mutex);
+                return -EBUSY;
+        }
+        dev->irq_enabled = 1;
+        mutex_unlock(&dev->struct_mutex);
+
+        /* Before installing handler */
+        if (dev->driver->irq_preinstall)
+                dev->driver->irq_preinstall(dev);
+
+        ret = dispc_request_irq(dev->driver->irq_handler, dev);
+
+        if (ret < 0) {
+                mutex_lock(&dev->struct_mutex);
+                dev->irq_enabled = 0;
+                mutex_unlock(&dev->struct_mutex);
+                return ret;
+        }
+
+        /* After installing handler */
+        if (dev->driver->irq_postinstall)
+                ret = dev->driver->irq_postinstall(dev);
+
+        if (ret < 0) {
+                mutex_lock(&dev->struct_mutex);
+                dev->irq_enabled = 0;
+                mutex_unlock(&dev->struct_mutex);
+                dispc_free_irq(dev);
+        }
+
+        return ret;
+}
+
+int omap_drm_irq_uninstall(struct drm_device *dev)
+{
+        unsigned long irqflags;
+        int irq_enabled, i;
+
+        mutex_lock(&dev->struct_mutex);
+        irq_enabled = dev->irq_enabled;
+        dev->irq_enabled = 0;
+        mutex_unlock(&dev->struct_mutex);
+
+        /*
+         * Wake up any waiters so they don't hang.
+         */
+        if (dev->num_crtcs) {
+                spin_lock_irqsave(&dev->vbl_lock, irqflags);
+                for (i = 0; i < dev->num_crtcs; i++) {
+                        DRM_WAKEUP(&dev->vbl_queue[i]);
+                        dev->vblank_enabled[i] = 0;
+                        dev->last_vblank[i] =
+                                dev->driver->get_vblank_counter(dev, i);
+                }
+                spin_unlock_irqrestore(&dev->vbl_lock, irqflags);
+        }
+
+        if (!irq_enabled)
+                return -EINVAL;
+
+        if (dev->driver->irq_uninstall)
+                dev->driver->irq_uninstall(dev);
+
+        dispc_free_irq(dev);
+
+        return 0;
+}
diff --git a/drivers/staging/omapdrm/omap_plane.c b/drivers/staging/omapdrm/omap_plane.c
index 2a8e5bab49c9..bb989d7f026d 100644
--- a/drivers/staging/omapdrm/omap_plane.c
+++ b/drivers/staging/omapdrm/omap_plane.c
@@ -41,12 +41,14 @@ struct callback {
 
 struct omap_plane {
         struct drm_plane base;
-        struct omap_overlay *ovl;
+        int id;  /* TODO rename omap_plane -> omap_plane_id in omapdss so I can use the enum */
+        const char *name;
         struct omap_overlay_info info;
+        struct omap_drm_apply apply;
 
         /* position/orientation of scanout within the fb: */
         struct omap_drm_window win;
-
+        bool enabled;
 
         /* last fb that we pinned: */
         struct drm_framebuffer *pinned_fb;
@@ -54,189 +56,15 @@ struct omap_plane {
         uint32_t nformats;
         uint32_t formats[32];
 
-        /* for synchronizing access to unpins fifo */
-        struct mutex unpin_mutex;
+        struct omap_drm_irq error_irq;
 
-        /* set of bo's pending unpin until next END_WIN irq */
+        /* set of bo's pending unpin until next post_apply() */
         DECLARE_KFIFO_PTR(unpin_fifo, struct drm_gem_object *);
-        int num_unpins, pending_num_unpins;
-
-        /* for deferred unpin when we need to wait for scanout complete irq */
-        struct work_struct work;
-
-        /* callback on next endwin irq */
-        struct callback endwin;
-};
 
-/* map from ovl->id to the irq we are interested in for scanout-done */
-static const uint32_t id2irq[] = {
-                [OMAP_DSS_GFX]    = DISPC_IRQ_GFX_END_WIN,
-                [OMAP_DSS_VIDEO1] = DISPC_IRQ_VID1_END_WIN,
-                [OMAP_DSS_VIDEO2] = DISPC_IRQ_VID2_END_WIN,
-                [OMAP_DSS_VIDEO3] = DISPC_IRQ_VID3_END_WIN,
+        // XXX maybe get rid of this and handle vblank in crtc too?
+        struct callback apply_done_cb;
 };
 
-static void dispc_isr(void *arg, uint32_t mask)
-{
-        struct drm_plane *plane = arg;
-        struct omap_plane *omap_plane = to_omap_plane(plane);
-        struct omap_drm_private *priv = plane->dev->dev_private;
-
-        omap_dispc_unregister_isr(dispc_isr, plane,
-                        id2irq[omap_plane->ovl->id]);
-
-        queue_work(priv->wq, &omap_plane->work);
-}
-
-static void unpin_worker(struct work_struct *work)
-{
-        struct omap_plane *omap_plane =
-                        container_of(work, struct omap_plane, work);
-        struct callback endwin;
-
-        mutex_lock(&omap_plane->unpin_mutex);
-        DBG("unpinning %d of %d", omap_plane->num_unpins,
-                        omap_plane->num_unpins + omap_plane->pending_num_unpins);
-        while (omap_plane->num_unpins > 0) {
-                struct drm_gem_object *bo = NULL;
-                int ret = kfifo_get(&omap_plane->unpin_fifo, &bo);
-                WARN_ON(!ret);
-                omap_gem_put_paddr(bo);
-                drm_gem_object_unreference_unlocked(bo);
-                omap_plane->num_unpins--;
-        }
-        endwin = omap_plane->endwin;
-        omap_plane->endwin.fxn = NULL;
-        mutex_unlock(&omap_plane->unpin_mutex);
-
-        if (endwin.fxn)
-                endwin.fxn(endwin.arg);
-}
-
-static void install_irq(struct drm_plane *plane)
-{
-        struct omap_plane *omap_plane = to_omap_plane(plane);
-        struct omap_overlay *ovl = omap_plane->ovl;
-        int ret;
-
-        ret = omap_dispc_register_isr(dispc_isr, plane, id2irq[ovl->id]);
-
-        /*
-         * omapdss has upper limit on # of registered irq handlers,
-         * which we shouldn't hit.. but if we do the limit should
-         * be raised or bad things happen:
-         */
-        WARN_ON(ret == -EBUSY);
-}
-
-/* push changes down to dss2 */
-static int commit(struct drm_plane *plane)
-{
-        struct drm_device *dev = plane->dev;
-        struct omap_plane *omap_plane = to_omap_plane(plane);
-        struct omap_overlay *ovl = omap_plane->ovl;
-        struct omap_overlay_info *info = &omap_plane->info;
-        int ret;
-
-        DBG("%s", ovl->name);
-        DBG("%dx%d -> %dx%d (%d)", info->width, info->height, info->out_width,
-                        info->out_height, info->screen_width);
-        DBG("%d,%d %08x %08x", info->pos_x, info->pos_y,
-                        info->paddr, info->p_uv_addr);
-
-        /* NOTE: do we want to do this at all here, or just wait
-         * for dpms(ON) since other CRTC's may not have their mode
-         * set yet, so fb dimensions may still change..
-         */
-        ret = ovl->set_overlay_info(ovl, info);
-        if (ret) {
-                dev_err(dev->dev, "could not set overlay info\n");
-                return ret;
-        }
-
-        mutex_lock(&omap_plane->unpin_mutex);
-        omap_plane->num_unpins += omap_plane->pending_num_unpins;
-        omap_plane->pending_num_unpins = 0;
-        mutex_unlock(&omap_plane->unpin_mutex);
-
-        /* our encoder doesn't necessarily get a commit() after this, in
-         * particular in the dpms() and mode_set_base() cases, so force the
-         * manager to update:
-         *
-         * could this be in the encoder somehow?
-         */
-        if (ovl->manager) {
-                ret = ovl->manager->apply(ovl->manager);
-                if (ret) {
-                        dev_err(dev->dev, "could not apply settings\n");
-                        return ret;
-                }
-
-                /*
-                 * NOTE: really this should be atomic w/ mgr->apply() but
-                 * omapdss does not expose such an API
-                 */
-                if (omap_plane->num_unpins > 0)
-                        install_irq(plane);
-
-        } else {
-                struct omap_drm_private *priv = dev->dev_private;
-                queue_work(priv->wq, &omap_plane->work);
-        }
-
-
-        if (ovl->is_enabled(ovl)) {
-                omap_framebuffer_flush(plane->fb, info->pos_x, info->pos_y,
-                                info->out_width, info->out_height);
-        }
-
-        return 0;
-}
-
-/* when CRTC that we are attached to has potentially changed, this checks
- * if we are attached to proper manager, and if necessary updates.
- */
-static void update_manager(struct drm_plane *plane)
-{
-        struct omap_drm_private *priv = plane->dev->dev_private;
-        struct omap_plane *omap_plane = to_omap_plane(plane);
-        struct omap_overlay *ovl = omap_plane->ovl;
-        struct omap_overlay_manager *mgr = NULL;
-        int i;
-
-        if (plane->crtc) {
-                for (i = 0; i < priv->num_encoders; i++) {
-                        struct drm_encoder *encoder = priv->encoders[i];
-                        if (encoder->crtc == plane->crtc) {
-                                mgr = omap_encoder_get_manager(encoder);
-                                break;
-                        }
-                }
-        }
-
-        if (ovl->manager != mgr) {
-                bool enabled = ovl->is_enabled(ovl);
-
-                /* don't switch things around with enabled overlays: */
-                if (enabled)
-                        omap_plane_dpms(plane, DRM_MODE_DPMS_OFF);
-
-                if (ovl->manager) {
-                        DBG("disconnecting %s from %s", ovl->name,
-                                        ovl->manager->name);
-                        ovl->unset_manager(ovl);
-                }
-
-                if (mgr) {
-                        DBG("connecting %s to %s", ovl->name, mgr->name);
-                        ovl->set_manager(ovl, mgr);
-                }
-
-                if (enabled && mgr)
-                        omap_plane_dpms(plane, DRM_MODE_DPMS_ON);
-        }
-}
-
 static void unpin(void *arg, struct drm_gem_object *bo)
 {
         struct drm_plane *plane = arg;
@@ -244,7 +72,6 @@ static void unpin(void *arg, struct drm_gem_object *bo)
 
         if (kfifo_put(&omap_plane->unpin_fifo,
                         (const struct drm_gem_object **)&bo)) {
-                omap_plane->pending_num_unpins++;
                 /* also hold a ref so it isn't free'd while pinned */
                 drm_gem_object_reference(bo);
         } else {
@@ -264,13 +91,19 @@ static int update_pin(struct drm_plane *plane, struct drm_framebuffer *fb)
 
                 DBG("%p -> %p", pinned_fb, fb);
 
-                mutex_lock(&omap_plane->unpin_mutex);
+                if (fb)
+                        drm_framebuffer_reference(fb);
+
                 ret = omap_framebuffer_replace(pinned_fb, fb, plane, unpin);
-                mutex_unlock(&omap_plane->unpin_mutex);
+
+                if (pinned_fb)
+                        drm_framebuffer_unreference(pinned_fb);
 
                 if (ret) {
                         dev_err(plane->dev->dev, "could not swap %p -> %p\n",
                                         omap_plane->pinned_fb, fb);
+                        if (fb)
+                                drm_framebuffer_unreference(fb);
                         omap_plane->pinned_fb = NULL;
                         return ret;
                 }
@@ -281,31 +114,90 @@ static int update_pin(struct drm_plane *plane, struct drm_framebuffer *fb)
         return 0;
 }
 
-/* update parameters that are dependent on the framebuffer dimensions and
- * position within the fb that this plane scans out from. This is called
- * when framebuffer or x,y base may have changed.
- */
-static void update_scanout(struct drm_plane *plane)
+static void omap_plane_pre_apply(struct omap_drm_apply *apply)
 {
-        struct omap_plane *omap_plane = to_omap_plane(plane);
-        struct omap_overlay_info *info = &omap_plane->info;
+        struct omap_plane *omap_plane =
+                        container_of(apply, struct omap_plane, apply);
         struct omap_drm_window *win = &omap_plane->win;
+        struct drm_plane *plane = &omap_plane->base;
+        struct drm_device *dev = plane->dev;
+        struct omap_overlay_info *info = &omap_plane->info;
+        struct drm_crtc *crtc = plane->crtc;
+        enum omap_channel channel;
+        bool enabled = omap_plane->enabled && crtc;
+        bool ilace, replication;
         int ret;
 
-        ret = update_pin(plane, plane->fb);
-        if (ret) {
-                dev_err(plane->dev->dev,
-                        "could not pin fb: %d\n", ret);
-                omap_plane_dpms(plane, DRM_MODE_DPMS_OFF);
+        DBG("%s, enabled=%d", omap_plane->name, enabled);
+
+        /* if fb has changed, pin new fb: */
+        update_pin(plane, enabled ? plane->fb : NULL);
+
+        if (!enabled) {
+                dispc_ovl_enable(omap_plane->id, false);
                 return;
         }
 
+        channel = omap_crtc_channel(crtc);
+
+        /* update scanout: */
         omap_framebuffer_update_scanout(plane->fb, win, info);
 
-        DBG("%s: %d,%d: %08x %08x (%d)", omap_plane->ovl->name,
-                        win->src_x, win->src_y,
-                        (u32)info->paddr, (u32)info->p_uv_addr,
+        DBG("%dx%d -> %dx%d (%d)", info->width, info->height,
+                        info->out_width, info->out_height,
                         info->screen_width);
+        DBG("%d,%d %08x %08x", info->pos_x, info->pos_y,
+                        info->paddr, info->p_uv_addr);
+
+        /* TODO: */
+        ilace = false;
+        replication = false;
+
+        /* and finally, update omapdss: */
+        ret = dispc_ovl_setup(omap_plane->id, info,
+                        replication, omap_crtc_timings(crtc), false);
+        if (ret) {
+                dev_err(dev->dev, "dispc_ovl_setup failed: %d\n", ret);
+                return;
+        }
+
+        dispc_ovl_enable(omap_plane->id, true);
+        dispc_ovl_set_channel_out(omap_plane->id, channel);
+}
+
+static void omap_plane_post_apply(struct omap_drm_apply *apply)
+{
+        struct omap_plane *omap_plane =
+                        container_of(apply, struct omap_plane, apply);
+        struct drm_plane *plane = &omap_plane->base;
+        struct omap_overlay_info *info = &omap_plane->info;
+        struct drm_gem_object *bo = NULL;
+        struct callback cb;
+
+        cb = omap_plane->apply_done_cb;
+        omap_plane->apply_done_cb.fxn = NULL;
+
+        while (kfifo_get(&omap_plane->unpin_fifo, &bo)) {
+                omap_gem_put_paddr(bo);
+                drm_gem_object_unreference_unlocked(bo);
+        }
+
+        if (cb.fxn)
+                cb.fxn(cb.arg);
+
+        if (omap_plane->enabled) {
+                omap_framebuffer_flush(plane->fb, info->pos_x, info->pos_y,
+                                info->out_width, info->out_height);
+        }
+}
+
+static int apply(struct drm_plane *plane)
+{
+        if (plane->crtc) {
+                struct omap_plane *omap_plane = to_omap_plane(plane);
+                return omap_crtc_apply(plane->crtc, &omap_plane->apply);
+        }
+        return 0;
 }
 
 int omap_plane_mode_set(struct drm_plane *plane,
@@ -313,7 +205,8 @@ int omap_plane_mode_set(struct drm_plane *plane,
                 int crtc_x, int crtc_y,
                 unsigned int crtc_w, unsigned int crtc_h,
                 uint32_t src_x, uint32_t src_y,
-                uint32_t src_w, uint32_t src_h)
+                uint32_t src_w, uint32_t src_h,
+                void (*fxn)(void *), void *arg)
 {
         struct omap_plane *omap_plane = to_omap_plane(plane);
         struct omap_drm_window *win = &omap_plane->win;
@@ -329,17 +222,20 @@ int omap_plane_mode_set(struct drm_plane *plane,
         win->src_w = src_w >> 16;
         win->src_h = src_h >> 16;
 
-        /* note: this is done after this fxn returns.. but if we need
-         * to do a commit/update_scanout, etc before this returns we
-         * need the current value.
-         */
+        if (fxn) {
+                /* omap_crtc should ensure that a new page flip
+                 * isn't permitted while there is one pending:
+                 */
+                BUG_ON(omap_plane->apply_done_cb.fxn);
+
+                omap_plane->apply_done_cb.fxn = fxn;
+                omap_plane->apply_done_cb.arg = arg;
+        }
+
         plane->fb = fb;
         plane->crtc = crtc;
 
-        update_scanout(plane);
-        update_manager(plane);
-
-        return 0;
+        return apply(plane);
 }
 
 static int omap_plane_update(struct drm_plane *plane,
@@ -349,9 +245,12 @@ static int omap_plane_update(struct drm_plane *plane,
                 uint32_t src_x, uint32_t src_y,
                 uint32_t src_w, uint32_t src_h)
 {
-        omap_plane_mode_set(plane, crtc, fb, crtc_x, crtc_y, crtc_w, crtc_h,
-                        src_x, src_y, src_w, src_h);
-        return omap_plane_dpms(plane, DRM_MODE_DPMS_ON);
+        struct omap_plane *omap_plane = to_omap_plane(plane);
+        omap_plane->enabled = true;
+        return omap_plane_mode_set(plane, crtc, fb,
+                        crtc_x, crtc_y, crtc_w, crtc_h,
+                        src_x, src_y, src_w, src_h,
+                        NULL, NULL);
 }
 
 static int omap_plane_disable(struct drm_plane *plane)
@@ -364,48 +263,32 @@ static int omap_plane_disable(struct drm_plane *plane)
 static void omap_plane_destroy(struct drm_plane *plane)
 {
         struct omap_plane *omap_plane = to_omap_plane(plane);
-        DBG("%s", omap_plane->ovl->name);
+
+        DBG("%s", omap_plane->name);
+
+        omap_irq_unregister(plane->dev, &omap_plane->error_irq);
+
         omap_plane_disable(plane);
         drm_plane_cleanup(plane);
-        WARN_ON(omap_plane->pending_num_unpins + omap_plane->num_unpins > 0);
+
+        WARN_ON(!kfifo_is_empty(&omap_plane->unpin_fifo));
         kfifo_free(&omap_plane->unpin_fifo);
+
         kfree(omap_plane);
 }
 
 int omap_plane_dpms(struct drm_plane *plane, int mode)
 {
         struct omap_plane *omap_plane = to_omap_plane(plane);
-        struct omap_overlay *ovl = omap_plane->ovl;
-        int r;
+        bool enabled = (mode == DRM_MODE_DPMS_ON);
+        int ret = 0;
 
-        DBG("%s: %d", omap_plane->ovl->name, mode);
-
-        if (mode == DRM_MODE_DPMS_ON) {
-                update_scanout(plane);
-                r = commit(plane);
-                if (!r)
-                        r = ovl->enable(ovl);
-        } else {
-                struct omap_drm_private *priv = plane->dev->dev_private;
-                r = ovl->disable(ovl);
-                update_pin(plane, NULL);
-                queue_work(priv->wq, &omap_plane->work);
+        if (enabled != omap_plane->enabled) {
+                omap_plane->enabled = enabled;
+                ret = apply(plane);
         }
 
-        return r;
-}
-
-void omap_plane_on_endwin(struct drm_plane *plane,
-                void (*fxn)(void *), void *arg)
-{
-        struct omap_plane *omap_plane = to_omap_plane(plane);
-
-        mutex_lock(&omap_plane->unpin_mutex);
-        omap_plane->endwin.fxn = fxn;
-        omap_plane->endwin.arg = arg;
-        mutex_unlock(&omap_plane->unpin_mutex);
-
-        install_irq(plane);
+        return ret;
 }
 
 /* helper to install properties which are common to planes and crtcs */
@@ -454,25 +337,13 @@ int omap_plane_set_property(struct drm_plane *plane,
         int ret = -EINVAL;
 
         if (property == priv->rotation_prop) {
-                struct omap_overlay *ovl = omap_plane->ovl;
-
-                DBG("%s: rotation: %02x", ovl->name, (uint32_t)val);
+                DBG("%s: rotation: %02x", omap_plane->name, (uint32_t)val);
                 omap_plane->win.rotation = val;
-
-                if (ovl->is_enabled(ovl))
-                        ret = omap_plane_dpms(plane, DRM_MODE_DPMS_ON);
-                else
-                        ret = 0;
+                ret = apply(plane);
         } else if (property == priv->zorder_prop) {
-                struct omap_overlay *ovl = omap_plane->ovl;
-
-                DBG("%s: zorder: %d", ovl->name, (uint32_t)val);
+                DBG("%s: zorder: %02x", omap_plane->name, (uint32_t)val);
                 omap_plane->info.zorder = val;
-
-                if (ovl->is_enabled(ovl))
-                        ret = omap_plane_dpms(plane, DRM_MODE_DPMS_ON);
-                else
-                        ret = 0;
+                ret = apply(plane);
         }
 
         return ret;
@@ -485,20 +356,38 @@ static const struct drm_plane_funcs omap_plane_funcs = {
                 .set_property = omap_plane_set_property,
 };
 
+static void omap_plane_error_irq(struct omap_drm_irq *irq, uint32_t irqstatus)
+{
+        struct omap_plane *omap_plane =
+                        container_of(irq, struct omap_plane, error_irq);
+        DRM_ERROR("%s: errors: %08x\n", omap_plane->name, irqstatus);
+}
+
+static const char *plane_names[] = {
+                [OMAP_DSS_GFX] = "gfx",
+                [OMAP_DSS_VIDEO1] = "vid1",
+                [OMAP_DSS_VIDEO2] = "vid2",
+                [OMAP_DSS_VIDEO3] = "vid3",
+};
+
+static const uint32_t error_irqs[] = {
+                [OMAP_DSS_GFX] = DISPC_IRQ_GFX_FIFO_UNDERFLOW,
+                [OMAP_DSS_VIDEO1] = DISPC_IRQ_VID1_FIFO_UNDERFLOW,
+                [OMAP_DSS_VIDEO2] = DISPC_IRQ_VID2_FIFO_UNDERFLOW,
+                [OMAP_DSS_VIDEO3] = DISPC_IRQ_VID3_FIFO_UNDERFLOW,
+};
+
 /* initialize plane */
 struct drm_plane *omap_plane_init(struct drm_device *dev,
-                struct omap_overlay *ovl, unsigned int possible_crtcs,
-                bool priv)
+                int id, bool private_plane)
 {
+        struct omap_drm_private *priv = dev->dev_private;
         struct drm_plane *plane = NULL;
         struct omap_plane *omap_plane;
+        struct omap_overlay_info *info;
         int ret;
 
-        DBG("%s: possible_crtcs=%08x, priv=%d", ovl->name,
-                        possible_crtcs, priv);
-
-        /* friendly reminder to update table for future hw: */
-        WARN_ON(ovl->id >= ARRAY_SIZE(id2irq));
+        DBG("%s: priv=%d", plane_names[id], private_plane);
 
         omap_plane = kzalloc(sizeof(*omap_plane), GFP_KERNEL);
         if (!omap_plane) {
@@ -506,47 +395,50 @@ struct drm_plane *omap_plane_init(struct drm_device *dev,
                 goto fail;
         }
 
-        mutex_init(&omap_plane->unpin_mutex);
-
         ret = kfifo_alloc(&omap_plane->unpin_fifo, 16, GFP_KERNEL);
         if (ret) {
                 dev_err(dev->dev, "could not allocate unpin FIFO\n");
                 goto fail;
         }
 
-        INIT_WORK(&omap_plane->work, unpin_worker);
-
         omap_plane->nformats = omap_framebuffer_get_formats(
                         omap_plane->formats, ARRAY_SIZE(omap_plane->formats),
-                        ovl->supported_modes);
-        omap_plane->ovl = ovl;
+                        dss_feat_get_supported_color_modes(id));
+        omap_plane->id = id;
+        omap_plane->name = plane_names[id];
+
         plane = &omap_plane->base;
 
-        drm_plane_init(dev, plane, possible_crtcs, &omap_plane_funcs,
-                        omap_plane->formats, omap_plane->nformats, priv);
+        omap_plane->apply.pre_apply  = omap_plane_pre_apply;
+        omap_plane->apply.post_apply = omap_plane_post_apply;
+
+        omap_plane->error_irq.irqmask = error_irqs[id];
+        omap_plane->error_irq.irq = omap_plane_error_irq;
+        omap_irq_register(dev, &omap_plane->error_irq);
+
+        drm_plane_init(dev, plane, (1 << priv->num_crtcs) - 1, &omap_plane_funcs,
+                        omap_plane->formats, omap_plane->nformats, private_plane);
 
         omap_plane_install_properties(plane, &plane->base);
 
         /* get our starting configuration, set defaults for parameters
          * we don't currently use, etc:
          */
-        ovl->get_overlay_info(ovl, &omap_plane->info);
-        omap_plane->info.rotation_type = OMAP_DSS_ROT_DMA;
-        omap_plane->info.rotation = OMAP_DSS_ROT_0;
-        omap_plane->info.global_alpha = 0xff;
-        omap_plane->info.mirror = 0;
+        info = &omap_plane->info;
+        info->rotation_type = OMAP_DSS_ROT_DMA;
+        info->rotation = OMAP_DSS_ROT_0;
+        info->global_alpha = 0xff;
+        info->mirror = 0;
 
         /* Set defaults depending on whether we are a CRTC or overlay
          * layer.
          * TODO add ioctl to give userspace an API to change this.. this
          * will come in a subsequent patch.
          */
-        if (priv)
+        if (private_plane)
                 omap_plane->info.zorder = 0;
         else
-                omap_plane->info.zorder = ovl->id;
-
-        update_manager(plane);
+                omap_plane->info.zorder = id;
 
         return plane;
 
diff --git a/drivers/staging/rtl8187se/r8180_core.c b/drivers/staging/rtl8187se/r8180_core.c
index ae38475854b5..d10d75e8a33f 100644
--- a/drivers/staging/rtl8187se/r8180_core.c
+++ b/drivers/staging/rtl8187se/r8180_core.c
@@ -937,7 +937,8 @@ short alloc_rx_desc_ring(struct net_device *dev, u16 bufsize, int count)
 
                 dma_tmp = pci_map_single(pdev, buf, bufsize * sizeof(u8),
                                          PCI_DMA_FROMDEVICE);
-
+                if (pci_dma_mapping_error(pdev, dma_tmp))
+                        return -1;
                 if (-1 == buffer_add(&(priv->rxbuffer), buf, dma_tmp,
                            &(priv->rxbufferhead))) {
                         DMESGE("Unable to allocate mem RX buf");
diff --git a/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c b/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
index 808aab6fa5ef..a9d78e9651c6 100644
--- a/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
+++ b/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
@@ -1183,6 +1183,8 @@ void  rtl8192_tx_fill_desc(struct net_device *dev, struct tx_desc *pdesc,
                                                 pTxFwInfo->TxRate,
                                                 cb_desc);
 
+        if (pci_dma_mapping_error(priv->pdev, mapping))
+                RT_TRACE(COMP_ERR, "DMA Mapping error\n");;
         if (cb_desc->bAMPDUEnable) {
                 pTxFwInfo->AllowAggregation = 1;
                 pTxFwInfo->RxMF = cb_desc->ampdu_factor;
@@ -1280,6 +1282,8 @@ void  rtl8192_tx_fill_cmd_desc(struct net_device *dev,
         dma_addr_t mapping = pci_map_single(priv->pdev, skb->data, skb->len,
                          PCI_DMA_TODEVICE);
 
+        if (pci_dma_mapping_error(priv->pdev, mapping))
+                RT_TRACE(COMP_ERR, "DMA Mapping error\n");;
         memset(entry, 0, 12);
         entry->LINIP = cb_desc->bLastIniPkt;
         entry->FirstSeg = 1;
diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
index 1a70f324552f..4ebf99b30975 100644
--- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
+++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
@@ -2104,7 +2104,10 @@ static short rtl8192_alloc_rx_desc_ring(struct net_device *dev)
                                                   skb_tail_pointer_rsl(skb),
                                                   priv->rxbuffersize,
                                                   PCI_DMA_FROMDEVICE);
-
+                        if (pci_dma_mapping_error(priv->pdev, *mapping)) {
+                                dev_kfree_skb_any(skb);
+                                return -1;
+                        }
                         entry->BufferAddress = cpu_to_le32(*mapping);
 
                         entry->Length = priv->rxbuffersize;
@@ -2397,7 +2400,11 @@ static void rtl8192_rx_normal(struct net_device *dev)
                                                     skb_tail_pointer_rsl(skb),
                                                     priv->rxbuffersize,
                                                     PCI_DMA_FROMDEVICE);
-
+                        if (pci_dma_mapping_error(priv->pdev,
+                                                  *((dma_addr_t *)skb->cb))) {
+                                dev_kfree_skb_any(skb);
+                                return;
+                        }
                 }
 done:
                 pdesc->BufferAddress = cpu_to_le32(*((dma_addr_t *)skb->cb));
diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c
index 6b73843e580a..a96cd06d69dd 100644
--- a/drivers/staging/rtl8712/usb_intf.c
+++ b/drivers/staging/rtl8712/usb_intf.c
@@ -63,6 +63,8 @@ static struct usb_device_id rtl871x_usb_id_tbl[] = {
         {USB_DEVICE(0x0B05, 0x1791)}, /* 11n mode disable */
         /* Belkin */
         {USB_DEVICE(0x050D, 0x945A)},
+        /* ISY IWL - Belkin clone */
+        {USB_DEVICE(0x050D, 0x11F1)},
         /* Corega */
         {USB_DEVICE(0x07AA, 0x0047)},
         /* D-Link */
diff --git a/drivers/staging/sb105x/Kconfig b/drivers/staging/sb105x/Kconfig
index ac87c5e38dee..1facad625554 100644
--- a/drivers/staging/sb105x/Kconfig
+++ b/drivers/staging/sb105x/Kconfig
@@ -2,6 +2,7 @@ config SB105X
         tristate "SystemBase PCI Multiport UART"
         select SERIAL_CORE
         depends on PCI
+        depends on X86
         help
           A driver for the SystemBase Multi-2/PCI serial card
 
diff --git a/drivers/staging/sb105x/sb_pci_mp.c b/drivers/staging/sb105x/sb_pci_mp.c
index edb2a85b9d52..131afd0c460c 100644
--- a/drivers/staging/sb105x/sb_pci_mp.c
+++ b/drivers/staging/sb105x/sb_pci_mp.c
@@ -3054,6 +3054,7 @@ static int init_mp_dev(struct pci_dev *pcidev, mppcibrd_t brd)
                                 sbdev->nr_ports = ((portnum_hex/16)*10) + (portnum_hex % 16);
                         }
                         break;
+#ifdef CONFIG_PARPORT
                 case PCI_DEVICE_ID_MP2S1P :
                         sbdev->nr_ports = 2;
 
@@ -3073,6 +3074,7 @@ static int init_mp_dev(struct pci_dev *pcidev, mppcibrd_t brd)
                         /* add PC compatible parallel port */
                         parport_pc_probe_port(pcidev->resource[2].start, pcidev->resource[3].start, PARPORT_IRQ_NONE, PARPORT_DMA_NONE, &pcidev->dev, 0);
                         break;
+#endif
         }
 
         ret = request_region(sbdev->uart_access_addr, (8*sbdev->nr_ports), sbdev->name);
diff --git a/drivers/staging/speakup/synth.c b/drivers/staging/speakup/synth.c
index df9533798095..7616f058a00b 100644
--- a/drivers/staging/speakup/synth.c
+++ b/drivers/staging/speakup/synth.c
@@ -342,7 +342,7 @@ int synth_init(char *synth_name)
 
         mutex_lock(&spk_mutex);
         /* First, check if we already have it loaded. */
-        for (i = 0; synths[i] != NULL && i < MAXSYNTHS; i++)
+        for (i = 0; i < MAXSYNTHS && synths[i] != NULL; i++)
                 if (strcmp(synths[i]->name, synth_name) == 0)
                         synth = synths[i];
 
@@ -423,7 +423,7 @@ int synth_add(struct spk_synth *in_synth)
         int i;
         int status = 0;
         mutex_lock(&spk_mutex);
-        for (i = 0; synths[i] != NULL && i < MAXSYNTHS; i++)
+        for (i = 0; i < MAXSYNTHS && synths[i] != NULL; i++)
                 /* synth_remove() is responsible for rotating the array down */
                 if (in_synth == synths[i]) {
                         mutex_unlock(&spk_mutex);
diff --git a/drivers/staging/tidspbridge/core/_tiomap.h b/drivers/staging/tidspbridge/core/_tiomap.h
index 543a127c7d4d..b783bfa59b1c 100644
--- a/drivers/staging/tidspbridge/core/_tiomap.h
+++ b/drivers/staging/tidspbridge/core/_tiomap.h
@@ -31,7 +31,7 @@
  * driver should read or write to PRM/CM registers directly; they
  * should rely on OMAP core code to do this.
  */
-#include <mach-omap2/cm2xxx_3xxx.h>
+#include <mach-omap2/cm3xxx.h>
 #include <mach-omap2/prm-regbits-34xx.h>
 #include <mach-omap2/cm-regbits-34xx.h>
 #include <dspbridge/devdefs.h>
diff --git a/drivers/staging/tidspbridge/core/dsp-clock.c b/drivers/staging/tidspbridge/core/dsp-clock.c
index b647207928b1..2f084e181d39 100644
--- a/drivers/staging/tidspbridge/core/dsp-clock.c
+++ b/drivers/staging/tidspbridge/core/dsp-clock.c
@@ -121,9 +121,13 @@ void dsp_clk_exit(void)
         for (i = 0; i < DM_TIMER_CLOCKS; i++)
                 omap_dm_timer_free(timer[i]);
 
+        clk_unprepare(iva2_clk);
         clk_put(iva2_clk);
+        clk_unprepare(ssi.sst_fck);
         clk_put(ssi.sst_fck);
+        clk_unprepare(ssi.ssr_fck);
         clk_put(ssi.ssr_fck);
+        clk_unprepare(ssi.ick);
         clk_put(ssi.ick);
 }
 
@@ -145,14 +149,21 @@ void dsp_clk_init(void)
         iva2_clk = clk_get(&dspbridge_device.dev, "iva2_ck");
         if (IS_ERR(iva2_clk))
                 dev_err(bridge, "failed to get iva2 clock %p\n", iva2_clk);
+        else
+                clk_prepare(iva2_clk);
 
         ssi.sst_fck = clk_get(&dspbridge_device.dev, "ssi_sst_fck");
         ssi.ssr_fck = clk_get(&dspbridge_device.dev, "ssi_ssr_fck");
         ssi.ick = clk_get(&dspbridge_device.dev, "ssi_ick");
 
-        if (IS_ERR(ssi.sst_fck) || IS_ERR(ssi.ssr_fck) || IS_ERR(ssi.ick))
+        if (IS_ERR(ssi.sst_fck) || IS_ERR(ssi.ssr_fck) || IS_ERR(ssi.ick)) {
                 dev_err(bridge, "failed to get ssi: sst %p, ssr %p, ick %p\n",
                                         ssi.sst_fck, ssi.ssr_fck, ssi.ick);
+        } else {
+                clk_prepare(ssi.sst_fck);
+                clk_prepare(ssi.ssr_fck);
+                clk_prepare(ssi.ick);
+        }
 }
 
 /**
diff --git a/drivers/staging/tidspbridge/core/wdt.c b/drivers/staging/tidspbridge/core/wdt.c
index 1dce36fb828f..7ff0e6c98039 100644
--- a/drivers/staging/tidspbridge/core/wdt.c
+++ b/drivers/staging/tidspbridge/core/wdt.c
@@ -63,11 +63,15 @@ int dsp_wdt_init(void)
         dsp_wdt.fclk = clk_get(NULL, "wdt3_fck");
 
         if (!IS_ERR(dsp_wdt.fclk)) {
+                clk_prepare(dsp_wdt.fclk);
+
                 dsp_wdt.iclk = clk_get(NULL, "wdt3_ick");
                 if (IS_ERR(dsp_wdt.iclk)) {
                         clk_put(dsp_wdt.fclk);
                         dsp_wdt.fclk = NULL;
                         ret = -EFAULT;
+                } else {
+                        clk_prepare(dsp_wdt.iclk);
                 }
         } else
                 ret = -EFAULT;
@@ -95,10 +99,14 @@ void dsp_wdt_exit(void)
         free_irq(INT_34XX_WDT3_IRQ, &dsp_wdt);
         tasklet_kill(&dsp_wdt.wdt3_tasklet);
 
-        if (dsp_wdt.fclk)
+        if (dsp_wdt.fclk) {
+                clk_unprepare(dsp_wdt.fclk);
                 clk_put(dsp_wdt.fclk);
-        if (dsp_wdt.iclk)
+        }
+        if (dsp_wdt.iclk) {
+                clk_unprepare(dsp_wdt.iclk);
                 clk_put(dsp_wdt.iclk);
+        }
 
         dsp_wdt.fclk = NULL;
         dsp_wdt.iclk = NULL;
diff --git a/drivers/staging/vme/devices/vme_pio2_core.c b/drivers/staging/vme/devices/vme_pio2_core.c
index 0331178ca3b3..bf73ba26e88a 100644
--- a/drivers/staging/vme/devices/vme_pio2_core.c
+++ b/drivers/staging/vme/devices/vme_pio2_core.c
@@ -162,11 +162,9 @@ static struct vme_driver pio2_driver = {
 
 static int __init pio2_init(void)
 {
-        int retval = 0;
-
         if (bus_num == 0) {
                 pr_err("No cards, skipping registration\n");
-                goto err_nocard;
+                return -ENODEV;
         }
 
         if (bus_num > PIO2_CARDS_MAX) {
@@ -176,15 +174,7 @@ static int __init pio2_init(void)
         }
 
         /* Register the PIO2 driver */
-        retval = vme_register_driver(&pio2_driver, bus_num);
-        if (retval != 0)
-                goto err_reg;
-
-        return retval;
-
-err_reg:
-err_nocard:
-        return retval;
+        return  vme_register_driver(&pio2_driver, bus_num);
 }
 
 static int pio2_match(struct vme_dev *vdev)
diff --git a/drivers/staging/wlan-ng/cfg80211.c b/drivers/staging/wlan-ng/cfg80211.c
index 18c06a59c091..1d31eab19d16 100644
--- a/drivers/staging/wlan-ng/cfg80211.c
+++ b/drivers/staging/wlan-ng/cfg80211.c
@@ -638,8 +638,8 @@ int prism2_leave_ibss(struct wiphy *wiphy, struct net_device *dev)
 }
 
 
-int prism2_set_tx_power(struct wiphy *wiphy, enum nl80211_tx_power_setting type,
-                        int mbm)
+int prism2_set_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
+                        enum nl80211_tx_power_setting type, int mbm)
 {
         struct prism2_wiphy_private *priv = wiphy_priv(wiphy);
         wlandevice_t *wlandev = priv->wlandev;
@@ -665,7 +665,8 @@ exit:
         return err;
 }
 
-int prism2_get_tx_power(struct wiphy *wiphy, int *dbm)
+int prism2_get_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
+                        int *dbm)
 {
         struct prism2_wiphy_private *priv = wiphy_priv(wiphy);
         wlandevice_t *wlandev = priv->wlandev;
diff --git a/drivers/staging/zram/zram_drv.c b/drivers/staging/zram/zram_drv.c
index fb4a7c94aed3..f2a73bd739fb 100644
--- a/drivers/staging/zram/zram_drv.c
+++ b/drivers/staging/zram/zram_drv.c
@@ -265,7 +265,7 @@ out_cleanup:
 static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
                            int offset)
 {
-        int ret;
+        int ret = 0;
         size_t clen;
         unsigned long handle;
         struct page *page;
@@ -286,10 +286,8 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
                         goto out;
                 }
                 ret = zram_decompress_page(zram, uncmem, index);
-                if (ret) {
-                        kfree(uncmem);
+                if (ret)
                         goto out;
-                }
         }
 
         /*
@@ -302,16 +300,18 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
 
         user_mem = kmap_atomic(page);
 
-        if (is_partial_io(bvec))
+        if (is_partial_io(bvec)) {
                 memcpy(uncmem + offset, user_mem + bvec->bv_offset,
                        bvec->bv_len);
-        else
+                kunmap_atomic(user_mem);
+                user_mem = NULL;
+        } else {
                 uncmem = user_mem;
+        }
 
         if (page_zero_filled(uncmem)) {
-                kunmap_atomic(user_mem);
-                if (is_partial_io(bvec))
-                        kfree(uncmem);
+                if (!is_partial_io(bvec))
+                        kunmap_atomic(user_mem);
                 zram_stat_inc(&zram->stats.pages_zero);
                 zram_set_flag(zram, index, ZRAM_ZERO);
                 ret = 0;
@@ -321,9 +321,11 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
         ret = lzo1x_1_compress(uncmem, PAGE_SIZE, src, &clen,
                                zram->compress_workmem);
 
-        kunmap_atomic(user_mem);
-        if (is_partial_io(bvec))
-                        kfree(uncmem);
+        if (!is_partial_io(bvec)) {
+                kunmap_atomic(user_mem);
+                user_mem = NULL;
+                uncmem = NULL;
+        }
 
         if (unlikely(ret != LZO_E_OK)) {
                 pr_err("Compression failed! err=%d\n", ret);
@@ -332,8 +334,10 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
 
         if (unlikely(clen > max_zpage_size)) {
                 zram_stat_inc(&zram->stats.bad_compress);
-                src = uncmem;
                 clen = PAGE_SIZE;
+                src = NULL;
+                if (is_partial_io(bvec))
+                        src = uncmem;
         }
 
         handle = zs_malloc(zram->mem_pool, clen);
@@ -345,7 +349,11 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
         }
         cmem = zs_map_object(zram->mem_pool, handle, ZS_MM_WO);
 
+        if ((clen == PAGE_SIZE) && !is_partial_io(bvec))
+                src = kmap_atomic(page);
         memcpy(cmem, src, clen);
+        if ((clen == PAGE_SIZE) && !is_partial_io(bvec))
+                kunmap_atomic(src);
 
         zs_unmap_object(zram->mem_pool, handle);
 
@@ -358,9 +366,10 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
         if (clen <= PAGE_SIZE / 2)
                 zram_stat_inc(&zram->stats.good_compress);
 
-        return 0;
-
 out:
+        if (is_partial_io(bvec))
+                kfree(uncmem);
+
         if (ret)
                 zram_stat64_inc(zram, &zram->stats.failed_writes);
         return ret;
diff --git a/drivers/target/iscsi/iscsi_target_erl2.c b/drivers/target/iscsi/iscsi_target_erl2.c
index 9ac4c151eae4..ba6091bf93fc 100644
--- a/drivers/target/iscsi/iscsi_target_erl2.c
+++ b/drivers/target/iscsi/iscsi_target_erl2.c
@@ -372,7 +372,7 @@ int iscsit_prepare_cmds_for_realligance(struct iscsi_conn *conn)
                  * made generic here.
                  */
                 if (!(cmd->cmd_flags & ICF_OOO_CMDSN) && !cmd->immediate_cmd &&
-                     iscsi_sna_gte(cmd->stat_sn, conn->sess->exp_cmd_sn)) {
+                     iscsi_sna_gte(cmd->cmd_sn, conn->sess->exp_cmd_sn)) {
                         list_del(&cmd->i_conn_node);
                         spin_unlock_bh(&conn->cmd_lock);
                         iscsit_free_cmd(cmd);
diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
index 85140f7dde1e..7d4ec02e29a9 100644
--- a/drivers/target/target_core_alua.c
+++ b/drivers/target/target_core_alua.c
@@ -212,7 +212,7 @@ target_emulate_set_target_port_groups(struct se_cmd *cmd)
         struct t10_alua_tg_pt_gp_member *tg_pt_gp_mem, *l_tg_pt_gp_mem;
         unsigned char *buf;
         unsigned char *ptr;
-        sense_reason_t rc;
+        sense_reason_t rc = TCM_NO_SENSE;
         u32 len = 4; /* Skip over RESERVED area in header */
         int alua_access_state, primary = 0;
         u16 tg_pt_id, rtpi;
diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
index e35dbf85841f..8e0290b38e43 100644
--- a/drivers/target/target_core_pr.c
+++ b/drivers/target/target_core_pr.c
@@ -2053,7 +2053,7 @@ core_scsi3_emulate_pro_register(struct se_cmd *cmd, u64 res_key, u64 sa_res_key,
         /* Used for APTPL metadata w/ UNREGISTER */
         unsigned char *pr_aptpl_buf = NULL;
         unsigned char isid_buf[PR_REG_ISID_LEN], *isid_ptr = NULL;
-        sense_reason_t ret;
+        sense_reason_t ret = TCM_NO_SENSE;
         int pr_holder = 0, type;
 
         if (!se_sess || !se_lun) {
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index c23c76ccef65..bd587b70661a 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -541,9 +541,6 @@ static void transport_lun_remove_cmd(struct se_cmd *cmd)
 
 void transport_cmd_finish_abort(struct se_cmd *cmd, int remove)
 {
-        if (!(cmd->se_cmd_flags & SCF_SCSI_TMR_CDB))
-                transport_lun_remove_cmd(cmd);
-
         if (transport_cmd_check_stop_to_fabric(cmd))
                 return;
         if (remove)
@@ -1396,6 +1393,8 @@ static void target_complete_tmr_failure(struct work_struct *work)
 
         se_cmd->se_tmr_req->response = TMR_LUN_DOES_NOT_EXIST;
         se_cmd->se_tfo->queue_tm_rsp(se_cmd);
+
+        transport_cmd_check_stop_to_fabric(se_cmd);
 }
 
 /**
@@ -1688,6 +1687,7 @@ void target_execute_cmd(struct se_cmd *cmd)
         }
 
         cmd->t_state = TRANSPORT_PROCESSING;
+        cmd->transport_state |= CMD_T_ACTIVE;
         spin_unlock_irq(&cmd->t_state_lock);
 
         if (!target_handle_task_attr(cmd))
@@ -2597,6 +2597,16 @@ transport_send_check_condition_and_sense(struct se_cmd *cmd,
          * SENSE KEY values from include/scsi/scsi.h
          */
         switch (reason) {
+        case TCM_NO_SENSE:
+                /* CURRENT ERROR */
+                buffer[0] = 0x70;
+                buffer[SPC_ADD_SENSE_LEN_OFFSET] = 10;
+                /* Not Ready */
+                buffer[SPC_SENSE_KEY_OFFSET] = NOT_READY;
+                /* NO ADDITIONAL SENSE INFORMATION */
+                buffer[SPC_ASC_KEY_OFFSET] = 0;
+                buffer[SPC_ASCQ_KEY_OFFSET] = 0;
+                break;
         case TCM_NON_EXISTENT_LUN:
                 /* CURRENT ERROR */
                 buffer[0] = 0x70;
@@ -2743,7 +2753,7 @@ transport_send_check_condition_and_sense(struct se_cmd *cmd,
                 /* ILLEGAL REQUEST */
                 buffer[SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
                 /* LOGICAL UNIT COMMUNICATION FAILURE */
-                buffer[SPC_ASC_KEY_OFFSET] = 0x80;
+                buffer[SPC_ASC_KEY_OFFSET] = 0x08;
                 break;
         }
         /*
@@ -2804,6 +2814,8 @@ void transport_send_task_abort(struct se_cmd *cmd)
         }
         cmd->scsi_status = SAM_STAT_TASK_ABORTED;
 
+        transport_lun_remove_cmd(cmd);
+
         pr_debug("Setting SAM_STAT_TASK_ABORTED status for CDB: 0x%02x,"
                 " ITT: 0x%08x\n", cmd->t_task_cdb[0],
                 cmd->se_tfo->get_task_tag(cmd));
diff --git a/drivers/target/tcm_fc/tfc_sess.c b/drivers/target/tcm_fc/tfc_sess.c
index 12d6fa21e5e1..6659dd36e806 100644
--- a/drivers/target/tcm_fc/tfc_sess.c
+++ b/drivers/target/tcm_fc/tfc_sess.c
@@ -355,11 +355,11 @@ static int ft_prli_locked(struct fc_rport_priv *rdata, u32 spp_len,
 
         tport = ft_tport_create(rdata->local_port);
         if (!tport)
-                return 0;       /* not a target for this local port */
+                goto not_target;        /* not a target for this local port */
 
         acl = ft_acl_get(tport->tpg, rdata);
         if (!acl)
-                return 0;
+                goto not_target;        /* no target for this remote */
 
         if (!rspp)
                 goto fill;
@@ -396,12 +396,18 @@ static int ft_prli_locked(struct fc_rport_priv *rdata, u32 spp_len,
 
         /*
          * OR in our service parameters with other provider (initiator), if any.
-         * TBD XXX - indicate RETRY capability?
          */
 fill:
         fcp_parm = ntohl(spp->spp_params);
+        fcp_parm &= ~FCP_SPPF_RETRY;
         spp->spp_params = htonl(fcp_parm | FCP_SPPF_TARG_FCN);
         return FC_SPP_RESP_ACK;
+
+not_target:
+        fcp_parm = ntohl(spp->spp_params);
+        fcp_parm &= ~FCP_SPPF_TARG_FCN;
+        spp->spp_params = htonl(fcp_parm);
+        return 0;
 }
 
 /**
diff --git a/drivers/usb/Kconfig b/drivers/usb/Kconfig
index 4c90b510d016..640ae6c6d2d2 100644
--- a/drivers/usb/Kconfig
+++ b/drivers/usb/Kconfig
@@ -37,6 +37,7 @@ config USB_ARCH_HAS_EHCI
         default y if ARCH_W90X900
         default y if ARCH_AT91
         default y if ARCH_MXC
+        default y if ARCH_MXS
         default y if ARCH_OMAP3
         default y if ARCH_CNS3XXX
         default y if ARCH_VT8500
diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c
index caecad9213f5..8e9d31277c43 100644
--- a/drivers/usb/chipidea/host.c
+++ b/drivers/usb/chipidea/host.c
@@ -70,6 +70,9 @@ static int host_start(struct ci13xxx *ci)
         else
                 ci->hcd = hcd;
 
+        if (ci->platdata->flags & CI13XXX_DISABLE_STREAMING)
+                hw_write(ci, OP_USBMODE, USBMODE_CI_SDIS, USBMODE_CI_SDIS);
+
         return ret;
 }
 
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 8d809a811e16..2d92cce260d7 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1602,6 +1602,9 @@ static const struct usb_device_id acm_ids[] = {
         { USB_DEVICE(0x0572, 0x1340), /* Conexant CX93010-2x UCMxx */
         .driver_info = NO_UNION_NORMAL,
         },
+        { USB_DEVICE(0x05f9, 0x4002), /* PSC Scanning, Magellan 800i */
+        .driver_info = NO_UNION_NORMAL,
+        },
         { USB_DEVICE(0x1bbb, 0x0003), /* Alcatel OT-I650 */
         .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
         },
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index a815fd2cc5e7..957ed2c41482 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -877,6 +877,60 @@ static int hub_hub_status(struct usb_hub *hub,
         return ret;
 }
 
+static int hub_set_port_link_state(struct usb_hub *hub, int port1,
+                        unsigned int link_status)
+{
+        return set_port_feature(hub->hdev,
+                        port1 | (link_status << 3),
+                        USB_PORT_FEAT_LINK_STATE);
+}
+
+/*
+ * If USB 3.0 ports are placed into the Disabled state, they will no longer
+ * detect any device connects or disconnects.  This is generally not what the
+ * USB core wants, since it expects a disabled port to produce a port status
+ * change event when a new device connects.
+ *
+ * Instead, set the link state to Disabled, wait for the link to settle into
+ * that state, clear any change bits, and then put the port into the RxDetect
+ * state.
+ */
+static int hub_usb3_port_disable(struct usb_hub *hub, int port1)
+{
+        int ret;
+        int total_time;
+        u16 portchange, portstatus;
+
+        if (!hub_is_superspeed(hub->hdev))
+                return -EINVAL;
+
+        ret = hub_set_port_link_state(hub, port1, USB_SS_PORT_LS_SS_DISABLED);
+        if (ret) {
+                dev_err(hub->intfdev, "cannot disable port %d (err = %d)\n",
+                                port1, ret);
+                return ret;
+        }
+
+        /* Wait for the link to enter the disabled state. */
+        for (total_time = 0; ; total_time += HUB_DEBOUNCE_STEP) {
+                ret = hub_port_status(hub, port1, &portstatus, &portchange);
+                if (ret < 0)
+                        return ret;
+
+                if ((portstatus & USB_PORT_STAT_LINK_STATE) ==
+                                USB_SS_PORT_LS_SS_DISABLED)
+                        break;
+                if (total_time >= HUB_DEBOUNCE_TIMEOUT)
+                        break;
+                msleep(HUB_DEBOUNCE_STEP);
+        }
+        if (total_time >= HUB_DEBOUNCE_TIMEOUT)
+                dev_warn(hub->intfdev, "Could not disable port %d after %d ms\n",
+                                port1, total_time);
+
+        return hub_set_port_link_state(hub, port1, USB_SS_PORT_LS_RX_DETECT);
+}
+
 static int hub_port_disable(struct usb_hub *hub, int port1, int set_state)
 {
         struct usb_device *hdev = hub->hdev;
@@ -885,8 +939,13 @@ static int hub_port_disable(struct usb_hub *hub, int port1, int set_state)
         if (hub->ports[port1 - 1]->child && set_state)
                 usb_set_device_state(hub->ports[port1 - 1]->child,
                                 USB_STATE_NOTATTACHED);
-        if (!hub->error && !hub_is_superspeed(hub->hdev))
-                ret = clear_port_feature(hdev, port1, USB_PORT_FEAT_ENABLE);
+        if (!hub->error) {
+                if (hub_is_superspeed(hub->hdev))
+                        ret = hub_usb3_port_disable(hub, port1);
+                else
+                        ret = clear_port_feature(hdev, port1,
+                                        USB_PORT_FEAT_ENABLE);
+        }
         if (ret)
                 dev_err(hub->intfdev, "cannot disable port %d (err = %d)\n",
                                 port1, ret);
@@ -2440,7 +2499,7 @@ static unsigned hub_is_wusb(struct usb_hub *hub)
 #define HUB_SHORT_RESET_TIME    10
 #define HUB_BH_RESET_TIME       50
 #define HUB_LONG_RESET_TIME     200
-#define HUB_RESET_TIMEOUT       500
+#define HUB_RESET_TIMEOUT       800
 
 static int hub_port_reset(struct usb_hub *hub, int port1,
                         struct usb_device *udev, unsigned int delay, bool warm);
@@ -2475,6 +2534,10 @@ static int hub_port_wait_reset(struct usb_hub *hub, int port1,
                 if (ret < 0)
                         return ret;
 
+                /* The port state is unknown until the reset completes. */
+                if ((portstatus & USB_PORT_STAT_RESET))
+                        goto delay;
+
                 /*
                  * Some buggy devices require a warm reset to be issued even
                  * when the port appears not to be connected.
@@ -2520,11 +2583,7 @@ static int hub_port_wait_reset(struct usb_hub *hub, int port1,
                         if ((portchange & USB_PORT_STAT_C_CONNECTION))
                                 return -ENOTCONN;
 
-                        /* if we`ve finished resetting, then break out of
-                         * the loop
-                         */
-                        if (!(portstatus & USB_PORT_STAT_RESET) &&
-                            (portstatus & USB_PORT_STAT_ENABLE)) {
+                        if ((portstatus & USB_PORT_STAT_ENABLE)) {
                                 if (hub_is_wusb(hub))
                                         udev->speed = USB_SPEED_WIRELESS;
                                 else if (hub_is_superspeed(hub->hdev))
@@ -2538,10 +2597,15 @@ static int hub_port_wait_reset(struct usb_hub *hub, int port1,
                                 return 0;
                         }
                 } else {
-                        if (portchange & USB_PORT_STAT_C_BH_RESET)
-                                return 0;
+                        if (!(portstatus & USB_PORT_STAT_CONNECTION) ||
+                                        hub_port_warm_reset_required(hub,
+                                                portstatus))
+                                return -ENOTCONN;
+
+                        return 0;
                 }
 
+delay:
                 /* switch to the long delay after two short delay failures */
                 if (delay_time >= 2 * HUB_SHORT_RESET_TIME)
                         delay = HUB_LONG_RESET_TIME;
@@ -2565,14 +2629,11 @@ static void hub_port_finish_reset(struct usb_hub *hub, int port1,
                         msleep(10 + 40);
                         update_devnum(udev, 0);
                         hcd = bus_to_hcd(udev->bus);
-                        if (hcd->driver->reset_device) {
-                                *status = hcd->driver->reset_device(hcd, udev);
-                                if (*status < 0) {
-                                        dev_err(&udev->dev, "Cannot reset "
-                                                        "HCD device state\n");
-                                        break;
-                                }
-                        }
+                        /* The xHC may think the device is already reset,
+                         * so ignore the status.
+                         */
+                        if (hcd->driver->reset_device)
+                                hcd->driver->reset_device(hcd, udev);
                 }
                 /* FALL THROUGH */
         case -ENOTCONN:
@@ -2580,16 +2641,16 @@ static void hub_port_finish_reset(struct usb_hub *hub, int port1,
                 clear_port_feature(hub->hdev,
                                 port1, USB_PORT_FEAT_C_RESET);
                 /* FIXME need disconnect() for NOTATTACHED device */
-                if (warm) {
+                if (hub_is_superspeed(hub->hdev)) {
                         clear_port_feature(hub->hdev, port1,
                                         USB_PORT_FEAT_C_BH_PORT_RESET);
                         clear_port_feature(hub->hdev, port1,
                                         USB_PORT_FEAT_C_PORT_LINK_STATE);
-                } else {
+                }
+                if (!warm)
                         usb_set_device_state(udev, *status
                                         ? USB_STATE_NOTATTACHED
                                         : USB_STATE_DEFAULT);
-                }
                 break;
         }
 }
@@ -2939,7 +3000,7 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
 static int finish_port_resume(struct usb_device *udev)
 {
         int     status = 0;
-        u16     devstatus;
+        u16     devstatus = 0;
 
         /* caller owns the udev device lock */
         dev_dbg(&udev->dev, "%s\n",
@@ -2984,7 +3045,13 @@ static int finish_port_resume(struct usb_device *udev)
         if (status) {
                 dev_dbg(&udev->dev, "gone after usb resume? status %d\n",
                                 status);
-        } else if (udev->actconfig) {
+        /*
+         * There are a few quirky devices which violate the standard
+         * by claiming to have remote wakeup enabled after a reset,
+         * which crash if the feature is cleared, hence check for
+         * udev->reset_resume
+         */
+        } else if (udev->actconfig && !udev->reset_resume) {
                 le16_to_cpus(&devstatus);
                 if (devstatus & (1 << USB_DEVICE_REMOTE_WAKEUP)) {
                         status = usb_control_msg(udev,
@@ -4638,9 +4705,14 @@ static void hub_events(void)
                          * SS.Inactive state.
                          */
                         if (hub_port_warm_reset_required(hub, portstatus)) {
+                                int status;
+
                                 dev_dbg(hub_dev, "warm reset port %d\n", i);
-                                hub_port_reset(hub, i, NULL,
+                                status = hub_port_reset(hub, i, NULL,
                                                 HUB_BH_RESET_TIME, true);
+                                if (status < 0)
+                                        hub_port_disable(hub, i, 1);
+                                connect_change = 0;
                         }
 
                         if (connect_change)
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index fdefd9c7f7af..3113c1d71442 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -43,6 +43,9 @@ static const struct usb_device_id usb_quirk_list[] = {
         /* Creative SB Audigy 2 NX */
         { USB_DEVICE(0x041e, 0x3020), .driver_info = USB_QUIRK_RESET_RESUME },
 
+        /* Microsoft LifeCam-VX700 v2.0 */
+        { USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME },
+
         /* Logitech Quickcam Fusion */
         { USB_DEVICE(0x046d, 0x08c1), .driver_info = USB_QUIRK_RESET_RESUME },
 
diff --git a/drivers/usb/dwc3/debugfs.c b/drivers/usb/dwc3/debugfs.c
index 92604b4f9712..5945aadaa1c9 100644
--- a/drivers/usb/dwc3/debugfs.c
+++ b/drivers/usb/dwc3/debugfs.c
@@ -56,7 +56,7 @@
 #define dump_register(nm)                               \
 {                                                       \
         .name   = __stringify(nm),                      \
-        .offset = DWC3_ ##nm,                           \
+        .offset = DWC3_ ##nm - DWC3_GLOBALS_REGS_START, \
 }
 
 static const struct debugfs_reg32 dwc3_regs[] = {
diff --git a/drivers/usb/gadget/amd5536udc.c b/drivers/usb/gadget/amd5536udc.c
index fc0ec5e0d58e..d9f6b9372491 100644
--- a/drivers/usb/gadget/amd5536udc.c
+++ b/drivers/usb/gadget/amd5536udc.c
@@ -3231,7 +3231,7 @@ static int udc_pci_probe(
         }
 
         if (!pdev->irq) {
-                dev_err(&dev->pdev->dev, "irq not set\n");
+                dev_err(&pdev->dev, "irq not set\n");
                 kfree(dev);
                 dev = NULL;
                 retval = -ENODEV;
@@ -3250,7 +3250,7 @@ static int udc_pci_probe(
         dev->txfifo = (u32 __iomem *)(dev->virt_addr + UDC_TXFIFO_ADDR);
 
         if (request_irq(pdev->irq, udc_irq, IRQF_SHARED, name, dev) != 0) {
-                dev_dbg(&dev->pdev->dev, "request_irq(%d) fail\n", pdev->irq);
+                dev_dbg(&pdev->dev, "request_irq(%d) fail\n", pdev->irq);
                 kfree(dev);
                 dev = NULL;
                 retval = -EBUSY;
diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c
index 95d584dbed13..8cf0c0f6fa1f 100644
--- a/drivers/usb/gadget/dummy_hcd.c
+++ b/drivers/usb/gadget/dummy_hcd.c
@@ -130,10 +130,7 @@ static const char ep0name[] = "ep0";
 static const char *const ep_name[] = {
         ep0name,                                /* everyone has ep0 */
 
-        /* act like a net2280: high speed, six configurable endpoints */
-        "ep-a", "ep-b", "ep-c", "ep-d", "ep-e", "ep-f",
-
-        /* or like pxa250: fifteen fixed function endpoints */
+        /* act like a pxa250: fifteen fixed function endpoints */
         "ep1in-bulk", "ep2out-bulk", "ep3in-iso", "ep4out-iso", "ep5in-int",
         "ep6in-bulk", "ep7out-bulk", "ep8in-iso", "ep9out-iso", "ep10in-int",
         "ep11in-bulk", "ep12out-bulk", "ep13in-iso", "ep14out-iso",
@@ -141,6 +138,10 @@ static const char *const ep_name[] = {
 
         /* or like sa1100: two fixed function endpoints */
         "ep1out-bulk", "ep2in-bulk",
+
+        /* and now some generic EPs so we have enough in multi config */
+        "ep3out", "ep4in", "ep5out", "ep6out", "ep7in", "ep8out", "ep9in",
+        "ep10out", "ep11out", "ep12in", "ep13out", "ep14in", "ep15out",
 };
 #define DUMMY_ENDPOINTS ARRAY_SIZE(ep_name)
 
diff --git a/drivers/usb/gadget/mv_udc_core.c b/drivers/usb/gadget/mv_udc_core.c
index 379aac7b82fc..6e8b1272ebce 100644
--- a/drivers/usb/gadget/mv_udc_core.c
+++ b/drivers/usb/gadget/mv_udc_core.c
@@ -1012,7 +1012,7 @@ static void udc_clock_enable(struct mv_udc *udc)
         unsigned int i;
 
         for (i = 0; i < udc->clknum; i++)
-                clk_enable(udc->clk[i]);
+                clk_prepare_enable(udc->clk[i]);
 }
 
 static void udc_clock_disable(struct mv_udc *udc)
@@ -1020,7 +1020,7 @@ static void udc_clock_disable(struct mv_udc *udc)
         unsigned int i;
 
         for (i = 0; i < udc->clknum; i++)
-                clk_disable(udc->clk[i]);
+                clk_disable_unprepare(udc->clk[i]);
 }
 
 static void udc_stop(struct mv_udc *udc)
diff --git a/drivers/usb/gadget/s3c-hsotg.c b/drivers/usb/gadget/s3c-hsotg.c
index 141971d9051e..439c3f972f8c 100644
--- a/drivers/usb/gadget/s3c-hsotg.c
+++ b/drivers/usb/gadget/s3c-hsotg.c
@@ -3477,12 +3477,11 @@ static void s3c_hsotg_delete_debug(struct s3c_hsotg *hsotg)
 /**
  * s3c_hsotg_release - release callback for hsotg device
  * @dev: Device to for which release is called
+ *
+ * Nothing to do as the resource is allocated using devm_ API.
  */
 static void s3c_hsotg_release(struct device *dev)
 {
-        struct s3c_hsotg *hsotg = dev_get_drvdata(dev);
-
-        kfree(hsotg);
 }
 
 /**
diff --git a/drivers/usb/gadget/tcm_usb_gadget.c b/drivers/usb/gadget/tcm_usb_gadget.c
index 4f7f76f00c74..7cacd6ae818e 100644
--- a/drivers/usb/gadget/tcm_usb_gadget.c
+++ b/drivers/usb/gadget/tcm_usb_gadget.c
@@ -1794,9 +1794,10 @@ static int tcm_usbg_drop_nexus(struct usbg_tpg *tpg)
         tpg->tpg_nexus = NULL;
 
         kfree(tv_nexus);
+        ret = 0;
 out:
         mutex_unlock(&tpg->tpg_mutex);
-        return 0;
+        return ret;
 }
 
 static ssize_t tcm_usbg_tpg_store_nexus(
diff --git a/drivers/usb/gadget/u_serial.c b/drivers/usb/gadget/u_serial.c
index d0f95482f40e..598dcc1212f0 100644
--- a/drivers/usb/gadget/u_serial.c
+++ b/drivers/usb/gadget/u_serial.c
@@ -887,7 +887,7 @@ static void gs_close(struct tty_struct *tty, struct file *file)
         pr_debug("gs_close: ttyGS%d (%p,%p) done!\n",
                         port->port_num, tty, file);
 
-        wake_up_interruptible(&port->port.close_wait);
+        wake_up(&port->port.close_wait);
 exit:
         spin_unlock_irq(&port->port_lock);
 }
diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c
index fd9b5424b860..d81d2fcbff18 100644
--- a/drivers/usb/host/ehci-fsl.c
+++ b/drivers/usb/host/ehci-fsl.c
@@ -230,7 +230,7 @@ static int ehci_fsl_setup_phy(struct usb_hcd *hcd,
 
         switch (phy_mode) {
         case FSL_USB2_PHY_ULPI:
-                if (pdata->controller_ver) {
+                if (pdata->have_sysif_regs && pdata->controller_ver) {
                         /* controller version 1.6 or above */
                         setbits32(non_ehci + FSL_SOC_USB_CTRL,
                                         ULPI_PHY_CLK_SEL);
@@ -251,7 +251,7 @@ static int ehci_fsl_setup_phy(struct usb_hcd *hcd,
                 portsc |= PORT_PTS_PTW;
                 /* fall through */
         case FSL_USB2_PHY_UTMI:
-                if (pdata->controller_ver) {
+                if (pdata->have_sysif_regs && pdata->controller_ver) {
                         /* controller version 1.6 or above */
                         setbits32(non_ehci + FSL_SOC_USB_CTRL, UTMI_PHY_EN);
                         mdelay(FSL_UTMI_PHY_DLY);  /* Delay for UTMI PHY CLK to
@@ -267,7 +267,8 @@ static int ehci_fsl_setup_phy(struct usb_hcd *hcd,
                 break;
         }
 
-        if (pdata->controller_ver && (phy_mode == FSL_USB2_PHY_ULPI)) {
+        if (pdata->have_sysif_regs && pdata->controller_ver &&
+            (phy_mode == FSL_USB2_PHY_ULPI)) {
                 /* check PHY_CLK_VALID to get phy clk valid */
                 if (!spin_event_timeout(in_be32(non_ehci + FSL_SOC_USB_CTRL) &
                                 PHY_CLK_VALID, FSL_USB_PHY_CLK_TIMEOUT, 0)) {
@@ -278,7 +279,7 @@ static int ehci_fsl_setup_phy(struct usb_hcd *hcd,
 
         ehci_writel(ehci, portsc, &ehci->regs->port_status[port_offset]);
 
-        if (phy_mode != FSL_USB2_PHY_ULPI)
+        if (phy_mode != FSL_USB2_PHY_ULPI && pdata->have_sysif_regs)
                 setbits32(non_ehci + FSL_SOC_USB_CTRL, USB_CTRL_USB_EN);
 
         return 0;
diff --git a/drivers/usb/host/ehci-mv.c b/drivers/usb/host/ehci-mv.c
index f7bfc0b898b9..6c56297ea16b 100644
--- a/drivers/usb/host/ehci-mv.c
+++ b/drivers/usb/host/ehci-mv.c
@@ -43,7 +43,7 @@ static void ehci_clock_enable(struct ehci_hcd_mv *ehci_mv)
         unsigned int i;
 
         for (i = 0; i < ehci_mv->clknum; i++)
-                clk_enable(ehci_mv->clk[i]);
+                clk_prepare_enable(ehci_mv->clk[i]);
 }
 
 static void ehci_clock_disable(struct ehci_hcd_mv *ehci_mv)
@@ -51,7 +51,7 @@ static void ehci_clock_disable(struct ehci_hcd_mv *ehci_mv)
         unsigned int i;
 
         for (i = 0; i < ehci_mv->clknum; i++)
-                clk_disable(ehci_mv->clk[i]);
+                clk_disable_unprepare(ehci_mv->clk[i]);
 }
 
 static int mv_ehci_enable(struct ehci_hcd_mv *ehci_mv)
diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index dabb20494826..170b9399e09f 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -200,6 +200,26 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
                 break;
         }
 
+        /* optional debug port, normally in the first BAR */
+        temp = pci_find_capability(pdev, PCI_CAP_ID_DBG);
+        if (temp) {
+                pci_read_config_dword(pdev, temp, &temp);
+                temp >>= 16;
+                if (((temp >> 13) & 7) == 1) {
+                        u32 hcs_params = ehci_readl(ehci,
+                                                    &ehci->caps->hcs_params);
+
+                        temp &= 0x1fff;
+                        ehci->debug = hcd->regs + temp;
+                        temp = ehci_readl(ehci, &ehci->debug->control);
+                        ehci_info(ehci, "debug port %d%s\n",
+                                  HCS_DEBUG_PORT(hcs_params),
+                                  (temp & DBGP_ENABLED) ? " IN USE" : "");
+                        if (!(temp & DBGP_ENABLED))
+                                ehci->debug = NULL;
+                }
+        }
+
         retval = ehci_setup(hcd);
         if (retval)
                 return retval;
@@ -228,25 +248,6 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
                 break;
         }
 
-        /* optional debug port, normally in the first BAR */
-        temp = pci_find_capability(pdev, 0x0a);
-        if (temp) {
-                pci_read_config_dword(pdev, temp, &temp);
-                temp >>= 16;
-                if ((temp & (3 << 13)) == (1 << 13)) {
-                        temp &= 0x1fff;
-                        ehci->debug = hcd->regs + temp;
-                        temp = ehci_readl(ehci, &ehci->debug->control);
-                        ehci_info(ehci, "debug port %d%s\n",
-                                HCS_DEBUG_PORT(ehci->hcs_params),
-                                (temp & DBGP_ENABLED)
-                                        ? " IN USE"
-                                        : "");
-                        if (!(temp & DBGP_ENABLED))
-                                ehci->debug = NULL;
-                }
-        }
-
         /* at least the Genesys GL880S needs fixup here */
         temp = HCS_N_CC(ehci->hcs_params) * HCS_N_PCC(ehci->hcs_params);
         temp &= 0x0f;
diff --git a/drivers/usb/host/fsl-mph-dr-of.c b/drivers/usb/host/fsl-mph-dr-of.c
index 5105127c1d4b..11e0b79ff9d5 100644
--- a/drivers/usb/host/fsl-mph-dr-of.c
+++ b/drivers/usb/host/fsl-mph-dr-of.c
@@ -142,6 +142,9 @@ static int usb_get_ver_info(struct device_node *np)
                         return ver;
         }
 
+        if (of_device_is_compatible(np, "fsl,mpc5121-usb2-dr"))
+                return FSL_USB_VER_OLD;
+
         if (of_device_is_compatible(np, "fsl-usb2-mph")) {
                 if (of_device_is_compatible(np, "fsl-usb2-mph-v1.6"))
                         ver = FSL_USB_VER_1_6;
diff --git a/drivers/usb/host/imx21-hcd.c b/drivers/usb/host/imx21-hcd.c
index bd6a7447ccc9..f0ebe8e7c58b 100644
--- a/drivers/usb/host/imx21-hcd.c
+++ b/drivers/usb/host/imx21-hcd.c
@@ -58,6 +58,7 @@
 #include <linux/usb.h>
 #include <linux/usb/hcd.h>
 #include <linux/dma-mapping.h>
+#include <linux/module.h>
 
 #include "imx21-hcd.h"
 
diff --git a/drivers/usb/host/ohci-tmio.c b/drivers/usb/host/ohci-tmio.c
index d370245a4ee2..5e3a6deb62b1 100644
--- a/drivers/usb/host/ohci-tmio.c
+++ b/drivers/usb/host/ohci-tmio.c
@@ -128,7 +128,8 @@ static void tmio_start_hc(struct platform_device *dev)
         tmio_iowrite8(2, tmio->ccr + CCR_INTC);
 
         dev_info(&dev->dev, "revision %d @ 0x%08llx, irq %d\n",
-                        tmio_ioread8(tmio->ccr + CCR_REVID), hcd->rsrc_start, hcd->irq);
+                        tmio_ioread8(tmio->ccr + CCR_REVID),
+                        (u64) hcd->rsrc_start, hcd->irq);
 }
 
 static int ohci_tmio_start(struct usb_hcd *hcd)
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index a686cf4905bb..68914429482f 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -761,12 +761,39 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                         break;
                 case USB_PORT_FEAT_LINK_STATE:
                         temp = xhci_readl(xhci, port_array[wIndex]);
+
+                        /* Disable port */
+                        if (link_state == USB_SS_PORT_LS_SS_DISABLED) {
+                                xhci_dbg(xhci, "Disable port %d\n", wIndex);
+                                temp = xhci_port_state_to_neutral(temp);
+                                /*
+                                 * Clear all change bits, so that we get a new
+                                 * connection event.
+                                 */
+                                temp |= PORT_CSC | PORT_PEC | PORT_WRC |
+                                        PORT_OCC | PORT_RC | PORT_PLC |
+                                        PORT_CEC;
+                                xhci_writel(xhci, temp | PORT_PE,
+                                        port_array[wIndex]);
+                                temp = xhci_readl(xhci, port_array[wIndex]);
+                                break;
+                        }
+
+                        /* Put link in RxDetect (enable port) */
+                        if (link_state == USB_SS_PORT_LS_RX_DETECT) {
+                                xhci_dbg(xhci, "Enable port %d\n", wIndex);
+                                xhci_set_link_state(xhci, port_array, wIndex,
+                                                link_state);
+                                temp = xhci_readl(xhci, port_array[wIndex]);
+                                break;
+                        }
+
                         /* Software should not attempt to set
-                         * port link state above '5' (Rx.Detect) and the port
+                         * port link state above '3' (U3) and the port
                          * must be enabled.
                          */
                         if ((temp & PORT_PE) == 0 ||
-                                (link_state > USB_SS_PORT_LS_RX_DETECT)) {
+                                (link_state > USB_SS_PORT_LS_U3)) {
                                 xhci_warn(xhci, "Cannot set link state.\n");
                                 goto error;
                         }
@@ -957,6 +984,7 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)
         int max_ports;
         __le32 __iomem **port_array;
         struct xhci_bus_state *bus_state;
+        bool reset_change = false;
 
         max_ports = xhci_get_ports(hcd, &port_array);
         bus_state = &xhci->bus_state[hcd_index(hcd)];
@@ -988,6 +1016,12 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)
                         buf[(i + 1) / 8] |= 1 << (i + 1) % 8;
                         status = 1;
                 }
+                if ((temp & PORT_RC))
+                        reset_change = true;
+        }
+        if (!status && !reset_change) {
+                xhci_dbg(xhci, "%s: stopping port polling.\n", __func__);
+                clear_bit(HCD_FLAG_POLL_RH, &hcd->flags);
         }
         spin_unlock_irqrestore(&xhci->lock, flags);
         return status ? retval : 0;
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index fb51c7085ad0..35616ffbe3ae 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1250,6 +1250,8 @@ static unsigned int xhci_microframes_to_exponent(struct usb_device *udev,
 static unsigned int xhci_parse_microframe_interval(struct usb_device *udev,
                 struct usb_host_endpoint *ep)
 {
+        if (ep->desc.bInterval == 0)
+                return 0;
         return xhci_microframes_to_exponent(udev, ep,
                         ep->desc.bInterval, 0, 15);
 }
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index cbb44b7b9d65..59fb5c677dbe 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1725,6 +1725,15 @@ cleanup:
         if (bogus_port_status)
                 return;
 
+        /*
+         * xHCI port-status-change events occur when the "or" of all the
+         * status-change bits in the portsc register changes from 0 to 1.
+         * New status changes won't cause an event if any other change
+         * bits are still set.  When an event occurs, switch over to
+         * polling to avoid losing status changes.
+         */
+        xhci_dbg(xhci, "%s: starting port polling.\n", __func__);
+        set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
         spin_unlock(&xhci->lock);
         /* Pass this up to the core */
         usb_hcd_poll_rh_status(hcd);
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 5c72c431bab1..f1f01a834ba7 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -884,6 +884,11 @@ int xhci_suspend(struct xhci_hcd *xhci)
                         xhci->shared_hcd->state != HC_STATE_SUSPENDED)
                 return -EINVAL;
 
+        /* Don't poll the roothubs on bus suspend. */
+        xhci_dbg(xhci, "%s: stopping port polling.\n", __func__);
+        clear_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+        del_timer_sync(&hcd->rh_timer);
+
         spin_lock_irq(&xhci->lock);
         clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
         clear_bit(HCD_FLAG_HW_ACCESSIBLE, &xhci->shared_hcd->flags);
@@ -1069,6 +1074,11 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
         if (xhci->quirks & XHCI_COMP_MODE_QUIRK)
                 compliance_mode_recovery_timer_init(xhci);
 
+        /* Re-enable port polling. */
+        xhci_dbg(xhci, "%s: starting port polling.\n", __func__);
+        set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+        usb_hcd_poll_rh_status(hcd);
+
         return retval;
 }
 #endif  /* CONFIG_PM */
diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
index 7667b12f2ff5..268148de9714 100644
--- a/drivers/usb/misc/usbtest.c
+++ b/drivers/usb/misc/usbtest.c
@@ -2179,7 +2179,7 @@ usbtest_ioctl(struct usb_interface *intf, unsigned int code, void *buf)
                 if (dev->out_pipe == 0 || !param->length || param->sglen < 4)
                         break;
                 retval = 0;
-                dev_info(&intf->dev, "TEST 17:  unlink from %d queues of "
+                dev_info(&intf->dev, "TEST 24:  unlink from %d queues of "
                                 "%d %d-byte writes\n",
                                 param->iterations, param->sglen, param->length);
                 for (i = param->iterations; retval == 0 && i > 0; --i) {
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index f1c6c5470b92..fd3486745e64 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -2298,10 +2298,7 @@ static int __init musb_init(void)
         if (usb_disabled())
                 return 0;
 
-        pr_info("%s: version " MUSB_VERSION ", "
-                "?dma?"
-                ", "
-                "otg (peripheral+host)",
+        pr_info("%s: version " MUSB_VERSION ", ?dma?, otg (peripheral+host)\n",
                 musb_driver_name);
         return platform_driver_register(&musb_driver);
 }
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index e6f2ae8368bb..f7d764de6fda 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -134,6 +134,11 @@ static const resource_size_t dsps_control_module_phys[] = {
         DSPS_AM33XX_CONTROL_MODULE_PHYS_1,
 };
 
+#define USBPHY_CM_PWRDN         (1 << 0)
+#define USBPHY_OTG_PWRDN        (1 << 1)
+#define USBPHY_OTGVDET_EN       (1 << 19)
+#define USBPHY_OTGSESSEND_EN    (1 << 20)
+
 /**
  * musb_dsps_phy_control - phy on/off
  * @glue: struct dsps_glue *
diff --git a/drivers/usb/otg/Kconfig b/drivers/usb/otg/Kconfig
index 6223062d5d1b..37962c99ff1e 100644
--- a/drivers/usb/otg/Kconfig
+++ b/drivers/usb/otg/Kconfig
@@ -110,7 +110,7 @@ config AB8500_USB
 
 config FSL_USB2_OTG
         bool "Freescale USB OTG Transceiver Driver"
-        depends on USB_EHCI_FSL && USB_GADGET_FSL_USB2 && USB_SUSPEND
+        depends on USB_EHCI_FSL && USB_FSL_USB2 && USB_SUSPEND
         select USB_OTG
         select USB_OTG_UTILS
         help
diff --git a/drivers/usb/otg/mv_otg.c b/drivers/usb/otg/mv_otg.c
index 1dd57504186d..eace975991a8 100644
--- a/drivers/usb/otg/mv_otg.c
+++ b/drivers/usb/otg/mv_otg.c
@@ -240,7 +240,7 @@ static void otg_clock_enable(struct mv_otg *mvotg)
         unsigned int i;
 
         for (i = 0; i < mvotg->clknum; i++)
-                clk_enable(mvotg->clk[i]);
+                clk_prepare_enable(mvotg->clk[i]);
 }
 
 static void otg_clock_disable(struct mv_otg *mvotg)
@@ -248,7 +248,7 @@ static void otg_clock_disable(struct mv_otg *mvotg)
         unsigned int i;
 
         for (i = 0; i < mvotg->clknum; i++)
-                clk_disable(mvotg->clk[i]);
+                clk_disable_unprepare(mvotg->clk[i]);
 }
 
 static int mv_otg_enable_internal(struct mv_otg *mvotg)
diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
index dd41f61893ef..f2985cd88021 100644
--- a/drivers/usb/renesas_usbhs/mod_gadget.c
+++ b/drivers/usb/renesas_usbhs/mod_gadget.c
@@ -545,15 +545,6 @@ static int usbhsg_pipe_disable(struct usbhsg_uep *uep)
         return 0;
 }
 
-static void usbhsg_uep_init(struct usbhsg_gpriv *gpriv)
-{
-        int i;
-        struct usbhsg_uep *uep;
-
-        usbhsg_for_each_uep_with_dcp(uep, gpriv, i)
-                uep->pipe = NULL;
-}
-
 /*
  *
  *              usb_ep_ops
@@ -610,7 +601,12 @@ static int usbhsg_ep_disable(struct usb_ep *ep)
 {
         struct usbhsg_uep *uep = usbhsg_ep_to_uep(ep);
 
-        return usbhsg_pipe_disable(uep);
+        usbhsg_pipe_disable(uep);
+
+        uep->pipe->mod_private  = NULL;
+        uep->pipe               = NULL;
+
+        return 0;
 }
 
 static struct usb_request *usbhsg_ep_alloc_request(struct usb_ep *ep,
@@ -761,9 +757,8 @@ static int usbhsg_try_start(struct usbhs_priv *priv, u32 status)
         usbhs_pipe_init(priv,
                         usbhsg_dma_map_ctrl);
         usbhs_fifo_init(priv);
-        usbhsg_uep_init(gpriv);
 
-        /* dcp init */
+        /* dcp init instead of usbhsg_ep_enable() */
         dcp->pipe               = usbhs_dcp_malloc(priv);
         dcp->pipe->mod_private  = dcp;
         usbhs_pipe_config_update(dcp->pipe, 0, 0, 64);
@@ -825,7 +820,7 @@ static int usbhsg_try_stop(struct usbhs_priv *priv, u32 status)
         usbhs_sys_set_test_mode(priv, 0);
         usbhs_sys_function_ctrl(priv, 0);
 
-        usbhsg_pipe_disable(dcp);
+        usbhsg_ep_disable(&dcp->ep);
 
         dev_dbg(dev, "stop gadget\n");
 
@@ -998,6 +993,7 @@ int usbhs_mod_gadget_probe(struct usbhs_priv *priv)
          */
         usbhsg_for_each_uep_with_dcp(uep, gpriv, i) {
                 uep->gpriv      = gpriv;
+                uep->pipe       = NULL;
                 snprintf(uep->ep_name, EP_NAME_SIZE, "ep%d", i);
 
                 uep->ep.name            = uep->ep_name;
diff --git a/drivers/usb/renesas_usbhs/mod_host.c b/drivers/usb/renesas_usbhs/mod_host.c
index 3d3cd6ca2689..b86815421c8d 100644
--- a/drivers/usb/renesas_usbhs/mod_host.c
+++ b/drivers/usb/renesas_usbhs/mod_host.c
@@ -661,9 +661,10 @@ static void usbhsh_queue_done(struct usbhs_priv *priv, struct usbhs_pkt *pkt)
                 status = -ESHUTDOWN;
 
         urb->actual_length = pkt->actual;
-        usbhsh_ureq_free(hpriv, ureq);
 
         usbhsh_endpoint_sequence_save(hpriv, urb, pkt);
+        usbhsh_ureq_free(hpriv, ureq);
+
         usbhsh_pipe_detach(hpriv, usbhsh_ep_to_uep(urb->ep));
 
         usb_hcd_unlink_urb_from_ep(hcd, urb);
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 0a373b3ae96a..ba68835d06a6 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -875,6 +875,8 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_DISTORTEC_JTAG_LOCK_PICK_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { USB_DEVICE(FTDI_VID, FTDI_LUMEL_PD12_PID) },
+        /* Crucible Devices */
+        { USB_DEVICE(FTDI_VID, FTDI_CT_COMET_PID) },
         { },                                    /* Optional parameter entry */
         { }                                     /* Terminating entry */
 };
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 049b6e715fa4..fa5d56038276 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -1259,3 +1259,9 @@
  * ATI command output: Cinterion MC55i
  */
 #define FTDI_CINTERION_MC55I_PID        0xA951
+
+/*
+ * Product: Comet Caller ID decoder
+ * Manufacturer: Crucible Technologies
+ */
+#define FTDI_CT_COMET_PID       0x8e08
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index e6f87b76c715..478adcfcdf26 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -288,6 +288,7 @@ static void option_instat_callback(struct urb *urb);
 #define ALCATEL_VENDOR_ID                       0x1bbb
 #define ALCATEL_PRODUCT_X060S_X200              0x0000
 #define ALCATEL_PRODUCT_X220_X500D              0x0017
+#define ALCATEL_PRODUCT_L100V                   0x011e
 
 #define PIRELLI_VENDOR_ID                       0x1266
 #define PIRELLI_PRODUCT_C100_1                  0x1002
@@ -429,9 +430,12 @@ static void option_instat_callback(struct urb *urb);
 #define MEDIATEK_VENDOR_ID                      0x0e8d
 #define MEDIATEK_PRODUCT_DC_1COM                0x00a0
 #define MEDIATEK_PRODUCT_DC_4COM                0x00a5
+#define MEDIATEK_PRODUCT_DC_4COM2               0x00a7
 #define MEDIATEK_PRODUCT_DC_5COM                0x00a4
 #define MEDIATEK_PRODUCT_7208_1COM              0x7101
 #define MEDIATEK_PRODUCT_7208_2COM              0x7102
+#define MEDIATEK_PRODUCT_7103_2COM              0x7103
+#define MEDIATEK_PRODUCT_7106_2COM              0x7106
 #define MEDIATEK_PRODUCT_FP_1COM                0x0003
 #define MEDIATEK_PRODUCT_FP_2COM                0x0023
 #define MEDIATEK_PRODUCT_FPDC_1COM              0x0043
@@ -441,6 +445,10 @@ static void option_instat_callback(struct urb *urb);
 #define CELLIENT_VENDOR_ID                      0x2692
 #define CELLIENT_PRODUCT_MEN200                 0x9005
 
+/* Hyundai Petatel Inc. products */
+#define PETATEL_VENDOR_ID                       0x1ff4
+#define PETATEL_PRODUCT_NP10T                   0x600e
+
 /* some devices interfaces need special handling due to a number of reasons */
 enum option_blacklist_reason {
                 OPTION_BLACKLIST_NONE = 0,
@@ -923,7 +931,8 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0257, 0xff, 0xff, 0xff), /* ZTE MF821 */
           .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0265, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0284, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0284, 0xff, 0xff, 0xff), /* ZTE MF880 */
+          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0317, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0326, 0xff, 0xff, 0xff),
           .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
@@ -1190,6 +1199,8 @@ static const struct usb_device_id option_ids[] = {
           .driver_info = (kernel_ulong_t)&alcatel_x200_blacklist
         },
         { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X220_X500D) },
+        { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_L100V),
+          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) },
         { USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) },
         { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14),
@@ -1294,7 +1305,12 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_FP_2COM, 0x0a, 0x00, 0x00) },
         { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_FPDC_1COM, 0x0a, 0x00, 0x00) },
         { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_FPDC_2COM, 0x0a, 0x00, 0x00) },
+        { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_7103_2COM, 0xff, 0x00, 0x00) },
+        { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_7106_2COM, 0x02, 0x02, 0x01) },
+        { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x02, 0x01) },
+        { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x00, 0x00) },
         { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) },
+        { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T) },
         { } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
diff --git a/drivers/video/ssd1307fb.c b/drivers/video/ssd1307fb.c
index 4d99dd7a6831..395cb6a8d8f3 100644
--- a/drivers/video/ssd1307fb.c
+++ b/drivers/video/ssd1307fb.c
@@ -145,8 +145,8 @@ static void ssd1307fb_update_display(struct ssd1307fb_par *par)
                                 u32 page_length = SSD1307FB_WIDTH * i;
                                 u32 index = page_length + (SSD1307FB_WIDTH * k + j) / 8;
                                 u8 byte = *(vmem + index);
-                                u8 bit = byte & (1 << (7 - (j % 8)));
-                                bit = bit >> (7 - (j % 8));
+                                u8 bit = byte & (1 << (j % 8));
+                                bit = bit >> (j % 8);
                                 buf |= bit << k;
                         }
                         ssd1307fb_write_data(par->client, buf);
diff --git a/fs/buffer.c b/fs/buffer.c
index c017a2dfb909..7a75c3e0fd58 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -2935,6 +2935,7 @@ static void guard_bh_eod(int rw, struct bio *bio, struct buffer_head *bh)
                 void *kaddr = kmap_atomic(bh->b_page);
                 memset(kaddr + bh_offset(bh) + bytes, 0, bh->b_size - bytes);
                 kunmap_atomic(kaddr);
+                flush_dcache_page(bh->b_page);
         }
 }
 
diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
index 153bb1e42e63..a5f12b7e228d 100644
--- a/fs/debugfs/inode.c
+++ b/fs/debugfs/inode.c
@@ -176,7 +176,7 @@ static int debugfs_parse_options(char *data, struct debugfs_mount_opts *opts)
                         opts->uid = uid;
                         break;
                 case Opt_gid:
-                        if (match_octal(&args[0], &option))
+                        if (match_int(&args[0], &option))
                                 return -EINVAL;
                         gid = make_kgid(current_user_ns(), option);
                         if (!gid_valid(gid))
diff --git a/fs/exec.c b/fs/exec.c
index 18c45cac368f..20df02c1cc70 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -434,8 +434,9 @@ static int count(struct user_arg_ptr argv, int max)
                         if (IS_ERR(p))
                                 return -EFAULT;
 
-                        if (i++ >= max)
+                        if (i >= max)
                                 return -E2BIG;
+                        ++i;
 
                         if (fatal_signal_pending(current))
                                 return -ERESTARTNOHAND;
diff --git a/fs/jbd/journal.c b/fs/jbd/journal.c
index a2862339323b..81cc7eaff863 100644
--- a/fs/jbd/journal.c
+++ b/fs/jbd/journal.c
@@ -446,7 +446,8 @@ int __log_start_commit(journal_t *journal, tid_t target)
          * currently running transaction (if it exists).  Otherwise,
          * the target tid must be an old one.
          */
-        if (journal->j_running_transaction &&
+        if (journal->j_commit_request != target &&
+            journal->j_running_transaction &&
             journal->j_running_transaction->t_tid == target) {
                 /*
                  * We want a new commit: OK, mark the request and wakeup the
diff --git a/fs/seq_file.c b/fs/seq_file.c
index 9d863fb501f9..f2bc3dfd0b88 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -296,7 +296,7 @@ EXPORT_SYMBOL(seq_read);
  *      seq_lseek -     ->llseek() method for sequential files.
  *      @file: the file in question
  *      @offset: new position
- *      @origin: 0 for absolute, 1 for relative position
+ *      @whence: 0 for absolute, 1 for relative position
  *
  *      Ready-made ->f_op->llseek()
  */
diff --git a/fs/udf/super.c b/fs/udf/super.c
index d44fb568abe1..e9be396a558d 100644
--- a/fs/udf/super.c
+++ b/fs/udf/super.c
@@ -307,7 +307,8 @@ static void udf_sb_free_partitions(struct super_block *sb)
 {
         struct udf_sb_info *sbi = UDF_SB(sb);
         int i;
-
+        if (sbi->s_partmaps == NULL)
+                return;
         for (i = 0; i < sbi->s_partitions; i++)
                 udf_free_partition(&sbi->s_partmaps[i]);
         kfree(sbi->s_partmaps);
diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index 26673a0b20e7..56d1614760cf 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -175,7 +175,7 @@ xfs_buf_get_maps(
         bp->b_map_count = map_count;
 
         if (map_count == 1) {
-                bp->b_maps = &bp->b_map;
+                bp->b_maps = &bp->__b_map;
                 return 0;
         }
 
@@ -193,7 +193,7 @@ static void
 xfs_buf_free_maps(
         struct xfs_buf  *bp)
 {
-        if (bp->b_maps != &bp->b_map) {
+        if (bp->b_maps != &bp->__b_map) {
                 kmem_free(bp->b_maps);
                 bp->b_maps = NULL;
         }
@@ -377,8 +377,8 @@ xfs_buf_allocate_memory(
         }
 
 use_alloc_page:
-        start = BBTOB(bp->b_map.bm_bn) >> PAGE_SHIFT;
-        end = (BBTOB(bp->b_map.bm_bn + bp->b_length) + PAGE_SIZE - 1)
+        start = BBTOB(bp->b_maps[0].bm_bn) >> PAGE_SHIFT;
+        end = (BBTOB(bp->b_maps[0].bm_bn + bp->b_length) + PAGE_SIZE - 1)
                                                                 >> PAGE_SHIFT;
         page_count = end - start;
         error = _xfs_buf_get_pages(bp, page_count, flags);
@@ -640,7 +640,7 @@ _xfs_buf_read(
         xfs_buf_flags_t         flags)
 {
         ASSERT(!(flags & XBF_WRITE));
-        ASSERT(bp->b_map.bm_bn != XFS_BUF_DADDR_NULL);
+        ASSERT(bp->b_maps[0].bm_bn != XFS_BUF_DADDR_NULL);
 
         bp->b_flags &= ~(XBF_WRITE | XBF_ASYNC | XBF_READ_AHEAD);
         bp->b_flags |= flags & (XBF_READ | XBF_ASYNC | XBF_READ_AHEAD);
@@ -1709,7 +1709,7 @@ xfs_buf_cmp(
         struct xfs_buf  *bp = container_of(b, struct xfs_buf, b_list);
         xfs_daddr_t             diff;
 
-        diff = ap->b_map.bm_bn - bp->b_map.bm_bn;
+        diff = ap->b_maps[0].bm_bn - bp->b_maps[0].bm_bn;
         if (diff < 0)
                 return -1;
         if (diff > 0)
diff --git a/fs/xfs/xfs_buf.h b/fs/xfs/xfs_buf.h
index 23f5642480bb..433a12ed7b17 100644
--- a/fs/xfs/xfs_buf.h
+++ b/fs/xfs/xfs_buf.h
@@ -151,7 +151,7 @@ typedef struct xfs_buf {
         struct page             **b_pages;      /* array of page pointers */
         struct page             *b_page_array[XB_PAGES]; /* inline pages */
         struct xfs_buf_map      *b_maps;        /* compound buffer map */
-        struct xfs_buf_map      b_map;          /* inline compound buffer map */
+        struct xfs_buf_map      __b_map;        /* inline compound buffer map */
         int                     b_map_count;
         int                     b_io_length;    /* IO size in BBs */
         atomic_t                b_pin_count;    /* pin count */
@@ -330,8 +330,8 @@ void xfs_buf_stale(struct xfs_buf *bp);
  * In future, uncached buffers will pass the block number directly to the io
  * request function and hence these macros will go away at that point.
  */
-#define XFS_BUF_ADDR(bp)                ((bp)->b_map.bm_bn)
-#define XFS_BUF_SET_ADDR(bp, bno)       ((bp)->b_map.bm_bn = (xfs_daddr_t)(bno))
+#define XFS_BUF_ADDR(bp)                ((bp)->b_maps[0].bm_bn)
+#define XFS_BUF_SET_ADDR(bp, bno)       ((bp)->b_maps[0].bm_bn = (xfs_daddr_t)(bno))
 
 static inline void xfs_buf_set_ref(struct xfs_buf *bp, int lru_ref)
 {
diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
index becf4a97efc6..77b09750e92c 100644
--- a/fs/xfs/xfs_buf_item.c
+++ b/fs/xfs/xfs_buf_item.c
@@ -71,7 +71,7 @@ xfs_buf_item_log_debug(
                 chunk_num = byte >> XFS_BLF_SHIFT;
                 word_num = chunk_num >> BIT_TO_WORD_SHIFT;
                 bit_num = chunk_num & (NBWORD - 1);
-                wordp = &(bip->bli_format.blf_data_map[word_num]);
+                wordp = &(bip->__bli_format.blf_data_map[word_num]);
                 bit_set = *wordp & (1 << bit_num);
                 ASSERT(bit_set);
                 byte++;
@@ -237,7 +237,7 @@ xfs_buf_item_size(
                  * cancel flag in it.
                  */
                 trace_xfs_buf_item_size_stale(bip);
-                ASSERT(bip->bli_format.blf_flags & XFS_BLF_CANCEL);
+                ASSERT(bip->__bli_format.blf_flags & XFS_BLF_CANCEL);
                 return bip->bli_format_count;
         }
 
@@ -278,7 +278,7 @@ xfs_buf_item_format_segment(
         uint            buffer_offset;
 
         /* copy the flags across from the base format item */
-        blfp->blf_flags = bip->bli_format.blf_flags;
+        blfp->blf_flags = bip->__bli_format.blf_flags;
 
         /*
          * Base size is the actual size of the ondisk structure - it reflects
@@ -287,6 +287,17 @@ xfs_buf_item_format_segment(
          */
         base_size = offsetof(struct xfs_buf_log_format, blf_data_map) +
                         (blfp->blf_map_size * sizeof(blfp->blf_data_map[0]));
+
+        nvecs = 0;
+        first_bit = xfs_next_bit(blfp->blf_data_map, blfp->blf_map_size, 0);
+        if (!(bip->bli_flags & XFS_BLI_STALE) && first_bit == -1) {
+                /*
+                 * If the map is not be dirty in the transaction, mark
+                 * the size as zero and do not advance the vector pointer.
+                 */
+                goto out;
+        }
+
         vecp->i_addr = blfp;
         vecp->i_len = base_size;
         vecp->i_type = XLOG_REG_TYPE_BFORMAT;
@@ -301,15 +312,13 @@ xfs_buf_item_format_segment(
                  */
                 trace_xfs_buf_item_format_stale(bip);
                 ASSERT(blfp->blf_flags & XFS_BLF_CANCEL);
-                blfp->blf_size = nvecs;
-                return vecp;
+                goto out;
         }
 
         /*
          * Fill in an iovec for each set of contiguous chunks.
          */
-        first_bit = xfs_next_bit(blfp->blf_data_map, blfp->blf_map_size, 0);
-        ASSERT(first_bit != -1);
+
         last_bit = first_bit;
         nbits = 1;
         for (;;) {
@@ -371,7 +380,8 @@ xfs_buf_item_format_segment(
                         nbits++;
                 }
         }
-        bip->bli_format.blf_size = nvecs;
+out:
+        blfp->blf_size = nvecs;
         return vecp;
 }
 
@@ -405,7 +415,7 @@ xfs_buf_item_format(
         if (bip->bli_flags & XFS_BLI_INODE_BUF) {
                 if (!((bip->bli_flags & XFS_BLI_INODE_ALLOC_BUF) &&
                       xfs_log_item_in_current_chkpt(lip)))
-                        bip->bli_format.blf_flags |= XFS_BLF_INODE_BUF;
+                        bip->__bli_format.blf_flags |= XFS_BLF_INODE_BUF;
                 bip->bli_flags &= ~XFS_BLI_INODE_BUF;
         }
 
@@ -485,7 +495,7 @@ xfs_buf_item_unpin(
                 ASSERT(bip->bli_flags & XFS_BLI_STALE);
                 ASSERT(xfs_buf_islocked(bp));
                 ASSERT(XFS_BUF_ISSTALE(bp));
-                ASSERT(bip->bli_format.blf_flags & XFS_BLF_CANCEL);
+                ASSERT(bip->__bli_format.blf_flags & XFS_BLF_CANCEL);
 
                 trace_xfs_buf_item_unpin_stale(bip);
 
@@ -601,7 +611,7 @@ xfs_buf_item_unlock(
 {
         struct xfs_buf_log_item *bip = BUF_ITEM(lip);
         struct xfs_buf          *bp = bip->bli_buf;
-        int                     aborted;
+        int                     aborted, clean, i;
         uint                    hold;
 
         /* Clear the buffer's association with this transaction. */
@@ -631,7 +641,7 @@ xfs_buf_item_unlock(
          */
         if (bip->bli_flags & XFS_BLI_STALE) {
                 trace_xfs_buf_item_unlock_stale(bip);
-                ASSERT(bip->bli_format.blf_flags & XFS_BLF_CANCEL);
+                ASSERT(bip->__bli_format.blf_flags & XFS_BLF_CANCEL);
                 if (!aborted) {
                         atomic_dec(&bip->bli_refcount);
                         return;
@@ -644,8 +654,15 @@ xfs_buf_item_unlock(
          * If the buf item isn't tracking any data, free it, otherwise drop the
          * reference we hold to it.
          */
-        if (xfs_bitmap_empty(bip->bli_format.blf_data_map,
-                             bip->bli_format.blf_map_size))
+        clean = 1;
+        for (i = 0; i < bip->bli_format_count; i++) {
+                if (!xfs_bitmap_empty(bip->bli_formats[i].blf_data_map,
+                             bip->bli_formats[i].blf_map_size)) {
+                        clean = 0;
+                        break;
+                }
+        }
+        if (clean)
                 xfs_buf_item_relse(bp);
         else
                 atomic_dec(&bip->bli_refcount);
@@ -716,7 +733,7 @@ xfs_buf_item_get_format(
         bip->bli_format_count = count;
 
         if (count == 1) {
-                bip->bli_formats = &bip->bli_format;
+                bip->bli_formats = &bip->__bli_format;
                 return 0;
         }
 
@@ -731,7 +748,7 @@ STATIC void
 xfs_buf_item_free_format(
         struct xfs_buf_log_item *bip)
 {
-        if (bip->bli_formats != &bip->bli_format) {
+        if (bip->bli_formats != &bip->__bli_format) {
                 kmem_free(bip->bli_formats);
                 bip->bli_formats = NULL;
         }
diff --git a/fs/xfs/xfs_buf_item.h b/fs/xfs/xfs_buf_item.h
index 6850f49f4af3..16def435944a 100644
--- a/fs/xfs/xfs_buf_item.h
+++ b/fs/xfs/xfs_buf_item.h
@@ -104,7 +104,7 @@ typedef struct xfs_buf_log_item {
 #endif
         int                     bli_format_count;       /* count of headers */
         struct xfs_buf_log_format *bli_formats; /* array of in-log header ptrs */
-        struct xfs_buf_log_format bli_format;   /* embedded in-log header */
+        struct xfs_buf_log_format __bli_format; /* embedded in-log header */
 } xfs_buf_log_item_t;
 
 void    xfs_buf_item_init(struct xfs_buf *, struct xfs_mount *);
diff --git a/fs/xfs/xfs_dir2_block.c b/fs/xfs/xfs_dir2_block.c
index 7536faaa61e7..12afe07a91d7 100644
--- a/fs/xfs/xfs_dir2_block.c
+++ b/fs/xfs/xfs_dir2_block.c
@@ -355,10 +355,12 @@ xfs_dir2_block_addname(
         /*
          * If need to compact the leaf entries, do it now.
          */
-        if (compact)
+        if (compact) {
                 xfs_dir2_block_compact(tp, bp, hdr, btp, blp, &needlog,
                                       &lfloghigh, &lfloglow);
-        else if (btp->stale) {
+                /* recalculate blp post-compaction */
+                blp = xfs_dir2_block_leaf_p(btp);
+        } else if (btp->stale) {
                 /*
                  * Set leaf logging boundaries to impossible state.
                  * For the no-stale case they're set explicitly.
diff --git a/fs/xfs/xfs_qm_syscalls.c b/fs/xfs/xfs_qm_syscalls.c
index 5f53e75409b8..8a59f8546552 100644
--- a/fs/xfs/xfs_qm_syscalls.c
+++ b/fs/xfs/xfs_qm_syscalls.c
@@ -784,11 +784,11 @@ xfs_qm_scall_getquota(
              (XFS_IS_OQUOTA_ENFORCED(mp) &&
                         (dst->d_flags & (FS_PROJ_QUOTA | FS_GROUP_QUOTA)))) &&
             dst->d_id != 0) {
-                if (((int) dst->d_bcount > (int) dst->d_blk_softlimit) &&
+                if ((dst->d_bcount > dst->d_blk_softlimit) &&
                     (dst->d_blk_softlimit > 0)) {
                         ASSERT(dst->d_btimer != 0);
                 }
-                if (((int) dst->d_icount > (int) dst->d_ino_softlimit) &&
+                if ((dst->d_icount > dst->d_ino_softlimit) &&
                     (dst->d_ino_softlimit > 0)) {
                         ASSERT(dst->d_itimer != 0);
                 }
diff --git a/fs/xfs/xfs_trans_buf.c b/fs/xfs/xfs_trans_buf.c
index 4fc17d479d42..3edf5dbee001 100644
--- a/fs/xfs/xfs_trans_buf.c
+++ b/fs/xfs/xfs_trans_buf.c
@@ -93,7 +93,7 @@ _xfs_trans_bjoin(
         xfs_buf_item_init(bp, tp->t_mountp);
         bip = bp->b_fspriv;
         ASSERT(!(bip->bli_flags & XFS_BLI_STALE));
-        ASSERT(!(bip->bli_format.blf_flags & XFS_BLF_CANCEL));
+        ASSERT(!(bip->__bli_format.blf_flags & XFS_BLF_CANCEL));
         ASSERT(!(bip->bli_flags & XFS_BLI_LOGGED));
         if (reset_recur)
                 bip->bli_recur = 0;
@@ -432,7 +432,7 @@ xfs_trans_brelse(xfs_trans_t	*tp,
         bip = bp->b_fspriv;
         ASSERT(bip->bli_item.li_type == XFS_LI_BUF);
         ASSERT(!(bip->bli_flags & XFS_BLI_STALE));
-        ASSERT(!(bip->bli_format.blf_flags & XFS_BLF_CANCEL));
+        ASSERT(!(bip->__bli_format.blf_flags & XFS_BLF_CANCEL));
         ASSERT(atomic_read(&bip->bli_refcount) > 0);
 
         trace_xfs_trans_brelse(bip);
@@ -519,7 +519,7 @@ xfs_trans_bhold(xfs_trans_t	*tp,
         ASSERT(bp->b_transp == tp);
         ASSERT(bip != NULL);
         ASSERT(!(bip->bli_flags & XFS_BLI_STALE));
-        ASSERT(!(bip->bli_format.blf_flags & XFS_BLF_CANCEL));
+        ASSERT(!(bip->__bli_format.blf_flags & XFS_BLF_CANCEL));
         ASSERT(atomic_read(&bip->bli_refcount) > 0);
 
         bip->bli_flags |= XFS_BLI_HOLD;
@@ -539,7 +539,7 @@ xfs_trans_bhold_release(xfs_trans_t	*tp,
         ASSERT(bp->b_transp == tp);
         ASSERT(bip != NULL);
         ASSERT(!(bip->bli_flags & XFS_BLI_STALE));
-        ASSERT(!(bip->bli_format.blf_flags & XFS_BLF_CANCEL));
+        ASSERT(!(bip->__bli_format.blf_flags & XFS_BLF_CANCEL));
         ASSERT(atomic_read(&bip->bli_refcount) > 0);
         ASSERT(bip->bli_flags & XFS_BLI_HOLD);
 
@@ -598,7 +598,7 @@ xfs_trans_log_buf(xfs_trans_t	*tp,
                 bip->bli_flags &= ~XFS_BLI_STALE;
                 ASSERT(XFS_BUF_ISSTALE(bp));
                 XFS_BUF_UNSTALE(bp);
-                bip->bli_format.blf_flags &= ~XFS_BLF_CANCEL;
+                bip->__bli_format.blf_flags &= ~XFS_BLF_CANCEL;
         }
 
         tp->t_flags |= XFS_TRANS_DIRTY;
@@ -643,6 +643,7 @@ xfs_trans_binval(
         xfs_buf_t       *bp)
 {
         xfs_buf_log_item_t      *bip = bp->b_fspriv;
+        int                     i;
 
         ASSERT(bp->b_transp == tp);
         ASSERT(bip != NULL);
@@ -657,8 +658,8 @@ xfs_trans_binval(
                  */
                 ASSERT(XFS_BUF_ISSTALE(bp));
                 ASSERT(!(bip->bli_flags & (XFS_BLI_LOGGED | XFS_BLI_DIRTY)));
-                ASSERT(!(bip->bli_format.blf_flags & XFS_BLF_INODE_BUF));
-                ASSERT(bip->bli_format.blf_flags & XFS_BLF_CANCEL);
+                ASSERT(!(bip->__bli_format.blf_flags & XFS_BLF_INODE_BUF));
+                ASSERT(bip->__bli_format.blf_flags & XFS_BLF_CANCEL);
                 ASSERT(bip->bli_item.li_desc->lid_flags & XFS_LID_DIRTY);
                 ASSERT(tp->t_flags & XFS_TRANS_DIRTY);
                 return;
@@ -668,10 +669,12 @@ xfs_trans_binval(
 
         bip->bli_flags |= XFS_BLI_STALE;
         bip->bli_flags &= ~(XFS_BLI_INODE_BUF | XFS_BLI_LOGGED | XFS_BLI_DIRTY);
-        bip->bli_format.blf_flags &= ~XFS_BLF_INODE_BUF;
-        bip->bli_format.blf_flags |= XFS_BLF_CANCEL;
-        memset((char *)(bip->bli_format.blf_data_map), 0,
-              (bip->bli_format.blf_map_size * sizeof(uint)));
+        bip->__bli_format.blf_flags &= ~XFS_BLF_INODE_BUF;
+        bip->__bli_format.blf_flags |= XFS_BLF_CANCEL;
+        for (i = 0; i < bip->bli_format_count; i++) {
+                memset(bip->bli_formats[i].blf_data_map, 0,
+                       (bip->bli_formats[i].blf_map_size * sizeof(uint)));
+        }
         bip->bli_item.li_desc->lid_flags |= XFS_LID_DIRTY;
         tp->t_flags |= XFS_TRANS_DIRTY;
 }
@@ -775,5 +778,5 @@ xfs_trans_dquot_buf(
                type == XFS_BLF_GDQUOT_BUF);
         ASSERT(atomic_read(&bip->bli_refcount) > 0);
 
-        bip->bli_format.blf_flags |= type;
+        bip->__bli_format.blf_flags |= type;
 }
diff --git a/include/drm/drmP.h b/include/drm/drmP.h
index fad21c927a38..e74731c1a912 100644
--- a/include/drm/drmP.h
+++ b/include/drm/drmP.h
@@ -446,7 +446,15 @@ struct drm_file {
         int is_master; /* this file private is a master for a minor */
         struct drm_master *master; /* master this node is currently associated with
                                       N.B. not always minor->master */
+
+        /**
+         * fbs - List of framebuffers associated with this file.
+         *
+         * Protected by fbs_lock. Note that the fbs list holds a reference on
+         * the fb object to prevent it from untimely disappearing.
+         */
         struct list_head fbs;
+        struct mutex fbs_lock;
 
         wait_queue_head_t event_wait;
         struct list_head event_list;
@@ -1276,6 +1284,11 @@ static inline int drm_device_is_unplugged(struct drm_device *dev)
         return ret;
 }
 
+static inline bool drm_modeset_is_locked(struct drm_device *dev)
+{
+        return mutex_is_locked(&dev->mode_config.mutex);
+}
+
 /******************************************************************/
 /** \name Internal function definitions */
 /*@{*/
diff --git a/include/drm/drm_crtc.h b/include/drm/drm_crtc.h
index 00d78b5161c0..66b2732f175a 100644
--- a/include/drm/drm_crtc.h
+++ b/include/drm/drm_crtc.h
@@ -254,6 +254,10 @@ struct drm_framebuffer {
          * userspace perspective.
          */
         struct kref refcount;
+        /*
+         * Place on the dev->mode_config.fb_list, access protected by
+         * dev->mode_config.fb_lock.
+         */
         struct list_head head;
         struct drm_mode_object base;
         const struct drm_framebuffer_funcs *funcs;
@@ -390,6 +394,15 @@ struct drm_crtc {
         struct drm_device *dev;
         struct list_head head;
 
+        /**
+         * crtc mutex
+         *
+         * This provides a read lock for the overall crtc state (mode, dpms
+         * state, ...) and a write lock for everything which can be update
+         * without a full modeset (fb, cursor data, ...)
+         */
+        struct mutex mutex;
+
         struct drm_mode_object base;
 
         /* framebuffer the connector is currently bound to */
@@ -771,8 +784,18 @@ struct drm_mode_config {
         struct mutex idr_mutex; /* for IDR management */
         struct idr crtc_idr; /* use this idr for all IDs, fb, crtc, connector, modes - just makes life easier */
         /* this is limited to one for now */
+
+
+        /**
+         * fb_lock - mutex to protect fb state
+         *
+         * Besides the global fb list his also protects the fbs list in the
+         * file_priv
+         */
+        struct mutex fb_lock;
         int num_fb;
         struct list_head fb_list;
+
         int num_connector;
         struct list_head connector_list;
         int num_encoder;
@@ -842,6 +865,9 @@ struct drm_prop_enum_list {
         char *name;
 };
 
+extern void drm_modeset_lock_all(struct drm_device *dev);
+extern void drm_modeset_unlock_all(struct drm_device *dev);
+
 extern int drm_crtc_init(struct drm_device *dev,
                          struct drm_crtc *crtc,
                          const struct drm_crtc_funcs *funcs);
@@ -932,10 +958,13 @@ extern void drm_framebuffer_set_object(struct drm_device *dev,
 extern int drm_framebuffer_init(struct drm_device *dev,
                                 struct drm_framebuffer *fb,
                                 const struct drm_framebuffer_funcs *funcs);
+extern struct drm_framebuffer *drm_framebuffer_lookup(struct drm_device *dev,
+                                                      uint32_t id);
 extern void drm_framebuffer_unreference(struct drm_framebuffer *fb);
 extern void drm_framebuffer_reference(struct drm_framebuffer *fb);
 extern void drm_framebuffer_remove(struct drm_framebuffer *fb);
 extern void drm_framebuffer_cleanup(struct drm_framebuffer *fb);
+extern void drm_framebuffer_unregister_private(struct drm_framebuffer *fb);
 extern int drmfb_probe(struct drm_device *dev, struct drm_crtc *crtc);
 extern int drmfb_remove(struct drm_device *dev, struct drm_framebuffer *fb);
 extern void drm_crtc_probe_connector_modes(struct drm_device *dev, int maxX, int maxY);
@@ -985,6 +1014,7 @@ extern int drm_mode_getcrtc(struct drm_device *dev,
                             void *data, struct drm_file *file_priv);
 extern int drm_mode_getconnector(struct drm_device *dev,
                               void *data, struct drm_file *file_priv);
+extern int drm_mode_set_config_internal(struct drm_mode_set *set);
 extern int drm_mode_setcrtc(struct drm_device *dev,
                             void *data, struct drm_file *file_priv);
 extern int drm_mode_getplane(struct drm_device *dev,
diff --git a/include/drm/drm_mm.h b/include/drm/drm_mm.h
index 9b991f91d81b..88591ef8fa24 100644
--- a/include/drm/drm_mm.h
+++ b/include/drm/drm_mm.h
@@ -70,7 +70,7 @@ struct drm_mm {
         unsigned long scan_color;
         unsigned long scan_size;
         unsigned long scan_hit_start;
-        unsigned scan_hit_size;
+        unsigned long scan_hit_end;
         unsigned scanned_blocks;
         unsigned long scan_start;
         unsigned long scan_end;
diff --git a/include/linux/audit.h b/include/linux/audit.h
index bce729afbcf9..5a6d718adf34 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -24,6 +24,7 @@
 #define _LINUX_AUDIT_H_
 
 #include <linux/sched.h>
+#include <linux/ptrace.h>
 #include <uapi/linux/audit.h>
 
 struct audit_sig_info {
@@ -157,7 +158,8 @@ void audit_core_dumps(long signr);
 
 static inline void audit_seccomp(unsigned long syscall, long signr, int code)
 {
-        if (unlikely(!audit_dummy_context()))
+        /* Force a record to be reported if a signal was delivered. */
+        if (signr || unlikely(!audit_dummy_context()))
                 __audit_seccomp(syscall, signr, code);
 }
 
diff --git a/include/linux/compaction.h b/include/linux/compaction.h
index 6ecb6dc2f303..cc7bddeaf553 100644
--- a/include/linux/compaction.h
+++ b/include/linux/compaction.h
@@ -22,7 +22,7 @@ extern int sysctl_extfrag_handler(struct ctl_table *table, int write,
 extern int fragmentation_index(struct zone *zone, unsigned int order);
 extern unsigned long try_to_compact_pages(struct zonelist *zonelist,
                         int order, gfp_t gfp_mask, nodemask_t *mask,
-                        bool sync, bool *contended, struct page **page);
+                        bool sync, bool *contended);
 extern int compact_pgdat(pg_data_t *pgdat, int order);
 extern void reset_isolation_suitable(pg_data_t *pgdat);
 extern unsigned long compaction_suitable(struct zone *zone, int order);
@@ -75,7 +75,7 @@ static inline bool compaction_restarting(struct zone *zone, int order)
 #else
 static inline unsigned long try_to_compact_pages(struct zonelist *zonelist,
                         int order, gfp_t gfp_mask, nodemask_t *nodemask,
-                        bool sync, bool *contended, struct page **page)
+                        bool sync, bool *contended)
 {
         return COMPACT_CONTINUE;
 }
diff --git a/include/linux/cpu_rmap.h b/include/linux/cpu_rmap.h
index ac3bbb5b9502..1739510d8994 100644
--- a/include/linux/cpu_rmap.h
+++ b/include/linux/cpu_rmap.h
@@ -13,9 +13,11 @@
 #include <linux/cpumask.h>
 #include <linux/gfp.h>
 #include <linux/slab.h>
+#include <linux/kref.h>
 
 /**
  * struct cpu_rmap - CPU affinity reverse-map
+ * @refcount: kref for object
  * @size: Number of objects to be reverse-mapped
  * @used: Number of objects added
  * @obj: Pointer to array of object pointers
@@ -23,6 +25,7 @@
  *      based on affinity masks
  */
 struct cpu_rmap {
+        struct kref     refcount;
         u16             size, used;
         void            **obj;
         struct {
@@ -33,15 +36,7 @@ struct cpu_rmap {
 #define CPU_RMAP_DIST_INF 0xffff
 
 extern struct cpu_rmap *alloc_cpu_rmap(unsigned int size, gfp_t flags);
-
-/**
- * free_cpu_rmap - free CPU affinity reverse-map
- * @rmap: Reverse-map allocated with alloc_cpu_rmap(), or %NULL
- */
-static inline void free_cpu_rmap(struct cpu_rmap *rmap)
-{
-        kfree(rmap);
-}
+extern int cpu_rmap_put(struct cpu_rmap *rmap);
 
 extern int cpu_rmap_add(struct cpu_rmap *rmap, void *obj);
 extern int cpu_rmap_update(struct cpu_rmap *rmap, u16 index,
diff --git a/include/linux/cpuidle.h b/include/linux/cpuidle.h
index 3711b34dc4f9..24cd1037b6d6 100644
--- a/include/linux/cpuidle.h
+++ b/include/linux/cpuidle.h
@@ -126,9 +126,9 @@ struct cpuidle_driver {
         struct module           *owner;
         int                     refcnt;
 
-        unsigned int            power_specified:1;
         /* set to 1 to use the core cpuidle time keeping (for all states). */
         unsigned int            en_core_tk_irqen:1;
+        /* states array must be ordered in decreasing power consumption */
         struct cpuidle_state    states[CPUIDLE_STATE_MAX];
         int                     state_count;
         int                     safe_state_index;
diff --git a/include/linux/init.h b/include/linux/init.h
index a799273714ac..10ed4f436458 100644
--- a/include/linux/init.h
+++ b/include/linux/init.h
@@ -93,14 +93,6 @@
 
 #define __exit          __section(.exit.text) __exitused __cold notrace
 
-/* Used for HOTPLUG, but that is always enabled now, so just make them noops */
-#define __devinit
-#define __devinitdata
-#define __devinitconst
-#define __devexit
-#define __devexitdata
-#define __devexitconst
-
 /* Used for HOTPLUG_CPU */
 #define __cpuinit        __section(.cpuinit.text) __cold notrace
 #define __cpuinitdata    __section(.cpuinit.data)
@@ -337,18 +329,6 @@ void __init parse_early_options(char *cmdline);
 #define __INITRODATA_OR_MODULE __INITRODATA
 #endif /*CONFIG_MODULES*/
 
-/* Functions marked as __devexit may be discarded at kernel link time, depending
-   on config options.  Newer versions of binutils detect references from
-   retained sections to discarded sections and flag an error.  Pointers to
-   __devexit functions must use __devexit_p(function_name), the wrapper will
-   insert either the function_name or NULL, depending on the config options.
- */
-#if defined(MODULE) || defined(CONFIG_HOTPLUG)
-#define __devexit_p(x) x
-#else
-#define __devexit_p(x) NULL
-#endif
-
 #ifdef MODULE
 #define __exit_p(x) x
 #else
diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
index 5e4e6170f43a..5fa5afeeb759 100644
--- a/include/linux/interrupt.h
+++ b/include/linux/interrupt.h
@@ -268,11 +268,6 @@ struct irq_affinity_notify {
 extern int
 irq_set_affinity_notifier(unsigned int irq, struct irq_affinity_notify *notify);
 
-static inline void irq_run_affinity_notifiers(void)
-{
-        flush_scheduled_work();
-}
-
 #else /* CONFIG_SMP */
 
 static inline int irq_set_affinity(unsigned int irq, const struct cpumask *m)
diff --git a/include/linux/lockdep.h b/include/linux/lockdep.h
index 00e46376e28f..2bca44b0893c 100644
--- a/include/linux/lockdep.h
+++ b/include/linux/lockdep.h
@@ -524,14 +524,17 @@ static inline void print_irqtrace_events(struct task_struct *curr)
 #ifdef CONFIG_DEBUG_LOCK_ALLOC
 # ifdef CONFIG_PROVE_LOCKING
 #  define rwsem_acquire(l, s, t, i)             lock_acquire(l, s, t, 0, 2, NULL, i)
+#  define rwsem_acquire_nest(l, s, t, n, i)     lock_acquire(l, s, t, 0, 2, n, i)
 #  define rwsem_acquire_read(l, s, t, i)        lock_acquire(l, s, t, 1, 2, NULL, i)
 # else
 #  define rwsem_acquire(l, s, t, i)             lock_acquire(l, s, t, 0, 1, NULL, i)
+#  define rwsem_acquire_nest(l, s, t, n, i)     lock_acquire(l, s, t, 0, 1, n, i)
 #  define rwsem_acquire_read(l, s, t, i)        lock_acquire(l, s, t, 1, 1, NULL, i)
 # endif
 # define rwsem_release(l, n, i)                 lock_release(l, n, i)
 #else
 # define rwsem_acquire(l, s, t, i)              do { } while (0)
+# define rwsem_acquire_nest(l, s, t, n, i)      do { } while (0)
 # define rwsem_acquire_read(l, s, t, i)         do { } while (0)
 # define rwsem_release(l, n, i)                 do { } while (0)
 #endif
diff --git a/include/linux/mm.h b/include/linux/mm.h
index 63204078f72b..66e2f7c61e5c 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -455,7 +455,6 @@ void put_pages_list(struct list_head *pages);
 
 void split_page(struct page *page, unsigned int order);
 int split_free_page(struct page *page);
-int capture_free_page(struct page *page, int alloc_order, int migratetype);
 
 /*
  * Compound pages have a destructor function.  Provide a
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index c599e4782d45..9ef07d0868b6 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -60,6 +60,9 @@ struct wireless_dev;
 #define SET_ETHTOOL_OPS(netdev,ops) \
         ( (netdev)->ethtool_ops = (ops) )
 
+extern void netdev_set_default_ethtool_ops(struct net_device *dev,
+                                           const struct ethtool_ops *ops);
+
 /* hardware address assignment types */
 #define NET_ADDR_PERM           0       /* address is permanent (default) */
 #define NET_ADDR_RANDOM         1       /* address is generated randomly */
diff --git a/include/linux/rbtree_augmented.h b/include/linux/rbtree_augmented.h
index 2ac60c9cf644..fea49b5da12a 100644
--- a/include/linux/rbtree_augmented.h
+++ b/include/linux/rbtree_augmented.h
@@ -123,9 +123,9 @@ __rb_change_child(struct rb_node *old, struct rb_node *new,
 extern void __rb_erase_color(struct rb_node *parent, struct rb_root *root,
         void (*augment_rotate)(struct rb_node *old, struct rb_node *new));
 
-static __always_inline void
-rb_erase_augmented(struct rb_node *node, struct rb_root *root,
-                   const struct rb_augment_callbacks *augment)
+static __always_inline struct rb_node *
+__rb_erase_augmented(struct rb_node *node, struct rb_root *root,
+                     const struct rb_augment_callbacks *augment)
 {
         struct rb_node *child = node->rb_right, *tmp = node->rb_left;
         struct rb_node *parent, *rebalance;
@@ -217,6 +217,14 @@ rb_erase_augmented(struct rb_node *node, struct rb_root *root,
         }
 
         augment->propagate(tmp, NULL);
+        return rebalance;
+}
+
+static __always_inline void
+rb_erase_augmented(struct rb_node *node, struct rb_root *root,
+                   const struct rb_augment_callbacks *augment)
+{
+        struct rb_node *rebalance = __rb_erase_augmented(node, root, augment);
         if (rebalance)
                 __rb_erase_color(rebalance, root, augment->rotate);
 }
diff --git a/include/linux/rwsem.h b/include/linux/rwsem.h
index 54bd7cd7ecbd..8da67d625e13 100644
--- a/include/linux/rwsem.h
+++ b/include/linux/rwsem.h
@@ -125,8 +125,17 @@ extern void downgrade_write(struct rw_semaphore *sem);
  */
 extern void down_read_nested(struct rw_semaphore *sem, int subclass);
 extern void down_write_nested(struct rw_semaphore *sem, int subclass);
+extern void _down_write_nest_lock(struct rw_semaphore *sem, struct lockdep_map *nest_lock);
+
+# define down_write_nest_lock(sem, nest_lock)                   \
+do {                                                            \
+        typecheck(struct lockdep_map *, &(nest_lock)->dep_map); \
+        _down_write_nest_lock(sem, &(nest_lock)->dep_map);      \
+} while (0);
+
 #else
 # define down_read_nested(sem, subclass)                down_read(sem)
+# define down_write_nest_lock(sem, nest_lock)   down_write(sem)
 # define down_write_nested(sem, subclass)       down_write(sem)
 #endif
 
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 206bb089c06b..6fc8f45de4e9 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -1810,6 +1810,7 @@ extern void thread_group_cputime_adjusted(struct task_struct *p, cputime_t *ut,
 #define PF_MEMALLOC     0x00000800      /* Allocating memory */
 #define PF_NPROC_EXCEEDED 0x00001000    /* set_user noticed that RLIMIT_NPROC was exceeded */
 #define PF_USED_MATH    0x00002000      /* if unset the fpu must be initialized before use */
+#define PF_USED_ASYNC   0x00004000      /* used async_schedule*(), used by module init */
 #define PF_NOFREEZE     0x00008000      /* this thread should not be frozen */
 #define PF_FROZEN       0x00010000      /* frozen for system suspend */
 #define PF_FSTRANS      0x00020000      /* inside a filesystem transaction */
diff --git a/include/sound/cs4271.h b/include/sound/cs4271.h
index 6d9e15ed1dcf..dd8c48d14ed9 100644
--- a/include/sound/cs4271.h
+++ b/include/sound/cs4271.h
@@ -19,7 +19,7 @@
 
 struct cs4271_platform_data {
         int gpio_nreset;        /* GPIO driving Reset pin, if any */
-        int amutec_eq_bmutec:1; /* flag to enable AMUTEC=BMUTEC */
+        bool amutec_eq_bmutec;  /* flag to enable AMUTEC=BMUTEC */
 };
 
 #endif /* __CS4271_H */
diff --git a/include/sound/soc.h b/include/sound/soc.h
index 769e27c774a3..bc56738cb109 100644
--- a/include/sound/soc.h
+++ b/include/sound/soc.h
@@ -58,8 +58,9 @@
         .info = snd_soc_info_volsw_range, .get = snd_soc_get_volsw_range, \
         .put = snd_soc_put_volsw_range, \
         .private_value = (unsigned long)&(struct soc_mixer_control) \
-                {.reg = xreg, .shift = xshift, .min = xmin,\
-                 .max = xmax, .platform_max = xmax, .invert = xinvert} }
+                {.reg = xreg, .rreg = xreg, .shift = xshift, \
+                 .rshift = xshift,  .min = xmin, .max = xmax, \
+                 .platform_max = xmax, .invert = xinvert} }
 #define SOC_SINGLE_TLV(xname, reg, shift, max, invert, tlv_array) \
 {       .iface = SNDRV_CTL_ELEM_IFACE_MIXER, .name = xname, \
         .access = SNDRV_CTL_ELEM_ACCESS_TLV_READ |\
@@ -88,8 +89,9 @@
         .info = snd_soc_info_volsw_range, \
         .get = snd_soc_get_volsw_range, .put = snd_soc_put_volsw_range, \
         .private_value = (unsigned long)&(struct soc_mixer_control) \
-                {.reg = xreg, .shift = xshift, .min = xmin,\
-                 .max = xmax, .platform_max = xmax, .invert = xinvert} }
+                {.reg = xreg, .rreg = xreg, .shift = xshift, \
+                 .rshift = xshift, .min = xmin, .max = xmax, \
+                 .platform_max = xmax, .invert = xinvert} }
 #define SOC_DOUBLE(xname, reg, shift_left, shift_right, max, invert) \
 {       .iface = SNDRV_CTL_ELEM_IFACE_MIXER, .name = (xname),\
         .info = snd_soc_info_volsw, .get = snd_soc_get_volsw, \
diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h
index 7cae2360221e..663e34a5383f 100644
--- a/include/target/target_core_base.h
+++ b/include/target/target_core_base.h
@@ -174,6 +174,7 @@ typedef unsigned __bitwise__ sense_reason_t;
 
 enum tcm_sense_reason_table {
 #define R(x)    (__force sense_reason_t )(x)
+        TCM_NO_SENSE                            = R(0x00),
         TCM_NON_EXISTENT_LUN                    = R(0x01),
         TCM_UNSUPPORTED_SCSI_OPCODE             = R(0x02),
         TCM_INCORRECT_AMOUNT_OF_DATA            = R(0x03),
diff --git a/include/uapi/linux/audit.h b/include/uapi/linux/audit.h
index 76352ac45f24..9f096f1c0907 100644
--- a/include/uapi/linux/audit.h
+++ b/include/uapi/linux/audit.h
@@ -26,7 +26,6 @@
 
 #include <linux/types.h>
 #include <linux/elf-em.h>
-#include <linux/ptrace.h>
 
 /* The netlink messages for the audit system is divided into blocks:
  * 1000 - 1099 are for commanding the audit system
@@ -106,6 +105,7 @@
 #define AUDIT_MMAP              1323    /* Record showing descriptor and flags in mmap */
 #define AUDIT_NETFILTER_PKT     1324    /* Packets traversing netfilter chains */
 #define AUDIT_NETFILTER_CFG     1325    /* Netfilter chain modifications */
+#define AUDIT_SECCOMP           1326    /* Secure Computing event */
 
 #define AUDIT_AVC               1400    /* SE Linux avc denial or grant */
 #define AUDIT_SELINUX_ERR       1401    /* Internal SE Linux Errors */
diff --git a/init/Kconfig b/init/Kconfig
index 7d30240e5bfe..be8b7f55312d 100644
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1182,7 +1182,7 @@ config CC_OPTIMIZE_FOR_SIZE
           Enabling this option will pass "-Os" instead of "-O2" to gcc
           resulting in a smaller kernel.
 
-          If unsure, say Y.
+          If unsure, say N.
 
 config SYSCTL
         bool
diff --git a/kernel/async.c b/kernel/async.c
index 9d3118384858..a1d585c351d6 100644
--- a/kernel/async.c
+++ b/kernel/async.c
@@ -196,6 +196,9 @@ static async_cookie_t __async_schedule(async_func_ptr *ptr, void *data, struct a
         atomic_inc(&entry_count);
         spin_unlock_irqrestore(&async_lock, flags);
 
+        /* mark that this task has queued an async job, used by module init */
+        current->flags |= PF_USED_ASYNC;
+
         /* schedule for execution */
         queue_work(system_unbound_wq, &entry->work);
 
diff --git a/kernel/audit.c b/kernel/audit.c
index 40414e9143db..d596e5355f15 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -272,6 +272,8 @@ static int audit_log_config_change(char *function_name, int new, int old,
         int rc = 0;
 
         ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
+        if (unlikely(!ab))
+                return rc;
         audit_log_format(ab, "%s=%d old=%d auid=%u ses=%u", function_name, new,
                          old, from_kuid(&init_user_ns, loginuid), sessionid);
         if (sid) {
@@ -619,6 +621,8 @@ static int audit_log_common_recv_msg(struct audit_buffer **ab, u16 msg_type,
         }
 
         *ab = audit_log_start(NULL, GFP_KERNEL, msg_type);
+        if (unlikely(!*ab))
+                return rc;
         audit_log_format(*ab, "pid=%d uid=%u auid=%u ses=%u",
                          task_tgid_vnr(current),
                          from_kuid(&init_user_ns, current_uid()),
@@ -1097,6 +1101,23 @@ static inline void audit_get_stamp(struct audit_context *ctx,
         }
 }
 
+/*
+ * Wait for auditd to drain the queue a little
+ */
+static void wait_for_auditd(unsigned long sleep_time)
+{
+        DECLARE_WAITQUEUE(wait, current);
+        set_current_state(TASK_INTERRUPTIBLE);
+        add_wait_queue(&audit_backlog_wait, &wait);
+
+        if (audit_backlog_limit &&
+            skb_queue_len(&audit_skb_queue) > audit_backlog_limit)
+                schedule_timeout(sleep_time);
+
+        __set_current_state(TASK_RUNNING);
+        remove_wait_queue(&audit_backlog_wait, &wait);
+}
+
 /* Obtain an audit buffer.  This routine does locking to obtain the
  * audit buffer, but then no locking is required for calls to
  * audit_log_*format.  If the tsk is a task that is currently in a
@@ -1142,20 +1163,13 @@ struct audit_buffer *audit_log_start(struct audit_context *ctx, gfp_t gfp_mask,
 
         while (audit_backlog_limit
                && skb_queue_len(&audit_skb_queue) > audit_backlog_limit + reserve) {
-                if (gfp_mask & __GFP_WAIT && audit_backlog_wait_time
-                    && time_before(jiffies, timeout_start + audit_backlog_wait_time)) {
+                if (gfp_mask & __GFP_WAIT && audit_backlog_wait_time) {
+                        unsigned long sleep_time;
 
-                        /* Wait for auditd to drain the queue a little */
-                        DECLARE_WAITQUEUE(wait, current);
-                        set_current_state(TASK_INTERRUPTIBLE);
-                        add_wait_queue(&audit_backlog_wait, &wait);
-
-                        if (audit_backlog_limit &&
-                            skb_queue_len(&audit_skb_queue) > audit_backlog_limit)
-                                schedule_timeout(timeout_start + audit_backlog_wait_time - jiffies);
-
-                        __set_current_state(TASK_RUNNING);
-                        remove_wait_queue(&audit_backlog_wait, &wait);
+                        sleep_time = timeout_start + audit_backlog_wait_time -
+                                        jiffies;
+                        if ((long)sleep_time > 0)
+                                wait_for_auditd(sleep_time);
                         continue;
                 }
                 if (audit_rate_check() && printk_ratelimit())
diff --git a/kernel/audit_tree.c b/kernel/audit_tree.c
index e81175ef25f8..642a89c4f3d6 100644
--- a/kernel/audit_tree.c
+++ b/kernel/audit_tree.c
@@ -449,11 +449,26 @@ static int tag_chunk(struct inode *inode, struct audit_tree *tree)
         return 0;
 }
 
+static void audit_log_remove_rule(struct audit_krule *rule)
+{
+        struct audit_buffer *ab;
+
+        ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
+        if (unlikely(!ab))
+                return;
+        audit_log_format(ab, "op=");
+        audit_log_string(ab, "remove rule");
+        audit_log_format(ab, " dir=");
+        audit_log_untrustedstring(ab, rule->tree->pathname);
+        audit_log_key(ab, rule->filterkey);
+        audit_log_format(ab, " list=%d res=1", rule->listnr);
+        audit_log_end(ab);
+}
+
 static void kill_rules(struct audit_tree *tree)
 {
         struct audit_krule *rule, *next;
         struct audit_entry *entry;
-        struct audit_buffer *ab;
 
         list_for_each_entry_safe(rule, next, &tree->rules, rlist) {
                 entry = container_of(rule, struct audit_entry, rule);
@@ -461,14 +476,7 @@ static void kill_rules(struct audit_tree *tree)
                 list_del_init(&rule->rlist);
                 if (rule->tree) {
                         /* not a half-baked one */
-                        ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_CONFIG_CHANGE);
-                        audit_log_format(ab, "op=");
-                        audit_log_string(ab, "remove rule");
-                        audit_log_format(ab, " dir=");
-                        audit_log_untrustedstring(ab, rule->tree->pathname);
-                        audit_log_key(ab, rule->filterkey);
-                        audit_log_format(ab, " list=%d res=1", rule->listnr);
-                        audit_log_end(ab);
+                        audit_log_remove_rule(rule);
                         rule->tree = NULL;
                         list_del_rcu(&entry->list);
                         list_del(&entry->rule.list);
diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c
index 4a599f699adc..22831c4d369c 100644
--- a/kernel/audit_watch.c
+++ b/kernel/audit_watch.c
@@ -240,6 +240,8 @@ static void audit_watch_log_rule_change(struct audit_krule *r, struct audit_watc
         if (audit_enabled) {
                 struct audit_buffer *ab;
                 ab = audit_log_start(NULL, GFP_NOFS, AUDIT_CONFIG_CHANGE);
+                if (unlikely(!ab))
+                        return;
                 audit_log_format(ab, "auid=%u ses=%u op=",
                                  from_kuid(&init_user_ns, audit_get_loginuid(current)),
                                  audit_get_sessionid(current));
diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index 7f19f23d38a3..f9fc54bbe06f 100644
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -1144,7 +1144,6 @@ static void audit_log_rule_change(kuid_t loginuid, u32 sessionid, u32 sid,
  * audit_receive_filter - apply all rules to the specified message type
  * @type: audit message type
  * @pid: target pid for netlink audit messages
- * @uid: target uid for netlink audit messages
  * @seq: netlink audit message sequence (serial) number
  * @data: payload data
  * @datasz: size of payload data
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index e37e6a12c5e3..a371f857a0a9 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -1464,14 +1464,14 @@ static void show_special(struct audit_context *context, int *call_panic)
                         audit_log_end(ab);
                         ab = audit_log_start(context, GFP_KERNEL,
                                              AUDIT_IPC_SET_PERM);
+                        if (unlikely(!ab))
+                                return;
                         audit_log_format(ab,
                                 "qbytes=%lx ouid=%u ogid=%u mode=%#ho",
                                 context->ipc.qbytes,
                                 context->ipc.perm_uid,
                                 context->ipc.perm_gid,
                                 context->ipc.perm_mode);
-                        if (!ab)
-                                return;
                 }
                 break; }
         case AUDIT_MQ_OPEN: {
@@ -2675,7 +2675,7 @@ void __audit_mmap_fd(int fd, int flags)
         context->type = AUDIT_MMAP;
 }
 
-static void audit_log_abend(struct audit_buffer *ab, char *reason, long signr)
+static void audit_log_task(struct audit_buffer *ab)
 {
         kuid_t auid, uid;
         kgid_t gid;
@@ -2693,6 +2693,11 @@ static void audit_log_abend(struct audit_buffer *ab, char *reason, long signr)
         audit_log_task_context(ab);
         audit_log_format(ab, " pid=%d comm=", current->pid);
         audit_log_untrustedstring(ab, current->comm);
+}
+
+static void audit_log_abend(struct audit_buffer *ab, char *reason, long signr)
+{
+        audit_log_task(ab);
         audit_log_format(ab, " reason=");
         audit_log_string(ab, reason);
         audit_log_format(ab, " sig=%ld", signr);
@@ -2715,6 +2720,8 @@ void audit_core_dumps(long signr)
                 return;
 
         ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_ANOM_ABEND);
+        if (unlikely(!ab))
+                return;
         audit_log_abend(ab, "memory violation", signr);
         audit_log_end(ab);
 }
@@ -2723,8 +2730,11 @@ void __audit_seccomp(unsigned long syscall, long signr, int code)
 {
         struct audit_buffer *ab;
 
-        ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_ANOM_ABEND);
-        audit_log_abend(ab, "seccomp", signr);
+        ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_SECCOMP);
+        if (unlikely(!ab))
+                return;
+        audit_log_task(ab);
+        audit_log_format(ab, " sig=%ld", signr);
         audit_log_format(ab, " syscall=%ld", syscall);
         audit_log_format(ab, " compat=%d", is_compat_task());
         audit_log_format(ab, " ip=0x%lx", KSTK_EIP(current));
diff --git a/kernel/module.c b/kernel/module.c
index 250092c1d57d..b10b048367e1 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -3013,6 +3013,12 @@ static int do_init_module(struct module *mod)
 {
         int ret = 0;
 
+        /*
+         * We want to find out whether @mod uses async during init.  Clear
+         * PF_USED_ASYNC.  async_schedule*() will set it.
+         */
+        current->flags &= ~PF_USED_ASYNC;
+
         blocking_notifier_call_chain(&module_notify_list,
                         MODULE_STATE_COMING, mod);
 
@@ -3058,8 +3064,25 @@ static int do_init_module(struct module *mod)
         blocking_notifier_call_chain(&module_notify_list,
                                      MODULE_STATE_LIVE, mod);
 
-        /* We need to finish all async code before the module init sequence is done */
-        async_synchronize_full();
+        /*
+         * We need to finish all async code before the module init sequence
+         * is done.  This has potential to deadlock.  For example, a newly
+         * detected block device can trigger request_module() of the
+         * default iosched from async probing task.  Once userland helper
+         * reaches here, async_synchronize_full() will wait on the async
+         * task waiting on request_module() and deadlock.
+         *
+         * This deadlock is avoided by perfomring async_synchronize_full()
+         * iff module init queued any async jobs.  This isn't a full
+         * solution as it will deadlock the same if module loading from
+         * async jobs nests more than once; however, due to the various
+         * constraints, this hack seems to be the best option for now.
+         * Please refer to the following thread for details.
+         *
+         * http://thread.gmane.org/gmane.linux.kernel/1420814
+         */
+        if (current->flags & PF_USED_ASYNC)
+                async_synchronize_full();
 
         mutex_lock(&module_mutex);
         /* Drop initial reference. */
diff --git a/kernel/rwsem.c b/kernel/rwsem.c
index 6850f53e02d8..b3c6c3fcd847 100644
--- a/kernel/rwsem.c
+++ b/kernel/rwsem.c
@@ -116,6 +116,16 @@ void down_read_nested(struct rw_semaphore *sem, int subclass)
 
 EXPORT_SYMBOL(down_read_nested);
 
+void _down_write_nest_lock(struct rw_semaphore *sem, struct lockdep_map *nest)
+{
+        might_sleep();
+        rwsem_acquire_nest(&sem->dep_map, 0, 0, nest, _RET_IP_);
+
+        LOCK_CONTENDED(sem, __down_write_trylock, __down_write);
+}
+
+EXPORT_SYMBOL(_down_write_nest_lock);
+
 void down_write_nested(struct rw_semaphore *sem, int subclass)
 {
         might_sleep();
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index e5125677efa0..3c13e46d7d24 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -2899,6 +2899,8 @@ tracing_trace_options_write(struct file *filp, const char __user *ubuf,
         if (copy_from_user(&buf, ubuf, cnt))
                 return -EFAULT;
 
+        buf[cnt] = 0;
+
         trace_set_options(buf);
 
         *ppos += cnt;
@@ -3452,7 +3454,7 @@ static int tracing_wait_pipe(struct file *filp)
                         return -EINTR;
 
                 /*
-                 * We block until we read something and tracing is enabled.
+                 * We block until we read something and tracing is disabled.
                  * We still block if tracing is disabled, but we have never
                  * read anything. This allows a user to cat this file, and
                  * then enable tracing. But after we have read something,
@@ -3460,7 +3462,7 @@ static int tracing_wait_pipe(struct file *filp)
                  *
                  * iter->pos will be 0 if we haven't read anything.
                  */
-                if (tracing_is_enabled() && iter->pos)
+                if (!tracing_is_enabled() && iter->pos)
                         break;
         }
 
@@ -4815,10 +4817,17 @@ rb_simple_write(struct file *filp, const char __user *ubuf,
                 return ret;
 
         if (buffer) {
-                if (val)
+                mutex_lock(&trace_types_lock);
+                if (val) {
                         ring_buffer_record_on(buffer);
-                else
+                        if (current_trace->start)
+                                current_trace->start(tr);
+                } else {
                         ring_buffer_record_off(buffer);
+                        if (current_trace->stop)
+                                current_trace->stop(tr);
+                }
+                mutex_unlock(&trace_types_lock);
         }
 
         (*ppos)++;
diff --git a/lib/cpu_rmap.c b/lib/cpu_rmap.c
index 145dec5267c9..5fbed5caba6e 100644
--- a/lib/cpu_rmap.c
+++ b/lib/cpu_rmap.c
@@ -45,6 +45,7 @@ struct cpu_rmap *alloc_cpu_rmap(unsigned int size, gfp_t flags)
         if (!rmap)
                 return NULL;
 
+        kref_init(&rmap->refcount);
         rmap->obj = (void **)((char *)rmap + obj_offset);
 
         /* Initially assign CPUs to objects on a rota, since we have
@@ -63,6 +64,35 @@ struct cpu_rmap *alloc_cpu_rmap(unsigned int size, gfp_t flags)
 }
 EXPORT_SYMBOL(alloc_cpu_rmap);
 
+/**
+ * cpu_rmap_release - internal reclaiming helper called from kref_put
+ * @ref: kref to struct cpu_rmap
+ */
+static void cpu_rmap_release(struct kref *ref)
+{
+        struct cpu_rmap *rmap = container_of(ref, struct cpu_rmap, refcount);
+        kfree(rmap);
+}
+
+/**
+ * cpu_rmap_get - internal helper to get new ref on a cpu_rmap
+ * @rmap: reverse-map allocated with alloc_cpu_rmap()
+ */
+static inline void cpu_rmap_get(struct cpu_rmap *rmap)
+{
+        kref_get(&rmap->refcount);
+}
+
+/**
+ * cpu_rmap_put - release ref on a cpu_rmap
+ * @rmap: reverse-map allocated with alloc_cpu_rmap()
+ */
+int cpu_rmap_put(struct cpu_rmap *rmap)
+{
+        return kref_put(&rmap->refcount, cpu_rmap_release);
+}
+EXPORT_SYMBOL(cpu_rmap_put);
+
 /* Reevaluate nearest object for given CPU, comparing with the given
  * neighbours at the given distance.
  */
@@ -197,8 +227,7 @@ struct irq_glue {
  * free_irq_cpu_rmap - free a CPU affinity reverse-map used for IRQs
  * @rmap: Reverse-map allocated with alloc_irq_cpu_map(), or %NULL
  *
- * Must be called in process context, before freeing the IRQs, and
- * without holding any locks required by global workqueue items.
+ * Must be called in process context, before freeing the IRQs.
  */
 void free_irq_cpu_rmap(struct cpu_rmap *rmap)
 {
@@ -212,12 +241,18 @@ void free_irq_cpu_rmap(struct cpu_rmap *rmap)
                 glue = rmap->obj[index];
                 irq_set_affinity_notifier(glue->notify.irq, NULL);
         }
-        irq_run_affinity_notifiers();
 
-        kfree(rmap);
+        cpu_rmap_put(rmap);
 }
 EXPORT_SYMBOL(free_irq_cpu_rmap);
 
+/**
+ * irq_cpu_rmap_notify - callback for IRQ subsystem when IRQ affinity updated
+ * @notify: struct irq_affinity_notify passed by irq/manage.c
+ * @mask: cpu mask for new SMP affinity
+ *
+ * This is executed in workqueue context.
+ */
 static void
 irq_cpu_rmap_notify(struct irq_affinity_notify *notify, const cpumask_t *mask)
 {
@@ -230,10 +265,16 @@ irq_cpu_rmap_notify(struct irq_affinity_notify *notify, const cpumask_t *mask)
                 pr_warning("irq_cpu_rmap_notify: update failed: %d\n", rc);
 }
 
+/**
+ * irq_cpu_rmap_release - reclaiming callback for IRQ subsystem
+ * @ref: kref to struct irq_affinity_notify passed by irq/manage.c
+ */
 static void irq_cpu_rmap_release(struct kref *ref)
 {
         struct irq_glue *glue =
                 container_of(ref, struct irq_glue, notify.kref);
+
+        cpu_rmap_put(glue->rmap);
         kfree(glue);
 }
 
@@ -258,10 +299,13 @@ int irq_cpu_rmap_add(struct cpu_rmap *rmap, int irq)
         glue->notify.notify = irq_cpu_rmap_notify;
         glue->notify.release = irq_cpu_rmap_release;
         glue->rmap = rmap;
+        cpu_rmap_get(rmap);
         glue->index = cpu_rmap_add(rmap, glue);
         rc = irq_set_affinity_notifier(irq, &glue->notify);
-        if (rc)
+        if (rc) {
+                cpu_rmap_put(glue->rmap);
                 kfree(glue);
+        }
         return rc;
 }
 EXPORT_SYMBOL(irq_cpu_rmap_add);
diff --git a/lib/rbtree.c b/lib/rbtree.c
index 4f56a11d67fa..c0e31fe2fabf 100644
--- a/lib/rbtree.c
+++ b/lib/rbtree.c
@@ -194,8 +194,12 @@ __rb_insert(struct rb_node *node, struct rb_root *root,
         }
 }
 
-__always_inline void
-__rb_erase_color(struct rb_node *parent, struct rb_root *root,
+/*
+ * Inline version for rb_erase() use - we want to be able to inline
+ * and eliminate the dummy_rotate callback there
+ */
+static __always_inline void
+____rb_erase_color(struct rb_node *parent, struct rb_root *root,
         void (*augment_rotate)(struct rb_node *old, struct rb_node *new))
 {
         struct rb_node *node = NULL, *sibling, *tmp1, *tmp2;
@@ -355,6 +359,13 @@ __rb_erase_color(struct rb_node *parent, struct rb_root *root,
                 }
         }
 }
+
+/* Non-inline version for rb_erase_augmented() use */
+void __rb_erase_color(struct rb_node *parent, struct rb_root *root,
+        void (*augment_rotate)(struct rb_node *old, struct rb_node *new))
+{
+        ____rb_erase_color(parent, root, augment_rotate);
+}
 EXPORT_SYMBOL(__rb_erase_color);
 
 /*
@@ -380,7 +391,10 @@ EXPORT_SYMBOL(rb_insert_color);
 
 void rb_erase(struct rb_node *node, struct rb_root *root)
 {
-        rb_erase_augmented(node, root, &dummy_callbacks);
+        struct rb_node *rebalance;
+        rebalance = __rb_erase_augmented(node, root, &dummy_callbacks);
+        if (rebalance)
+                ____rb_erase_color(rebalance, root, dummy_rotate);
 }
 EXPORT_SYMBOL(rb_erase);
 
diff --git a/mm/bootmem.c b/mm/bootmem.c
index 1324cd74faec..b93376c39b61 100644
--- a/mm/bootmem.c
+++ b/mm/bootmem.c
@@ -185,10 +185,23 @@ static unsigned long __init free_all_bootmem_core(bootmem_data_t *bdata)
 
         while (start < end) {
                 unsigned long *map, idx, vec;
+                unsigned shift;
 
                 map = bdata->node_bootmem_map;
                 idx = start - bdata->node_min_pfn;
+                shift = idx & (BITS_PER_LONG - 1);
+                /*
+                 * vec holds at most BITS_PER_LONG map bits,
+                 * bit 0 corresponds to start.
+                 */
                 vec = ~map[idx / BITS_PER_LONG];
+
+                if (shift) {
+                        vec >>= shift;
+                        if (end - start >= BITS_PER_LONG)
+                                vec |= ~map[idx / BITS_PER_LONG + 1] <<
+                                        (BITS_PER_LONG - shift);
+                }
                 /*
                  * If we have a properly aligned and fully unreserved
                  * BITS_PER_LONG block of pages in front of us, free
@@ -201,19 +214,18 @@ static unsigned long __init free_all_bootmem_core(bootmem_data_t *bdata)
                         count += BITS_PER_LONG;
                         start += BITS_PER_LONG;
                 } else {
-                        unsigned long off = 0;
+                        unsigned long cur = start;
 
-                        vec >>= start & (BITS_PER_LONG - 1);
-                        while (vec) {
+                        start = ALIGN(start + 1, BITS_PER_LONG);
+                        while (vec && cur != start) {
                                 if (vec & 1) {
-                                        page = pfn_to_page(start + off);
+                                        page = pfn_to_page(cur);
                                         __free_pages_bootmem(page, 0);
                                         count++;
                                 }
                                 vec >>= 1;
-                                off++;
+                                ++cur;
                         }
-                        start = ALIGN(start + 1, BITS_PER_LONG);
                 }
         }
 
diff --git a/mm/compaction.c b/mm/compaction.c
index 6b807e466497..c62bd063d766 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -816,6 +816,7 @@ static isolate_migrate_t isolate_migratepages(struct zone *zone,
 static int compact_finished(struct zone *zone,
                             struct compact_control *cc)
 {
+        unsigned int order;
         unsigned long watermark;
 
         if (fatal_signal_pending(current))
@@ -850,22 +851,16 @@ static int compact_finished(struct zone *zone,
                 return COMPACT_CONTINUE;
 
         /* Direct compactor: Is a suitable page free? */
-        if (cc->page) {
-                /* Was a suitable page captured? */
-                if (*cc->page)
+        for (order = cc->order; order < MAX_ORDER; order++) {
+                struct free_area *area = &zone->free_area[order];
+
+                /* Job done if page is free of the right migratetype */
+                if (!list_empty(&area->free_list[cc->migratetype]))
+                        return COMPACT_PARTIAL;
+
+                /* Job done if allocation would set block type */
+                if (cc->order >= pageblock_order && area->nr_free)
                         return COMPACT_PARTIAL;
-        } else {
-                unsigned int order;
-                for (order = cc->order; order < MAX_ORDER; order++) {
-                        struct free_area *area = &zone->free_area[cc->order];
-                        /* Job done if page is free of the right migratetype */
-                        if (!list_empty(&area->free_list[cc->migratetype]))
-                                return COMPACT_PARTIAL;
-
-                        /* Job done if allocation would set block type */
-                        if (cc->order >= pageblock_order && area->nr_free)
-                                return COMPACT_PARTIAL;
-                }
         }
 
         return COMPACT_CONTINUE;
@@ -921,60 +916,6 @@ unsigned long compaction_suitable(struct zone *zone, int order)
         return COMPACT_CONTINUE;
 }
 
-static void compact_capture_page(struct compact_control *cc)
-{
-        unsigned long flags;
-        int mtype, mtype_low, mtype_high;
-
-        if (!cc->page || *cc->page)
-                return;
-
-        /*
-         * For MIGRATE_MOVABLE allocations we capture a suitable page ASAP
-         * regardless of the migratetype of the freelist is is captured from.
-         * This is fine because the order for a high-order MIGRATE_MOVABLE
-         * allocation is typically at least a pageblock size and overall
-         * fragmentation is not impaired. Other allocation types must
-         * capture pages from their own migratelist because otherwise they
-         * could pollute other pageblocks like MIGRATE_MOVABLE with
-         * difficult to move pages and making fragmentation worse overall.
-         */
-        if (cc->migratetype == MIGRATE_MOVABLE) {
-                mtype_low = 0;
-                mtype_high = MIGRATE_PCPTYPES;
-        } else {
-                mtype_low = cc->migratetype;
-                mtype_high = cc->migratetype + 1;
-        }
-
-        /* Speculatively examine the free lists without zone lock */
-        for (mtype = mtype_low; mtype < mtype_high; mtype++) {
-                int order;
-                for (order = cc->order; order < MAX_ORDER; order++) {
-                        struct page *page;
-                        struct free_area *area;
-                        area = &(cc->zone->free_area[order]);
-                        if (list_empty(&area->free_list[mtype]))
-                                continue;
-
-                        /* Take the lock and attempt capture of the page */
-                        if (!compact_trylock_irqsave(&cc->zone->lock, &flags, cc))
-                                return;
-                        if (!list_empty(&area->free_list[mtype])) {
-                                page = list_entry(area->free_list[mtype].next,
-                                                        struct page, lru);
-                                if (capture_free_page(page, cc->order, mtype)) {
-                                        spin_unlock_irqrestore(&cc->zone->lock,
-                                                                        flags);
-                                        *cc->page = page;
-                                        return;
-                                }
-                        }
-                        spin_unlock_irqrestore(&cc->zone->lock, flags);
-                }
-        }
-}
-
 static int compact_zone(struct zone *zone, struct compact_control *cc)
 {
         int ret;
@@ -1054,9 +995,6 @@ static int compact_zone(struct zone *zone, struct compact_control *cc)
                                 goto out;
                         }
                 }
-
-                /* Capture a page now if it is a suitable size */
-                compact_capture_page(cc);
         }
 
 out:
@@ -1069,8 +1007,7 @@ out:
 
 static unsigned long compact_zone_order(struct zone *zone,
                                  int order, gfp_t gfp_mask,
-                                 bool sync, bool *contended,
-                                 struct page **page)
+                                 bool sync, bool *contended)
 {
         unsigned long ret;
         struct compact_control cc = {
@@ -1080,7 +1017,6 @@ static unsigned long compact_zone_order(struct zone *zone,
                 .migratetype = allocflags_to_migratetype(gfp_mask),
                 .zone = zone,
                 .sync = sync,
-                .page = page,
         };
         INIT_LIST_HEAD(&cc.freepages);
         INIT_LIST_HEAD(&cc.migratepages);
@@ -1110,7 +1046,7 @@ int sysctl_extfrag_threshold = 500;
  */
 unsigned long try_to_compact_pages(struct zonelist *zonelist,
                         int order, gfp_t gfp_mask, nodemask_t *nodemask,
-                        bool sync, bool *contended, struct page **page)
+                        bool sync, bool *contended)
 {
         enum zone_type high_zoneidx = gfp_zone(gfp_mask);
         int may_enter_fs = gfp_mask & __GFP_FS;
@@ -1136,7 +1072,7 @@ unsigned long try_to_compact_pages(struct zonelist *zonelist,
                 int status;
 
                 status = compact_zone_order(zone, order, gfp_mask, sync,
-                                                contended, page);
+                                                contended);
                 rc = max(status, rc);
 
                 /* If a normal allocation would succeed, stop compacting */
@@ -1192,7 +1128,6 @@ int compact_pgdat(pg_data_t *pgdat, int order)
         struct compact_control cc = {
                 .order = order,
                 .sync = false,
-                .page = NULL,
         };
 
         return __compact_pgdat(pgdat, &cc);
@@ -1203,14 +1138,13 @@ static int compact_node(int nid)
         struct compact_control cc = {
                 .order = -1,
                 .sync = true,
-                .page = NULL,
         };
 
         return __compact_pgdat(NODE_DATA(nid), &cc);
 }
 
 /* Compact all nodes in the system */
-static int compact_nodes(void)
+static void compact_nodes(void)
 {
         int nid;
 
@@ -1219,8 +1153,6 @@ static int compact_nodes(void)
 
         for_each_online_node(nid)
                 compact_node(nid);
-
-        return COMPACT_COMPLETE;
 }
 
 /* The written value is actually unused, all memory is compacted */
@@ -1231,7 +1163,7 @@ int sysctl_compaction_handler(struct ctl_table *table, int write,
                         void __user *buffer, size_t *length, loff_t *ppos)
 {
         if (write)
-                return compact_nodes();
+                compact_nodes();
 
         return 0;
 }
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 9e894edc7811..6001ee6347a9 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -1819,9 +1819,19 @@ int split_huge_page(struct page *page)
 
         BUG_ON(is_huge_zero_pfn(page_to_pfn(page)));
         BUG_ON(!PageAnon(page));
-        anon_vma = page_lock_anon_vma_read(page);
+
+        /*
+         * The caller does not necessarily hold an mmap_sem that would prevent
+         * the anon_vma disappearing so we first we take a reference to it
+         * and then lock the anon_vma for write. This is similar to
+         * page_lock_anon_vma_read except the write lock is taken to serialise
+         * against parallel split or collapse operations.
+         */
+        anon_vma = page_get_anon_vma(page);
         if (!anon_vma)
                 goto out;
+        anon_vma_lock_write(anon_vma);
+
         ret = 0;
         if (!PageCompound(page))
                 goto out_unlock;
@@ -1832,7 +1842,8 @@ int split_huge_page(struct page *page)
 
         BUG_ON(PageCompound(page));
 out_unlock:
-        page_unlock_anon_vma_read(anon_vma);
+        anon_vma_unlock(anon_vma);
+        put_anon_vma(anon_vma);
 out:
         return ret;
 }
diff --git a/mm/internal.h b/mm/internal.h
index d597f94cc205..9ba21100ebf3 100644
--- a/mm/internal.h
+++ b/mm/internal.h
@@ -135,7 +135,6 @@ struct compact_control {
         int migratetype;                /* MOVABLE, RECLAIMABLE etc */
         struct zone *zone;
         bool contended;                 /* True if a lock was contended */
-        struct page **page;             /* Page captured of requested size */
 };
 
 unsigned long
diff --git a/mm/memblock.c b/mm/memblock.c
index 625905523c2a..88adc8afb610 100644
--- a/mm/memblock.c
+++ b/mm/memblock.c
@@ -314,7 +314,8 @@ static void __init_memblock memblock_merge_regions(struct memblock_type *type)
                 }
 
                 this->size += next->size;
-                memmove(next, next + 1, (type->cnt - (i + 1)) * sizeof(*next));
+                /* move forward from next + 1, index of which is i + 2 */
+                memmove(next, next + 1, (type->cnt - (i + 2)) * sizeof(*next));
                 type->cnt--;
         }
 }
diff --git a/mm/migrate.c b/mm/migrate.c
index 3b676b0c5c3e..c38778610aa8 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -1679,9 +1679,21 @@ int migrate_misplaced_transhuge_page(struct mm_struct *mm,
         page_xchg_last_nid(new_page, page_last_nid(page));
 
         isolated = numamigrate_isolate_page(pgdat, page);
-        if (!isolated) {
+
+        /*
+         * Failing to isolate or a GUP pin prevents migration. The expected
+         * page count is 2. 1 for anonymous pages without a mapping and 1
+         * for the callers pin. If the page was isolated, the page will
+         * need to be put back on the LRU.
+         */
+        if (!isolated || page_count(page) != 2) {
                 count_vm_events(PGMIGRATE_FAIL, HPAGE_PMD_NR);
                 put_page(new_page);
+                if (isolated) {
+                        putback_lru_page(page);
+                        isolated = 0;
+                        goto out;
+                }
                 goto out_keep_locked;
         }
 
diff --git a/mm/mmap.c b/mm/mmap.c
index f54b235f29a9..35730ee9d515 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -2886,7 +2886,7 @@ static void vm_lock_anon_vma(struct mm_struct *mm, struct anon_vma *anon_vma)
                  * The LSB of head.next can't change from under us
                  * because we hold the mm_all_locks_mutex.
                  */
-                down_write(&anon_vma->root->rwsem);
+                down_write_nest_lock(&anon_vma->root->rwsem, &mm->mmap_sem);
                 /*
                  * We can safely modify head.next after taking the
                  * anon_vma->root->rwsem. If some other vma in this mm shares
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index bc6cc0e913bd..df2022ff0c8a 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1384,14 +1384,8 @@ void split_page(struct page *page, unsigned int order)
                 set_page_refcounted(page + i);
 }
 
-/*
- * Similar to the split_page family of functions except that the page
- * required at the given order and being isolated now to prevent races
- * with parallel allocators
- */
-int capture_free_page(struct page *page, int alloc_order, int migratetype)
+static int __isolate_free_page(struct page *page, unsigned int order)
 {
-        unsigned int order;
         unsigned long watermark;
         struct zone *zone;
         int mt;
@@ -1399,7 +1393,6 @@ int capture_free_page(struct page *page, int alloc_order, int migratetype)
         BUG_ON(!PageBuddy(page));
 
         zone = page_zone(page);
-        order = page_order(page);
         mt = get_pageblock_migratetype(page);
 
         if (mt != MIGRATE_ISOLATE) {
@@ -1408,7 +1401,7 @@ int capture_free_page(struct page *page, int alloc_order, int migratetype)
                 if (!zone_watermark_ok(zone, 0, watermark, 0, 0))
                         return 0;
 
-                __mod_zone_freepage_state(zone, -(1UL << alloc_order), mt);
+                __mod_zone_freepage_state(zone, -(1UL << order), mt);
         }
 
         /* Remove page from free list */
@@ -1416,11 +1409,7 @@ int capture_free_page(struct page *page, int alloc_order, int migratetype)
         zone->free_area[order].nr_free--;
         rmv_page_order(page);
 
-        if (alloc_order != order)
-                expand(zone, page, alloc_order, order,
-                        &zone->free_area[order], migratetype);
-
-        /* Set the pageblock if the captured page is at least a pageblock */
+        /* Set the pageblock if the isolated page is at least a pageblock */
         if (order >= pageblock_order - 1) {
                 struct page *endpage = page + (1 << order) - 1;
                 for (; page < endpage; page += pageblock_nr_pages) {
@@ -1431,7 +1420,7 @@ int capture_free_page(struct page *page, int alloc_order, int migratetype)
                 }
         }
 
-        return 1UL << alloc_order;
+        return 1UL << order;
 }
 
 /*
@@ -1449,10 +1438,9 @@ int split_free_page(struct page *page)
         unsigned int order;
         int nr_pages;
 
-        BUG_ON(!PageBuddy(page));
         order = page_order(page);
 
-        nr_pages = capture_free_page(page, order, 0);
+        nr_pages = __isolate_free_page(page, order);
         if (!nr_pages)
                 return 0;
 
@@ -2136,8 +2124,6 @@ __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order,
         bool *contended_compaction, bool *deferred_compaction,
         unsigned long *did_some_progress)
 {
-        struct page *page = NULL;
-
         if (!order)
                 return NULL;
 
@@ -2149,16 +2135,12 @@ __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order,
         current->flags |= PF_MEMALLOC;
         *did_some_progress = try_to_compact_pages(zonelist, order, gfp_mask,
                                                 nodemask, sync_migration,
-                                                contended_compaction, &page);
+                                                contended_compaction);
         current->flags &= ~PF_MEMALLOC;
 
-        /* If compaction captured a page, prep and use it */
-        if (page) {
-                prep_new_page(page, order, gfp_mask);
-                goto got_page;
-        }
-
         if (*did_some_progress != COMPACT_SKIPPED) {
+                struct page *page;
+
                 /* Page migration frees to the PCP lists but we want merging */
                 drain_pages(get_cpu());
                 put_cpu();
@@ -2168,7 +2150,6 @@ __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order,
                                 alloc_flags & ~ALLOC_NO_WATERMARKS,
                                 preferred_zone, migratetype);
                 if (page) {
-got_page:
                         preferred_zone->compact_blockskip_flush = false;
                         preferred_zone->compact_considered = 0;
                         preferred_zone->compact_defer_shift = 0;
@@ -5604,7 +5585,7 @@ static inline int pfn_to_bitidx(struct zone *zone, unsigned long pfn)
         pfn &= (PAGES_PER_SECTION-1);
         return (pfn >> pageblock_order) * NR_PAGEBLOCK_BITS;
 #else
-        pfn = pfn - zone->zone_start_pfn;
+        pfn = pfn - round_down(zone->zone_start_pfn, pageblock_nr_pages);
         return (pfn >> pageblock_order) * NR_PAGEBLOCK_BITS;
 #endif /* CONFIG_SPARSEMEM */
 }
diff --git a/net/core/dev.c b/net/core/dev.c
index 515473ee52cb..f64e439b4a00 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -6121,6 +6121,14 @@ struct netdev_queue *dev_ingress_queue_create(struct net_device *dev)
 
 static const struct ethtool_ops default_ethtool_ops;
 
+void netdev_set_default_ethtool_ops(struct net_device *dev,
+                                    const struct ethtool_ops *ops)
+{
+        if (dev->ethtool_ops == &default_ethtool_ops)
+                dev->ethtool_ops = ops;
+}
+EXPORT_SYMBOL_GPL(netdev_set_default_ethtool_ops);
+
 /**
  *      alloc_netdev_mqs - allocate network device
  *      @sizeof_priv:   size of private data to allocate space for
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 3c9d20880283..d9c4f113d709 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -590,7 +590,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
         case IP_TTL:
                 if (optlen < 1)
                         goto e_inval;
-                if (val != -1 && (val < 0 || val > 255))
+                if (val != -1 && (val < 1 || val > 255))
                         goto e_inval;
                 inet->uc_ttl = val;
                 break;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 1ca253635f7a..2aa69c8ae60c 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1428,12 +1428,12 @@ static void tcp_service_net_dma(struct sock *sk, bool wait)
 }
 #endif
 
-static inline struct sk_buff *tcp_recv_skb(struct sock *sk, u32 seq, u32 *off)
+static struct sk_buff *tcp_recv_skb(struct sock *sk, u32 seq, u32 *off)
 {
         struct sk_buff *skb;
         u32 offset;
 
-        skb_queue_walk(&sk->sk_receive_queue, skb) {
+        while ((skb = skb_peek(&sk->sk_receive_queue)) != NULL) {
                 offset = seq - TCP_SKB_CB(skb)->seq;
                 if (tcp_hdr(skb)->syn)
                         offset--;
@@ -1441,6 +1441,11 @@ static inline struct sk_buff *tcp_recv_skb(struct sock *sk, u32 seq, u32 *off)
                         *off = offset;
                         return skb;
                 }
+                /* This looks weird, but this can happen if TCP collapsing
+                 * splitted a fat GRO packet, while we released socket lock
+                 * in skb_splice_bits()
+                 */
+                sk_eat_skb(sk, skb, false);
         }
         return NULL;
 }
@@ -1482,7 +1487,7 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
                                         break;
                         }
                         used = recv_actor(desc, skb, offset, len);
-                        if (used < 0) {
+                        if (used <= 0) {
                                 if (!copied)
                                         copied = used;
                                 break;
@@ -1520,8 +1525,10 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
         tcp_rcv_space_adjust(sk);
 
         /* Clean up data we have read: This will do ACK frames. */
-        if (copied > 0)
+        if (copied > 0) {
+                tcp_recv_skb(sk, seq, &offset);
                 tcp_cleanup_rbuf(sk, copied);
+        }
         return copied;
 }
 EXPORT_SYMBOL(tcp_read_sock);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index a28e4db8a952..18f97ca76b00 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5543,7 +5543,7 @@ slow_path:
         if (len < (th->doff << 2) || tcp_checksum_complete_user(sk, skb))
                 goto csum_error;
 
-        if (!th->ack)
+        if (!th->ack && !th->rst)
                 goto discard;
 
         /*
@@ -5988,7 +5988,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                         goto discard;
         }
 
-        if (!th->ack)
+        if (!th->ack && !th->rst)
                 goto discard;
 
         if (!tcp_validate_incoming(sk, skb, th, 0))
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 408cac4ae00a..420e56326384 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -154,6 +154,11 @@ static void addrconf_type_change(struct net_device *dev,
                                  unsigned long event);
 static int addrconf_ifdown(struct net_device *dev, int how);
 
+static struct rt6_info *addrconf_get_prefix_route(const struct in6_addr *pfx,
+                                                  int plen,
+                                                  const struct net_device *dev,
+                                                  u32 flags, u32 noflags);
+
 static void addrconf_dad_start(struct inet6_ifaddr *ifp);
 static void addrconf_dad_timer(unsigned long data);
 static void addrconf_dad_completed(struct inet6_ifaddr *ifp);
@@ -250,12 +255,6 @@ static inline bool addrconf_qdisc_ok(const struct net_device *dev)
         return !qdisc_tx_is_noop(dev);
 }
 
-/* Check if a route is valid prefix route */
-static inline int addrconf_is_prefix_route(const struct rt6_info *rt)
-{
-        return (rt->rt6i_flags & (RTF_GATEWAY | RTF_DEFAULT)) == 0;
-}
-
 static void addrconf_del_timer(struct inet6_ifaddr *ifp)
 {
         if (del_timer(&ifp->timer))
@@ -941,17 +940,15 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
         if ((ifp->flags & IFA_F_PERMANENT) && onlink < 1) {
                 struct in6_addr prefix;
                 struct rt6_info *rt;
-                struct net *net = dev_net(ifp->idev->dev);
-                struct flowi6 fl6 = {};
 
                 ipv6_addr_prefix(&prefix, &ifp->addr, ifp->prefix_len);
-                fl6.flowi6_oif = ifp->idev->dev->ifindex;
-                fl6.daddr = prefix;
-                rt = (struct rt6_info *)ip6_route_lookup(net, &fl6,
-                                                         RT6_LOOKUP_F_IFACE);
 
-                if (rt != net->ipv6.ip6_null_entry &&
-                    addrconf_is_prefix_route(rt)) {
+                rt = addrconf_get_prefix_route(&prefix,
+                                               ifp->prefix_len,
+                                               ifp->idev->dev,
+                                               0, RTF_GATEWAY | RTF_DEFAULT);
+
+                if (rt) {
                         if (onlink == 0) {
                                 ip6_del_rt(rt);
                                 rt = NULL;
@@ -1877,7 +1874,7 @@ static struct rt6_info *addrconf_get_prefix_route(const struct in6_addr *pfx,
                         continue;
                 if ((rt->rt6i_flags & flags) != flags)
                         continue;
-                if ((noflags != 0) && ((rt->rt6i_flags & flags) != 0))
+                if ((rt->rt6i_flags & noflags) != 0)
                         continue;
                 dst_hold(&rt->dst);
                 break;
diff --git a/net/iucv/iucv.c b/net/iucv/iucv.c
index 3ad1f9db5f8b..df082508362d 100644
--- a/net/iucv/iucv.c
+++ b/net/iucv/iucv.c
@@ -1806,7 +1806,7 @@ static void iucv_external_interrupt(struct ext_code ext_code,
         struct iucv_irq_data *p;
         struct iucv_irq_list *work;
 
-        kstat_cpu(smp_processor_id()).irqs[EXTINT_IUC]++;
+        inc_irq_stat(IRQEXT_IUC);
         p = iucv_irq_data[smp_processor_id()];
         if (p->ippathid >= iucv_max_pathid) {
                 WARN_ON(p->ippathid >= iucv_max_pathid);
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 5c61677487cf..47e0aca614b7 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1009,6 +1009,8 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
         if (old_probe_resp)
                 kfree_rcu(old_probe_resp, rcu_head);
 
+        list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
+                sta_info_flush(local, vlan);
         sta_info_flush(local, sdata);
         ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
 
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 53f03120db55..80e55527504b 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -4,6 +4,7 @@
 
 #include <linux/nl80211.h>
 #include <linux/export.h>
+#include <linux/rtnetlink.h>
 #include <net/cfg80211.h>
 #include "ieee80211_i.h"
 #include "driver-ops.h"
@@ -197,6 +198,15 @@ static void __ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata)
 
         ctx = container_of(conf, struct ieee80211_chanctx, conf);
 
+        if (sdata->vif.type == NL80211_IFTYPE_AP) {
+                struct ieee80211_sub_if_data *vlan;
+
+                /* for the VLAN list */
+                ASSERT_RTNL();
+                list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
+                        rcu_assign_pointer(vlan->vif.chanctx_conf, NULL);
+        }
+
         ieee80211_unassign_vif_chanctx(sdata, ctx);
         if (ctx->refcount == 0)
                 ieee80211_free_chanctx(local, ctx);
@@ -316,6 +326,15 @@ int ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
                 goto out;
         }
 
+        if (sdata->vif.type == NL80211_IFTYPE_AP) {
+                struct ieee80211_sub_if_data *vlan;
+
+                /* for the VLAN list */
+                ASSERT_RTNL();
+                list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
+                        rcu_assign_pointer(vlan->vif.chanctx_conf, &ctx->conf);
+        }
+
         ieee80211_recalc_smps_chanctx(local, ctx);
  out:
         mutex_unlock(&local->chanctx_mtx);
@@ -331,6 +350,25 @@ void ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata)
         mutex_unlock(&sdata->local->chanctx_mtx);
 }
 
+void ieee80211_vif_vlan_copy_chanctx(struct ieee80211_sub_if_data *sdata)
+{
+        struct ieee80211_local *local = sdata->local;
+        struct ieee80211_sub_if_data *ap;
+        struct ieee80211_chanctx_conf *conf;
+
+        if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->bss))
+                return;
+
+        ap = container_of(sdata->bss, struct ieee80211_sub_if_data, u.ap);
+
+        mutex_lock(&local->chanctx_mtx);
+
+        conf = rcu_dereference_protected(ap->vif.chanctx_conf,
+                                         lockdep_is_held(&local->chanctx_mtx));
+        rcu_assign_pointer(sdata->vif.chanctx_conf, conf);
+        mutex_unlock(&local->chanctx_mtx);
+}
+
 void ieee80211_iter_chan_contexts_atomic(
         struct ieee80211_hw *hw,
         void (*iter)(struct ieee80211_hw *hw,
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 8881fc77fb13..6b7644e818d8 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -703,8 +703,8 @@ static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata)
         sdata_info(sdata,
                    "No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge)\n");
 
-        ieee80211_request_internal_scan(sdata,
-                        ifibss->ssid, ifibss->ssid_len, NULL);
+        ieee80211_request_ibss_scan(sdata, ifibss->ssid, ifibss->ssid_len,
+                                    NULL);
 }
 
 static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
@@ -802,9 +802,8 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
                                         IEEE80211_SCAN_INTERVAL)) {
                 sdata_info(sdata, "Trigger new scan to find an IBSS to join\n");
 
-                ieee80211_request_internal_scan(sdata,
-                                ifibss->ssid, ifibss->ssid_len,
-                                ifibss->fixed_channel ? ifibss->channel : NULL);
+                ieee80211_request_ibss_scan(sdata, ifibss->ssid,
+                                            ifibss->ssid_len, chan);
         } else {
                 int interval = IEEE80211_SCAN_INTERVAL;
 
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 42d0d0267730..8563b9a5cac3 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -92,8 +92,6 @@ struct ieee80211_bss {
 
         u32 device_ts;
 
-        u8 dtim_period;
-
         bool wmm_used;
         bool uapsd_supported;
 
@@ -140,7 +138,6 @@ enum ieee80211_bss_corrupt_data_flags {
 
 /**
  * enum ieee80211_valid_data_flags - BSS valid data flags
- * @IEEE80211_BSS_VALID_DTIM: DTIM data was gathered from non-corrupt IE
  * @IEEE80211_BSS_VALID_WMM: WMM/UAPSD data was gathered from non-corrupt IE
  * @IEEE80211_BSS_VALID_RATES: Supported rates were gathered from non-corrupt IE
  * @IEEE80211_BSS_VALID_ERP: ERP flag was gathered from non-corrupt IE
@@ -151,7 +148,6 @@ enum ieee80211_bss_corrupt_data_flags {
  * beacon/probe response.
  */
 enum ieee80211_bss_valid_data_flags {
-        IEEE80211_BSS_VALID_DTIM                = BIT(0),
         IEEE80211_BSS_VALID_WMM                 = BIT(1),
         IEEE80211_BSS_VALID_RATES               = BIT(2),
         IEEE80211_BSS_VALID_ERP                 = BIT(3)
@@ -440,6 +436,7 @@ struct ieee80211_if_managed {
         unsigned long timers_running; /* used for quiesce/restart */
         bool powersave; /* powersave requested for this iface */
         bool broken_ap; /* AP is broken -- turn off powersave */
+        u8 dtim_period;
         enum ieee80211_smps_mode req_smps, /* requested smps mode */
                                  driver_smps_mode; /* smps mode request */
 
@@ -773,6 +770,10 @@ struct ieee80211_sub_if_data {
                 u32 mntr_flags;
         } u;
 
+        spinlock_t cleanup_stations_lock;
+        struct list_head cleanup_stations;
+        struct work_struct cleanup_stations_wk;
+
 #ifdef CONFIG_MAC80211_DEBUGFS
         struct {
                 struct dentry *dir;
@@ -1329,9 +1330,9 @@ void ieee80211_mesh_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
 
 /* scan/BSS handling */
 void ieee80211_scan_work(struct work_struct *work);
-int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
-                                    const u8 *ssid, u8 ssid_len,
-                                    struct ieee80211_channel *chan);
+int ieee80211_request_ibss_scan(struct ieee80211_sub_if_data *sdata,
+                                const u8 *ssid, u8 ssid_len,
+                                struct ieee80211_channel *chan);
 int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
                            struct cfg80211_scan_request *req);
 void ieee80211_scan_cancel(struct ieee80211_local *local);
@@ -1628,6 +1629,7 @@ ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
                           const struct cfg80211_chan_def *chandef,
                           enum ieee80211_chanctx_mode mode);
 void ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata);
+void ieee80211_vif_vlan_copy_chanctx(struct ieee80211_sub_if_data *sdata);
 
 void ieee80211_recalc_smps_chanctx(struct ieee80211_local *local,
                                    struct ieee80211_chanctx *chanctx);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 09a80b55cf5a..8be854e86cd9 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -207,17 +207,8 @@ void ieee80211_recalc_idle(struct ieee80211_local *local)
 
 static int ieee80211_change_mtu(struct net_device *dev, int new_mtu)
 {
-        int meshhdrlen;
-        struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
-
-        meshhdrlen = (sdata->vif.type == NL80211_IFTYPE_MESH_POINT) ? 5 : 0;
-
-        /* FIX: what would be proper limits for MTU?
-         * This interface uses 802.3 frames. */
-        if (new_mtu < 256 ||
-            new_mtu > IEEE80211_MAX_DATA_LEN - 24 - 6 - meshhdrlen) {
+        if (new_mtu < 256 || new_mtu > IEEE80211_MAX_DATA_LEN)
                 return -EINVAL;
-        }
 
         dev->mtu = new_mtu;
         return 0;
@@ -586,11 +577,13 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
 
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_AP_VLAN:
-                /* no need to tell driver, but set carrier */
-                if (rtnl_dereference(sdata->bss->beacon))
+                /* no need to tell driver, but set carrier and chanctx */
+                if (rtnl_dereference(sdata->bss->beacon)) {
+                        ieee80211_vif_vlan_copy_chanctx(sdata);
                         netif_carrier_on(dev);
-                else
+                } else {
                         netif_carrier_off(dev);
+                }
                 break;
         case NL80211_IFTYPE_MONITOR:
                 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES) {
@@ -839,6 +832,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
         switch (sdata->vif.type) {
         case NL80211_IFTYPE_AP_VLAN:
                 list_del(&sdata->u.vlan.list);
+                rcu_assign_pointer(sdata->vif.chanctx_conf, NULL);
                 /* no need to tell driver */
                 break;
         case NL80211_IFTYPE_MONITOR:
@@ -865,20 +859,11 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
                 cancel_work_sync(&sdata->work);
                 /*
                  * When we get here, the interface is marked down.
-                 * Call rcu_barrier() to wait both for the RX path
+                 * Call synchronize_rcu() to wait for the RX path
                  * should it be using the interface and enqueuing
-                 * frames at this very time on another CPU, and
-                 * for the sta free call_rcu callbacks.
-                 */
-                rcu_barrier();
-
-                /*
-                 * free_sta_rcu() enqueues a work for the actual
-                 * sta cleanup, so we need to flush it while
-                 * sdata is still valid.
+                 * frames at this very time on another CPU.
                  */
-                flush_workqueue(local->workqueue);
-
+                synchronize_rcu();
                 skb_queue_purge(&sdata->skb_queue);
 
                 /*
@@ -1498,6 +1483,15 @@ static void ieee80211_assign_perm_addr(struct ieee80211_local *local,
         mutex_unlock(&local->iflist_mtx);
 }
 
+static void ieee80211_cleanup_sdata_stas_wk(struct work_struct *wk)
+{
+        struct ieee80211_sub_if_data *sdata;
+
+        sdata = container_of(wk, struct ieee80211_sub_if_data, cleanup_stations_wk);
+
+        ieee80211_cleanup_sdata_stas(sdata);
+}
+
 int ieee80211_if_add(struct ieee80211_local *local, const char *name,
                      struct wireless_dev **new_wdev, enum nl80211_iftype type,
                      struct vif_params *params)
@@ -1573,6 +1567,10 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
 
         INIT_LIST_HEAD(&sdata->key_list);
 
+        spin_lock_init(&sdata->cleanup_stations_lock);
+        INIT_LIST_HEAD(&sdata->cleanup_stations);
+        INIT_WORK(&sdata->cleanup_stations_wk, ieee80211_cleanup_sdata_stas_wk);
+
         for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
                 struct ieee80211_supported_band *sband;
                 sband = local->hw.wiphy->bands[i];
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 1bf03f9ff3ba..649ad513547f 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -163,7 +163,7 @@ int mesh_rmc_init(struct ieee80211_sub_if_data *sdata)
                 return -ENOMEM;
         sdata->u.mesh.rmc->idx_mask = RMC_BUCKETS - 1;
         for (i = 0; i < RMC_BUCKETS; i++)
-                INIT_LIST_HEAD(&sdata->u.mesh.rmc->bucket[i].list);
+                INIT_LIST_HEAD(&sdata->u.mesh.rmc->bucket[i]);
         return 0;
 }
 
@@ -177,7 +177,7 @@ void mesh_rmc_free(struct ieee80211_sub_if_data *sdata)
                 return;
 
         for (i = 0; i < RMC_BUCKETS; i++)
-                list_for_each_entry_safe(p, n, &rmc->bucket[i].list, list) {
+                list_for_each_entry_safe(p, n, &rmc->bucket[i], list) {
                         list_del(&p->list);
                         kmem_cache_free(rm_cache, p);
                 }
@@ -210,7 +210,7 @@ int mesh_rmc_check(u8 *sa, struct ieee80211s_hdr *mesh_hdr,
         /* Don't care about endianness since only match matters */
         memcpy(&seqnum, &mesh_hdr->seqnum, sizeof(mesh_hdr->seqnum));
         idx = le32_to_cpu(mesh_hdr->seqnum) & rmc->idx_mask;
-        list_for_each_entry_safe(p, n, &rmc->bucket[idx].list, list) {
+        list_for_each_entry_safe(p, n, &rmc->bucket[idx], list) {
                 ++entries;
                 if (time_after(jiffies, p->exp_time) ||
                                 (entries == RMC_QUEUE_MAX_LEN)) {
@@ -229,7 +229,7 @@ int mesh_rmc_check(u8 *sa, struct ieee80211s_hdr *mesh_hdr,
         p->seqnum = seqnum;
         p->exp_time = jiffies + RMC_TIMEOUT;
         memcpy(p->sa, sa, ETH_ALEN);
-        list_add(&p->list, &rmc->bucket[idx].list);
+        list_add(&p->list, &rmc->bucket[idx]);
         return 0;
 }
 
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index 7c9215fb2ac8..84c28c6101cd 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -184,7 +184,7 @@ struct rmc_entry {
 };
 
 struct mesh_rmc {
-        struct rmc_entry bucket[RMC_BUCKETS];
+        struct list_head bucket[RMC_BUCKETS];
         u32 idx_mask;
 };
 
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 7753a9ca98a6..a3552929a21d 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1074,12 +1074,8 @@ void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
                 if (beaconint_us > latency) {
                         local->ps_sdata = NULL;
                 } else {
-                        struct ieee80211_bss *bss;
                         int maxslp = 1;
-                        u8 dtimper;
-
-                        bss = (void *)found->u.mgd.associated->priv;
-                        dtimper = bss->dtim_period;
+                        u8 dtimper = found->u.mgd.dtim_period;
 
                         /* If the TIM IE is invalid, pretend the value is 1 */
                         if (!dtimper)
@@ -1410,10 +1406,17 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
 
         ieee80211_led_assoc(local, 1);
 
-        if (local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD)
-                bss_conf->dtim_period = bss->dtim_period;
-        else
+        if (local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD) {
+                /*
+                 * If the AP is buggy we may get here with no DTIM period
+                 * known, so assume it's 1 which is the only safe assumption
+                 * in that case, although if the TIM IE is broken powersave
+                 * probably just won't work at all.
+                 */
+                bss_conf->dtim_period = sdata->u.mgd.dtim_period ?: 1;
+        } else {
                 bss_conf->dtim_period = 0;
+        }
 
         bss_conf->assoc = 1;
 
@@ -1562,6 +1565,8 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
 
         sdata->u.mgd.timers_running = 0;
 
+        sdata->vif.bss_conf.dtim_period = 0;
+
         ifmgd->flags = 0;
         ieee80211_vif_release_channel(sdata);
 }
@@ -2373,11 +2378,18 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_channel *channel;
         bool need_ps = false;
 
-        if (sdata->u.mgd.associated &&
-            ether_addr_equal(mgmt->bssid, sdata->u.mgd.associated->bssid)) {
-                bss = (void *)sdata->u.mgd.associated->priv;
+        if ((sdata->u.mgd.associated &&
+             ether_addr_equal(mgmt->bssid, sdata->u.mgd.associated->bssid)) ||
+            (sdata->u.mgd.assoc_data &&
+             ether_addr_equal(mgmt->bssid,
+                              sdata->u.mgd.assoc_data->bss->bssid))) {
                 /* not previously set so we may need to recalc */
-                need_ps = !bss->dtim_period;
+                need_ps = sdata->u.mgd.associated && !sdata->u.mgd.dtim_period;
+
+                if (elems->tim && !elems->parse_error) {
+                        struct ieee80211_tim_ie *tim_ie = elems->tim;
+                        sdata->u.mgd.dtim_period = tim_ie->dtim_period;
+                }
         }
 
         if (elems->ds_params && elems->ds_params_len == 1)
@@ -3896,20 +3908,41 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
         /* kick off associate process */
 
         ifmgd->assoc_data = assoc_data;
+        ifmgd->dtim_period = 0;
 
         err = ieee80211_prep_connection(sdata, req->bss, true);
         if (err)
                 goto err_clear;
 
-        if (!bss->dtim_period &&
-            sdata->local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD) {
-                /*
-                 * Wait up to one beacon interval ...
-                 * should this be more if we miss one?
-                 */
-                sdata_info(sdata, "waiting for beacon from %pM\n",
-                           ifmgd->bssid);
-                assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
+        if (sdata->local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD) {
+                const struct cfg80211_bss_ies *beacon_ies;
+
+                rcu_read_lock();
+                beacon_ies = rcu_dereference(req->bss->beacon_ies);
+                if (!beacon_ies) {
+                        /*
+                         * Wait up to one beacon interval ...
+                         * should this be more if we miss one?
+                         */
+                        sdata_info(sdata, "waiting for beacon from %pM\n",
+                                   ifmgd->bssid);
+                        assoc_data->timeout =
+                                TU_TO_EXP_TIME(req->bss->beacon_interval);
+                } else {
+                        const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM,
+                                                            beacon_ies->data,
+                                                            beacon_ies->len);
+                        if (tim_ie && tim_ie[1] >=
+                                        sizeof(struct ieee80211_tim_ie)) {
+                                const struct ieee80211_tim_ie *tim;
+                                tim = (void *)(tim_ie + 2);
+                                ifmgd->dtim_period = tim->dtim_period;
+                        }
+                        assoc_data->have_beacon = true;
+                        assoc_data->sent_assoc = false;
+                        assoc_data->timeout = jiffies;
+                }
+                rcu_read_unlock();
         } else {
                 assoc_data->have_beacon = true;
                 assoc_data->sent_assoc = false;
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 8ed83dcc149f..d59fc6818b1c 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -113,18 +113,6 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
                         bss->valid_data |= IEEE80211_BSS_VALID_ERP;
         }
 
-        if (elems->tim && (!elems->parse_error ||
-                           !(bss->valid_data & IEEE80211_BSS_VALID_DTIM))) {
-                struct ieee80211_tim_ie *tim_ie = elems->tim;
-                bss->dtim_period = tim_ie->dtim_period;
-                if (!elems->parse_error)
-                        bss->valid_data |= IEEE80211_BSS_VALID_DTIM;
-        }
-
-        /* If the beacon had no TIM IE, or it was invalid, use 1 */
-        if (beacon && !bss->dtim_period)
-                bss->dtim_period = 1;
-
         /* replace old supported rates if we get new values */
         if (!elems->parse_error ||
             !(bss->valid_data & IEEE80211_BSS_VALID_RATES)) {
@@ -832,9 +820,9 @@ int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
         return res;
 }
 
-int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
-                                    const u8 *ssid, u8 ssid_len,
-                                    struct ieee80211_channel *chan)
+int ieee80211_request_ibss_scan(struct ieee80211_sub_if_data *sdata,
+                                const u8 *ssid, u8 ssid_len,
+                                struct ieee80211_channel *chan)
 {
         struct ieee80211_local *local = sdata->local;
         int ret = -EBUSY;
@@ -848,22 +836,36 @@ int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
 
         /* fill internal scan request */
         if (!chan) {
-                int i, nchan = 0;
+                int i, max_n;
+                int n_ch = 0;
 
                 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
                         if (!local->hw.wiphy->bands[band])
                                 continue;
-                        for (i = 0;
-                             i < local->hw.wiphy->bands[band]->n_channels;
-                             i++) {
-                                local->int_scan_req->channels[nchan] =
+
+                        max_n = local->hw.wiphy->bands[band]->n_channels;
+                        for (i = 0; i < max_n; i++) {
+                                struct ieee80211_channel *tmp_ch =
                                     &local->hw.wiphy->bands[band]->channels[i];
-                                nchan++;
+
+                                if (tmp_ch->flags & (IEEE80211_CHAN_NO_IBSS |
+                                                     IEEE80211_CHAN_DISABLED))
+                                        continue;
+
+                                local->int_scan_req->channels[n_ch] = tmp_ch;
+                                n_ch++;
                         }
                 }
 
-                local->int_scan_req->n_channels = nchan;
+                if (WARN_ON_ONCE(n_ch == 0))
+                        goto unlock;
+
+                local->int_scan_req->n_channels = n_ch;
         } else {
+                if (WARN_ON_ONCE(chan->flags & (IEEE80211_CHAN_NO_IBSS |
+                                                IEEE80211_CHAN_DISABLED)))
+                        goto unlock;
+
                 local->int_scan_req->channels[0] = chan;
                 local->int_scan_req->n_channels = 1;
         }
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index f3e502502fee..ca9fde198188 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -91,9 +91,8 @@ static int sta_info_hash_del(struct ieee80211_local *local,
         return -ENOENT;
 }
 
-static void free_sta_work(struct work_struct *wk)
+static void cleanup_single_sta(struct sta_info *sta)
 {
-        struct sta_info *sta = container_of(wk, struct sta_info, free_sta_wk);
         int ac, i;
         struct tid_ampdu_tx *tid_tx;
         struct ieee80211_sub_if_data *sdata = sta->sdata;
@@ -153,11 +152,35 @@ static void free_sta_work(struct work_struct *wk)
         sta_info_free(local, sta);
 }
 
+void ieee80211_cleanup_sdata_stas(struct ieee80211_sub_if_data *sdata)
+{
+        struct sta_info *sta;
+
+        spin_lock_bh(&sdata->cleanup_stations_lock);
+        while (!list_empty(&sdata->cleanup_stations)) {
+                sta = list_first_entry(&sdata->cleanup_stations,
+                                       struct sta_info, list);
+                list_del(&sta->list);
+                spin_unlock_bh(&sdata->cleanup_stations_lock);
+
+                cleanup_single_sta(sta);
+
+                spin_lock_bh(&sdata->cleanup_stations_lock);
+        }
+
+        spin_unlock_bh(&sdata->cleanup_stations_lock);
+}
+
 static void free_sta_rcu(struct rcu_head *h)
 {
         struct sta_info *sta = container_of(h, struct sta_info, rcu_head);
+        struct ieee80211_sub_if_data *sdata = sta->sdata;
 
-        ieee80211_queue_work(&sta->local->hw, &sta->free_sta_wk);
+        spin_lock(&sdata->cleanup_stations_lock);
+        list_add_tail(&sta->list, &sdata->cleanup_stations);
+        spin_unlock(&sdata->cleanup_stations_lock);
+
+        ieee80211_queue_work(&sdata->local->hw, &sdata->cleanup_stations_wk);
 }
 
 /* protected by RCU */
@@ -310,7 +333,6 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
 
         spin_lock_init(&sta->lock);
         INIT_WORK(&sta->drv_unblock_wk, sta_unblock);
-        INIT_WORK(&sta->free_sta_wk, free_sta_work);
         INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work);
         mutex_init(&sta->ampdu_mlme.mtx);
 
@@ -862,7 +884,7 @@ void sta_info_init(struct ieee80211_local *local)
 
 void sta_info_stop(struct ieee80211_local *local)
 {
-        del_timer(&local->sta_cleanup);
+        del_timer_sync(&local->sta_cleanup);
         sta_info_flush(local, NULL);
 }
 
@@ -891,6 +913,20 @@ int sta_info_flush(struct ieee80211_local *local,
         }
         mutex_unlock(&local->sta_mtx);
 
+        rcu_barrier();
+
+        if (sdata) {
+                ieee80211_cleanup_sdata_stas(sdata);
+                cancel_work_sync(&sdata->cleanup_stations_wk);
+        } else {
+                mutex_lock(&local->iflist_mtx);
+                list_for_each_entry(sdata, &local->interfaces, list) {
+                        ieee80211_cleanup_sdata_stas(sdata);
+                        cancel_work_sync(&sdata->cleanup_stations_wk);
+                }
+                mutex_unlock(&local->iflist_mtx);
+        }
+
         return ret;
 }
 
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 1489bca9ea97..37c1889afd3a 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -299,7 +299,6 @@ struct sta_info {
         spinlock_t lock;
 
         struct work_struct drv_unblock_wk;
-        struct work_struct free_sta_wk;
 
         u16 listen_interval;
 
@@ -563,4 +562,6 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta);
 void ieee80211_sta_ps_deliver_poll_response(struct sta_info *sta);
 void ieee80211_sta_ps_deliver_uapsd(struct sta_info *sta);
 
+void ieee80211_cleanup_sdata_stas(struct ieee80211_sub_if_data *sdata);
+
 #endif /* STA_INFO_H */
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 1915ffe598e3..507b5e84fbdb 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -555,7 +555,7 @@ EXPORT_SYMBOL_GPL(rpc_clone_client);
  * rpc_clone_client_set_auth - Clone an RPC client structure and set its auth
  *
  * @clnt: RPC client whose parameters are copied
- * @auth: security flavor for new client
+ * @flavor: security flavor for new client
  *
  * Returns a fresh RPC client or an ERR_PTR.
  */
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index b4133bd13915..bfa31714581f 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -972,8 +972,7 @@ static void rpc_async_release(struct work_struct *work)
 
 static void rpc_release_resources_task(struct rpc_task *task)
 {
-        if (task->tk_rqstp)
-                xprt_release(task);
+        xprt_release(task);
         if (task->tk_msg.rpc_cred) {
                 put_rpccred(task->tk_msg.rpc_cred);
                 task->tk_msg.rpc_cred = NULL;
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index bd462a532acf..33811db8788a 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -1136,10 +1136,18 @@ static void xprt_request_init(struct rpc_task *task, struct rpc_xprt *xprt)
 void xprt_release(struct rpc_task *task)
 {
         struct rpc_xprt *xprt;
-        struct rpc_rqst *req;
+        struct rpc_rqst *req = task->tk_rqstp;
 
-        if (!(req = task->tk_rqstp))
+        if (req == NULL) {
+                if (task->tk_client) {
+                        rcu_read_lock();
+                        xprt = rcu_dereference(task->tk_client->cl_xprt);
+                        if (xprt->snd_task == task)
+                                xprt_release_write(xprt, task);
+                        rcu_read_unlock();
+                }
                 return;
+        }
 
         xprt = req->rq_xprt;
         if (task->tk_ops->rpc_count_stats != NULL)
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 14d990400354..b677eab55b68 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -866,8 +866,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
                 /* allow mac80211 to determine the timeout */
                 wdev->ps_timeout = -1;
 
-                if (!dev->ethtool_ops)
-                        dev->ethtool_ops = &cfg80211_ethtool_ops;
+                netdev_set_default_ethtool_ops(dev, &cfg80211_ethtool_ops);
 
                 if ((wdev->iftype == NL80211_IFTYPE_STATION ||
                      wdev->iftype == NL80211_IFTYPE_P2P_CLIENT ||
diff --git a/sound/arm/pxa2xx-ac97-lib.c b/sound/arm/pxa2xx-ac97-lib.c
index 6fc0ae90e5b1..fff7753e35c1 100644
--- a/sound/arm/pxa2xx-ac97-lib.c
+++ b/sound/arm/pxa2xx-ac97-lib.c
@@ -18,6 +18,7 @@
 #include <linux/delay.h>
 #include <linux/module.h>
 #include <linux/io.h>
+#include <linux/gpio.h>
 
 #include <sound/ac97_codec.h>
 #include <sound/pxa2xx-lib.h>
@@ -148,6 +149,8 @@ static inline void pxa_ac97_warm_pxa27x(void)
 
 static inline void pxa_ac97_cold_pxa27x(void)
 {
+        unsigned int timeout;
+
         GCR &=  GCR_COLD_RST;  /* clear everything but nCRST */
         GCR &= ~GCR_COLD_RST;  /* then assert nCRST */
 
@@ -157,8 +160,10 @@ static inline void pxa_ac97_cold_pxa27x(void)
         clk_enable(ac97conf_clk);
         udelay(5);
         clk_disable(ac97conf_clk);
-        GCR = GCR_COLD_RST;
-        udelay(50);
+        GCR = GCR_COLD_RST | GCR_WARM_RST;
+        timeout = 100;     /* wait for the codec-ready bit to be set */
+        while (!((GSR | gsr_bits) & (GSR_PCR | GSR_SCR)) && timeout--)
+                mdelay(1);
 }
 #endif
 
@@ -340,8 +345,21 @@ int pxa2xx_ac97_hw_probe(struct platform_device *dev)
         }
 
         if (cpu_is_pxa27x()) {
-                /* Use GPIO 113 as AC97 Reset on Bulverde */
+                /*
+                 * This gpio is needed for a work-around to a bug in the ac97
+                 * controller during warm reset.  The direction and level is set
+                 * here so that it is an output driven high when switching from
+                 * AC97_nRESET alt function to generic gpio.
+                 */
+                ret = gpio_request_one(reset_gpio, GPIOF_OUT_INIT_HIGH,
+                                       "pxa27x ac97 reset");
+                if (ret < 0) {
+                        pr_err("%s: gpio_request_one() failed: %d\n",
+                               __func__, ret);
+                        goto err_conf;
+                }
                 pxa27x_assert_ac97reset(reset_gpio, 0);
+
                 ac97conf_clk = clk_get(&dev->dev, "AC97CONFCLK");
                 if (IS_ERR(ac97conf_clk)) {
                         ret = PTR_ERR(ac97conf_clk);
@@ -384,6 +402,8 @@ EXPORT_SYMBOL_GPL(pxa2xx_ac97_hw_probe);
 
 void pxa2xx_ac97_hw_remove(struct platform_device *dev)
 {
+        if (cpu_is_pxa27x())
+                gpio_free(reset_gpio);
         GCR |= GCR_ACLINK_OFF;
         free_irq(IRQ_AC97, NULL);
         if (ac97conf_clk) {
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index cca87277baf0..0b6aebacc56b 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -573,9 +573,12 @@ enum {
 #define AZX_DCAPS_PM_RUNTIME    (1 << 26)       /* runtime PM support */
 
 /* quirks for Intel PCH */
-#define AZX_DCAPS_INTEL_PCH \
+#define AZX_DCAPS_INTEL_PCH_NOPM \
         (AZX_DCAPS_SCH_SNOOP | AZX_DCAPS_BUFSIZE | \
-         AZX_DCAPS_COUNT_LPIB_DELAY | AZX_DCAPS_PM_RUNTIME)
+         AZX_DCAPS_COUNT_LPIB_DELAY)
+
+#define AZX_DCAPS_INTEL_PCH \
+        (AZX_DCAPS_INTEL_PCH_NOPM | AZX_DCAPS_PM_RUNTIME)
 
 /* quirks for ATI SB / AMD Hudson */
 #define AZX_DCAPS_PRESET_ATI_SB \
@@ -3586,13 +3589,13 @@ static void azx_remove(struct pci_dev *pci)
 static DEFINE_PCI_DEVICE_TABLE(azx_ids) = {
         /* CPT */
         { PCI_DEVICE(0x8086, 0x1c20),
-          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
+          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH_NOPM },
         /* PBG */
         { PCI_DEVICE(0x8086, 0x1d20),
-          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
+          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH_NOPM },
         /* Panther Point */
         { PCI_DEVICE(0x8086, 0x1e20),
-          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
+          .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH_NOPM },
         /* Lynx Point */
         { PCI_DEVICE(0x8086, 0x8c20),
           .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH },
diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
index 60890bfecc19..dd798c3196ff 100644
--- a/sound/pci/hda/patch_conexant.c
+++ b/sound/pci/hda/patch_conexant.c
@@ -558,24 +558,12 @@ static int conexant_build_controls(struct hda_codec *codec)
         return 0;
 }
 
-#ifdef CONFIG_PM
-static int conexant_suspend(struct hda_codec *codec)
-{
-        snd_hda_shutup_pins(codec);
-        return 0;
-}
-#endif
-
 static const struct hda_codec_ops conexant_patch_ops = {
         .build_controls = conexant_build_controls,
         .build_pcms = conexant_build_pcms,
         .init = conexant_init,
         .free = conexant_free,
         .set_power_state = conexant_set_power,
-#ifdef CONFIG_PM
-        .suspend = conexant_suspend,
-#endif
-        .reboot_notify = snd_hda_shutup_pins,
 };
 
 #ifdef CONFIG_SND_HDA_INPUT_BEEP
@@ -4405,10 +4393,6 @@ static const struct hda_codec_ops cx_auto_patch_ops = {
         .init = cx_auto_init,
         .free = conexant_free,
         .unsol_event = snd_hda_jack_unsol_event,
-#ifdef CONFIG_PM
-        .suspend = conexant_suspend,
-#endif
-        .reboot_notify = snd_hda_shutup_pins,
 };
 
 /*
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index b6c21ea187ca..807a2aa1ff38 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -1502,7 +1502,7 @@ static int hdmi_chmap_ctl_put(struct snd_kcontrol *kcontrol,
         ctl_idx = snd_ctl_get_ioffidx(kcontrol, &ucontrol->id);
         substream = snd_pcm_chmap_substream(info, ctl_idx);
         if (!substream || !substream->runtime)
-                return -EBADFD;
+                return 0; /* just for avoiding error from alsactl restore */
         switch (substream->runtime->status->state) {
         case SNDRV_PCM_STATE_OPEN:
         case SNDRV_PCM_STATE_SETUP:
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 71ae23dd7103..f5196277b6e9 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -5817,6 +5817,9 @@ enum {
         ALC269_TYPE_ALC269VB,
         ALC269_TYPE_ALC269VC,
         ALC269_TYPE_ALC269VD,
+        ALC269_TYPE_ALC280,
+        ALC269_TYPE_ALC282,
+        ALC269_TYPE_ALC284,
 };
 
 /*
@@ -5833,10 +5836,13 @@ static int alc269_parse_auto_config(struct hda_codec *codec)
         switch (spec->codec_variant) {
         case ALC269_TYPE_ALC269VA:
         case ALC269_TYPE_ALC269VC:
+        case ALC269_TYPE_ALC280:
+        case ALC269_TYPE_ALC284:
                 ssids = alc269va_ssids;
                 break;
         case ALC269_TYPE_ALC269VB:
         case ALC269_TYPE_ALC269VD:
+        case ALC269_TYPE_ALC282:
                 ssids = alc269_ssids;
                 break;
         default:
@@ -6400,7 +6406,8 @@ static int patch_alc269(struct hda_codec *codec)
 
         alc_auto_parse_customize_define(codec);
 
-        if (codec->vendor_id == 0x10ec0269) {
+        switch (codec->vendor_id) {
+        case 0x10ec0269:
                 spec->codec_variant = ALC269_TYPE_ALC269VA;
                 switch (alc_get_coef0(codec) & 0x00f0) {
                 case 0x0010:
@@ -6425,6 +6432,20 @@ static int patch_alc269(struct hda_codec *codec)
                         goto error;
                 spec->init_hook = alc269_fill_coef;
                 alc269_fill_coef(codec);
+                break;
+
+        case 0x10ec0280:
+        case 0x10ec0290:
+                spec->codec_variant = ALC269_TYPE_ALC280;
+                break;
+        case 0x10ec0282:
+        case 0x10ec0283:
+                spec->codec_variant = ALC269_TYPE_ALC282;
+                break;
+        case 0x10ec0284:
+        case 0x10ec0292:
+                spec->codec_variant = ALC269_TYPE_ALC284;
+                break;
         }
 
         /* automatic parse from the BIOS config */
@@ -7129,6 +7150,7 @@ static const struct hda_codec_preset snd_hda_preset_realtek[] = {
         { .id = 0x10ec0280, .name = "ALC280", .patch = patch_alc269 },
         { .id = 0x10ec0282, .name = "ALC282", .patch = patch_alc269 },
         { .id = 0x10ec0283, .name = "ALC283", .patch = patch_alc269 },
+        { .id = 0x10ec0284, .name = "ALC284", .patch = patch_alc269 },
         { .id = 0x10ec0290, .name = "ALC290", .patch = patch_alc269 },
         { .id = 0x10ec0292, .name = "ALC292", .patch = patch_alc269 },
         { .id = 0x10ec0861, .rev = 0x100340, .name = "ALC660",
diff --git a/sound/pci/rme9652/hdspm.c b/sound/pci/rme9652/hdspm.c
index 6e02e064d7b4..223c3d9cc69e 100644
--- a/sound/pci/rme9652/hdspm.c
+++ b/sound/pci/rme9652/hdspm.c
@@ -441,6 +441,7 @@ MODULE_SUPPORTED_DEVICE("{{RME HDSPM-MADI}}");
 */
 /* status */
 #define HDSPM_AES32_wcLock      0x0200000
+#define HDSPM_AES32_wcSync      0x0100000
 #define HDSPM_AES32_wcFreq_bit  22
 /* (status >> HDSPM_AES32_wcFreq_bit) & 0xF gives WC frequency (cf function
   HDSPM_bit2freq */
@@ -3467,10 +3468,12 @@ static int hdspm_wc_sync_check(struct hdspm *hdspm)
         switch (hdspm->io_type) {
         case AES32:
                 status = hdspm_read(hdspm, HDSPM_statusRegister);
-                if (status & HDSPM_wcSync)
-                        return 2;
-                else if (status & HDSPM_wcLock)
-                        return 1;
+                if (status & HDSPM_AES32_wcLock) {
+                        if (status & HDSPM_AES32_wcSync)
+                                return 2;
+                        else
+                                return 1;
+                }
                 return 0;
                 break;
 
@@ -4658,6 +4661,7 @@ snd_hdspm_proc_read_aes32(struct snd_info_entry * entry,
         unsigned int status;
         unsigned int status2;
         unsigned int timecode;
+        unsigned int wcLock, wcSync;
         int pref_syncref;
         char *autosync_ref;
         int x;
@@ -4751,8 +4755,11 @@ snd_hdspm_proc_read_aes32(struct snd_info_entry * entry,
 
         snd_iprintf(buffer, "--- Status:\n");
 
+        wcLock = status & HDSPM_AES32_wcLock;
+        wcSync = wcLock && (status & HDSPM_AES32_wcSync);
+
         snd_iprintf(buffer, "Word: %s  Frequency: %d\n",
-                    (status & HDSPM_AES32_wcLock) ? "Sync   " : "No Lock",
+                    (wcLock) ? (wcSync ? "Sync   " : "Lock   ") : "No Lock",
                     HDSPM_bit2freq((status >> HDSPM_AES32_wcFreq_bit) & 0xF));
 
         for (x = 0; x < 8; x++) {
diff --git a/sound/soc/codecs/arizona.c b/sound/soc/codecs/arizona.c
index adf397b9d0e6..1d8bb5917594 100644
--- a/sound/soc/codecs/arizona.c
+++ b/sound/soc/codecs/arizona.c
@@ -446,15 +446,9 @@ static int arizona_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
         case SND_SOC_DAIFMT_DSP_A:
                 mode = 0;
                 break;
-        case SND_SOC_DAIFMT_DSP_B:
-                mode = 1;
-                break;
         case SND_SOC_DAIFMT_I2S:
                 mode = 2;
                 break;
-        case SND_SOC_DAIFMT_LEFT_J:
-                mode = 3;
-                break;
         default:
                 arizona_aif_err(dai, "Unsupported DAI format %d\n",
                                 fmt & SND_SOC_DAIFMT_FORMAT_MASK);
@@ -714,7 +708,8 @@ static int arizona_hw_params(struct snd_pcm_substream *substream,
                 snd_soc_update_bits(codec, ARIZONA_ASYNC_SAMPLE_RATE_1,
                                     ARIZONA_ASYNC_SAMPLE_RATE_MASK, sr_val);
                 snd_soc_update_bits(codec, base + ARIZONA_AIF_RATE_CTRL,
-                                    ARIZONA_AIF1_RATE_MASK, 8);
+                                    ARIZONA_AIF1_RATE_MASK,
+                                    8 << ARIZONA_AIF1_RATE_SHIFT);
                 break;
         default:
                 arizona_aif_err(dai, "Invalid clock %d\n", dai_priv->clk);
diff --git a/sound/soc/codecs/arizona.h b/sound/soc/codecs/arizona.h
index 41dae1ed3b71..4deebeb07177 100644
--- a/sound/soc/codecs/arizona.h
+++ b/sound/soc/codecs/arizona.h
@@ -34,15 +34,15 @@
 
 #define ARIZONA_FLL_SRC_MCLK1      0
 #define ARIZONA_FLL_SRC_MCLK2      1
-#define ARIZONA_FLL_SRC_SLIMCLK    2
-#define ARIZONA_FLL_SRC_FLL1       3
-#define ARIZONA_FLL_SRC_FLL2       4
-#define ARIZONA_FLL_SRC_AIF1BCLK   5
-#define ARIZONA_FLL_SRC_AIF2BCLK   6
-#define ARIZONA_FLL_SRC_AIF3BCLK   7
-#define ARIZONA_FLL_SRC_AIF1LRCLK  8
-#define ARIZONA_FLL_SRC_AIF2LRCLK  9
-#define ARIZONA_FLL_SRC_AIF3LRCLK 10
+#define ARIZONA_FLL_SRC_SLIMCLK    3
+#define ARIZONA_FLL_SRC_FLL1       4
+#define ARIZONA_FLL_SRC_FLL2       5
+#define ARIZONA_FLL_SRC_AIF1BCLK   8
+#define ARIZONA_FLL_SRC_AIF2BCLK   9
+#define ARIZONA_FLL_SRC_AIF3BCLK  10
+#define ARIZONA_FLL_SRC_AIF1LRCLK 12
+#define ARIZONA_FLL_SRC_AIF2LRCLK 13
+#define ARIZONA_FLL_SRC_AIF3LRCLK 14
 
 #define ARIZONA_MIXER_VOL_MASK             0x00FE
 #define ARIZONA_MIXER_VOL_SHIFT                 1
diff --git a/sound/soc/codecs/cs4271.c b/sound/soc/codecs/cs4271.c
index 4f1127935fdf..ac8742a1f25a 100644
--- a/sound/soc/codecs/cs4271.c
+++ b/sound/soc/codecs/cs4271.c
@@ -474,16 +474,16 @@ static int cs4271_probe(struct snd_soc_codec *codec)
         struct cs4271_platform_data *cs4271plat = codec->dev->platform_data;
         int ret;
         int gpio_nreset = -EINVAL;
-        int amutec_eq_bmutec = 0;
+        bool amutec_eq_bmutec = false;
 
 #ifdef CONFIG_OF
         if (of_match_device(cs4271_dt_ids, codec->dev)) {
                 gpio_nreset = of_get_named_gpio(codec->dev->of_node,
                                                 "reset-gpio", 0);
 
-                if (!of_get_property(codec->dev->of_node,
+                if (of_get_property(codec->dev->of_node,
                                      "cirrus,amutec-eq-bmutec", NULL))
-                        amutec_eq_bmutec = 1;
+                        amutec_eq_bmutec = true;
         }
 #endif
 
diff --git a/sound/soc/codecs/cs42l52.c b/sound/soc/codecs/cs42l52.c
index 99bb1c69499e..9811a5478c87 100644
--- a/sound/soc/codecs/cs42l52.c
+++ b/sound/soc/codecs/cs42l52.c
@@ -737,7 +737,7 @@ static const struct cs42l52_clk_para clk_map_table[] = {
 
 static int cs42l52_get_clk(int mclk, int rate)
 {
-        int i, ret = 0;
+        int i, ret = -EINVAL;
         u_int mclk1, mclk2 = 0;
 
         for (i = 0; i < ARRAY_SIZE(clk_map_table); i++) {
@@ -749,8 +749,6 @@ static int cs42l52_get_clk(int mclk, int rate)
                         }
                 }
         }
-        if (ret > ARRAY_SIZE(clk_map_table))
-                return -EINVAL;
         return ret;
 }
 
diff --git a/sound/soc/codecs/lm49453.c b/sound/soc/codecs/lm49453.c
index d75257d40a49..e19490cfb3a8 100644
--- a/sound/soc/codecs/lm49453.c
+++ b/sound/soc/codecs/lm49453.c
@@ -111,9 +111,9 @@ static struct reg_default lm49453_reg_defs[] = {
         { 101, 0x00 },
         { 102, 0x00 },
         { 103, 0x01 },
-        { 105, 0x01 },
-        { 106, 0x00 },
-        { 107, 0x01 },
+        { 104, 0x01 },
+        { 105, 0x00 },
+        { 106, 0x01 },
         { 107, 0x00 },
         { 108, 0x00 },
         { 109, 0x00 },
@@ -163,56 +163,25 @@ static struct reg_default lm49453_reg_defs[] = {
         { 184, 0x00 },
         { 185, 0x00 },
         { 186, 0x00 },
-        { 189, 0x00 },
+        { 187, 0x00 },
         { 188, 0x00 },
-        { 194, 0x00 },
-        { 195, 0x00 },
-        { 196, 0x00 },
-        { 197, 0x00 },
-        { 200, 0x00 },
-        { 201, 0x00 },
-        { 202, 0x00 },
-        { 203, 0x00 },
-        { 204, 0x00 },
-        { 205, 0x00 },
-        { 208, 0x00 },
+        { 189, 0x00 },
+        { 208, 0x06 },
         { 209, 0x00 },
-        { 210, 0x00 },
-        { 211, 0x00 },
-        { 213, 0x00 },
-        { 214, 0x00 },
-        { 215, 0x00 },
-        { 216, 0x00 },
-        { 217, 0x00 },
-        { 218, 0x00 },
-        { 219, 0x00 },
+        { 210, 0x08 },
+        { 211, 0x54 },
+        { 212, 0x14 },
+        { 213, 0x0d },
+        { 214, 0x0d },
+        { 215, 0x14 },
+        { 216, 0x60 },
         { 221, 0x00 },
         { 222, 0x00 },
+        { 223, 0x00 },
         { 224, 0x00 },
-        { 225, 0x00 },
-        { 226, 0x00 },
-        { 227, 0x00 },
-        { 228, 0x00 },
-        { 229, 0x00 },
-        { 230, 0x13 },
-        { 231, 0x00 },
-        { 232, 0x80 },
-        { 233, 0x0C },
-        { 234, 0xDD },
-        { 235, 0x00 },
-        { 236, 0x04 },
-        { 237, 0x00 },
-        { 238, 0x00 },
-        { 239, 0x00 },
-        { 240, 0x00 },
-        { 241, 0x00 },
-        { 242, 0x00 },
-        { 243, 0x00 },
-        { 244, 0x00 },
-        { 245, 0x00 },
         { 248, 0x00 },
         { 249, 0x00 },
-        { 254, 0x00 },
+        { 250, 0x00 },
         { 255, 0x00 },
 };
 
@@ -525,36 +494,41 @@ SOC_DAPM_SINGLE("Port2_2 Switch", LM49453_P0_PORT2_TX2_REG, 7, 1, 0),
 };
 
 /* TLV Declarations */
-static const DECLARE_TLV_DB_SCALE(digital_tlv, -7650, 150, 1);
-static const DECLARE_TLV_DB_SCALE(port_tlv, 0, 600, 0);
+static const DECLARE_TLV_DB_SCALE(adc_dac_tlv, -7650, 150, 1);
+static const DECLARE_TLV_DB_SCALE(mic_tlv, 0, 200, 1);
+static const DECLARE_TLV_DB_SCALE(port_tlv, -1800, 600, 0);
+static const DECLARE_TLV_DB_SCALE(stn_tlv, -7200, 150, 0);
 
 static const struct snd_kcontrol_new lm49453_sidetone_mixer_controls[] = {
 /* Sidetone supports mono only */
 SOC_DAPM_SINGLE_TLV("Sidetone ADCL Volume", LM49453_P0_STN_VOL_ADCL_REG,
-                     0, 0x3F, 0, digital_tlv),
+                     0, 0x3F, 0, stn_tlv),
 SOC_DAPM_SINGLE_TLV("Sidetone ADCR Volume", LM49453_P0_STN_VOL_ADCR_REG,
-                     0, 0x3F, 0, digital_tlv),
+                     0, 0x3F, 0, stn_tlv),
 SOC_DAPM_SINGLE_TLV("Sidetone DMIC1L Volume", LM49453_P0_STN_VOL_DMIC1L_REG,
-                     0, 0x3F, 0, digital_tlv),
+                     0, 0x3F, 0, stn_tlv),
 SOC_DAPM_SINGLE_TLV("Sidetone DMIC1R Volume", LM49453_P0_STN_VOL_DMIC1R_REG,
-                     0, 0x3F, 0, digital_tlv),
+                     0, 0x3F, 0, stn_tlv),
 SOC_DAPM_SINGLE_TLV("Sidetone DMIC2L Volume", LM49453_P0_STN_VOL_DMIC2L_REG,
-                     0, 0x3F, 0, digital_tlv),
+                     0, 0x3F, 0, stn_tlv),
 SOC_DAPM_SINGLE_TLV("Sidetone DMIC2R Volume", LM49453_P0_STN_VOL_DMIC2R_REG,
-                     0, 0x3F, 0, digital_tlv),
+                     0, 0x3F, 0, stn_tlv),
 };
 
 static const struct snd_kcontrol_new lm49453_snd_controls[] = {
         /* mic1 and mic2 supports mono only */
-        SOC_SINGLE_TLV("Mic1 Volume", LM49453_P0_ADC_LEVELL_REG, 0, 6,
-                        0, digital_tlv),
-        SOC_SINGLE_TLV("Mic2 Volume", LM49453_P0_ADC_LEVELR_REG, 0, 6,
-                        0, digital_tlv),
+        SOC_SINGLE_TLV("Mic1 Volume", LM49453_P0_MICL_REG, 0, 15, 0, mic_tlv),
+        SOC_SINGLE_TLV("Mic2 Volume", LM49453_P0_MICR_REG, 0, 15, 0, mic_tlv),
+
+        SOC_SINGLE_TLV("ADCL Volume", LM49453_P0_ADC_LEVELL_REG, 0, 63,
+                        0, adc_dac_tlv),
+        SOC_SINGLE_TLV("ADCR Volume", LM49453_P0_ADC_LEVELR_REG, 0, 63,
+                        0, adc_dac_tlv),
 
         SOC_DOUBLE_R_TLV("DMIC1 Volume", LM49453_P0_DMIC1_LEVELL_REG,
-                          LM49453_P0_DMIC1_LEVELR_REG, 0, 6, 0, digital_tlv),
+                          LM49453_P0_DMIC1_LEVELR_REG, 0, 63, 0, adc_dac_tlv),
         SOC_DOUBLE_R_TLV("DMIC2 Volume", LM49453_P0_DMIC2_LEVELL_REG,
-                          LM49453_P0_DMIC2_LEVELR_REG, 0, 6, 0, digital_tlv),
+                          LM49453_P0_DMIC2_LEVELR_REG, 0, 63, 0, adc_dac_tlv),
 
         SOC_DAPM_ENUM("Mic2Mode", lm49453_mic2mode_enum),
         SOC_DAPM_ENUM("DMIC12 SRC", lm49453_dmic12_cfg_enum),
@@ -569,16 +543,16 @@ static const struct snd_kcontrol_new lm49453_snd_controls[] = {
                                           2, 1, 0),
 
         SOC_DOUBLE_R_TLV("DAC HP Volume", LM49453_P0_DAC_HP_LEVELL_REG,
-                          LM49453_P0_DAC_HP_LEVELR_REG, 0, 6, 0, digital_tlv),
+                          LM49453_P0_DAC_HP_LEVELR_REG, 0, 63, 0, adc_dac_tlv),
         SOC_DOUBLE_R_TLV("DAC LO Volume", LM49453_P0_DAC_LO_LEVELL_REG,
-                          LM49453_P0_DAC_LO_LEVELR_REG, 0, 6, 0, digital_tlv),
+                          LM49453_P0_DAC_LO_LEVELR_REG, 0, 63, 0, adc_dac_tlv),
         SOC_DOUBLE_R_TLV("DAC LS Volume", LM49453_P0_DAC_LS_LEVELL_REG,
-                          LM49453_P0_DAC_LS_LEVELR_REG, 0, 6, 0, digital_tlv),
+                          LM49453_P0_DAC_LS_LEVELR_REG, 0, 63, 0, adc_dac_tlv),
         SOC_DOUBLE_R_TLV("DAC HA Volume", LM49453_P0_DAC_HA_LEVELL_REG,
-                          LM49453_P0_DAC_HA_LEVELR_REG, 0, 6, 0, digital_tlv),
+                          LM49453_P0_DAC_HA_LEVELR_REG, 0, 63, 0, adc_dac_tlv),
 
         SOC_SINGLE_TLV("EP Volume", LM49453_P0_DAC_LS_LEVELL_REG,
-                        0, 6, 0, digital_tlv),
+                        0, 63, 0, adc_dac_tlv),
 
         SOC_SINGLE_TLV("PORT1_1_RX_LVL Volume", LM49453_P0_PORT1_RX_LVL1_REG,
                         0, 3, 0, port_tlv),
@@ -1218,7 +1192,7 @@ static int lm49453_set_dai_fmt(struct snd_soc_dai *codec_dai, unsigned int fmt)
         }
 
         snd_soc_update_bits(codec, LM49453_P0_AUDIO_PORT1_BASIC_REG,
-                            LM49453_AUDIO_PORT1_BASIC_FMT_MASK|BIT(1)|BIT(5),
+                            LM49453_AUDIO_PORT1_BASIC_FMT_MASK|BIT(0)|BIT(5),
                             (aif_val | mode | clk_phase));
 
         snd_soc_write(codec, LM49453_P0_AUDIO_PORT1_RX_MSB_REG, clk_shift);
diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c
index cb1675cd8e1c..92bbfec9b107 100644
--- a/sound/soc/codecs/sgtl5000.c
+++ b/sound/soc/codecs/sgtl5000.c
@@ -401,7 +401,7 @@ static const struct snd_kcontrol_new sgtl5000_snd_controls[] = {
                         5, 1, 0),
 
         SOC_SINGLE_TLV("Mic Volume", SGTL5000_CHIP_MIC_CTRL,
-                        0, 4, 0, mic_gain_tlv),
+                        0, 3, 0, mic_gain_tlv),
 };
 
 /* mute the codec used by alsa core */
@@ -1344,7 +1344,7 @@ static int sgtl5000_probe(struct snd_soc_codec *codec)
                         SGTL5000_HP_ZCD_EN |
                         SGTL5000_ADC_ZCD_EN);
 
-        snd_soc_write(codec, SGTL5000_CHIP_MIC_CTRL, 0);
+        snd_soc_write(codec, SGTL5000_CHIP_MIC_CTRL, 2);
 
         /*
          * disable DAP
diff --git a/sound/soc/codecs/sta529.c b/sound/soc/codecs/sta529.c
index ab355c4f0b2d..40c07be9b581 100644
--- a/sound/soc/codecs/sta529.c
+++ b/sound/soc/codecs/sta529.c
@@ -74,9 +74,10 @@
                                 SNDRV_PCM_FMTBIT_S32_LE)
 #define S2PC_VALUE              0x98
 #define CLOCK_OUT               0x60
-#define LEFT_J_DATA_FORMAT      0x10
-#define I2S_DATA_FORMAT         0x12
-#define RIGHT_J_DATA_FORMAT     0x14
+#define DATA_FORMAT_MSK         0x0E
+#define LEFT_J_DATA_FORMAT      0x00
+#define I2S_DATA_FORMAT         0x02
+#define RIGHT_J_DATA_FORMAT     0x04
 #define CODEC_MUTE_VAL          0x80
 
 #define POWER_CNTLMSAK          0x40
@@ -289,7 +290,7 @@ static int sta529_set_dai_fmt(struct snd_soc_dai *codec_dai, u32 fmt)
                 return -EINVAL;
         }
 
-        snd_soc_update_bits(codec, STA529_S2PCFG0, 0x0D, mode);
+        snd_soc_update_bits(codec, STA529_S2PCFG0, DATA_FORMAT_MSK, mode);
 
         return 0;
 }
diff --git a/sound/soc/codecs/wm2000.c b/sound/soc/codecs/wm2000.c
index 1cbe88f01d63..12bcae63a7f0 100644
--- a/sound/soc/codecs/wm2000.c
+++ b/sound/soc/codecs/wm2000.c
@@ -209,9 +209,9 @@ static int wm2000_power_up(struct i2c_client *i2c, int analogue)
 
         ret = wm2000_read(i2c, WM2000_REG_SPEECH_CLARITY);
         if (wm2000->speech_clarity)
-                ret &= ~WM2000_SPEECH_CLARITY;
-        else
                 ret |= WM2000_SPEECH_CLARITY;
+        else
+                ret &= ~WM2000_SPEECH_CLARITY;
         wm2000_write(i2c, WM2000_REG_SPEECH_CLARITY, ret);
 
         wm2000_write(i2c, WM2000_REG_SYS_START0, 0x33);
diff --git a/sound/soc/codecs/wm2200.c b/sound/soc/codecs/wm2200.c
index afcf31df77e0..e6cefe1ac677 100644
--- a/sound/soc/codecs/wm2200.c
+++ b/sound/soc/codecs/wm2200.c
@@ -1566,15 +1566,9 @@ static int wm2200_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
         case SND_SOC_DAIFMT_DSP_A:
                 fmt_val = 0;
                 break;
-        case SND_SOC_DAIFMT_DSP_B:
-                fmt_val = 1;
-                break;
         case SND_SOC_DAIFMT_I2S:
                 fmt_val = 2;
                 break;
-        case SND_SOC_DAIFMT_LEFT_J:
-                fmt_val = 3;
-                break;
         default:
                 dev_err(codec->dev, "Unsupported DAI format %d\n",
                         fmt & SND_SOC_DAIFMT_FORMAT_MASK);
@@ -1626,7 +1620,7 @@ static int wm2200_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
                             WM2200_AIF1TX_LRCLK_MSTR | WM2200_AIF1TX_LRCLK_INV,
                             lrclk);
         snd_soc_update_bits(codec, WM2200_AUDIO_IF_1_5,
-                            WM2200_AIF1_FMT_MASK << 1, fmt_val << 1);
+                            WM2200_AIF1_FMT_MASK, fmt_val);
 
         return 0;
 }
diff --git a/sound/soc/codecs/wm5100.c b/sound/soc/codecs/wm5100.c
index 5a5f36936235..54397a508073 100644
--- a/sound/soc/codecs/wm5100.c
+++ b/sound/soc/codecs/wm5100.c
@@ -1279,15 +1279,9 @@ static int wm5100_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
         case SND_SOC_DAIFMT_DSP_A:
                 mask = 0;
                 break;
-        case SND_SOC_DAIFMT_DSP_B:
-                mask = 1;
-                break;
         case SND_SOC_DAIFMT_I2S:
                 mask = 2;
                 break;
-        case SND_SOC_DAIFMT_LEFT_J:
-                mask = 3;
-                break;
         default:
                 dev_err(codec->dev, "Unsupported DAI format %d\n",
                         fmt & SND_SOC_DAIFMT_FORMAT_MASK);
diff --git a/sound/soc/codecs/wm5102.c b/sound/soc/codecs/wm5102.c
index 688ade080589..7a9048dad1cd 100644
--- a/sound/soc/codecs/wm5102.c
+++ b/sound/soc/codecs/wm5102.c
@@ -36,6 +36,9 @@
 struct wm5102_priv {
         struct arizona_priv core;
         struct arizona_fll fll[2];
+
+        unsigned int spk_ena:2;
+        unsigned int spk_ena_pending:1;
 };
 
 static DECLARE_TLV_DB_SCALE(ana_tlv, 0, 100, 0);
@@ -787,6 +790,47 @@ ARIZONA_MIXER_CONTROLS("AIF3TX1", ARIZONA_AIF3TX1MIX_INPUT_1_SOURCE),
 ARIZONA_MIXER_CONTROLS("AIF3TX2", ARIZONA_AIF3TX2MIX_INPUT_1_SOURCE),
 };
 
+static int wm5102_spk_ev(struct snd_soc_dapm_widget *w,
+                         struct snd_kcontrol *kcontrol,
+                         int event)
+{
+        struct snd_soc_codec *codec = w->codec;
+        struct arizona *arizona = dev_get_drvdata(codec->dev->parent);
+        struct wm5102_priv *wm5102 = snd_soc_codec_get_drvdata(codec);
+
+        if (arizona->rev < 1)
+                return 0;
+
+        switch (event) {
+        case SND_SOC_DAPM_PRE_PMU:
+                if (!wm5102->spk_ena) {
+                        snd_soc_write(codec, 0x4f5, 0x25a);
+                        wm5102->spk_ena_pending = true;
+                }
+                break;
+        case SND_SOC_DAPM_POST_PMU:
+                if (wm5102->spk_ena_pending) {
+                        msleep(75);
+                        snd_soc_write(codec, 0x4f5, 0xda);
+                        wm5102->spk_ena_pending = false;
+                        wm5102->spk_ena++;
+                }
+                break;
+        case SND_SOC_DAPM_PRE_PMD:
+                wm5102->spk_ena--;
+                if (!wm5102->spk_ena)
+                        snd_soc_write(codec, 0x4f5, 0x25a);
+                break;
+        case SND_SOC_DAPM_POST_PMD:
+                if (!wm5102->spk_ena)
+                        snd_soc_write(codec, 0x4f5, 0x0da);
+                break;
+        }
+
+        return 0;
+}
+
+
 ARIZONA_MIXER_ENUMS(EQ1, ARIZONA_EQ1MIX_INPUT_1_SOURCE);
 ARIZONA_MIXER_ENUMS(EQ2, ARIZONA_EQ2MIX_INPUT_1_SOURCE);
 ARIZONA_MIXER_ENUMS(EQ3, ARIZONA_EQ3MIX_INPUT_1_SOURCE);
@@ -1034,10 +1078,10 @@ SND_SOC_DAPM_PGA_E("OUT3L", ARIZONA_OUTPUT_ENABLES_1,
                    ARIZONA_OUT3L_ENA_SHIFT, 0, NULL, 0, arizona_out_ev,
                    SND_SOC_DAPM_PRE_PMD | SND_SOC_DAPM_POST_PMU),
 SND_SOC_DAPM_PGA_E("OUT4L", ARIZONA_OUTPUT_ENABLES_1,
-                   ARIZONA_OUT4L_ENA_SHIFT, 0, NULL, 0, arizona_out_ev,
+                   ARIZONA_OUT4L_ENA_SHIFT, 0, NULL, 0, wm5102_spk_ev,
                    SND_SOC_DAPM_PRE_PMD | SND_SOC_DAPM_POST_PMU),
 SND_SOC_DAPM_PGA_E("OUT4R", ARIZONA_OUTPUT_ENABLES_1,
-                   ARIZONA_OUT4R_ENA_SHIFT, 0, NULL, 0, arizona_out_ev,
+                   ARIZONA_OUT4R_ENA_SHIFT, 0, NULL, 0, wm5102_spk_ev,
                    SND_SOC_DAPM_PRE_PMD | SND_SOC_DAPM_POST_PMU),
 SND_SOC_DAPM_PGA_E("OUT5L", ARIZONA_OUTPUT_ENABLES_1,
                    ARIZONA_OUT5L_ENA_SHIFT, 0, NULL, 0, arizona_out_ev,
diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c
index ffc89fab96fb..7b198c38f3ef 100644
--- a/sound/soc/codecs/wm_adsp.c
+++ b/sound/soc/codecs/wm_adsp.c
@@ -169,6 +169,7 @@ static int wm_adsp_load(struct wm_adsp *dsp)
         const struct wm_adsp_region *mem;
         const char *region_name;
         char *file, *text;
+        void *buf;
         unsigned int reg;
         int regions = 0;
         int ret, offset, type, sizes;
@@ -322,8 +323,18 @@ static int wm_adsp_load(struct wm_adsp *dsp)
                 }
 
                 if (reg) {
-                        ret = regmap_raw_write(regmap, reg, region->data,
+                        buf = kmemdup(region->data, le32_to_cpu(region->len),
+                                      GFP_KERNEL);
+                        if (!buf) {
+                                adsp_err(dsp, "Out of memory\n");
+                                return -ENOMEM;
+                        }
+
+                        ret = regmap_raw_write(regmap, reg, buf,
                                                le32_to_cpu(region->len));
+
+                        kfree(buf);
+
                         if (ret != 0) {
                                 adsp_err(dsp,
                                         "%s.%d: Failed to write %d bytes at %d in %s: %d\n",
@@ -359,6 +370,7 @@ static int wm_adsp_load_coeff(struct wm_adsp *dsp)
         const char *region_name;
         int ret, pos, blocks, type, offset, reg;
         char *file;
+        void *buf;
 
         file = kzalloc(PAGE_SIZE, GFP_KERNEL);
         if (file == NULL)
@@ -426,6 +438,13 @@ static int wm_adsp_load_coeff(struct wm_adsp *dsp)
                 }
 
                 if (reg) {
+                        buf = kmemdup(blk->data, le32_to_cpu(blk->len),
+                                      GFP_KERNEL);
+                        if (!buf) {
+                                adsp_err(dsp, "Out of memory\n");
+                                return -ENOMEM;
+                        }
+
                         ret = regmap_raw_write(regmap, reg, blk->data,
                                                le32_to_cpu(blk->len));
                         if (ret != 0) {
@@ -433,6 +452,8 @@ static int wm_adsp_load_coeff(struct wm_adsp *dsp)
                                         "%s.%d: Failed to write to %x in %s\n",
                                         file, blocks, reg, region_name);
                         }
+
+                        kfree(buf);
                 }
 
                 pos += le32_to_cpu(blk->len) + sizeof(*blk);
diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c
index 91d592ff67b7..2370063b5824 100644
--- a/sound/soc/soc-core.c
+++ b/sound/soc/soc-core.c
@@ -1255,6 +1255,8 @@ static int soc_post_component_init(struct snd_soc_card *card,
         INIT_LIST_HEAD(&rtd->dpcm[SNDRV_PCM_STREAM_CAPTURE].fe_clients);
         ret = device_add(rtd->dev);
         if (ret < 0) {
+                /* calling put_device() here to free the rtd->dev */
+                put_device(rtd->dev);
                 dev_err(card->dev,
                         "ASoC: failed to register runtime device: %d\n", ret);
                 return ret;
@@ -1554,7 +1556,7 @@ static void soc_remove_aux_dev(struct snd_soc_card *card, int num)
         /* unregister the rtd device */
         if (rtd->dev_registered) {
                 device_remove_file(rtd->dev, &dev_attr_codec_reg);
-                device_del(rtd->dev);
+                device_unregister(rtd->dev);
                 rtd->dev_registered = 0;
         }
 
@@ -2917,7 +2919,7 @@ int snd_soc_info_volsw_range(struct snd_kcontrol *kcontrol,
         platform_max = mc->platform_max;
 
         uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER;
-        uinfo->count = 1;
+        uinfo->count = snd_soc_volsw_is_stereo(mc) ? 2 : 1;
         uinfo->value.integer.min = 0;
         uinfo->value.integer.max = platform_max - min;
 
@@ -2941,12 +2943,14 @@ int snd_soc_put_volsw_range(struct snd_kcontrol *kcontrol,
                 (struct soc_mixer_control *)kcontrol->private_value;
         struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
         unsigned int reg = mc->reg;
+        unsigned int rreg = mc->rreg;
         unsigned int shift = mc->shift;
         int min = mc->min;
         int max = mc->max;
         unsigned int mask = (1 << fls(max)) - 1;
         unsigned int invert = mc->invert;
         unsigned int val, val_mask;
+        int ret;
 
         val = ((ucontrol->value.integer.value[0] + min) & mask);
         if (invert)
@@ -2954,7 +2958,21 @@ int snd_soc_put_volsw_range(struct snd_kcontrol *kcontrol,
         val_mask = mask << shift;
         val = val << shift;
 
-        return snd_soc_update_bits_locked(codec, reg, val_mask, val);
+        ret = snd_soc_update_bits_locked(codec, reg, val_mask, val);
+        if (ret != 0)
+                return ret;
+
+        if (snd_soc_volsw_is_stereo(mc)) {
+                val = ((ucontrol->value.integer.value[1] + min) & mask);
+                if (invert)
+                        val = max - val;
+                val_mask = mask << shift;
+                val = val << shift;
+
+                ret = snd_soc_update_bits_locked(codec, rreg, val_mask, val);
+        }
+
+        return ret;
 }
 EXPORT_SYMBOL_GPL(snd_soc_put_volsw_range);
 
@@ -2974,6 +2992,7 @@ int snd_soc_get_volsw_range(struct snd_kcontrol *kcontrol,
                 (struct soc_mixer_control *)kcontrol->private_value;
         struct snd_soc_codec *codec = snd_kcontrol_chip(kcontrol);
         unsigned int reg = mc->reg;
+        unsigned int rreg = mc->rreg;
         unsigned int shift = mc->shift;
         int min = mc->min;
         int max = mc->max;
@@ -2988,6 +3007,16 @@ int snd_soc_get_volsw_range(struct snd_kcontrol *kcontrol,
         ucontrol->value.integer.value[0] =
                 ucontrol->value.integer.value[0] - min;
 
+        if (snd_soc_volsw_is_stereo(mc)) {
+                ucontrol->value.integer.value[1] =
+                        (snd_soc_read(codec, rreg) >> shift) & mask;
+                if (invert)
+                        ucontrol->value.integer.value[1] =
+                                max - ucontrol->value.integer.value[1];
+                ucontrol->value.integer.value[1] =
+                        ucontrol->value.integer.value[1] - min;
+        }
+
         return 0;
 }
 EXPORT_SYMBOL_GPL(snd_soc_get_volsw_range);
diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c
index d7711fce119b..cf191e6aebbe 100644
--- a/sound/soc/soc-pcm.c
+++ b/sound/soc/soc-pcm.c
@@ -1243,6 +1243,7 @@ static int dpcm_be_dai_hw_free(struct snd_soc_pcm_runtime *fe, int stream)
                 if ((be->dpcm[stream].state != SND_SOC_DPCM_STATE_HW_PARAMS) &&
                     (be->dpcm[stream].state != SND_SOC_DPCM_STATE_PREPARE) &&
                     (be->dpcm[stream].state != SND_SOC_DPCM_STATE_HW_FREE) &&
+                    (be->dpcm[stream].state != SND_SOC_DPCM_STATE_PAUSED) &&
                     (be->dpcm[stream].state != SND_SOC_DPCM_STATE_STOP))
                         continue;
 
diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
index e71fe55cebef..0e2ed3d05c45 100644
--- a/sound/usb/mixer_maps.c
+++ b/sound/usb/mixer_maps.c
@@ -179,6 +179,15 @@ static struct usbmix_name_map audigy2nx_map[] = {
         { 0 } /* terminator */
 };
 
+static struct usbmix_selector_map c400_selectors[] = {
+        {
+                .id = 0x80,
+                .count = 2,
+                .names = (const char*[]) {"Internal", "SPDIF"}
+        },
+        { 0 } /* terminator */
+};
+
 static struct usbmix_selector_map audigy2nx_selectors[] = {
         {
                 .id = 14, /* Capture Source */
@@ -367,6 +376,10 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
                 .map = hercules_usb51_map,
         },
         {
+                .id = USB_ID(0x0763, 0x2030),
+                .selector_map = c400_selectors,
+        },
+        {
                 .id = USB_ID(0x08bb, 0x2702),
                 .map = linex_map,
                 .ignore_ctl_error = 1,
diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index 0422b1360af3..15520de1df56 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -1206,7 +1206,7 @@ static int snd_c400_create_mixer(struct usb_mixer_interface *mixer)
  * are valid they presents mono controls as L and R channels of
  * stereo. So we provide a good mixer here.
  */
-struct std_mono_table ebox44_table[] = {
+static struct std_mono_table ebox44_table[] = {
         {
                 .unitid = 4,
                 .control = 1,
diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c
index c6593101c049..d82e378d37cb 100644
--- a/sound/usb/pcm.c
+++ b/sound/usb/pcm.c
@@ -511,6 +511,16 @@ static int configure_sync_endpoint(struct snd_usb_substream *subs)
         struct snd_usb_substream *sync_subs =
                 &subs->stream->substream[subs->direction ^ 1];
 
+        if (subs->sync_endpoint->type != SND_USB_ENDPOINT_TYPE_DATA ||
+            !subs->stream)
+                return snd_usb_endpoint_set_params(subs->sync_endpoint,
+                                                   subs->pcm_format,
+                                                   subs->channels,
+                                                   subs->period_bytes,
+                                                   subs->cur_rate,
+                                                   subs->cur_audiofmt,
+                                                   NULL);
+
         /* Try to find the best matching audioformat. */
         list_for_each_entry(fp, &sync_subs->fmt_list, list) {
                 int score = match_endpoint_audioformats(fp, subs->cur_audiofmt,
diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h
index 78e845ec65da..64d25a7a4d59 100644
--- a/sound/usb/quirks-table.h
+++ b/sound/usb/quirks-table.h
@@ -2289,7 +2289,7 @@ YAMAHA_DEVICE(0x7010, "UB99"),
                                         .rate_table = (unsigned int[]) {
                                                         44100, 48000, 88200, 96000
                                         },
-                                        .clock = 0x81,
+                                        .clock = 0x80,
                                 }
                         },
                         /* Capture */
@@ -2315,7 +2315,7 @@ YAMAHA_DEVICE(0x7010, "UB99"),
                                         .rate_table = (unsigned int[]) {
                                                 44100, 48000, 88200, 96000
                                         },
-                                        .clock = 0x81,
+                                        .clock = 0x80,
                                 }
                         },
                         /* MIDI */
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index acc12f004c23..2c971858d6b7 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -387,11 +387,13 @@ static int snd_usb_fasttrackpro_boot_quirk(struct usb_device *dev)
                  * rules
                  */
                 err = usb_driver_set_configuration(dev, 2);
-                if (err < 0) {
+                if (err < 0)
                         snd_printdd("error usb_driver_set_configuration: %d\n",
                                     err);
-                        return -ENODEV;
-                }
+                /* Always return an error, so that we stop creating a device
+                   that will just be destroyed and recreated with a new
+                   configuration */
+                return -ENODEV;
         } else
                 snd_printk(KERN_INFO "usb-audio: Fast Track Pro config OK\n");
 
@@ -859,6 +861,17 @@ void snd_usb_endpoint_start_quirk(struct snd_usb_endpoint *ep)
         if ((le16_to_cpu(ep->chip->dev->descriptor.idVendor) == 0x23ba) &&
             ep->type == SND_USB_ENDPOINT_TYPE_SYNC)
                 ep->skip_packets = 4;
+
+        /*
+         * M-Audio Fast Track C400 - when packets are not skipped, real world
+         * latency varies by approx. +/- 50 frames (at 96KHz) each time the
+         * stream is (re)started. When skipping packets 16 at endpoint start
+         * up, the real world latency is stable within +/- 1 frame (also
+         * across power cycles).
+         */
+        if (ep->chip->usb_id == USB_ID(0x0763, 0x2030) &&
+            ep->type == SND_USB_ENDPOINT_TYPE_DATA)
+                ep->skip_packets = 16;
 }
 
 void snd_usb_ctl_msg_quirk(struct usb_device *dev, unsigned int pipe,