577 files changed, 14538 insertions, 4605 deletions

diff --git a/drivers/acpi/apei/apei-base.c b/drivers/acpi/apei/apei-base.c
index 00a783661d0b..46f80e2c92f7 100644
--- a/drivers/acpi/apei/apei-base.c
+++ b/drivers/acpi/apei/apei-base.c
@@ -590,6 +590,9 @@ static int apei_check_gar(struct acpi_generic_address *reg, u64 *paddr,
         if (bit_width == 32 && bit_offset == 0 && (*paddr & 0x03) == 0 &&
             *access_bit_width < 32)
                 *access_bit_width = 32;
+        else if (bit_width == 64 && bit_offset == 0 && (*paddr & 0x07) == 0 &&
+            *access_bit_width < 64)
+                *access_bit_width = 64;
 
         if ((bit_width + bit_offset) > *access_bit_width) {
                 pr_warning(FW_BUG APEI_PFX
diff --git a/drivers/acpi/apei/cper.c b/drivers/acpi/apei/cper.c
index e6defd86b424..1e5d8a40101e 100644
--- a/drivers/acpi/apei/cper.c
+++ b/drivers/acpi/apei/cper.c
@@ -29,6 +29,7 @@
 #include <linux/time.h>
 #include <linux/cper.h>
 #include <linux/acpi.h>
+#include <linux/pci.h>
 #include <linux/aer.h>
 
 /*
@@ -249,6 +250,10 @@ static const char *cper_pcie_port_type_strs[] = {
 static void cper_print_pcie(const char *pfx, const struct cper_sec_pcie *pcie,
                             const struct acpi_hest_generic_data *gdata)
 {
+#ifdef CONFIG_ACPI_APEI_PCIEAER
+        struct pci_dev *dev;
+#endif
+
         if (pcie->validation_bits & CPER_PCIE_VALID_PORT_TYPE)
                 printk("%s""port_type: %d, %s\n", pfx, pcie->port_type,
                        pcie->port_type < ARRAY_SIZE(cper_pcie_port_type_strs) ?
@@ -281,10 +286,18 @@ static void cper_print_pcie(const char *pfx, const struct cper_sec_pcie *pcie,
         "%s""bridge: secondary_status: 0x%04x, control: 0x%04x\n",
         pfx, pcie->bridge.secondary_status, pcie->bridge.control);
 #ifdef CONFIG_ACPI_APEI_PCIEAER
-        if (pcie->validation_bits & CPER_PCIE_VALID_AER_INFO) {
-                struct aer_capability_regs *aer_regs = (void *)pcie->aer_info;
-                cper_print_aer(pfx, gdata->error_severity, aer_regs);
+        dev = pci_get_domain_bus_and_slot(pcie->device_id.segment,
+                        pcie->device_id.bus, pcie->device_id.function);
+        if (!dev) {
+                pr_err("PCI AER Cannot get PCI device %04x:%02x:%02x.%d\n",
+                        pcie->device_id.segment, pcie->device_id.bus,
+                        pcie->device_id.slot, pcie->device_id.function);
+                return;
         }
+        if (pcie->validation_bits & CPER_PCIE_VALID_AER_INFO)
+                cper_print_aer(pfx, dev, gdata->error_severity,
+                                (struct aer_capability_regs *) pcie->aer_info);
+        pci_dev_put(dev);
 #endif
 }
 
diff --git a/drivers/acpi/glue.c b/drivers/acpi/glue.c
index 95af6f674a6c..35da18113216 100644
--- a/drivers/acpi/glue.c
+++ b/drivers/acpi/glue.c
@@ -297,7 +297,7 @@ static int acpi_platform_notify(struct device *dev)
         if (!ret) {
                 struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
 
-                acpi_get_name(dev->acpi_handle, ACPI_FULL_PATHNAME, &buffer);
+                acpi_get_name(ACPI_HANDLE(dev), ACPI_FULL_PATHNAME, &buffer);
                 DBG("Device %s -> %s\n", dev_name(dev), (char *)buffer.pointer);
                 kfree(buffer.pointer);
         } else
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index 3ff267861541..bd22f8667eed 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -250,7 +250,7 @@ acpi_physical_address __init acpi_os_get_root_pointer(void)
                 return acpi_rsdp;
 #endif
 
-        if (efi_enabled) {
+        if (efi_enabled(EFI_CONFIG_TABLES)) {
                 if (efi.acpi20 != EFI_INVALID_TABLE_ADDR)
                         return efi.acpi20;
                 else if (efi.acpi != EFI_INVALID_TABLE_ADDR)
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index f1a5da44591d..ed9a1cc690be 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -958,6 +958,9 @@ static int acpi_processor_setup_cpuidle_cx(struct acpi_processor *pr)
                 return -EINVAL;
         }
 
+        if (!dev)
+                return -EINVAL;
+
         dev->cpu = pr->id;
 
         if (max_cstate == 0)
@@ -1149,6 +1152,7 @@ int acpi_processor_cst_has_changed(struct acpi_processor *pr)
                 }
 
                 /* Populate Updated C-state information */
+                acpi_processor_get_power_info(pr);
                 acpi_processor_setup_cpuidle_states(pr);
 
                 /* Enable all cpuidle devices */
diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
index 836bfe069042..53e7ac9403a7 100644
--- a/drivers/acpi/processor_perflib.c
+++ b/drivers/acpi/processor_perflib.c
@@ -340,6 +340,13 @@ static void amd_fixup_frequency(struct acpi_processor_px *px, int i)
         if ((boot_cpu_data.x86 == 0x10 && boot_cpu_data.x86_model < 10)
             || boot_cpu_data.x86 == 0x11) {
                 rdmsr(MSR_AMD_PSTATE_DEF_BASE + index, lo, hi);
+                /*
+                 * MSR C001_0064+:
+                 * Bit 63: PstateEn. Read-write. If set, the P-state is valid.
+                 */
+                if (!(hi & BIT(31)))
+                        return;
+
                 fid = lo & 0x3f;
                 did = (lo >> 6) & 7;
                 if (boot_cpu_data.x86 == 0x10)
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 7862d17976b7..495aeed26779 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -53,6 +53,7 @@
 
 enum {
         AHCI_PCI_BAR_STA2X11    = 0,
+        AHCI_PCI_BAR_ENMOTUS    = 2,
         AHCI_PCI_BAR_STANDARD   = 5,
 };
 
@@ -410,6 +411,9 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(ASMEDIA, 0x0611), board_ahci },   /* ASM1061 */
         { PCI_VDEVICE(ASMEDIA, 0x0612), board_ahci },   /* ASM1062 */
 
+        /* Enmotus */
+        { PCI_DEVICE(0x1c44, 0x8000), board_ahci },
+
         /* Generic, PCI class code for AHCI */
         { PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
           PCI_CLASS_STORAGE_SATA_AHCI, 0xffffff, board_ahci },
@@ -1057,6 +1061,86 @@ static inline void ahci_gtf_filter_workaround(struct ata_host *host)
 {}
 #endif
 
+int ahci_init_interrupts(struct pci_dev *pdev, struct ahci_host_priv *hpriv)
+{
+        int rc;
+        unsigned int maxvec;
+
+        if (!(hpriv->flags & AHCI_HFLAG_NO_MSI)) {
+                rc = pci_enable_msi_block_auto(pdev, &maxvec);
+                if (rc > 0) {
+                        if ((rc == maxvec) || (rc == 1))
+                                return rc;
+                        /*
+                         * Assume that advantage of multipe MSIs is negated,
+                         * so fallback to single MSI mode to save resources
+                         */
+                        pci_disable_msi(pdev);
+                        if (!pci_enable_msi(pdev))
+                                return 1;
+                }
+        }
+
+        pci_intx(pdev, 1);
+        return 0;
+}
+
+/**
+ *      ahci_host_activate - start AHCI host, request IRQs and register it
+ *      @host: target ATA host
+ *      @irq: base IRQ number to request
+ *      @n_msis: number of MSIs allocated for this host
+ *      @irq_handler: irq_handler used when requesting IRQs
+ *      @irq_flags: irq_flags used when requesting IRQs
+ *
+ *      Similar to ata_host_activate, but requests IRQs according to AHCI-1.1
+ *      when multiple MSIs were allocated. That is one MSI per port, starting
+ *      from @irq.
+ *
+ *      LOCKING:
+ *      Inherited from calling layer (may sleep).
+ *
+ *      RETURNS:
+ *      0 on success, -errno otherwise.
+ */
+int ahci_host_activate(struct ata_host *host, int irq, unsigned int n_msis)
+{
+        int i, rc;
+
+        /* Sharing Last Message among several ports is not supported */
+        if (n_msis < host->n_ports)
+                return -EINVAL;
+
+        rc = ata_host_start(host);
+        if (rc)
+                return rc;
+
+        for (i = 0; i < host->n_ports; i++) {
+                rc = devm_request_threaded_irq(host->dev,
+                        irq + i, ahci_hw_interrupt, ahci_thread_fn, IRQF_SHARED,
+                        dev_driver_string(host->dev), host->ports[i]);
+                if (rc)
+                        goto out_free_irqs;
+        }
+
+        for (i = 0; i < host->n_ports; i++)
+                ata_port_desc(host->ports[i], "irq %d", irq + i);
+
+        rc = ata_host_register(host, &ahci_sht);
+        if (rc)
+                goto out_free_all_irqs;
+
+        return 0;
+
+out_free_all_irqs:
+        i = host->n_ports;
+out_free_irqs:
+        for (i--; i >= 0; i--)
+                devm_free_irq(host->dev, irq + i, host->ports[i]);
+
+        return rc;
+}
+
 static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
         unsigned int board_id = ent->driver_data;
@@ -1065,7 +1149,7 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         struct device *dev = &pdev->dev;
         struct ahci_host_priv *hpriv;
         struct ata_host *host;
-        int n_ports, i, rc;
+        int n_ports, n_msis, i, rc;
         int ahci_pci_bar = AHCI_PCI_BAR_STANDARD;
 
         VPRINTK("ENTER\n");
@@ -1098,9 +1182,11 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
                 dev_info(&pdev->dev,
                          "PDC42819 can only drive SATA devices with this driver\n");
 
-        /* The Connext uses non-standard BAR */
+        /* Both Connext and Enmotus devices use non-standard BARs */
         if (pdev->vendor == PCI_VENDOR_ID_STMICRO && pdev->device == 0xCC06)
                 ahci_pci_bar = AHCI_PCI_BAR_STA2X11;
+        else if (pdev->vendor == 0x1c44 && pdev->device == 0x8000)
+                ahci_pci_bar = AHCI_PCI_BAR_ENMOTUS;
 
         /* acquire resources */
         rc = pcim_enable_device(pdev);
@@ -1150,11 +1236,12 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         if (ahci_sb600_enable_64bit(pdev))
                 hpriv->flags &= ~AHCI_HFLAG_32BIT_ONLY;
 
-        if ((hpriv->flags & AHCI_HFLAG_NO_MSI) || pci_enable_msi(pdev))
-                pci_intx(pdev, 1);
-
         hpriv->mmio = pcim_iomap_table(pdev)[ahci_pci_bar];
 
+        n_msis = ahci_init_interrupts(pdev, hpriv);
+        if (n_msis > 1)
+                hpriv->flags |= AHCI_HFLAG_MULTI_MSI;
+
         /* save initial config */
         ahci_pci_save_initial_config(pdev, hpriv);
 
@@ -1250,6 +1337,10 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         ahci_pci_print_info(host);
 
         pci_set_master(pdev);
+
+        if (hpriv->flags & AHCI_HFLAG_MULTI_MSI)
+                return ahci_host_activate(host, pdev->irq, n_msis);
+
         return ata_host_activate(host, pdev->irq, ahci_interrupt, IRQF_SHARED,
                                  &ahci_sht);
 }
diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h
index 9be471200a07..b830e6c9fe49 100644
--- a/drivers/ata/ahci.h
+++ b/drivers/ata/ahci.h
@@ -231,6 +231,7 @@ enum {
         AHCI_HFLAG_DELAY_ENGINE         = (1 << 15), /* do not start engine on
                                                         port start (wait until
                                                         error-handling stage) */
+        AHCI_HFLAG_MULTI_MSI            = (1 << 16), /* multiple PCI MSIs */
 
         /* ap->flags bits */
 
@@ -297,6 +298,8 @@ struct ahci_port_priv {
         unsigned int            ncq_saw_d2h:1;
         unsigned int            ncq_saw_dmas:1;
         unsigned int            ncq_saw_sdb:1;
+        u32                     intr_status;    /* interrupts to handle */
+        spinlock_t              lock;           /* protects parent ata_port */
         u32                     intr_mask;      /* interrupts to enable */
         bool                    fbs_supported;  /* set iff FBS is supported */
         bool                    fbs_enabled;    /* set iff FBS is enabled */
@@ -359,7 +362,10 @@ void ahci_set_em_messages(struct ahci_host_priv *hpriv,
                           struct ata_port_info *pi);
 int ahci_reset_em(struct ata_host *host);
 irqreturn_t ahci_interrupt(int irq, void *dev_instance);
+irqreturn_t ahci_hw_interrupt(int irq, void *dev_instance);
+irqreturn_t ahci_thread_fn(int irq, void *dev_instance);
 void ahci_print_info(struct ata_host *host, const char *scc_s);
+int ahci_host_activate(struct ata_host *host, int irq, unsigned int n_msis);
 
 static inline void __iomem *__ahci_port_base(struct ata_host *host,
                                              unsigned int port_no)
diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
index 320712a7b9ea..34c82167b962 100644
--- a/drivers/ata/libahci.c
+++ b/drivers/ata/libahci.c
@@ -1655,19 +1655,16 @@ static void ahci_error_intr(struct ata_port *ap, u32 irq_stat)
                 ata_port_abort(ap);
 }
 
-static void ahci_port_intr(struct ata_port *ap)
+static void ahci_handle_port_interrupt(struct ata_port *ap,
+                                       void __iomem *port_mmio, u32 status)
 {
-        void __iomem *port_mmio = ahci_port_base(ap);
         struct ata_eh_info *ehi = &ap->link.eh_info;
         struct ahci_port_priv *pp = ap->private_data;
         struct ahci_host_priv *hpriv = ap->host->private_data;
         int resetting = !!(ap->pflags & ATA_PFLAG_RESETTING);
-        u32 status, qc_active = 0;
+        u32 qc_active = 0;
         int rc;
 
-        status = readl(port_mmio + PORT_IRQ_STAT);
-        writel(status, port_mmio + PORT_IRQ_STAT);
-
         /* ignore BAD_PMP while resetting */
         if (unlikely(resetting))
                 status &= ~PORT_IRQ_BAD_PMP;
@@ -1743,6 +1740,107 @@ static void ahci_port_intr(struct ata_port *ap)
         }
 }
 
+void ahci_port_intr(struct ata_port *ap)
+{
+        void __iomem *port_mmio = ahci_port_base(ap);
+        u32 status;
+
+        status = readl(port_mmio + PORT_IRQ_STAT);
+        writel(status, port_mmio + PORT_IRQ_STAT);
+
+        ahci_handle_port_interrupt(ap, port_mmio, status);
+}
+
+irqreturn_t ahci_thread_fn(int irq, void *dev_instance)
+{
+        struct ata_port *ap = dev_instance;
+        struct ahci_port_priv *pp = ap->private_data;
+        void __iomem *port_mmio = ahci_port_base(ap);
+        unsigned long flags;
+        u32 status;
+
+        spin_lock_irqsave(&ap->host->lock, flags);
+        status = pp->intr_status;
+        if (status)
+                pp->intr_status = 0;
+        spin_unlock_irqrestore(&ap->host->lock, flags);
+
+        spin_lock_bh(ap->lock);
+        ahci_handle_port_interrupt(ap, port_mmio, status);
+        spin_unlock_bh(ap->lock);
+
+        return IRQ_HANDLED;
+}
+EXPORT_SYMBOL_GPL(ahci_thread_fn);
+
+void ahci_hw_port_interrupt(struct ata_port *ap)
+{
+        void __iomem *port_mmio = ahci_port_base(ap);
+        struct ahci_port_priv *pp = ap->private_data;
+        u32 status;
+
+        status = readl(port_mmio + PORT_IRQ_STAT);
+        writel(status, port_mmio + PORT_IRQ_STAT);
+
+        pp->intr_status |= status;
+}
+
+irqreturn_t ahci_hw_interrupt(int irq, void *dev_instance)
+{
+        struct ata_port *ap_this = dev_instance;
+        struct ahci_port_priv *pp = ap_this->private_data;
+        struct ata_host *host = ap_this->host;
+        struct ahci_host_priv *hpriv = host->private_data;
+        void __iomem *mmio = hpriv->mmio;
+        unsigned int i;
+        u32 irq_stat, irq_masked;
+
+        VPRINTK("ENTER\n");
+
+        spin_lock(&host->lock);
+
+        irq_stat = readl(mmio + HOST_IRQ_STAT);
+
+        if (!irq_stat) {
+                u32 status = pp->intr_status;
+
+                spin_unlock(&host->lock);
+
+                VPRINTK("EXIT\n");
+
+                return status ? IRQ_WAKE_THREAD : IRQ_NONE;
+        }
+
+        irq_masked = irq_stat & hpriv->port_map;
+
+        for (i = 0; i < host->n_ports; i++) {
+                struct ata_port *ap;
+
+                if (!(irq_masked & (1 << i)))
+                        continue;
+
+                ap = host->ports[i];
+                if (ap) {
+                        ahci_hw_port_interrupt(ap);
+                        VPRINTK("port %u\n", i);
+                } else {
+                        VPRINTK("port %u (no irq)\n", i);
+                        if (ata_ratelimit())
+                                dev_warn(host->dev,
+                                         "interrupt on disabled port %u\n", i);
+                }
+        }
+
+        writel(irq_stat, mmio + HOST_IRQ_STAT);
+
+        spin_unlock(&host->lock);
+
+        VPRINTK("EXIT\n");
+
+        return IRQ_WAKE_THREAD;
+}
+EXPORT_SYMBOL_GPL(ahci_hw_interrupt);
+
 irqreturn_t ahci_interrupt(int irq, void *dev_instance)
 {
         struct ata_host *host = dev_instance;
@@ -1951,13 +2049,13 @@ static void ahci_set_aggressive_devslp(struct ata_port *ap, bool sleep)
         /* Use the nominal value 10 ms if the read MDAT is zero,
          * the nominal value of DETO is 20 ms.
          */
-        if (dev->sata_settings[ATA_LOG_DEVSLP_VALID] &
+        if (dev->devslp_timing[ATA_LOG_DEVSLP_VALID] &
             ATA_LOG_DEVSLP_VALID_MASK) {
-                mdat = dev->sata_settings[ATA_LOG_DEVSLP_MDAT] &
+                mdat = dev->devslp_timing[ATA_LOG_DEVSLP_MDAT] &
                        ATA_LOG_DEVSLP_MDAT_MASK;
                 if (!mdat)
                         mdat = 10;
-                deto = dev->sata_settings[ATA_LOG_DEVSLP_DETO];
+                deto = dev->devslp_timing[ATA_LOG_DEVSLP_DETO];
                 if (!deto)
                         deto = 20;
         } else {
@@ -2196,6 +2294,14 @@ static int ahci_port_start(struct ata_port *ap)
          */
         pp->intr_mask = DEF_PORT_IRQ;
 
+        /*
+         * Switch to per-port locking in case each port has its own MSI vector.
+         */
+        if ((hpriv->flags & AHCI_HFLAG_MULTI_MSI)) {
+                spin_lock_init(&pp->lock);
+                ap->lock = &pp->lock;
+        }
+
         ap->private_data = pp;
 
         /* engage engines, captain */
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 9e8b99af400d..46cd3f4c6aaa 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -2325,24 +2325,28 @@ int ata_dev_configure(struct ata_device *dev)
                         }
                 }
 
-                /* check and mark DevSlp capability */
-                if (ata_id_has_devslp(dev->id))
-                        dev->flags |= ATA_DFLAG_DEVSLP;
-
-                /* Obtain SATA Settings page from Identify Device Data Log,
-                 * which contains DevSlp timing variables etc.
-                 * Exclude old devices with ata_id_has_ncq()
+                /* Check and mark DevSlp capability. Get DevSlp timing variables
+                 * from SATA Settings page of Identify Device Data Log.
                  */
-                if (ata_id_has_ncq(dev->id)) {
+                if (ata_id_has_devslp(dev->id)) {
+                        u8 sata_setting[ATA_SECT_SIZE];
+                        int i, j;
+
+                        dev->flags |= ATA_DFLAG_DEVSLP;
                         err_mask = ata_read_log_page(dev,
                                                      ATA_LOG_SATA_ID_DEV_DATA,
                                                      ATA_LOG_SATA_SETTINGS,
-                                                     dev->sata_settings,
+                                                     sata_setting,
                                                      1);
                         if (err_mask)
                                 ata_dev_dbg(dev,
                                             "failed to get Identify Device Data, Emask 0x%x\n",
                                             err_mask);
+                        else
+                                for (i = 0; i < ATA_LOG_DEVSLP_SIZE; i++) {
+                                        j = ATA_LOG_DEVSLP_OFFSET + i;
+                                        dev->devslp_timing[i] = sata_setting[j];
+                                }
                 }
 
                 dev->cdb_len = 16;
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index bf039b0e97b7..bcf4437214f5 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -2094,7 +2094,7 @@ static unsigned int ata_eh_speed_down(struct ata_device *dev,
  */
 static inline int ata_eh_worth_retry(struct ata_queued_cmd *qc)
 {
-        if (qc->flags & AC_ERR_MEDIA)
+        if (qc->err_mask & AC_ERR_MEDIA)
                 return 0;       /* don't retry media errors */
         if (qc->flags & ATA_QCFLAG_IO)
                 return 1;       /* otherwise retry anything from fs stack */
diff --git a/drivers/atm/iphase.h b/drivers/atm/iphase.h
index 6a0955e6d4fc..53ecac5a2161 100644
--- a/drivers/atm/iphase.h
+++ b/drivers/atm/iphase.h
@@ -636,82 +636,82 @@ struct rx_buf_desc {
 #define SEG_BASE IPHASE5575_FRAG_CONTROL_REG_BASE  
 #define REASS_BASE IPHASE5575_REASS_CONTROL_REG_BASE  
 
-typedef volatile u_int  freg_t;
+typedef volatile u_int  ffreg_t;
 typedef u_int   rreg_t;
 
 typedef struct _ffredn_t {
-        freg_t  idlehead_high;  /* Idle cell header (high)              */
-        freg_t  idlehead_low;   /* Idle cell header (low)               */
-        freg_t  maxrate;        /* Maximum rate                         */
-        freg_t  stparms;        /* Traffic Management Parameters        */
-        freg_t  abrubr_abr;     /* ABRUBR Priority Byte 1, TCR Byte 0   */
-        freg_t  rm_type;        /*                                      */
-        u_int   filler5[0x17 - 0x06];
-        freg_t  cmd_reg;        /* Command register                     */
-        u_int   filler18[0x20 - 0x18];
-        freg_t  cbr_base;       /* CBR Pointer Base                     */
-        freg_t  vbr_base;       /* VBR Pointer Base                     */
-        freg_t  abr_base;       /* ABR Pointer Base                     */
-        freg_t  ubr_base;       /* UBR Pointer Base                     */
-        u_int   filler24;
-        freg_t  vbrwq_base;     /* VBR Wait Queue Base                  */
-        freg_t  abrwq_base;     /* ABR Wait Queue Base                  */
-        freg_t  ubrwq_base;     /* UBR Wait Queue Base                  */
-        freg_t  vct_base;       /* Main VC Table Base                   */
-        freg_t  vcte_base;      /* Extended Main VC Table Base          */
-        u_int   filler2a[0x2C - 0x2A];
-        freg_t  cbr_tab_beg;    /* CBR Table Begin                      */
-        freg_t  cbr_tab_end;    /* CBR Table End                        */
-        freg_t  cbr_pointer;    /* CBR Pointer                          */
-        u_int   filler2f[0x30 - 0x2F];
-        freg_t  prq_st_adr;     /* Packet Ready Queue Start Address     */
-        freg_t  prq_ed_adr;     /* Packet Ready Queue End Address       */
-        freg_t  prq_rd_ptr;     /* Packet Ready Queue read pointer      */
-        freg_t  prq_wr_ptr;     /* Packet Ready Queue write pointer     */
-        freg_t  tcq_st_adr;     /* Transmit Complete Queue Start Address*/
-        freg_t  tcq_ed_adr;     /* Transmit Complete Queue End Address  */
-        freg_t  tcq_rd_ptr;     /* Transmit Complete Queue read pointer */
-        freg_t  tcq_wr_ptr;     /* Transmit Complete Queue write pointer*/
-        u_int   filler38[0x40 - 0x38];
-        freg_t  queue_base;     /* Base address for PRQ and TCQ         */
-        freg_t  desc_base;      /* Base address of descriptor table     */
-        u_int   filler42[0x45 - 0x42];
-        freg_t  mode_reg_0;     /* Mode register 0                      */
-        freg_t  mode_reg_1;     /* Mode register 1                      */
-        freg_t  intr_status_reg;/* Interrupt Status register            */
-        freg_t  mask_reg;       /* Mask Register                        */
-        freg_t  cell_ctr_high1; /* Total cell transfer count (high)     */
-        freg_t  cell_ctr_lo1;   /* Total cell transfer count (low)      */
-        freg_t  state_reg;      /* Status register                      */
-        u_int   filler4c[0x58 - 0x4c];
-        freg_t  curr_desc_num;  /* Contains the current descriptor num  */
-        freg_t  next_desc;      /* Next descriptor                      */
-        freg_t  next_vc;        /* Next VC                              */
-        u_int   filler5b[0x5d - 0x5b];
-        freg_t  present_slot_cnt;/* Present slot count                  */
-        u_int   filler5e[0x6a - 0x5e];
-        freg_t  new_desc_num;   /* New descriptor number                */
-        freg_t  new_vc;         /* New VC                               */
-        freg_t  sched_tbl_ptr;  /* Schedule table pointer               */
-        freg_t  vbrwq_wptr;     /* VBR wait queue write pointer         */
-        freg_t  vbrwq_rptr;     /* VBR wait queue read pointer          */
-        freg_t  abrwq_wptr;     /* ABR wait queue write pointer         */
-        freg_t  abrwq_rptr;     /* ABR wait queue read pointer          */
-        freg_t  ubrwq_wptr;     /* UBR wait queue write pointer         */
-        freg_t  ubrwq_rptr;     /* UBR wait queue read pointer          */
-        freg_t  cbr_vc;         /* CBR VC                               */
-        freg_t  vbr_sb_vc;      /* VBR SB VC                            */
-        freg_t  abr_sb_vc;      /* ABR SB VC                            */
-        freg_t  ubr_sb_vc;      /* UBR SB VC                            */
-        freg_t  vbr_next_link;  /* VBR next link                        */
-        freg_t  abr_next_link;  /* ABR next link                        */
-        freg_t  ubr_next_link;  /* UBR next link                        */
-        u_int   filler7a[0x7c-0x7a];
-        freg_t  out_rate_head;  /* Out of rate head                     */
-        u_int   filler7d[0xca-0x7d]; /* pad out to full address space   */
-        freg_t  cell_ctr_high1_nc;/* Total cell transfer count (high)   */
-        freg_t  cell_ctr_lo1_nc;/* Total cell transfer count (low)      */
-        u_int   fillercc[0x100-0xcc]; /* pad out to full address space   */
+        ffreg_t idlehead_high;  /* Idle cell header (high)              */
+        ffreg_t idlehead_low;   /* Idle cell header (low)               */
+        ffreg_t maxrate;        /* Maximum rate                         */
+        ffreg_t stparms;        /* Traffic Management Parameters        */
+        ffreg_t abrubr_abr;     /* ABRUBR Priority Byte 1, TCR Byte 0   */
+        ffreg_t rm_type;        /*                                      */
+        u_int   filler5[0x17 - 0x06];
+        ffreg_t cmd_reg;        /* Command register                     */
+        u_int   filler18[0x20 - 0x18];
+        ffreg_t cbr_base;       /* CBR Pointer Base                     */
+        ffreg_t vbr_base;       /* VBR Pointer Base                     */
+        ffreg_t abr_base;       /* ABR Pointer Base                     */
+        ffreg_t ubr_base;       /* UBR Pointer Base                     */
+        u_int   filler24;
+        ffreg_t vbrwq_base;     /* VBR Wait Queue Base                  */
+        ffreg_t abrwq_base;     /* ABR Wait Queue Base                  */
+        ffreg_t ubrwq_base;     /* UBR Wait Queue Base                  */
+        ffreg_t vct_base;       /* Main VC Table Base                   */
+        ffreg_t vcte_base;      /* Extended Main VC Table Base          */
+        u_int   filler2a[0x2C - 0x2A];
+        ffreg_t cbr_tab_beg;    /* CBR Table Begin                      */
+        ffreg_t cbr_tab_end;    /* CBR Table End                        */
+        ffreg_t cbr_pointer;    /* CBR Pointer                          */
+        u_int   filler2f[0x30 - 0x2F];
+        ffreg_t prq_st_adr;     /* Packet Ready Queue Start Address     */
+        ffreg_t prq_ed_adr;     /* Packet Ready Queue End Address       */
+        ffreg_t prq_rd_ptr;     /* Packet Ready Queue read pointer      */
+        ffreg_t prq_wr_ptr;     /* Packet Ready Queue write pointer     */
+        ffreg_t tcq_st_adr;     /* Transmit Complete Queue Start Address*/
+        ffreg_t tcq_ed_adr;     /* Transmit Complete Queue End Address  */
+        ffreg_t tcq_rd_ptr;     /* Transmit Complete Queue read pointer */
+        ffreg_t tcq_wr_ptr;     /* Transmit Complete Queue write pointer*/
+        u_int   filler38[0x40 - 0x38];
+        ffreg_t queue_base;     /* Base address for PRQ and TCQ         */
+        ffreg_t desc_base;      /* Base address of descriptor table     */
+        u_int   filler42[0x45 - 0x42];
+        ffreg_t mode_reg_0;     /* Mode register 0                      */
+        ffreg_t mode_reg_1;     /* Mode register 1                      */
+        ffreg_t intr_status_reg;/* Interrupt Status register            */
+        ffreg_t mask_reg;       /* Mask Register                        */
+        ffreg_t cell_ctr_high1; /* Total cell transfer count (high)     */
+        ffreg_t cell_ctr_lo1;   /* Total cell transfer count (low)      */
+        ffreg_t state_reg;      /* Status register                      */
+        u_int   filler4c[0x58 - 0x4c];
+        ffreg_t curr_desc_num;  /* Contains the current descriptor num  */
+        ffreg_t next_desc;      /* Next descriptor                      */
+        ffreg_t next_vc;        /* Next VC                              */
+        u_int   filler5b[0x5d - 0x5b];
+        ffreg_t present_slot_cnt;/* Present slot count                  */
+        u_int   filler5e[0x6a - 0x5e];
+        ffreg_t new_desc_num;   /* New descriptor number                */
+        ffreg_t new_vc;         /* New VC                               */
+        ffreg_t sched_tbl_ptr;  /* Schedule table pointer               */
+        ffreg_t vbrwq_wptr;     /* VBR wait queue write pointer         */
+        ffreg_t vbrwq_rptr;     /* VBR wait queue read pointer          */
+        ffreg_t abrwq_wptr;     /* ABR wait queue write pointer         */
+        ffreg_t abrwq_rptr;     /* ABR wait queue read pointer          */
+        ffreg_t ubrwq_wptr;     /* UBR wait queue write pointer         */
+        ffreg_t ubrwq_rptr;     /* UBR wait queue read pointer          */
+        ffreg_t cbr_vc;         /* CBR VC                               */
+        ffreg_t vbr_sb_vc;      /* VBR SB VC                            */
+        ffreg_t abr_sb_vc;      /* ABR SB VC                            */
+        ffreg_t ubr_sb_vc;      /* UBR SB VC                            */
+        ffreg_t vbr_next_link;  /* VBR next link                        */
+        ffreg_t abr_next_link;  /* ABR next link                        */
+        ffreg_t ubr_next_link;  /* UBR next link                        */
+        u_int   filler7a[0x7c-0x7a];
+        ffreg_t out_rate_head;  /* Out of rate head                     */
+        u_int   filler7d[0xca-0x7d]; /* pad out to full address space   */
+        ffreg_t cell_ctr_high1_nc;/* Total cell transfer count (high)   */
+        ffreg_t cell_ctr_lo1_nc;/* Total cell transfer count (low)      */
+        u_int   fillercc[0x100-0xcc]; /* pad out to full address space   */
 } ffredn_t;
 
 typedef struct _rfredn_t {
diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c
index 63452943abd1..fb10728f6372 100644
--- a/drivers/base/cpu.c
+++ b/drivers/base/cpu.c
@@ -224,7 +224,7 @@ static void cpu_device_release(struct device *dev)
          * by the cpu device.
          *
          * Never copy this way of doing things, or you too will be made fun of
-         * on the linux-kerenl list, you have been warned.
+         * on the linux-kernel list, you have been warned.
          */
 }
 
diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c
index d81460309182..b392b353be39 100644
--- a/drivers/base/firmware_class.c
+++ b/drivers/base/firmware_class.c
@@ -305,7 +305,7 @@ static bool fw_read_file_contents(struct file *file, struct firmware_buf *fw_buf
         char *buf;
 
         size = fw_file_size(file);
-        if (size < 0)
+        if (size <= 0)
                 return false;
         buf = vmalloc(size);
         if (!buf)
diff --git a/drivers/base/regmap/Makefile b/drivers/base/regmap/Makefile
index 5e75d1b683e2..cf129980abd0 100644
--- a/drivers/base/regmap/Makefile
+++ b/drivers/base/regmap/Makefile
@@ -1,5 +1,5 @@
 obj-$(CONFIG_REGMAP) += regmap.o regcache.o
-obj-$(CONFIG_REGMAP) += regcache-rbtree.o regcache-lzo.o
+obj-$(CONFIG_REGMAP) += regcache-rbtree.o regcache-lzo.o regcache-flat.o
 obj-$(CONFIG_DEBUG_FS) += regmap-debugfs.o
 obj-$(CONFIG_REGMAP_I2C) += regmap-i2c.o
 obj-$(CONFIG_REGMAP_SPI) += regmap-spi.o
diff --git a/drivers/base/regmap/internal.h b/drivers/base/regmap/internal.h
index 401d1919635a..5a22bd33ce3d 100644
--- a/drivers/base/regmap/internal.h
+++ b/drivers/base/regmap/internal.h
@@ -16,6 +16,7 @@
 #include <linux/regmap.h>
 #include <linux/fs.h>
 #include <linux/list.h>
+#include <linux/wait.h>
 
 struct regmap;
 struct regcache_ops;
@@ -25,6 +26,7 @@ struct regmap_debugfs_off_cache {
         off_t min;
         off_t max;
         unsigned int base_reg;
+        unsigned int max_reg;
 };
 
 struct regmap_format {
@@ -39,6 +41,13 @@ struct regmap_format {
         unsigned int (*parse_val)(void *buf);
 };
 
+struct regmap_async {
+        struct list_head list;
+        struct work_struct cleanup;
+        struct regmap *map;
+        void *work_buf;
+};
+
 struct regmap {
         struct mutex mutex;
         spinlock_t spinlock;
@@ -53,6 +62,11 @@ struct regmap {
         void *bus_context;
         const char *name;
 
+        spinlock_t async_lock;
+        wait_queue_head_t async_waitq;
+        struct list_head async_list;
+        int async_ret;
+
 #ifdef CONFIG_DEBUG_FS
         struct dentry *debugfs;
         const char *debugfs_name;
@@ -74,6 +88,11 @@ struct regmap {
         const struct regmap_access_table *volatile_table;
         const struct regmap_access_table *precious_table;
 
+        int (*reg_read)(void *context, unsigned int reg, unsigned int *val);
+        int (*reg_write)(void *context, unsigned int reg, unsigned int val);
+
+        bool defer_caching;
+
         u8 read_flag_mask;
         u8 write_flag_mask;
 
@@ -175,7 +194,10 @@ bool regcache_set_val(void *base, unsigned int idx,
                       unsigned int val, unsigned int word_size);
 int regcache_lookup_reg(struct regmap *map, unsigned int reg);
 
+void regmap_async_complete_cb(struct regmap_async *async, int ret);
+
 extern struct regcache_ops regcache_rbtree_ops;
 extern struct regcache_ops regcache_lzo_ops;
+extern struct regcache_ops regcache_flat_ops;
 
 #endif
diff --git a/drivers/base/regmap/regcache-flat.c b/drivers/base/regmap/regcache-flat.c
new file mode 100644
index 000000000000..d9762e41959b
--- /dev/null
+++ b/drivers/base/regmap/regcache-flat.c
@@ -0,0 +1,72 @@
+/*
+ * Register cache access API - flat caching support
+ *
+ * Copyright 2012 Wolfson Microelectronics plc
+ *
+ * Author: Mark Brown <broonie@opensource.wolfsonmicro.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <linux/slab.h>
+#include <linux/device.h>
+#include <linux/seq_file.h>
+
+#include "internal.h"
+
+static int regcache_flat_init(struct regmap *map)
+{
+        int i;
+        unsigned int *cache;
+
+        map->cache = kzalloc(sizeof(unsigned int) * (map->max_register + 1),
+                             GFP_KERNEL);
+        if (!map->cache)
+                return -ENOMEM;
+
+        cache = map->cache;
+
+        for (i = 0; i < map->num_reg_defaults; i++)
+                cache[map->reg_defaults[i].reg] = map->reg_defaults[i].def;
+
+        return 0;
+}
+
+static int regcache_flat_exit(struct regmap *map)
+{
+        kfree(map->cache);
+        map->cache = NULL;
+
+        return 0;
+}
+
+static int regcache_flat_read(struct regmap *map,
+                              unsigned int reg, unsigned int *value)
+{
+        unsigned int *cache = map->cache;
+
+        *value = cache[reg];
+
+        return 0;
+}
+
+static int regcache_flat_write(struct regmap *map, unsigned int reg,
+                               unsigned int value)
+{
+        unsigned int *cache = map->cache;
+
+        cache[reg] = value;
+
+        return 0;
+}
+
+struct regcache_ops regcache_flat_ops = {
+        .type = REGCACHE_FLAT,
+        .name = "flat",
+        .init = regcache_flat_init,
+        .exit = regcache_flat_exit,
+        .read = regcache_flat_read,
+        .write = regcache_flat_write,
+};
diff --git a/drivers/base/regmap/regcache.c b/drivers/base/regmap/regcache.c
index 835883bda977..e69ff3e4742c 100644
--- a/drivers/base/regmap/regcache.c
+++ b/drivers/base/regmap/regcache.c
@@ -22,6 +22,7 @@
 static const struct regcache_ops *cache_types[] = {
         &regcache_rbtree_ops,
         &regcache_lzo_ops,
+        &regcache_flat_ops,
 };
 
 static int regcache_hw_init(struct regmap *map)
diff --git a/drivers/base/regmap/regmap-debugfs.c b/drivers/base/regmap/regmap-debugfs.c
index 07aad786f817..78d5f20c5f5b 100644
--- a/drivers/base/regmap/regmap-debugfs.c
+++ b/drivers/base/regmap/regmap-debugfs.c
@@ -56,6 +56,19 @@ static const struct file_operations regmap_name_fops = {
         .llseek = default_llseek,
 };
 
+static void regmap_debugfs_free_dump_cache(struct regmap *map)
+{
+        struct regmap_debugfs_off_cache *c;
+
+        while (!list_empty(&map->debugfs_off_cache)) {
+                c = list_first_entry(&map->debugfs_off_cache,
+                                     struct regmap_debugfs_off_cache,
+                                     list);
+                list_del(&c->list);
+                kfree(c);
+        }
+}
+
 /*
  * Work out where the start offset maps into register numbers, bearing
  * in mind that we suppress hidden registers.
@@ -68,6 +81,8 @@ static unsigned int regmap_debugfs_get_dump_start(struct regmap *map,
         struct regmap_debugfs_off_cache *c = NULL;
         loff_t p = 0;
         unsigned int i, ret;
+        unsigned int fpos_offset;
+        unsigned int reg_offset;
 
         /*
          * If we don't have a cache build one so we don't have to do a
@@ -80,6 +95,9 @@ static unsigned int regmap_debugfs_get_dump_start(struct regmap *map,
                             regmap_precious(map, i)) {
                                 if (c) {
                                         c->max = p - 1;
+                                        fpos_offset = c->max - c->min;
+                                        reg_offset = fpos_offset / map->debugfs_tot_len;
+                                        c->max_reg = c->base_reg + reg_offset;
                                         list_add_tail(&c->list,
                                                       &map->debugfs_off_cache);
                                         c = NULL;
@@ -91,8 +109,10 @@ static unsigned int regmap_debugfs_get_dump_start(struct regmap *map,
                         /* No cache entry?  Start a new one */
                         if (!c) {
                                 c = kzalloc(sizeof(*c), GFP_KERNEL);
-                                if (!c)
-                                        break;
+                                if (!c) {
+                                        regmap_debugfs_free_dump_cache(map);
+                                        return base;
+                                }
                                 c->min = p;
                                 c->base_reg = i;
                         }
@@ -101,19 +121,53 @@ static unsigned int regmap_debugfs_get_dump_start(struct regmap *map,
                 }
         }
 
-        /* Find the relevant block */
+        /* Close the last entry off if we didn't scan beyond it */
+        if (c) {
+                c->max = p - 1;
+                fpos_offset = c->max - c->min;
+                reg_offset = fpos_offset / map->debugfs_tot_len;
+                c->max_reg = c->base_reg + reg_offset;
+                list_add_tail(&c->list,
+                              &map->debugfs_off_cache);
+        }
+
+        /*
+         * This should never happen; we return above if we fail to
+         * allocate and we should never be in this code if there are
+         * no registers at all.
+         */
+        WARN_ON(list_empty(&map->debugfs_off_cache));
+        ret = base;
+
+        /* Find the relevant block:offset */
         list_for_each_entry(c, &map->debugfs_off_cache, list) {
-                if (*pos >= c->min && *pos <= c->max) {
-                        *pos = c->min;
-                        return c->base_reg;
+                if (from >= c->min && from <= c->max) {
+                        fpos_offset = from - c->min;
+                        reg_offset = fpos_offset / map->debugfs_tot_len;
+                        *pos = c->min + (reg_offset * map->debugfs_tot_len);
+                        return c->base_reg + reg_offset;
                 }
 
-                ret = c->max;
+                *pos = c->max;
+                ret = c->max_reg;
         }
 
         return ret;
 }
 
+static inline void regmap_calc_tot_len(struct regmap *map,
+                                       void *buf, size_t count)
+{
+        /* Calculate the length of a fixed format  */
+        if (!map->debugfs_tot_len) {
+                map->debugfs_reg_len = regmap_calc_reg_len(map->max_register,
+                                                           buf, count);
+                map->debugfs_val_len = 2 * map->format.val_bytes;
+                map->debugfs_tot_len = map->debugfs_reg_len +
+                        map->debugfs_val_len + 3;      /* : \n */
+        }
+}
+
 static ssize_t regmap_read_debugfs(struct regmap *map, unsigned int from,
                                    unsigned int to, char __user *user_buf,
                                    size_t count, loff_t *ppos)
@@ -132,14 +186,7 @@ static ssize_t regmap_read_debugfs(struct regmap *map, unsigned int from,
         if (!buf)
                 return -ENOMEM;
 
-        /* Calculate the length of a fixed format  */
-        if (!map->debugfs_tot_len) {
-                map->debugfs_reg_len = regmap_calc_reg_len(map->max_register,
-                                                           buf, count);
-                map->debugfs_val_len = 2 * map->format.val_bytes;
-                map->debugfs_tot_len = map->debugfs_reg_len +
-                        map->debugfs_val_len + 3;      /* : \n */
-        }
+        regmap_calc_tot_len(map, buf, count);
 
         /* Work out which register we're starting at */
         start_reg = regmap_debugfs_get_dump_start(map, from, *ppos, &p);
@@ -154,7 +201,7 @@ static ssize_t regmap_read_debugfs(struct regmap *map, unsigned int from,
                 /* If we're in the region the user is trying to read */
                 if (p >= *ppos) {
                         /* ...but not beyond it */
-                        if (buf_pos + 1 + map->debugfs_tot_len >= count)
+                        if (buf_pos + map->debugfs_tot_len > count)
                                 break;
 
                         /* Format the register */
@@ -387,16 +434,8 @@ void regmap_debugfs_init(struct regmap *map, const char *name)
 
 void regmap_debugfs_exit(struct regmap *map)
 {
-        struct regmap_debugfs_off_cache *c;
-
         debugfs_remove_recursive(map->debugfs);
-        while (!list_empty(&map->debugfs_off_cache)) {
-                c = list_first_entry(&map->debugfs_off_cache,
-                                     struct regmap_debugfs_off_cache,
-                                     list);
-                list_del(&c->list);
-                kfree(c);
-        }
+        regmap_debugfs_free_dump_cache(map);
         kfree(map->debugfs_name);
 }
 
diff --git a/drivers/base/regmap/regmap-irq.c b/drivers/base/regmap/regmap-irq.c
index 5972ad958544..4706c63d0bc6 100644
--- a/drivers/base/regmap/regmap-irq.c
+++ b/drivers/base/regmap/regmap-irq.c
@@ -34,6 +34,7 @@ struct regmap_irq_chip_data {
         int irq;
         int wake_count;
 
+        void *status_reg_buf;
         unsigned int *status_buf;
         unsigned int *mask_buf;
         unsigned int *mask_buf_def;
@@ -87,6 +88,23 @@ static void regmap_irq_sync_unlock(struct irq_data *data)
                 if (ret != 0)
                         dev_err(d->map->dev, "Failed to sync masks in %x\n",
                                 reg);
+
+                reg = d->chip->wake_base +
+                        (i * map->reg_stride * d->irq_reg_stride);
+                if (d->wake_buf) {
+                        if (d->chip->wake_invert)
+                                ret = regmap_update_bits(d->map, reg,
+                                                         d->mask_buf_def[i],
+                                                         ~d->wake_buf[i]);
+                        else
+                                ret = regmap_update_bits(d->map, reg,
+                                                         d->mask_buf_def[i],
+                                                         d->wake_buf[i]);
+                        if (ret != 0)
+                                dev_err(d->map->dev,
+                                        "Failed to sync wakes in %x: %d\n",
+                                        reg, ret);
+                }
         }
 
         if (d->chip->runtime_pm)
@@ -129,16 +147,15 @@ static int regmap_irq_set_wake(struct irq_data *data, unsigned int on)
         struct regmap *map = d->map;
         const struct regmap_irq *irq_data = irq_to_regmap_irq(d, data->hwirq);
 
-        if (!d->chip->wake_base)
-                return -EINVAL;
-
         if (on) {
-                d->wake_buf[irq_data->reg_offset / map->reg_stride]
-                        &= ~irq_data->mask;
+                if (d->wake_buf)
+                        d->wake_buf[irq_data->reg_offset / map->reg_stride]
+                                &= ~irq_data->mask;
                 d->wake_count++;
         } else {
-                d->wake_buf[irq_data->reg_offset / map->reg_stride]
-                        |= irq_data->mask;
+                if (d->wake_buf)
+                        d->wake_buf[irq_data->reg_offset / map->reg_stride]
+                                |= irq_data->mask;
                 d->wake_count--;
         }
 
@@ -172,25 +189,69 @@ static irqreturn_t regmap_irq_thread(int irq, void *d)
         }
 
         /*
-         * Ignore masked IRQs and ack if we need to; we ack early so
-         * there is no race between handling and acknowleding the
-         * interrupt.  We assume that typically few of the interrupts
-         * will fire simultaneously so don't worry about overhead from
-         * doing a write per register.
+         * Read in the statuses, using a single bulk read if possible
+         * in order to reduce the I/O overheads.
          */
-        for (i = 0; i < data->chip->num_regs; i++) {
-                ret = regmap_read(map, chip->status_base + (i * map->reg_stride
-                                   * data->irq_reg_stride),
-                                   &data->status_buf[i]);
+        if (!map->use_single_rw && map->reg_stride == 1 &&
+            data->irq_reg_stride == 1) {
+                u8 *buf8 = data->status_reg_buf;
+                u16 *buf16 = data->status_reg_buf;
+                u32 *buf32 = data->status_reg_buf;
 
+                BUG_ON(!data->status_reg_buf);
+
+                ret = regmap_bulk_read(map, chip->status_base,
+                                       data->status_reg_buf,
+                                       chip->num_regs);
                 if (ret != 0) {
                         dev_err(map->dev, "Failed to read IRQ status: %d\n",
-                                        ret);
-                        if (chip->runtime_pm)
-                                pm_runtime_put(map->dev);
+                                ret);
                         return IRQ_NONE;
                 }
 
+                for (i = 0; i < data->chip->num_regs; i++) {
+                        switch (map->format.val_bytes) {
+                        case 1:
+                                data->status_buf[i] = buf8[i];
+                                break;
+                        case 2:
+                                data->status_buf[i] = buf16[i];
+                                break;
+                        case 4:
+                                data->status_buf[i] = buf32[i];
+                                break;
+                        default:
+                                BUG();
+                                return IRQ_NONE;
+                        }
+                }
+
+        } else {
+                for (i = 0; i < data->chip->num_regs; i++) {
+                        ret = regmap_read(map, chip->status_base +
+                                          (i * map->reg_stride
+                                           * data->irq_reg_stride),
+                                          &data->status_buf[i]);
+
+                        if (ret != 0) {
+                                dev_err(map->dev,
+                                        "Failed to read IRQ status: %d\n",
+                                        ret);
+                                if (chip->runtime_pm)
+                                        pm_runtime_put(map->dev);
+                                return IRQ_NONE;
+                        }
+                }
+        }
+
+        /*
+         * Ignore masked IRQs and ack if we need to; we ack early so
+         * there is no race between handling and acknowleding the
+         * interrupt.  We assume that typically few of the interrupts
+         * will fire simultaneously so don't worry about overhead from
+         * doing a write per register.
+         */
+        for (i = 0; i < data->chip->num_regs; i++) {
                 data->status_buf[i] &= ~data->mask_buf[i];
 
                 if (data->status_buf[i] && chip->ack_base) {
@@ -316,11 +377,6 @@ int regmap_add_irq_chip(struct regmap *map, int irq, int irq_flags,
 
         d->irq_chip = regmap_irq_chip;
         d->irq_chip.name = chip->name;
-        if (!chip->wake_base) {
-                d->irq_chip.irq_set_wake = NULL;
-                d->irq_chip.flags |= IRQCHIP_MASK_ON_SUSPEND |
-                                     IRQCHIP_SKIP_SET_WAKE;
-        }
         d->irq = irq;
         d->map = map;
         d->chip = chip;
@@ -331,6 +387,14 @@ int regmap_add_irq_chip(struct regmap *map, int irq, int irq_flags,
         else
                 d->irq_reg_stride = 1;
 
+        if (!map->use_single_rw && map->reg_stride == 1 &&
+            d->irq_reg_stride == 1) {
+                d->status_reg_buf = kmalloc(map->format.val_bytes *
+                                            chip->num_regs, GFP_KERNEL);
+                if (!d->status_reg_buf)
+                        goto err_alloc;
+        }
+
         mutex_init(&d->lock);
 
         for (i = 0; i < chip->num_irqs; i++)
@@ -361,8 +425,15 @@ int regmap_add_irq_chip(struct regmap *map, int irq, int irq_flags,
                         d->wake_buf[i] = d->mask_buf_def[i];
                         reg = chip->wake_base +
                                 (i * map->reg_stride * d->irq_reg_stride);
-                        ret = regmap_update_bits(map, reg, d->wake_buf[i],
-                                                 d->wake_buf[i]);
+
+                        if (chip->wake_invert)
+                                ret = regmap_update_bits(map, reg,
+                                                         d->mask_buf_def[i],
+                                                         0);
+                        else
+                                ret = regmap_update_bits(map, reg,
+                                                         d->mask_buf_def[i],
+                                                         d->wake_buf[i]);
                         if (ret != 0) {
                                 dev_err(map->dev, "Failed to set masks in 0x%x: %d\n",
                                         reg, ret);
@@ -401,6 +472,7 @@ err_alloc:
         kfree(d->mask_buf_def);
         kfree(d->mask_buf);
         kfree(d->status_buf);
+        kfree(d->status_reg_buf);
         kfree(d);
         return ret;
 }
@@ -422,6 +494,7 @@ void regmap_del_irq_chip(int irq, struct regmap_irq_chip_data *d)
         kfree(d->wake_buf);
         kfree(d->mask_buf_def);
         kfree(d->mask_buf);
+        kfree(d->status_reg_buf);
         kfree(d->status_buf);
         kfree(d);
 }
diff --git a/drivers/base/regmap/regmap-mmio.c b/drivers/base/regmap/regmap-mmio.c
index f05fc74dd84a..98745dd77e8c 100644
--- a/drivers/base/regmap/regmap-mmio.c
+++ b/drivers/base/regmap/regmap-mmio.c
@@ -16,6 +16,7 @@
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
 
+#include <linux/clk.h>
 #include <linux/err.h>
 #include <linux/init.h>
 #include <linux/io.h>
@@ -26,6 +27,7 @@
 struct regmap_mmio_context {
         void __iomem *regs;
         unsigned val_bytes;
+        struct clk *clk;
 };
 
 static int regmap_mmio_gather_write(void *context,
@@ -34,9 +36,16 @@ static int regmap_mmio_gather_write(void *context,
 {
         struct regmap_mmio_context *ctx = context;
         u32 offset;
+        int ret;
 
         BUG_ON(reg_size != 4);
 
+        if (ctx->clk) {
+                ret = clk_enable(ctx->clk);
+                if (ret < 0)
+                        return ret;
+        }
+
         offset = *(u32 *)reg;
 
         while (val_size) {
@@ -64,6 +73,9 @@ static int regmap_mmio_gather_write(void *context,
                 offset += ctx->val_bytes;
         }
 
+        if (ctx->clk)
+                clk_disable(ctx->clk);
+
         return 0;
 }
 
@@ -80,9 +92,16 @@ static int regmap_mmio_read(void *context,
 {
         struct regmap_mmio_context *ctx = context;
         u32 offset;
+        int ret;
 
         BUG_ON(reg_size != 4);
 
+        if (ctx->clk) {
+                ret = clk_enable(ctx->clk);
+                if (ret < 0)
+                        return ret;
+        }
+
         offset = *(u32 *)reg;
 
         while (val_size) {
@@ -110,11 +129,20 @@ static int regmap_mmio_read(void *context,
                 offset += ctx->val_bytes;
         }
 
+        if (ctx->clk)
+                clk_disable(ctx->clk);
+
         return 0;
 }
 
 static void regmap_mmio_free_context(void *context)
 {
+        struct regmap_mmio_context *ctx = context;
+
+        if (ctx->clk) {
+                clk_unprepare(ctx->clk);
+                clk_put(ctx->clk);
+        }
         kfree(context);
 }
 
@@ -128,11 +156,14 @@ static struct regmap_bus regmap_mmio = {
         .val_format_endian_default = REGMAP_ENDIAN_NATIVE,
 };
 
-static struct regmap_mmio_context *regmap_mmio_gen_context(void __iomem *regs,
+static struct regmap_mmio_context *regmap_mmio_gen_context(struct device *dev,
+                                        const char *clk_id,
+                                        void __iomem *regs,
                                         const struct regmap_config *config)
 {
         struct regmap_mmio_context *ctx;
         int min_stride;
+        int ret;
 
         if (config->reg_bits != 32)
                 return ERR_PTR(-EINVAL);
@@ -179,37 +210,59 @@ static struct regmap_mmio_context *regmap_mmio_gen_context(void __iomem *regs,
         ctx->regs = regs;
         ctx->val_bytes = config->val_bits / 8;
 
+        if (clk_id == NULL)
+                return ctx;
+
+        ctx->clk = clk_get(dev, clk_id);
+        if (IS_ERR(ctx->clk)) {
+                ret = PTR_ERR(ctx->clk);
+                goto err_free;
+        }
+
+        ret = clk_prepare(ctx->clk);
+        if (ret < 0) {
+                clk_put(ctx->clk);
+                goto err_free;
+        }
+
         return ctx;
+
+err_free:
+        kfree(ctx);
+
+        return ERR_PTR(ret);
 }
 
 /**
- * regmap_init_mmio(): Initialise register map
+ * regmap_init_mmio_clk(): Initialise register map with register clock
  *
  * @dev: Device that will be interacted with
+ * @clk_id: register clock consumer ID
  * @regs: Pointer to memory-mapped IO region
  * @config: Configuration for register map
  *
  * The return value will be an ERR_PTR() on error or a valid pointer to
  * a struct regmap.
  */
-struct regmap *regmap_init_mmio(struct device *dev,
-                                void __iomem *regs,
-                                const struct regmap_config *config)
+struct regmap *regmap_init_mmio_clk(struct device *dev, const char *clk_id,
+                                    void __iomem *regs,
+                                    const struct regmap_config *config)
 {
         struct regmap_mmio_context *ctx;
 
-        ctx = regmap_mmio_gen_context(regs, config);
+        ctx = regmap_mmio_gen_context(dev, clk_id, regs, config);
         if (IS_ERR(ctx))
                 return ERR_CAST(ctx);
 
         return regmap_init(dev, &regmap_mmio, ctx, config);
 }
-EXPORT_SYMBOL_GPL(regmap_init_mmio);
+EXPORT_SYMBOL_GPL(regmap_init_mmio_clk);
 
 /**
- * devm_regmap_init_mmio(): Initialise managed register map
+ * devm_regmap_init_mmio_clk(): Initialise managed register map with clock
  *
  * @dev: Device that will be interacted with
+ * @clk_id: register clock consumer ID
  * @regs: Pointer to memory-mapped IO region
  * @config: Configuration for register map
  *
@@ -217,18 +270,18 @@ EXPORT_SYMBOL_GPL(regmap_init_mmio);
  * to a struct regmap.  The regmap will be automatically freed by the
  * device management code.
  */
-struct regmap *devm_regmap_init_mmio(struct device *dev,
-                                     void __iomem *regs,
-                                     const struct regmap_config *config)
+struct regmap *devm_regmap_init_mmio_clk(struct device *dev, const char *clk_id,
+                                         void __iomem *regs,
+                                         const struct regmap_config *config)
 {
         struct regmap_mmio_context *ctx;
 
-        ctx = regmap_mmio_gen_context(regs, config);
+        ctx = regmap_mmio_gen_context(dev, clk_id, regs, config);
         if (IS_ERR(ctx))
                 return ERR_CAST(ctx);
 
         return devm_regmap_init(dev, &regmap_mmio, ctx, config);
 }
-EXPORT_SYMBOL_GPL(devm_regmap_init_mmio);
+EXPORT_SYMBOL_GPL(devm_regmap_init_mmio_clk);
 
 MODULE_LICENSE("GPL v2");
diff --git a/drivers/base/regmap/regmap-spi.c b/drivers/base/regmap/regmap-spi.c
index ffa46a92ad33..4c506bd940f3 100644
--- a/drivers/base/regmap/regmap-spi.c
+++ b/drivers/base/regmap/regmap-spi.c
@@ -15,6 +15,21 @@
 #include <linux/init.h>
 #include <linux/module.h>
 
+#include "internal.h"
+
+struct regmap_async_spi {
+        struct regmap_async core;
+        struct spi_message m;
+        struct spi_transfer t[2];
+};
+
+static void regmap_spi_complete(void *data)
+{
+        struct regmap_async_spi *async = data;
+
+        regmap_async_complete_cb(&async->core, async->m.status);
+}
+
 static int regmap_spi_write(void *context, const void *data, size_t count)
 {
         struct device *dev = context;
@@ -40,6 +55,43 @@ static int regmap_spi_gather_write(void *context,
         return spi_sync(spi, &m);
 }
 
+static int regmap_spi_async_write(void *context,
+                                  const void *reg, size_t reg_len,
+                                  const void *val, size_t val_len,
+                                  struct regmap_async *a)
+{
+        struct regmap_async_spi *async = container_of(a,
+                                                      struct regmap_async_spi,
+                                                      core);
+        struct device *dev = context;
+        struct spi_device *spi = to_spi_device(dev);
+
+        async->t[0].tx_buf = reg;
+        async->t[0].len = reg_len;
+        async->t[1].tx_buf = val;
+        async->t[1].len = val_len;
+
+        spi_message_init(&async->m);
+        spi_message_add_tail(&async->t[0], &async->m);
+        spi_message_add_tail(&async->t[1], &async->m);
+
+        async->m.complete = regmap_spi_complete;
+        async->m.context = async;
+
+        return spi_async(spi, &async->m);
+}
+
+static struct regmap_async *regmap_spi_async_alloc(void)
+{
+        struct regmap_async_spi *async_spi;
+
+        async_spi = kzalloc(sizeof(*async_spi), GFP_KERNEL);
+        if (!async_spi)
+                return NULL;
+
+        return &async_spi->core;
+}
+
 static int regmap_spi_read(void *context,
                            const void *reg, size_t reg_size,
                            void *val, size_t val_size)
@@ -53,6 +105,8 @@ static int regmap_spi_read(void *context,
 static struct regmap_bus regmap_spi = {
         .write = regmap_spi_write,
         .gather_write = regmap_spi_gather_write,
+        .async_write = regmap_spi_async_write,
+        .async_alloc = regmap_spi_async_alloc,
         .read = regmap_spi_read,
         .read_flag_mask = 0x80,
 };
diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c
index 42d5cb0f503f..3d2367501fd0 100644
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -16,6 +16,7 @@
 #include <linux/mutex.h>
 #include <linux/err.h>
 #include <linux/rbtree.h>
+#include <linux/sched.h>
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/regmap.h>
@@ -34,6 +35,22 @@ static int _regmap_update_bits(struct regmap *map, unsigned int reg,
                                unsigned int mask, unsigned int val,
                                bool *change);
 
+static int _regmap_bus_read(void *context, unsigned int reg,
+                            unsigned int *val);
+static int _regmap_bus_formatted_write(void *context, unsigned int reg,
+                                       unsigned int val);
+static int _regmap_bus_raw_write(void *context, unsigned int reg,
+                                 unsigned int val);
+
+static void async_cleanup(struct work_struct *work)
+{
+        struct regmap_async *async = container_of(work, struct regmap_async,
+                                                  cleanup);
+
+        kfree(async->work_buf);
+        kfree(async);
+}
+
 bool regmap_reg_in_ranges(unsigned int reg,
                           const struct regmap_range *ranges,
                           unsigned int nranges)
@@ -372,7 +389,7 @@ struct regmap *regmap_init(struct device *dev,
         enum regmap_endian reg_endian, val_endian;
         int i, j;
 
-        if (!bus || !config)
+        if (!config)
                 goto err;
 
         map = kzalloc(sizeof(*map), GFP_KERNEL);
@@ -386,7 +403,8 @@ struct regmap *regmap_init(struct device *dev,
                 map->unlock = config->unlock;
                 map->lock_arg = config->lock_arg;
         } else {
-                if (bus->fast_io) {
+                if ((bus && bus->fast_io) ||
+                    config->fast_io) {
                         spin_lock_init(&map->spinlock);
                         map->lock = regmap_lock_spinlock;
                         map->unlock = regmap_unlock_spinlock;
@@ -423,13 +441,27 @@ struct regmap *regmap_init(struct device *dev,
         map->cache_type = config->cache_type;
         map->name = config->name;
 
+        spin_lock_init(&map->async_lock);
+        INIT_LIST_HEAD(&map->async_list);
+        init_waitqueue_head(&map->async_waitq);
+
         if (config->read_flag_mask || config->write_flag_mask) {
                 map->read_flag_mask = config->read_flag_mask;
                 map->write_flag_mask = config->write_flag_mask;
-        } else {
+        } else if (bus) {
                 map->read_flag_mask = bus->read_flag_mask;
         }
 
+        if (!bus) {
+                map->reg_read  = config->reg_read;
+                map->reg_write = config->reg_write;
+
+                map->defer_caching = false;
+                goto skip_format_initialization;
+        } else {
+                map->reg_read  = _regmap_bus_read;
+        }
+
         reg_endian = config->reg_format_endian;
         if (reg_endian == REGMAP_ENDIAN_DEFAULT)
                 reg_endian = bus->reg_format_endian_default;
@@ -500,6 +532,12 @@ struct regmap *regmap_init(struct device *dev,
                 }
                 break;
 
+        case 24:
+                if (reg_endian != REGMAP_ENDIAN_BIG)
+                        goto err_map;
+                map->format.format_reg = regmap_format_24;
+                break;
+
         case 32:
                 switch (reg_endian) {
                 case REGMAP_ENDIAN_BIG:
@@ -575,6 +613,16 @@ struct regmap *regmap_init(struct device *dev,
                 goto err_map;
         }
 
+        if (map->format.format_write) {
+                map->defer_caching = false;
+                map->reg_write = _regmap_bus_formatted_write;
+        } else if (map->format.format_val) {
+                map->defer_caching = true;
+                map->reg_write = _regmap_bus_raw_write;
+        }
+
+skip_format_initialization:
+
         map->range_tree = RB_ROOT;
         for (i = 0; i < config->num_ranges; i++) {
                 const struct regmap_range_cfg *range_cfg = &config->ranges[i];
@@ -776,7 +824,7 @@ void regmap_exit(struct regmap *map)
         regcache_exit(map);
         regmap_debugfs_exit(map);
         regmap_range_exit(map);
-        if (map->bus->free_context)
+        if (map->bus && map->bus->free_context)
                 map->bus->free_context(map->bus_context);
         kfree(map->work_buf);
         kfree(map);
@@ -870,15 +918,20 @@ static int _regmap_select_page(struct regmap *map, unsigned int *reg,
 }
 
 static int _regmap_raw_write(struct regmap *map, unsigned int reg,
-                             const void *val, size_t val_len)
+                             const void *val, size_t val_len, bool async)
 {
         struct regmap_range_node *range;
+        unsigned long flags;
         u8 *u8 = map->work_buf;
+        void *work_val = map->work_buf + map->format.reg_bytes +
+                map->format.pad_bytes;
         void *buf;
         int ret = -ENOTSUPP;
         size_t len;
         int i;
 
+        BUG_ON(!map->bus);
+
         /* Check for unwritable registers before we start */
         if (map->writeable_reg)
                 for (i = 0; i < val_len / map->format.val_bytes; i++)
@@ -918,7 +971,7 @@ static int _regmap_raw_write(struct regmap *map, unsigned int reg,
                         dev_dbg(map->dev, "Writing window %d/%zu\n",
                                 win_residue, val_len / map->format.val_bytes);
                         ret = _regmap_raw_write(map, reg, val, win_residue *
-                                                map->format.val_bytes);
+                                                map->format.val_bytes, async);
                         if (ret != 0)
                                 return ret;
 
@@ -941,6 +994,50 @@ static int _regmap_raw_write(struct regmap *map, unsigned int reg,
 
         u8[0] |= map->write_flag_mask;
 
+        if (async && map->bus->async_write) {
+                struct regmap_async *async = map->bus->async_alloc();
+                if (!async)
+                        return -ENOMEM;
+
+                async->work_buf = kzalloc(map->format.buf_size,
+                                          GFP_KERNEL | GFP_DMA);
+                if (!async->work_buf) {
+                        kfree(async);
+                        return -ENOMEM;
+                }
+
+                INIT_WORK(&async->cleanup, async_cleanup);
+                async->map = map;
+
+                /* If the caller supplied the value we can use it safely. */
+                memcpy(async->work_buf, map->work_buf, map->format.pad_bytes +
+                       map->format.reg_bytes + map->format.val_bytes);
+                if (val == work_val)
+                        val = async->work_buf + map->format.pad_bytes +
+                                map->format.reg_bytes;
+
+                spin_lock_irqsave(&map->async_lock, flags);
+                list_add_tail(&async->list, &map->async_list);
+                spin_unlock_irqrestore(&map->async_lock, flags);
+
+                ret = map->bus->async_write(map->bus_context, async->work_buf,
+                                            map->format.reg_bytes +
+                                            map->format.pad_bytes,
+                                            val, val_len, async);
+
+                if (ret != 0) {
+                        dev_err(map->dev, "Failed to schedule write: %d\n",
+                                ret);
+
+                        spin_lock_irqsave(&map->async_lock, flags);
+                        list_del(&async->list);
+                        spin_unlock_irqrestore(&map->async_lock, flags);
+
+                        kfree(async->work_buf);
+                        kfree(async);
+                }
+        }
+
         trace_regmap_hw_write_start(map->dev, reg,
                                     val_len / map->format.val_bytes);
 
@@ -948,8 +1045,7 @@ static int _regmap_raw_write(struct regmap *map, unsigned int reg,
          * send the work_buf directly, otherwise try to do a gather
          * write.
          */
-        if (val == (map->work_buf + map->format.pad_bytes +
-                    map->format.reg_bytes))
+        if (val == work_val)
                 ret = map->bus->write(map->bus_context, map->work_buf,
                                       map->format.reg_bytes +
                                       map->format.pad_bytes +
@@ -981,14 +1077,62 @@ static int _regmap_raw_write(struct regmap *map, unsigned int reg,
         return ret;
 }
 
+static int _regmap_bus_formatted_write(void *context, unsigned int reg,
+                                       unsigned int val)
+{
+        int ret;
+        struct regmap_range_node *range;
+        struct regmap *map = context;
+
+        BUG_ON(!map->bus || !map->format.format_write);
+
+        range = _regmap_range_lookup(map, reg);
+        if (range) {
+                ret = _regmap_select_page(map, &reg, range, 1);
+                if (ret != 0)
+                        return ret;
+        }
+
+        map->format.format_write(map, reg, val);
+
+        trace_regmap_hw_write_start(map->dev, reg, 1);
+
+        ret = map->bus->write(map->bus_context, map->work_buf,
+                              map->format.buf_size);
+
+        trace_regmap_hw_write_done(map->dev, reg, 1);
+
+        return ret;
+}
+
+static int _regmap_bus_raw_write(void *context, unsigned int reg,
+                                 unsigned int val)
+{
+        struct regmap *map = context;
+
+        BUG_ON(!map->bus || !map->format.format_val);
+
+        map->format.format_val(map->work_buf + map->format.reg_bytes
+                               + map->format.pad_bytes, val, 0);
+        return _regmap_raw_write(map, reg,
+                                 map->work_buf +
+                                 map->format.reg_bytes +
+                                 map->format.pad_bytes,
+                                 map->format.val_bytes, false);
+}
+
+static inline void *_regmap_map_get_context(struct regmap *map)
+{
+        return (map->bus) ? map : map->bus_context;
+}
+
 int _regmap_write(struct regmap *map, unsigned int reg,
                   unsigned int val)
 {
-        struct regmap_range_node *range;
         int ret;
-        BUG_ON(!map->format.format_write && !map->format.format_val);
+        void *context = _regmap_map_get_context(map);
 
-        if (!map->cache_bypass && map->format.format_write) {
+        if (!map->cache_bypass && !map->defer_caching) {
                 ret = regcache_write(map, reg, val);
                 if (ret != 0)
                         return ret;
@@ -1005,33 +1149,7 @@ int _regmap_write(struct regmap *map, unsigned int reg,
 
         trace_regmap_reg_write(map->dev, reg, val);
 
-        if (map->format.format_write) {
-                range = _regmap_range_lookup(map, reg);
-                if (range) {
-                        ret = _regmap_select_page(map, &reg, range, 1);
-                        if (ret != 0)
-                                return ret;
-                }
-
-                map->format.format_write(map, reg, val);
-
-                trace_regmap_hw_write_start(map->dev, reg, 1);
-
-                ret = map->bus->write(map->bus_context, map->work_buf,
-                                      map->format.buf_size);
-
-                trace_regmap_hw_write_done(map->dev, reg, 1);
-
-                return ret;
-        } else {
-                map->format.format_val(map->work_buf + map->format.reg_bytes
-                                       + map->format.pad_bytes, val, 0);
-                return _regmap_raw_write(map, reg,
-                                         map->work_buf +
-                                         map->format.reg_bytes +
-                                         map->format.pad_bytes,
-                                         map->format.val_bytes);
-        }
+        return map->reg_write(context, reg, val);
 }
 
 /**
@@ -1082,6 +1200,8 @@ int regmap_raw_write(struct regmap *map, unsigned int reg,
 {
         int ret;
 
+        if (!map->bus)
+                return -EINVAL;
         if (val_len % map->format.val_bytes)
                 return -EINVAL;
         if (reg % map->reg_stride)
@@ -1089,7 +1209,7 @@ int regmap_raw_write(struct regmap *map, unsigned int reg,
 
         map->lock(map->lock_arg);
 
-        ret = _regmap_raw_write(map, reg, val, val_len);
+        ret = _regmap_raw_write(map, reg, val, val_len, false);
 
         map->unlock(map->lock_arg);
 
@@ -1106,7 +1226,7 @@ EXPORT_SYMBOL_GPL(regmap_raw_write);
  * @val_count: Number of registers to write
  *
  * This function is intended to be used for writing a large block of
- * data to be device either in single transfer or multiple transfer.
+ * data to the device either in single transfer or multiple transfer.
  *
  * A value of zero will be returned on success, a negative errno will
  * be returned in error cases.
@@ -1118,6 +1238,8 @@ int regmap_bulk_write(struct regmap *map, unsigned int reg, const void *val,
         size_t val_bytes = map->format.val_bytes;
         void *wval;
 
+        if (!map->bus)
+                return -EINVAL;
         if (!map->format.parse_val)
                 return -EINVAL;
         if (reg % map->reg_stride)
@@ -1145,14 +1267,15 @@ int regmap_bulk_write(struct regmap *map, unsigned int reg, const void *val,
         if (map->use_single_rw) {
                 for (i = 0; i < val_count; i++) {
                         ret = regmap_raw_write(map,
-                                                reg + (i * map->reg_stride),
-                                                val + (i * val_bytes),
-                                                val_bytes);
+                                               reg + (i * map->reg_stride),
+                                               val + (i * val_bytes),
+                                               val_bytes);
                         if (ret != 0)
                                 return ret;
                 }
         } else {
-                ret = _regmap_raw_write(map, reg, wval, val_bytes * val_count);
+                ret = _regmap_raw_write(map, reg, wval, val_bytes * val_count,
+                                        false);
         }
 
         if (val_bytes != 1)
@@ -1164,6 +1287,48 @@ out:
 }
 EXPORT_SYMBOL_GPL(regmap_bulk_write);
 
+/**
+ * regmap_raw_write_async(): Write raw values to one or more registers
+ *                           asynchronously
+ *
+ * @map: Register map to write to
+ * @reg: Initial register to write to
+ * @val: Block of data to be written, laid out for direct transmission to the
+ *       device.  Must be valid until regmap_async_complete() is called.
+ * @val_len: Length of data pointed to by val.
+ *
+ * This function is intended to be used for things like firmware
+ * download where a large block of data needs to be transferred to the
+ * device.  No formatting will be done on the data provided.
+ *
+ * If supported by the underlying bus the write will be scheduled
+ * asynchronously, helping maximise I/O speed on higher speed buses
+ * like SPI.  regmap_async_complete() can be called to ensure that all
+ * asynchrnous writes have been completed.
+ *
+ * A value of zero will be returned on success, a negative errno will
+ * be returned in error cases.
+ */
+int regmap_raw_write_async(struct regmap *map, unsigned int reg,
+                           const void *val, size_t val_len)
+{
+        int ret;
+
+        if (val_len % map->format.val_bytes)
+                return -EINVAL;
+        if (reg % map->reg_stride)
+                return -EINVAL;
+
+        map->lock(map->lock_arg);
+
+        ret = _regmap_raw_write(map, reg, val, val_len, true);
+
+        map->unlock(map->lock_arg);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(regmap_raw_write_async);
+
 static int _regmap_raw_read(struct regmap *map, unsigned int reg, void *val,
                             unsigned int val_len)
 {
@@ -1171,6 +1336,8 @@ static int _regmap_raw_read(struct regmap *map, unsigned int reg, void *val,
         u8 *u8 = map->work_buf;
         int ret;
 
+        BUG_ON(!map->bus);
+
         range = _regmap_range_lookup(map, reg);
         if (range) {
                 ret = _regmap_select_page(map, &reg, range,
@@ -1202,10 +1369,29 @@ static int _regmap_raw_read(struct regmap *map, unsigned int reg, void *val,
         return ret;
 }
 
+static int _regmap_bus_read(void *context, unsigned int reg,
+                            unsigned int *val)
+{
+        int ret;
+        struct regmap *map = context;
+
+        if (!map->format.parse_val)
+                return -EINVAL;
+
+        ret = _regmap_raw_read(map, reg, map->work_buf, map->format.val_bytes);
+        if (ret == 0)
+                *val = map->format.parse_val(map->work_buf);
+
+        return ret;
+}
+
 static int _regmap_read(struct regmap *map, unsigned int reg,
                         unsigned int *val)
 {
         int ret;
+        void *context = _regmap_map_get_context(map);
+
+        BUG_ON(!map->reg_read);
 
         if (!map->cache_bypass) {
                 ret = regcache_read(map, reg, val);
@@ -1213,26 +1399,21 @@ static int _regmap_read(struct regmap *map, unsigned int reg,
                         return 0;
         }
 
-        if (!map->format.parse_val)
-                return -EINVAL;
-
         if (map->cache_only)
                 return -EBUSY;
 
-        ret = _regmap_raw_read(map, reg, map->work_buf, map->format.val_bytes);
+        ret = map->reg_read(context, reg, val);
         if (ret == 0) {
-                *val = map->format.parse_val(map->work_buf);
-
 #ifdef LOG_DEVICE
                 if (strcmp(dev_name(map->dev), LOG_DEVICE) == 0)
                         dev_info(map->dev, "%x => %x\n", reg, *val);
 #endif
 
                 trace_regmap_reg_read(map->dev, reg, *val);
-        }
 
-        if (ret == 0 && !map->cache_bypass)
-                regcache_write(map, reg, *val);
+                if (!map->cache_bypass)
+                        regcache_write(map, reg, *val);
+        }
 
         return ret;
 }
@@ -1283,6 +1464,8 @@ int regmap_raw_read(struct regmap *map, unsigned int reg, void *val,
         unsigned int v;
         int ret, i;
 
+        if (!map->bus)
+                return -EINVAL;
         if (val_len % map->format.val_bytes)
                 return -EINVAL;
         if (reg % map->reg_stride)
@@ -1334,6 +1517,8 @@ int regmap_bulk_read(struct regmap *map, unsigned int reg, void *val,
         size_t val_bytes = map->format.val_bytes;
         bool vol = regmap_volatile_range(map, reg, val_count);
 
+        if (!map->bus)
+                return -EINVAL;
         if (!map->format.parse_val)
                 return -EINVAL;
         if (reg % map->reg_stride)
@@ -1450,6 +1635,68 @@ int regmap_update_bits_check(struct regmap *map, unsigned int reg,
 }
 EXPORT_SYMBOL_GPL(regmap_update_bits_check);
 
+void regmap_async_complete_cb(struct regmap_async *async, int ret)
+{
+        struct regmap *map = async->map;
+        bool wake;
+
+        spin_lock(&map->async_lock);
+
+        list_del(&async->list);
+        wake = list_empty(&map->async_list);
+
+        if (ret != 0)
+                map->async_ret = ret;
+
+        spin_unlock(&map->async_lock);
+
+        schedule_work(&async->cleanup);
+
+        if (wake)
+                wake_up(&map->async_waitq);
+}
+EXPORT_SYMBOL_GPL(regmap_async_complete_cb);
+
+static int regmap_async_is_done(struct regmap *map)
+{
+        unsigned long flags;
+        int ret;
+
+        spin_lock_irqsave(&map->async_lock, flags);
+        ret = list_empty(&map->async_list);
+        spin_unlock_irqrestore(&map->async_lock, flags);
+
+        return ret;
+}
+
+/**
+ * regmap_async_complete: Ensure all asynchronous I/O has completed.
+ *
+ * @map: Map to operate on.
+ *
+ * Blocks until any pending asynchronous I/O has completed.  Returns
+ * an error code for any failed I/O operations.
+ */
+int regmap_async_complete(struct regmap *map)
+{
+        unsigned long flags;
+        int ret;
+
+        /* Nothing to do with no async support */
+        if (!map->bus->async_write)
+                return 0;
+
+        wait_event(map->async_waitq, regmap_async_is_done(map));
+
+        spin_lock_irqsave(&map->async_lock, flags);
+        ret = map->async_ret;
+        map->async_ret = 0;
+        spin_unlock_irqrestore(&map->async_lock, flags);
+
+        return ret;
+}
+EXPORT_SYMBOL_GPL(regmap_async_complete);
+
 /**
  * regmap_register_patch: Register and apply register updates to be applied
  *                        on device initialistion
diff --git a/drivers/bcma/bcma_private.h b/drivers/bcma/bcma_private.h
index 19e3fbfd5757..cb0c45488572 100644
--- a/drivers/bcma/bcma_private.h
+++ b/drivers/bcma/bcma_private.h
@@ -94,11 +94,16 @@ void bcma_core_pci_hostmode_init(struct bcma_drv_pci *pc);
 #ifdef CONFIG_BCMA_DRIVER_GPIO
 /* driver_gpio.c */
 int bcma_gpio_init(struct bcma_drv_cc *cc);
+int bcma_gpio_unregister(struct bcma_drv_cc *cc);
 #else
 static inline int bcma_gpio_init(struct bcma_drv_cc *cc)
 {
         return -ENOTSUPP;
 }
+static inline int bcma_gpio_unregister(struct bcma_drv_cc *cc)
+{
+        return 0;
+}
 #endif /* CONFIG_BCMA_DRIVER_GPIO */
 
 #endif
diff --git a/drivers/bcma/driver_chipcommon_nflash.c b/drivers/bcma/driver_chipcommon_nflash.c
index dbda91e4dff5..1f0b83e18f68 100644
--- a/drivers/bcma/driver_chipcommon_nflash.c
+++ b/drivers/bcma/driver_chipcommon_nflash.c
@@ -21,7 +21,7 @@ int bcma_nflash_init(struct bcma_drv_cc *cc)
         struct bcma_bus *bus = cc->core->bus;
 
         if (bus->chipinfo.id != BCMA_CHIP_ID_BCM4706 &&
-            cc->core->id.rev != 0x38) {
+            cc->core->id.rev != 38) {
                 bcma_err(bus, "NAND flash on unsupported board!\n");
                 return -ENOTSUPP;
         }
diff --git a/drivers/bcma/driver_gpio.c b/drivers/bcma/driver_gpio.c
index 9a6f585da2d9..71f755c06fc6 100644
--- a/drivers/bcma/driver_gpio.c
+++ b/drivers/bcma/driver_gpio.c
@@ -96,3 +96,8 @@ int bcma_gpio_init(struct bcma_drv_cc *cc)
 
         return gpiochip_add(chip);
 }
+
+int bcma_gpio_unregister(struct bcma_drv_cc *cc)
+{
+        return gpiochip_remove(&cc->gpio);
+}
diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c
index 4a92f647b58b..324f9debda88 100644
--- a/drivers/bcma/main.c
+++ b/drivers/bcma/main.c
@@ -268,6 +268,13 @@ int bcma_bus_register(struct bcma_bus *bus)
 void bcma_bus_unregister(struct bcma_bus *bus)
 {
         struct bcma_device *cores[3];
+        int err;
+
+        err = bcma_gpio_unregister(&bus->drv_cc);
+        if (err == -EBUSY)
+                bcma_err(bus, "Some GPIOs are still in use.\n");
+        else if (err)
+                bcma_err(bus, "Can not unregister GPIO driver: %i\n", err);
 
         cores[0] = bcma_find_core(bus, BCMA_CORE_MIPS_74K);
         cores[1] = bcma_find_core(bus, BCMA_CORE_PCIE);
diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c
index f58a4a4b4dfb..2b8303ad63c9 100644
--- a/drivers/block/drbd/drbd_req.c
+++ b/drivers/block/drbd/drbd_req.c
@@ -168,7 +168,7 @@ static void wake_all_senders(struct drbd_tconn *tconn) {
 }
 
 /* must hold resource->req_lock */
-static void start_new_tl_epoch(struct drbd_tconn *tconn)
+void start_new_tl_epoch(struct drbd_tconn *tconn)
 {
         /* no point closing an epoch, if it is empty, anyways. */
         if (tconn->current_tle_writes == 0)
diff --git a/drivers/block/drbd/drbd_req.h b/drivers/block/drbd/drbd_req.h
index 016de6b8bb57..c08d22964d06 100644
--- a/drivers/block/drbd/drbd_req.h
+++ b/drivers/block/drbd/drbd_req.h
@@ -267,6 +267,7 @@ struct bio_and_error {
         int error;
 };
 
+extern void start_new_tl_epoch(struct drbd_tconn *tconn);
 extern void drbd_req_destroy(struct kref *kref);
 extern void _req_may_be_done(struct drbd_request *req,
                 struct bio_and_error *m);
diff --git a/drivers/block/drbd/drbd_state.c b/drivers/block/drbd/drbd_state.c
index 53bf6182bac4..0fe220cfb9e9 100644
--- a/drivers/block/drbd/drbd_state.c
+++ b/drivers/block/drbd/drbd_state.c
@@ -931,6 +931,7 @@ __drbd_set_state(struct drbd_conf *mdev, union drbd_state ns,
         enum drbd_state_rv rv = SS_SUCCESS;
         enum sanitize_state_warnings ssw;
         struct after_state_chg_work *ascw;
+        bool did_remote, should_do_remote;
 
         os = drbd_read_state(mdev);
 
@@ -981,11 +982,17 @@ __drbd_set_state(struct drbd_conf *mdev, union drbd_state ns,
             (os.disk != D_DISKLESS && ns.disk == D_DISKLESS))
                 atomic_inc(&mdev->local_cnt);
 
+        did_remote = drbd_should_do_remote(mdev->state);
         mdev->state.i = ns.i;
+        should_do_remote = drbd_should_do_remote(mdev->state);
         mdev->tconn->susp = ns.susp;
         mdev->tconn->susp_nod = ns.susp_nod;
         mdev->tconn->susp_fen = ns.susp_fen;
 
+        /* put replicated vs not-replicated requests in seperate epochs */
+        if (did_remote != should_do_remote)
+                start_new_tl_epoch(mdev->tconn);
+
         if (os.disk == D_ATTACHING && ns.disk >= D_NEGOTIATING)
                 drbd_print_uuids(mdev, "attached to UUIDs");
 
diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
index 9694dd99bbbc..3fd100990453 100644
--- a/drivers/block/mtip32xx/mtip32xx.c
+++ b/drivers/block/mtip32xx/mtip32xx.c
@@ -626,12 +626,13 @@ static void mtip_timeout_function(unsigned long int data)
                 }
         }
 
-        if (cmdto_cnt && !test_bit(MTIP_PF_IC_ACTIVE_BIT, &port->flags)) {
+        if (cmdto_cnt) {
                 print_tags(port->dd, "timed out", tagaccum, cmdto_cnt);
-
-                mtip_restart_port(port);
+                if (!test_bit(MTIP_PF_IC_ACTIVE_BIT, &port->flags)) {
+                        mtip_restart_port(port);
+                        wake_up_interruptible(&port->svc_wait);
+                }
                 clear_bit(MTIP_PF_EH_ACTIVE_BIT, &port->flags);
-                wake_up_interruptible(&port->svc_wait);
         }
 
         if (port->ic_pause_timer) {
@@ -3887,7 +3888,12 @@ static int mtip_block_remove(struct driver_data *dd)
          * Delete our gendisk structure. This also removes the device
          * from /dev
          */
-        del_gendisk(dd->disk);
+        if (dd->disk) {
+                if (dd->disk->queue)
+                        del_gendisk(dd->disk);
+                else
+                        put_disk(dd->disk);
+        }
 
         spin_lock(&rssd_index_lock);
         ida_remove(&rssd_index_ida, dd->index);
@@ -3921,7 +3927,13 @@ static int mtip_block_shutdown(struct driver_data *dd)
                 "Shutting down %s ...\n", dd->disk->disk_name);
 
         /* Delete our gendisk structure, and cleanup the blk queue. */
-        del_gendisk(dd->disk);
+        if (dd->disk) {
+                if (dd->disk->queue)
+                        del_gendisk(dd->disk);
+                else
+                        put_disk(dd->disk);
+        }
+
 
         spin_lock(&rssd_index_lock);
         ida_remove(&rssd_index_ida, dd->index);
diff --git a/drivers/block/sunvdc.c b/drivers/block/sunvdc.c
index 564156a8e572..5814deb6963d 100644
--- a/drivers/block/sunvdc.c
+++ b/drivers/block/sunvdc.c
@@ -461,7 +461,7 @@ static int generic_request(struct vdc_port *port, u8 op, void *buf, int len)
         int op_len, err;
         void *req_buf;
 
-        if (!(((u64)1 << ((u64)op - 1)) & port->operations))
+        if (!(((u64)1 << (u64)op) & port->operations))
                 return -EOPNOTSUPP;
 
         switch (op) {
diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c
index 9d8409c02082..8ad21a25bc0d 100644
--- a/drivers/block/virtio_blk.c
+++ b/drivers/block/virtio_blk.c
@@ -889,6 +889,7 @@ static void virtblk_remove(struct virtio_device *vdev)
 {
         struct virtio_blk *vblk = vdev->priv;
         int index = vblk->index;
+        int refc;
 
         /* Prevent config work handler from accessing the device. */
         mutex_lock(&vblk->config_lock);
@@ -903,11 +904,15 @@ static void virtblk_remove(struct virtio_device *vdev)
 
         flush_work(&vblk->config_work);
 
+        refc = atomic_read(&disk_to_dev(vblk->disk)->kobj.kref.refcount);
         put_disk(vblk->disk);
         mempool_destroy(vblk->pool);
         vdev->config->del_vqs(vdev);
         kfree(vblk);
-        ida_simple_remove(&vd_index_ida, index);
+
+        /* Only free device id if we don't have any users */
+        if (refc == 1)
+                ida_simple_remove(&vd_index_ida, index);
 }
 
 #ifdef CONFIG_PM
diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
index 74374fb762aa..5ac841ff6cc7 100644
--- a/drivers/block/xen-blkback/blkback.c
+++ b/drivers/block/xen-blkback/blkback.c
@@ -161,10 +161,12 @@ static int dispatch_rw_block_io(struct xen_blkif *blkif,
 static void make_response(struct xen_blkif *blkif, u64 id,
                           unsigned short op, int st);
 
-#define foreach_grant(pos, rbtree, node) \
-        for ((pos) = container_of(rb_first((rbtree)), typeof(*(pos)), node); \
+#define foreach_grant_safe(pos, n, rbtree, node) \
+        for ((pos) = container_of(rb_first((rbtree)), typeof(*(pos)), node), \
+             (n) = rb_next(&(pos)->node); \
              &(pos)->node != NULL; \
-             (pos) = container_of(rb_next(&(pos)->node), typeof(*(pos)), node))
+             (pos) = container_of(n, typeof(*(pos)), node), \
+             (n) = (&(pos)->node != NULL) ? rb_next(&(pos)->node) : NULL)
 
 
 static void add_persistent_gnt(struct rb_root *root,
@@ -217,10 +219,11 @@ static void free_persistent_gnts(struct rb_root *root, unsigned int num)
         struct gnttab_unmap_grant_ref unmap[BLKIF_MAX_SEGMENTS_PER_REQUEST];
         struct page *pages[BLKIF_MAX_SEGMENTS_PER_REQUEST];
         struct persistent_gnt *persistent_gnt;
+        struct rb_node *n;
         int ret = 0;
         int segs_to_unmap = 0;
 
-        foreach_grant(persistent_gnt, root, node) {
+        foreach_grant_safe(persistent_gnt, n, root, node) {
                 BUG_ON(persistent_gnt->handle ==
                         BLKBACK_INVALID_HANDLE);
                 gnttab_set_unmap_op(&unmap[segs_to_unmap],
@@ -230,9 +233,6 @@ static void free_persistent_gnts(struct rb_root *root, unsigned int num)
                         persistent_gnt->handle);
 
                 pages[segs_to_unmap] = persistent_gnt->page;
-                rb_erase(&persistent_gnt->node, root);
-                kfree(persistent_gnt);
-                num--;
 
                 if (++segs_to_unmap == BLKIF_MAX_SEGMENTS_PER_REQUEST ||
                         !rb_next(&persistent_gnt->node)) {
@@ -241,6 +241,10 @@ static void free_persistent_gnts(struct rb_root *root, unsigned int num)
                         BUG_ON(ret);
                         segs_to_unmap = 0;
                 }
+
+                rb_erase(&persistent_gnt->node, root);
+                kfree(persistent_gnt);
+                num--;
         }
         BUG_ON(num != 0);
 }
diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c
index 96e9b00db081..11043c18ac5a 100644
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -792,6 +792,7 @@ static void blkif_free(struct blkfront_info *info, int suspend)
 {
         struct llist_node *all_gnts;
         struct grant *persistent_gnt;
+        struct llist_node *n;
 
         /* Prevent new requests being issued until we fix things up. */
         spin_lock_irq(&info->io_lock);
@@ -804,7 +805,7 @@ static void blkif_free(struct blkfront_info *info, int suspend)
         /* Remove all persistent grants */
         if (info->persistent_gnts_c) {
                 all_gnts = llist_del_all(&info->persistent_gnts);
-                llist_for_each_entry(persistent_gnt, all_gnts, node) {
+                llist_for_each_entry_safe(persistent_gnt, n, all_gnts, node) {
                         gnttab_end_foreign_access(persistent_gnt->gref, 0, 0UL);
                         __free_page(pfn_to_page(persistent_gnt->pfn));
                         kfree(persistent_gnt);
@@ -835,7 +836,7 @@ static void blkif_free(struct blkfront_info *info, int suspend)
 static void blkif_completion(struct blk_shadow *s, struct blkfront_info *info,
                              struct blkif_response *bret)
 {
-        int i;
+        int i = 0;
         struct bio_vec *bvec;
         struct req_iterator iter;
         unsigned long flags;
@@ -852,7 +853,8 @@ static void blkif_completion(struct blk_shadow *s, struct blkfront_info *info,
                  */
                 rq_for_each_segment(bvec, s->request, iter) {
                         BUG_ON((bvec->bv_offset + bvec->bv_len) > PAGE_SIZE);
-                        i = offset >> PAGE_SHIFT;
+                        if (bvec->bv_offset < offset)
+                                i++;
                         BUG_ON(i >= s->req.u.rw.nr_segments);
                         shared_data = kmap_atomic(
                                 pfn_to_page(s->grants_used[i]->pfn));
@@ -861,7 +863,7 @@ static void blkif_completion(struct blk_shadow *s, struct blkfront_info *info,
                                 bvec->bv_len);
                         bvec_kunmap_irq(bvec_data, &flags);
                         kunmap_atomic(shared_data);
-                        offset += bvec->bv_len;
+                        offset = bvec->bv_offset + bvec->bv_len;
                 }
         }
         /* Add the persistent grant into the list of free grants */
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
index b00000e8aef6..33c9a44a9678 100644
--- a/drivers/bluetooth/ath3k.c
+++ b/drivers/bluetooth/ath3k.c
@@ -77,10 +77,15 @@ static struct usb_device_id ath3k_table[] = {
         { USB_DEVICE(0x0CF3, 0x311D) },
         { USB_DEVICE(0x13d3, 0x3375) },
         { USB_DEVICE(0x04CA, 0x3005) },
+        { USB_DEVICE(0x04CA, 0x3006) },
+        { USB_DEVICE(0x04CA, 0x3008) },
         { USB_DEVICE(0x13d3, 0x3362) },
         { USB_DEVICE(0x0CF3, 0xE004) },
         { USB_DEVICE(0x0930, 0x0219) },
         { USB_DEVICE(0x0489, 0xe057) },
+        { USB_DEVICE(0x13d3, 0x3393) },
+        { USB_DEVICE(0x0489, 0xe04e) },
+        { USB_DEVICE(0x0489, 0xe056) },
 
         /* Atheros AR5BBU12 with sflash firmware */
         { USB_DEVICE(0x0489, 0xE02C) },
@@ -104,10 +109,15 @@ static struct usb_device_id ath3k_blist_tbl[] = {
         { USB_DEVICE(0x0cf3, 0x311D), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
 
         /* Atheros AR5BBU22 with sflash firmware */
         { USB_DEVICE(0x0489, 0xE03C), .driver_info = BTUSB_ATH3012 },
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index a1d4ede5b892..7e351e345476 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -135,10 +135,15 @@ static struct usb_device_id blacklist_table[] = {
         { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x13d3, 0x3375), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 },
         { USB_DEVICE(0x0489, 0xe057), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x13d3, 0x3393), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0489, 0xe04e), .driver_info = BTUSB_ATH3012 },
+        { USB_DEVICE(0x0489, 0xe056), .driver_info = BTUSB_ATH3012 },
 
         /* Atheros AR5BBU12 with sflash firmware */
         { USB_DEVICE(0x0489, 0xe02c), .driver_info = BTUSB_IGNORE },
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 684b0d53764f..ee4dbeafb377 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -2062,7 +2062,8 @@ static void virtcons_remove(struct virtio_device *vdev)
         /* Disable interrupts for vqs */
         vdev->config->reset(vdev);
         /* Finish up work that's lined up */
-        cancel_work_sync(&portdev->control_work);
+        if (use_multiport(portdev))
+                cancel_work_sync(&portdev->control_work);
 
         list_for_each_entry_safe(port, port2, &portdev->ports, list)
                 unplug_port(port);
diff --git a/drivers/clk/mvebu/clk-cpu.c b/drivers/clk/mvebu/clk-cpu.c
index ff004578a119..9dd2551a0a41 100644
--- a/drivers/clk/mvebu/clk-cpu.c
+++ b/drivers/clk/mvebu/clk-cpu.c
@@ -124,7 +124,7 @@ void __init of_cpu_clk_setup(struct device_node *node)
 
         clks = kzalloc(ncpus * sizeof(*clks), GFP_KERNEL);
         if (WARN_ON(!clks))
-                return;
+                goto clks_out;
 
         for_each_node_by_type(dn, "cpu") {
                 struct clk_init_data init;
@@ -134,11 +134,11 @@ void __init of_cpu_clk_setup(struct device_node *node)
                 int cpu, err;
 
                 if (WARN_ON(!clk_name))
-                        return;
+                        goto bail_out;
 
                 err = of_property_read_u32(dn, "reg", &cpu);
                 if (WARN_ON(err))
-                        return;
+                        goto bail_out;
 
                 sprintf(clk_name, "cpu%d", cpu);
                 parent_clk = of_clk_get(node, 0);
@@ -167,6 +167,9 @@ void __init of_cpu_clk_setup(struct device_node *node)
         return;
 bail_out:
         kfree(clks);
+        while(ncpus--)
+                kfree(cpuclk[ncpus].clk_name);
+clks_out:
         kfree(cpuclk);
 }
 
diff --git a/drivers/cpufreq/Kconfig.x86 b/drivers/cpufreq/Kconfig.x86
index 934854ae5eb4..7227cd734042 100644
--- a/drivers/cpufreq/Kconfig.x86
+++ b/drivers/cpufreq/Kconfig.x86
@@ -106,7 +106,7 @@ config X86_POWERNOW_K7_ACPI
 config X86_POWERNOW_K8
         tristate "AMD Opteron/Athlon64 PowerNow!"
         select CPU_FREQ_TABLE
-        depends on ACPI && ACPI_PROCESSOR
+        depends on ACPI && ACPI_PROCESSOR && X86_ACPI_CPUFREQ
         help
           This adds the CPUFreq driver for K8/early Opteron/Athlon64 processors.
           Support for K10 and newer processors is now in acpi-cpufreq.
diff --git a/drivers/cpufreq/acpi-cpufreq.c b/drivers/cpufreq/acpi-cpufreq.c
index 0d048f6a2b23..7b0d49d78c61 100644
--- a/drivers/cpufreq/acpi-cpufreq.c
+++ b/drivers/cpufreq/acpi-cpufreq.c
@@ -1030,4 +1030,11 @@ MODULE_PARM_DESC(acpi_pstate_strict,
 late_initcall(acpi_cpufreq_init);
 module_exit(acpi_cpufreq_exit);
 
+static const struct x86_cpu_id acpi_cpufreq_ids[] = {
+        X86_FEATURE_MATCH(X86_FEATURE_ACPI),
+        X86_FEATURE_MATCH(X86_FEATURE_HW_PSTATE),
+        {}
+};
+MODULE_DEVICE_TABLE(x86cpu, acpi_cpufreq_ids);
+
 MODULE_ALIAS("acpi");
diff --git a/drivers/cpufreq/cpufreq-cpu0.c b/drivers/cpufreq/cpufreq-cpu0.c
index 52bf36d599f5..debc5a7c8db6 100644
--- a/drivers/cpufreq/cpufreq-cpu0.c
+++ b/drivers/cpufreq/cpufreq-cpu0.c
@@ -71,12 +71,15 @@ static int cpu0_set_target(struct cpufreq_policy *policy,
         }
 
         if (cpu_reg) {
+                rcu_read_lock();
                 opp = opp_find_freq_ceil(cpu_dev, &freq_Hz);
                 if (IS_ERR(opp)) {
+                        rcu_read_unlock();
                         pr_err("failed to find OPP for %ld\n", freq_Hz);
                         return PTR_ERR(opp);
                 }
                 volt = opp_get_voltage(opp);
+                rcu_read_unlock();
                 tol = volt * voltage_tolerance / 100;
                 volt_old = regulator_get_voltage(cpu_reg);
         }
@@ -236,12 +239,14 @@ static int cpu0_cpufreq_driver_init(void)
                  */
                 for (i = 0; freq_table[i].frequency != CPUFREQ_TABLE_END; i++)
                         ;
+                rcu_read_lock();
                 opp = opp_find_freq_exact(cpu_dev,
                                 freq_table[0].frequency * 1000, true);
                 min_uV = opp_get_voltage(opp);
                 opp = opp_find_freq_exact(cpu_dev,
                                 freq_table[i-1].frequency * 1000, true);
                 max_uV = opp_get_voltage(opp);
+                rcu_read_unlock();
                 ret = regulator_set_voltage_time(cpu_reg, min_uV, max_uV);
                 if (ret > 0)
                         transition_latency += ret * 1000;
diff --git a/drivers/cpufreq/omap-cpufreq.c b/drivers/cpufreq/omap-cpufreq.c
index 1f3417a8322d..97102b05843f 100644
--- a/drivers/cpufreq/omap-cpufreq.c
+++ b/drivers/cpufreq/omap-cpufreq.c
@@ -110,13 +110,16 @@ static int omap_target(struct cpufreq_policy *policy,
         freq = ret;
 
         if (mpu_reg) {
+                rcu_read_lock();
                 opp = opp_find_freq_ceil(mpu_dev, &freq);
                 if (IS_ERR(opp)) {
+                        rcu_read_unlock();
                         dev_err(mpu_dev, "%s: unable to find MPU OPP for %d\n",
                                 __func__, freqs.new);
                         return -EINVAL;
                 }
                 volt = opp_get_voltage(opp);
+                rcu_read_unlock();
                 tol = volt * OPP_TOLERANCE / 100;
                 volt_old = regulator_get_voltage(mpu_reg);
         }
diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
index fb4a7dd57f94..e1f6860e069c 100644
--- a/drivers/cpuidle/cpuidle.c
+++ b/drivers/cpuidle/cpuidle.c
@@ -69,24 +69,15 @@ int cpuidle_play_dead(void)
 {
         struct cpuidle_device *dev = __this_cpu_read(cpuidle_devices);
         struct cpuidle_driver *drv = cpuidle_get_cpu_driver(dev);
-        int i, dead_state = -1;
-        int power_usage = INT_MAX;
+        int i;
 
         if (!drv)
                 return -ENODEV;
 
         /* Find lowest-power state that supports long-term idle */
-        for (i = CPUIDLE_DRIVER_STATE_START; i < drv->state_count; i++) {
-                struct cpuidle_state *s = &drv->states[i];
-
-                if (s->power_usage < power_usage && s->enter_dead) {
-                        power_usage = s->power_usage;
-                        dead_state = i;
-                }
-        }
-
-        if (dead_state != -1)
-                return drv->states[dead_state].enter_dead(dev, dead_state);
+        for (i = drv->state_count - 1; i >= CPUIDLE_DRIVER_STATE_START; i--)
+                if (drv->states[i].enter_dead)
+                        return drv->states[i].enter_dead(dev, i);
 
         return -ENODEV;
 }
diff --git a/drivers/cpuidle/driver.c b/drivers/cpuidle/driver.c
index c2b281afe0ed..422c7b69ba7c 100644
--- a/drivers/cpuidle/driver.c
+++ b/drivers/cpuidle/driver.c
@@ -19,34 +19,9 @@ DEFINE_SPINLOCK(cpuidle_driver_lock);
 static void __cpuidle_set_cpu_driver(struct cpuidle_driver *drv, int cpu);
 static struct cpuidle_driver * __cpuidle_get_cpu_driver(int cpu);
 
-static void set_power_states(struct cpuidle_driver *drv)
-{
-        int i;
-
-        /*
-         * cpuidle driver should set the drv->power_specified bit
-         * before registering if the driver provides
-         * power_usage numbers.
-         *
-         * If power_specified is not set,
-         * we fill in power_usage with decreasing values as the
-         * cpuidle code has an implicit assumption that state Cn
-         * uses less power than C(n-1).
-         *
-         * With CONFIG_ARCH_HAS_CPU_RELAX, C0 is already assigned
-         * an power value of -1.  So we use -2, -3, etc, for other
-         * c-states.
-         */
-        for (i = CPUIDLE_DRIVER_STATE_START; i < drv->state_count; i++)
-                drv->states[i].power_usage = -1 - i;
-}
-
 static void __cpuidle_driver_init(struct cpuidle_driver *drv)
 {
         drv->refcnt = 0;
-
-        if (!drv->power_specified)
-                set_power_states(drv);
 }
 
 static int __cpuidle_register_driver(struct cpuidle_driver *drv, int cpu)
diff --git a/drivers/cpuidle/governors/menu.c b/drivers/cpuidle/governors/menu.c
index 20ea33afdda1..fe343a06b7da 100644
--- a/drivers/cpuidle/governors/menu.c
+++ b/drivers/cpuidle/governors/menu.c
@@ -312,7 +312,6 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev)
 {
         struct menu_device *data = &__get_cpu_var(menu_devices);
         int latency_req = pm_qos_request(PM_QOS_CPU_DMA_LATENCY);
-        int power_usage = INT_MAX;
         int i;
         int multiplier;
         struct timespec t;
@@ -383,11 +382,8 @@ static int menu_select(struct cpuidle_driver *drv, struct cpuidle_device *dev)
                 if (s->exit_latency * multiplier > data->predicted_us)
                         continue;
 
-                if (s->power_usage < power_usage) {
-                        power_usage = s->power_usage;
-                        data->last_state_idx = i;
-                        data->exit_us = s->exit_latency;
-                }
+                data->last_state_idx = i;
+                data->exit_us = s->exit_latency;
         }
 
         /* not deepest C-state chosen for low predicted residency */
diff --git a/drivers/cpuidle/sysfs.c b/drivers/cpuidle/sysfs.c
index 340942946106..428754af6236 100644
--- a/drivers/cpuidle/sysfs.c
+++ b/drivers/cpuidle/sysfs.c
@@ -374,7 +374,7 @@ static int cpuidle_add_state_sysfs(struct cpuidle_device *device)
         struct cpuidle_driver *drv = cpuidle_get_cpu_driver(device);
 
         /* state statistics */
-        for (i = 0; i < drv->state_count; i++) {
+        for (i = 0; i < device->state_count; i++) {
                 kobj = kzalloc(sizeof(struct cpuidle_state_kobj), GFP_KERNEL);
                 if (!kobj)
                         goto error_state;
diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
index 53766f39aadd..3b367973a802 100644
--- a/drivers/devfreq/devfreq.c
+++ b/drivers/devfreq/devfreq.c
@@ -994,6 +994,11 @@ module_exit(devfreq_exit);
  * @freq:       The frequency given to target function
  * @flags:      Flags handed from devfreq framework.
  *
+ * Locking: This function must be called under rcu_read_lock(). opp is a rcu
+ * protected pointer. The reason for the same is that the opp pointer which is
+ * returned will remain valid for use with opp_get_{voltage, freq} only while
+ * under the locked area. The pointer returned must be used prior to unlocking
+ * with rcu_read_unlock() to maintain the integrity of the pointer.
  */
 struct opp *devfreq_recommended_opp(struct device *dev, unsigned long *freq,
                                     u32 flags)
diff --git a/drivers/devfreq/exynos4_bus.c b/drivers/devfreq/exynos4_bus.c
index 80c745e83082..46d94e9e95b5 100644
--- a/drivers/devfreq/exynos4_bus.c
+++ b/drivers/devfreq/exynos4_bus.c
@@ -73,6 +73,16 @@ enum busclk_level_idx {
 #define EX4210_LV_NUM   (LV_2 + 1)
 #define EX4x12_LV_NUM   (LV_4 + 1)
 
+/**
+ * struct busfreq_opp_info - opp information for bus
+ * @rate:       Frequency in hertz
+ * @volt:       Voltage in microvolts corresponding to this OPP
+ */
+struct busfreq_opp_info {
+        unsigned long rate;
+        unsigned long volt;
+};
+
 struct busfreq_data {
         enum exynos4_busf_type type;
         struct device *dev;
@@ -80,7 +90,7 @@ struct busfreq_data {
         bool disabled;
         struct regulator *vdd_int;
         struct regulator *vdd_mif; /* Exynos4412/4212 only */
-        struct opp *curr_opp;
+        struct busfreq_opp_info curr_oppinfo;
         struct exynos4_ppmu dmc[2];
 
         struct notifier_block pm_notifier;
@@ -296,13 +306,14 @@ static unsigned int exynos4x12_clkdiv_sclkip[][3] = {
 };
 
 
-static int exynos4210_set_busclk(struct busfreq_data *data, struct opp *opp)
+static int exynos4210_set_busclk(struct busfreq_data *data,
+                                 struct busfreq_opp_info *oppi)
 {
         unsigned int index;
         unsigned int tmp;
 
         for (index = LV_0; index < EX4210_LV_NUM; index++)
-                if (opp_get_freq(opp) == exynos4210_busclk_table[index].clk)
+                if (oppi->rate == exynos4210_busclk_table[index].clk)
                         break;
 
         if (index == EX4210_LV_NUM)
@@ -361,13 +372,14 @@ static int exynos4210_set_busclk(struct busfreq_data *data, struct opp *opp)
         return 0;
 }
 
-static int exynos4x12_set_busclk(struct busfreq_data *data, struct opp *opp)
+static int exynos4x12_set_busclk(struct busfreq_data *data,
+                                 struct busfreq_opp_info *oppi)
 {
         unsigned int index;
         unsigned int tmp;
 
         for (index = LV_0; index < EX4x12_LV_NUM; index++)
-                if (opp_get_freq(opp) == exynos4x12_mifclk_table[index].clk)
+                if (oppi->rate == exynos4x12_mifclk_table[index].clk)
                         break;
 
         if (index == EX4x12_LV_NUM)
@@ -576,11 +588,12 @@ static int exynos4x12_get_intspec(unsigned long mifclk)
         return -EINVAL;
 }
 
-static int exynos4_bus_setvolt(struct busfreq_data *data, struct opp *opp,
-                               struct opp *oldopp)
+static int exynos4_bus_setvolt(struct busfreq_data *data,
+                               struct busfreq_opp_info *oppi,
+                               struct busfreq_opp_info *oldoppi)
 {
         int err = 0, tmp;
-        unsigned long volt = opp_get_voltage(opp);
+        unsigned long volt = oppi->volt;
 
         switch (data->type) {
         case TYPE_BUSF_EXYNOS4210:
@@ -595,11 +608,11 @@ static int exynos4_bus_setvolt(struct busfreq_data *data, struct opp *opp,
                 if (err)
                         break;
 
-                tmp = exynos4x12_get_intspec(opp_get_freq(opp));
+                tmp = exynos4x12_get_intspec(oppi->rate);
                 if (tmp < 0) {
                         err = tmp;
                         regulator_set_voltage(data->vdd_mif,
-                                              opp_get_voltage(oldopp),
+                                              oldoppi->volt,
                                               MAX_SAFEVOLT);
                         break;
                 }
@@ -609,7 +622,7 @@ static int exynos4_bus_setvolt(struct busfreq_data *data, struct opp *opp,
                 /*  Try to recover */
                 if (err)
                         regulator_set_voltage(data->vdd_mif,
-                                              opp_get_voltage(oldopp),
+                                              oldoppi->volt,
                                               MAX_SAFEVOLT);
                 break;
         default:
@@ -626,17 +639,26 @@ static int exynos4_bus_target(struct device *dev, unsigned long *_freq,
         struct platform_device *pdev = container_of(dev, struct platform_device,
                                                     dev);
         struct busfreq_data *data = platform_get_drvdata(pdev);
-        struct opp *opp = devfreq_recommended_opp(dev, _freq, flags);
-        unsigned long freq = opp_get_freq(opp);
-        unsigned long old_freq = opp_get_freq(data->curr_opp);
+        struct opp *opp;
+        unsigned long freq;
+        unsigned long old_freq = data->curr_oppinfo.rate;
+        struct busfreq_opp_info new_oppinfo;
 
-        if (IS_ERR(opp))
+        rcu_read_lock();
+        opp = devfreq_recommended_opp(dev, _freq, flags);
+        if (IS_ERR(opp)) {
+                rcu_read_unlock();
                 return PTR_ERR(opp);
+        }
+        new_oppinfo.rate = opp_get_freq(opp);
+        new_oppinfo.volt = opp_get_voltage(opp);
+        rcu_read_unlock();
+        freq = new_oppinfo.rate;
 
         if (old_freq == freq)
                 return 0;
 
-        dev_dbg(dev, "targetting %lukHz %luuV\n", freq, opp_get_voltage(opp));
+        dev_dbg(dev, "targetting %lukHz %luuV\n", freq, new_oppinfo.volt);
 
         mutex_lock(&data->lock);
 
@@ -644,17 +666,18 @@ static int exynos4_bus_target(struct device *dev, unsigned long *_freq,
                 goto out;
 
         if (old_freq < freq)
-                err = exynos4_bus_setvolt(data, opp, data->curr_opp);
+                err = exynos4_bus_setvolt(data, &new_oppinfo,
+                                          &data->curr_oppinfo);
         if (err)
                 goto out;
 
         if (old_freq != freq) {
                 switch (data->type) {
                 case TYPE_BUSF_EXYNOS4210:
-                        err = exynos4210_set_busclk(data, opp);
+                        err = exynos4210_set_busclk(data, &new_oppinfo);
                         break;
                 case TYPE_BUSF_EXYNOS4x12:
-                        err = exynos4x12_set_busclk(data, opp);
+                        err = exynos4x12_set_busclk(data, &new_oppinfo);
                         break;
                 default:
                         err = -EINVAL;
@@ -664,11 +687,12 @@ static int exynos4_bus_target(struct device *dev, unsigned long *_freq,
                 goto out;
 
         if (old_freq > freq)
-                err = exynos4_bus_setvolt(data, opp, data->curr_opp);
+                err = exynos4_bus_setvolt(data, &new_oppinfo,
+                                          &data->curr_oppinfo);
         if (err)
                 goto out;
 
-        data->curr_opp = opp;
+        data->curr_oppinfo = new_oppinfo;
 out:
         mutex_unlock(&data->lock);
         return err;
@@ -702,7 +726,7 @@ static int exynos4_bus_get_dev_status(struct device *dev,
 
         exynos4_read_ppmu(data);
         busier_dmc = exynos4_get_busier_dmc(data);
-        stat->current_frequency = opp_get_freq(data->curr_opp);
+        stat->current_frequency = data->curr_oppinfo.rate;
 
         if (busier_dmc)
                 addr = S5P_VA_DMC1;
@@ -933,6 +957,7 @@ static int exynos4_busfreq_pm_notifier_event(struct notifier_block *this,
         struct busfreq_data *data = container_of(this, struct busfreq_data,
                                                  pm_notifier);
         struct opp *opp;
+        struct busfreq_opp_info new_oppinfo;
         unsigned long maxfreq = ULONG_MAX;
         int err = 0;
 
@@ -943,18 +968,29 @@ static int exynos4_busfreq_pm_notifier_event(struct notifier_block *this,
 
                 data->disabled = true;
 
+                rcu_read_lock();
                 opp = opp_find_freq_floor(data->dev, &maxfreq);
+                if (IS_ERR(opp)) {
+                        rcu_read_unlock();
+                        dev_err(data->dev, "%s: unable to find a min freq\n",
+                                __func__);
+                        return PTR_ERR(opp);
+                }
+                new_oppinfo.rate = opp_get_freq(opp);
+                new_oppinfo.volt = opp_get_voltage(opp);
+                rcu_read_unlock();
 
-                err = exynos4_bus_setvolt(data, opp, data->curr_opp);
+                err = exynos4_bus_setvolt(data, &new_oppinfo,
+                                          &data->curr_oppinfo);
                 if (err)
                         goto unlock;
 
                 switch (data->type) {
                 case TYPE_BUSF_EXYNOS4210:
-                        err = exynos4210_set_busclk(data, opp);
+                        err = exynos4210_set_busclk(data, &new_oppinfo);
                         break;
                 case TYPE_BUSF_EXYNOS4x12:
-                        err = exynos4x12_set_busclk(data, opp);
+                        err = exynos4x12_set_busclk(data, &new_oppinfo);
                         break;
                 default:
                         err = -EINVAL;
@@ -962,7 +998,7 @@ static int exynos4_busfreq_pm_notifier_event(struct notifier_block *this,
                 if (err)
                         goto unlock;
 
-                data->curr_opp = opp;
+                data->curr_oppinfo = new_oppinfo;
 unlock:
                 mutex_unlock(&data->lock);
                 if (err)
@@ -1027,13 +1063,17 @@ static int exynos4_busfreq_probe(struct platform_device *pdev)
                 }
         }
 
+        rcu_read_lock();
         opp = opp_find_freq_floor(dev, &exynos4_devfreq_profile.initial_freq);
         if (IS_ERR(opp)) {
+                rcu_read_unlock();
                 dev_err(dev, "Invalid initial frequency %lu kHz.\n",
                         exynos4_devfreq_profile.initial_freq);
                 return PTR_ERR(opp);
         }
-        data->curr_opp = opp;
+        data->curr_oppinfo.rate = opp_get_freq(opp);
+        data->curr_oppinfo.volt = opp_get_voltage(opp);
+        rcu_read_unlock();
 
         platform_set_drvdata(pdev, data);
 
diff --git a/drivers/dma/imx-dma.c b/drivers/dma/imx-dma.c
index dbf0e6f8de8a..a7dcf78b1ff8 100644
--- a/drivers/dma/imx-dma.c
+++ b/drivers/dma/imx-dma.c
@@ -684,9 +684,8 @@ static int imxdma_control(struct dma_chan *chan, enum dma_ctrl_cmd cmd,
                         break;
                 }
 
-                imxdmac->hw_chaining = 1;
-                if (!imxdma_hw_chain(imxdmac))
-                        return -EINVAL;
+                imxdmac->hw_chaining = 0;
+
                 imxdmac->ccr_from_device = (mode | IMX_DMA_TYPE_FIFO) |
                         ((IMX_DMA_MEMSIZE_32 | IMX_DMA_TYPE_LINEAR) << 2) |
                         CCR_REN;
diff --git a/drivers/dma/ioat/dma_v3.c b/drivers/dma/ioat/dma_v3.c
index e5fc944de1f0..3e9d66920eb3 100644
--- a/drivers/dma/ioat/dma_v3.c
+++ b/drivers/dma/ioat/dma_v3.c
@@ -951,7 +951,7 @@ static int ioat_xor_val_self_test(struct ioatdma_device *device)
                         goto free_resources;
                 }
         }
-        dma_sync_single_for_device(dev, dest_dma, PAGE_SIZE, DMA_TO_DEVICE);
+        dma_sync_single_for_device(dev, dest_dma, PAGE_SIZE, DMA_FROM_DEVICE);
 
         /* skip validate if the capability is not present */
         if (!dma_has_cap(DMA_XOR_VAL, dma_chan->device->cap_mask))
diff --git a/drivers/dma/tegra20-apb-dma.c b/drivers/dma/tegra20-apb-dma.c
index c39e61bc8172..3cad856fe67f 100644
--- a/drivers/dma/tegra20-apb-dma.c
+++ b/drivers/dma/tegra20-apb-dma.c
@@ -266,6 +266,7 @@ static struct tegra_dma_desc *tegra_dma_desc_get(
                 if (async_tx_test_ack(&dma_desc->txd)) {
                         list_del(&dma_desc->node);
                         spin_unlock_irqrestore(&tdc->lock, flags);
+                        dma_desc->txd.flags = 0;
                         return dma_desc;
                 }
         }
@@ -1050,7 +1051,9 @@ struct dma_async_tx_descriptor *tegra_dma_prep_dma_cyclic(
                                         TEGRA_APBDMA_AHBSEQ_WRAP_SHIFT;
         ahb_seq |= TEGRA_APBDMA_AHBSEQ_BUS_WIDTH_32;
 
-        csr |= TEGRA_APBDMA_CSR_FLOW | TEGRA_APBDMA_CSR_IE_EOC;
+        csr |= TEGRA_APBDMA_CSR_FLOW;
+        if (flags & DMA_PREP_INTERRUPT)
+                csr |= TEGRA_APBDMA_CSR_IE_EOC;
         csr |= tdc->dma_sconfig.slave_id << TEGRA_APBDMA_CSR_REQ_SEL_SHIFT;
 
         apb_seq |= TEGRA_APBDMA_APBSEQ_WRAP_WORD_1;
@@ -1095,7 +1098,8 @@ struct dma_async_tx_descriptor *tegra_dma_prep_dma_cyclic(
                 mem += len;
         }
         sg_req->last_sg = true;
-        dma_desc->txd.flags = 0;
+        if (flags & DMA_CTRL_ACK)
+                dma_desc->txd.flags = DMA_CTRL_ACK;
 
         /*
          * Make sure that mode should not be conflicting with currently
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index ad8bf2aa629d..2d3f8825e8b8 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -31,7 +31,7 @@ static struct ecc_settings **ecc_stngs;
  *
  *FIXME: Produce a better mapping/linearisation.
  */
-struct scrubrate {
+static const struct scrubrate {
        u32 scrubval;           /* bit pattern for scrub rate */
        u32 bandwidth;          /* bandwidth consumed (bytes/sec) */
 } scrubrates[] = {
@@ -239,7 +239,7 @@ static int amd64_get_scrub_rate(struct mem_ctl_info *mci)
  * DRAM base/limit associated with node_id
  */
 static bool amd64_base_limit_match(struct amd64_pvt *pvt, u64 sys_addr,
-                                   unsigned nid)
+                                   u8 nid)
 {
         u64 addr;
 
@@ -265,7 +265,7 @@ static struct mem_ctl_info *find_mc_by_sys_addr(struct mem_ctl_info *mci,
                                                 u64 sys_addr)
 {
         struct amd64_pvt *pvt;
-        unsigned node_id;
+        u8 node_id;
         u32 intlv_en, bits;
 
         /*
@@ -939,7 +939,8 @@ static u64 get_error_address(struct mce *m)
                 struct amd64_pvt *pvt;
                 u64 cc6_base, tmp_addr;
                 u32 tmp;
-                u8 mce_nid, intlv_en;
+                u16 mce_nid;
+                u8 intlv_en;
 
                 if ((addr & GENMASK(24, 47)) >> 24 != 0x00fdf7)
                         return addr;
@@ -979,10 +980,29 @@ static u64 get_error_address(struct mce *m)
         return addr;
 }
 
+static struct pci_dev *pci_get_related_function(unsigned int vendor,
+                                                unsigned int device,
+                                                struct pci_dev *related)
+{
+        struct pci_dev *dev = NULL;
+
+        while ((dev = pci_get_device(vendor, device, dev))) {
+                if (pci_domain_nr(dev->bus) == pci_domain_nr(related->bus) &&
+                    (dev->bus->number == related->bus->number) &&
+                    (PCI_SLOT(dev->devfn) == PCI_SLOT(related->devfn)))
+                        break;
+        }
+
+        return dev;
+}
+
 static void read_dram_base_limit_regs(struct amd64_pvt *pvt, unsigned range)
 {
+        struct amd_northbridge *nb;
+        struct pci_dev *misc, *f1 = NULL;
         struct cpuinfo_x86 *c = &boot_cpu_data;
         int off = range << 3;
+        u32 llim;
 
         amd64_read_pci_cfg(pvt->F1, DRAM_BASE_LO + off,  &pvt->ranges[range].base.lo);
         amd64_read_pci_cfg(pvt->F1, DRAM_LIMIT_LO + off, &pvt->ranges[range].lim.lo);
@@ -996,30 +1016,32 @@ static void read_dram_base_limit_regs(struct amd64_pvt *pvt, unsigned range)
         amd64_read_pci_cfg(pvt->F1, DRAM_BASE_HI + off,  &pvt->ranges[range].base.hi);
         amd64_read_pci_cfg(pvt->F1, DRAM_LIMIT_HI + off, &pvt->ranges[range].lim.hi);
 
-        /* Factor in CC6 save area by reading dst node's limit reg */
-        if (c->x86 == 0x15) {
-                struct pci_dev *f1 = NULL;
-                u8 nid = dram_dst_node(pvt, range);
-                u32 llim;
+        /* F15h: factor in CC6 save area by reading dst node's limit reg */
+        if (c->x86 != 0x15)
+                return;
 
-                f1 = pci_get_domain_bus_and_slot(0, 0, PCI_DEVFN(0x18 + nid, 1));
-                if (WARN_ON(!f1))
-                        return;
+        nb = node_to_amd_nb(dram_dst_node(pvt, range));
+        if (WARN_ON(!nb))
+                return;
 
-                amd64_read_pci_cfg(f1, DRAM_LOCAL_NODE_LIM, &llim);
+        misc = nb->misc;
+        f1 = pci_get_related_function(misc->vendor, PCI_DEVICE_ID_AMD_15H_NB_F1, misc);
+        if (WARN_ON(!f1))
+                return;
 
-                pvt->ranges[range].lim.lo &= GENMASK(0, 15);
+        amd64_read_pci_cfg(f1, DRAM_LOCAL_NODE_LIM, &llim);
 
-                                            /* {[39:27],111b} */
-                pvt->ranges[range].lim.lo |= ((llim & 0x1fff) << 3 | 0x7) << 16;
+        pvt->ranges[range].lim.lo &= GENMASK(0, 15);
 
-                pvt->ranges[range].lim.hi &= GENMASK(0, 7);
+                                    /* {[39:27],111b} */
+        pvt->ranges[range].lim.lo |= ((llim & 0x1fff) << 3 | 0x7) << 16;
 
-                                            /* [47:40] */
-                pvt->ranges[range].lim.hi |= llim >> 13;
+        pvt->ranges[range].lim.hi &= GENMASK(0, 7);
 
-                pci_dev_put(f1);
-        }
+                                    /* [47:40] */
+        pvt->ranges[range].lim.hi |= llim >> 13;
+
+        pci_dev_put(f1);
 }
 
 static void k8_map_sysaddr_to_csrow(struct mem_ctl_info *mci, u64 sys_addr,
@@ -1305,7 +1327,7 @@ static u8 f1x_determine_channel(struct amd64_pvt *pvt, u64 sys_addr,
 }
 
 /* Convert the sys_addr to the normalized DCT address */
-static u64 f1x_get_norm_dct_addr(struct amd64_pvt *pvt, unsigned range,
+static u64 f1x_get_norm_dct_addr(struct amd64_pvt *pvt, u8 range,
                                  u64 sys_addr, bool hi_rng,
                                  u32 dct_sel_base_addr)
 {
@@ -1381,7 +1403,7 @@ static int f10_process_possible_spare(struct amd64_pvt *pvt, u8 dct, int csrow)
  *      -EINVAL:  NOT FOUND
  *      0..csrow = Chip-Select Row
  */
-static int f1x_lookup_addr_in_dct(u64 in_addr, u32 nid, u8 dct)
+static int f1x_lookup_addr_in_dct(u64 in_addr, u8 nid, u8 dct)
 {
         struct mem_ctl_info *mci;
         struct amd64_pvt *pvt;
@@ -1672,23 +1694,6 @@ static struct amd64_family_type amd64_family_types[] = {
         },
 };
 
-static struct pci_dev *pci_get_related_function(unsigned int vendor,
-                                                unsigned int device,
-                                                struct pci_dev *related)
-{
-        struct pci_dev *dev = NULL;
-
-        dev = pci_get_device(vendor, device, dev);
-        while (dev) {
-                if ((dev->bus->number == related->bus->number) &&
-                    (PCI_SLOT(dev->devfn) == PCI_SLOT(related->devfn)))
-                        break;
-                dev = pci_get_device(vendor, device, dev);
-        }
-
-        return dev;
-}
-
 /*
  * These are tables of eigenvectors (one per line) which can be used for the
  * construction of the syndrome tables. The modified syndrome search algorithm
@@ -1696,7 +1701,7 @@ static struct pci_dev *pci_get_related_function(unsigned int vendor,
  *
  * Algorithm courtesy of Ross LaFetra from AMD.
  */
-static u16 x4_vectors[] = {
+static const u16 x4_vectors[] = {
         0x2f57, 0x1afe, 0x66cc, 0xdd88,
         0x11eb, 0x3396, 0x7f4c, 0xeac8,
         0x0001, 0x0002, 0x0004, 0x0008,
@@ -1735,7 +1740,7 @@ static u16 x4_vectors[] = {
         0x19a9, 0x2efe, 0xb5cc, 0x6f88,
 };
 
-static u16 x8_vectors[] = {
+static const u16 x8_vectors[] = {
         0x0145, 0x028a, 0x2374, 0x43c8, 0xa1f0, 0x0520, 0x0a40, 0x1480,
         0x0211, 0x0422, 0x0844, 0x1088, 0x01b0, 0x44e0, 0x23c0, 0xed80,
         0x1011, 0x0116, 0x022c, 0x0458, 0x08b0, 0x8c60, 0x2740, 0x4e80,
@@ -1757,7 +1762,7 @@ static u16 x8_vectors[] = {
         0x0100, 0x0200, 0x0400, 0x0800, 0x1000, 0x2000, 0x4000, 0x8000,
 };
 
-static int decode_syndrome(u16 syndrome, u16 *vectors, unsigned num_vecs,
+static int decode_syndrome(u16 syndrome, const u16 *vectors, unsigned num_vecs,
                            unsigned v_dim)
 {
         unsigned int i, err_sym;
@@ -2181,7 +2186,7 @@ static int init_csrows(struct mem_ctl_info *mci)
 }
 
 /* get all cores on this DCT */
-static void get_cpus_on_this_dct_cpumask(struct cpumask *mask, unsigned nid)
+static void get_cpus_on_this_dct_cpumask(struct cpumask *mask, u16 nid)
 {
         int cpu;
 
@@ -2191,7 +2196,7 @@ static void get_cpus_on_this_dct_cpumask(struct cpumask *mask, unsigned nid)
 }
 
 /* check MCG_CTL on all the cpus on this node */
-static bool amd64_nb_mce_bank_enabled_on_node(unsigned nid)
+static bool amd64_nb_mce_bank_enabled_on_node(u16 nid)
 {
         cpumask_var_t mask;
         int cpu, nbe;
@@ -2224,7 +2229,7 @@ out:
         return ret;
 }
 
-static int toggle_ecc_err_reporting(struct ecc_settings *s, u8 nid, bool on)
+static int toggle_ecc_err_reporting(struct ecc_settings *s, u16 nid, bool on)
 {
         cpumask_var_t cmask;
         int cpu;
@@ -2262,7 +2267,7 @@ static int toggle_ecc_err_reporting(struct ecc_settings *s, u8 nid, bool on)
         return 0;
 }
 
-static bool enable_ecc_error_reporting(struct ecc_settings *s, u8 nid,
+static bool enable_ecc_error_reporting(struct ecc_settings *s, u16 nid,
                                        struct pci_dev *F3)
 {
         bool ret = true;
@@ -2314,7 +2319,7 @@ static bool enable_ecc_error_reporting(struct ecc_settings *s, u8 nid,
         return ret;
 }
 
-static void restore_ecc_error_reporting(struct ecc_settings *s, u8 nid,
+static void restore_ecc_error_reporting(struct ecc_settings *s, u16 nid,
                                         struct pci_dev *F3)
 {
         u32 value, mask = 0x3;          /* UECC/CECC enable */
@@ -2353,7 +2358,7 @@ static const char *ecc_msg =
         "'ecc_enable_override'.\n"
         " (Note that use of the override may cause unknown side effects.)\n";
 
-static bool ecc_enabled(struct pci_dev *F3, u8 nid)
+static bool ecc_enabled(struct pci_dev *F3, u16 nid)
 {
         u32 value;
         u8 ecc_en = 0;
@@ -2474,7 +2479,7 @@ static int amd64_init_one_instance(struct pci_dev *F2)
         struct mem_ctl_info *mci = NULL;
         struct edac_mc_layer layers[2];
         int err = 0, ret;
-        u8 nid = get_node_id(F2);
+        u16 nid = amd_get_node_id(F2);
 
         ret = -ENOMEM;
         pvt = kzalloc(sizeof(struct amd64_pvt), GFP_KERNEL);
@@ -2566,7 +2571,7 @@ err_ret:
 static int amd64_probe_one_instance(struct pci_dev *pdev,
                                     const struct pci_device_id *mc_type)
 {
-        u8 nid = get_node_id(pdev);
+        u16 nid = amd_get_node_id(pdev);
         struct pci_dev *F3 = node_to_amd_nb(nid)->misc;
         struct ecc_settings *s;
         int ret = 0;
@@ -2616,7 +2621,7 @@ static void amd64_remove_one_instance(struct pci_dev *pdev)
 {
         struct mem_ctl_info *mci;
         struct amd64_pvt *pvt;
-        u8 nid = get_node_id(pdev);
+        u16 nid = amd_get_node_id(pdev);
         struct pci_dev *F3 = node_to_amd_nb(nid)->misc;
         struct ecc_settings *s = ecc_stngs[nid];
 
diff --git a/drivers/edac/amd64_edac.h b/drivers/edac/amd64_edac.h
index e864f407806c..35637d83f235 100644
--- a/drivers/edac/amd64_edac.h
+++ b/drivers/edac/amd64_edac.h
@@ -292,12 +292,6 @@
 /* MSRs */
 #define MSR_MCGCTL_NBE                  BIT(4)
 
-/* AMD sets the first MC device at device ID 0x18. */
-static inline u8 get_node_id(struct pci_dev *pdev)
-{
-        return PCI_SLOT(pdev->devfn) - 0x18;
-}
-
 enum amd_families {
         K8_CPUS = 0,
         F10_CPUS,
@@ -340,7 +334,7 @@ struct amd64_pvt {
         /* pci_device handles which we utilize */
         struct pci_dev *F1, *F2, *F3;
 
-        unsigned mc_node_id;    /* MC index of this MC node */
+        u16 mc_node_id;         /* MC index of this MC node */
         int ext_model;          /* extended model value of this node */
         int channel_count;
 
@@ -393,7 +387,7 @@ struct err_info {
         u32 offset;
 };
 
-static inline u64 get_dram_base(struct amd64_pvt *pvt, unsigned i)
+static inline u64 get_dram_base(struct amd64_pvt *pvt, u8 i)
 {
         u64 addr = ((u64)pvt->ranges[i].base.lo & 0xffff0000) << 8;
 
@@ -403,7 +397,7 @@ static inline u64 get_dram_base(struct amd64_pvt *pvt, unsigned i)
         return (((u64)pvt->ranges[i].base.hi & 0x000000ff) << 40) | addr;
 }
 
-static inline u64 get_dram_limit(struct amd64_pvt *pvt, unsigned i)
+static inline u64 get_dram_limit(struct amd64_pvt *pvt, u8 i)
 {
         u64 lim = (((u64)pvt->ranges[i].lim.lo & 0xffff0000) << 8) | 0x00ffffff;
 
diff --git a/drivers/edac/edac_mc.c b/drivers/edac/edac_mc.c
index 281f566a5513..d1e9eb191f2b 100644
--- a/drivers/edac/edac_mc.c
+++ b/drivers/edac/edac_mc.c
@@ -340,7 +340,7 @@ struct mem_ctl_info *edac_mc_alloc(unsigned mc_num,
         /*
          * Alocate and fill the csrow/channels structs
          */
-        mci->csrows = kcalloc(sizeof(*mci->csrows), tot_csrows, GFP_KERNEL);
+        mci->csrows = kcalloc(tot_csrows, sizeof(*mci->csrows), GFP_KERNEL);
         if (!mci->csrows)
                 goto error;
         for (row = 0; row < tot_csrows; row++) {
@@ -351,7 +351,7 @@ struct mem_ctl_info *edac_mc_alloc(unsigned mc_num,
                 csr->csrow_idx = row;
                 csr->mci = mci;
                 csr->nr_channels = tot_channels;
-                csr->channels = kcalloc(sizeof(*csr->channels), tot_channels,
+                csr->channels = kcalloc(tot_channels, sizeof(*csr->channels),
                                         GFP_KERNEL);
                 if (!csr->channels)
                         goto error;
@@ -369,7 +369,7 @@ struct mem_ctl_info *edac_mc_alloc(unsigned mc_num,
         /*
          * Allocate and fill the dimm structs
          */
-        mci->dimms  = kcalloc(sizeof(*mci->dimms), tot_dimms, GFP_KERNEL);
+        mci->dimms  = kcalloc(tot_dimms, sizeof(*mci->dimms), GFP_KERNEL);
         if (!mci->dimms)
                 goto error;
 
diff --git a/drivers/edac/edac_pci_sysfs.c b/drivers/edac/edac_pci_sysfs.c
index dc6e905ee1a5..0056c4dae9d5 100644
--- a/drivers/edac/edac_pci_sysfs.c
+++ b/drivers/edac/edac_pci_sysfs.c
@@ -256,7 +256,7 @@ static ssize_t edac_pci_dev_store(struct kobject *kobj,
         struct edac_pci_dev_attribute *edac_pci_dev;
         edac_pci_dev = (struct edac_pci_dev_attribute *)attr;
 
-        if (edac_pci_dev->show)
+        if (edac_pci_dev->store)
                 return edac_pci_dev->store(edac_pci_dev->value, buffer, count);
         return -EIO;
 }
diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
index fd3ae6290d71..982f1f5f5742 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -471,7 +471,7 @@ void __init dmi_scan_machine(void)
         char __iomem *p, *q;
         int rc;
 
-        if (efi_enabled) {
+        if (efi_enabled(EFI_CONFIG_TABLES)) {
                 if (efi.smbios == EFI_INVALID_TABLE_ADDR)
                         goto error;
 
diff --git a/drivers/firmware/efivars.c b/drivers/firmware/efivars.c
index 7b1c37497c9a..f5596db0cf58 100644
--- a/drivers/firmware/efivars.c
+++ b/drivers/firmware/efivars.c
@@ -674,7 +674,7 @@ static int efi_status_to_err(efi_status_t status)
                 err = -EACCES;
                 break;
         case EFI_NOT_FOUND:
-                err = -ENOENT;
+                err = -EIO;
                 break;
         default:
                 err = -EINVAL;
@@ -793,6 +793,7 @@ static ssize_t efivarfs_file_write(struct file *file,
                 spin_unlock(&efivars->lock);
                 efivar_unregister(var);
                 drop_nlink(inode);
+                d_delete(file->f_dentry);
                 dput(file->f_dentry);
 
         } else {
@@ -994,7 +995,7 @@ static int efivarfs_unlink(struct inode *dir, struct dentry *dentry)
                 list_del(&var->list);
                 spin_unlock(&efivars->lock);
                 efivar_unregister(var);
-                drop_nlink(dir);
+                drop_nlink(dentry->d_inode);
                 dput(dentry);
                 return 0;
         }
@@ -1782,7 +1783,7 @@ efivars_init(void)
         printk(KERN_INFO "EFI Variables Facility v%s %s\n", EFIVARS_VERSION,
                EFIVARS_DATE);
 
-        if (!efi_enabled)
+        if (!efi_enabled(EFI_RUNTIME_SERVICES))
                 return 0;
 
         /* For now we'll register the efi directory at /sys/firmware/efi */
@@ -1822,7 +1823,7 @@ err_put:
 static void __exit
 efivars_exit(void)
 {
-        if (efi_enabled) {
+        if (efi_enabled(EFI_RUNTIME_SERVICES)) {
                 unregister_efivars(&__efivars);
                 kobject_put(efi_kobj);
         }
diff --git a/drivers/firmware/iscsi_ibft_find.c b/drivers/firmware/iscsi_ibft_find.c
index 4da4eb9ae926..2224f1dc074b 100644
--- a/drivers/firmware/iscsi_ibft_find.c
+++ b/drivers/firmware/iscsi_ibft_find.c
@@ -99,7 +99,7 @@ unsigned long __init find_ibft_region(unsigned long *sizep)
         /* iBFT 1.03 section 1.4.3.1 mandates that UEFI machines will
          * only use ACPI for this */
 
-        if (!efi_enabled)
+        if (!efi_enabled(EFI_BOOT))
                 find_ibft_in_mem();
 
         if (ibft_addr) {
diff --git a/drivers/gpio/gpio-mvebu.c b/drivers/gpio/gpio-mvebu.c
index 7d9bd94be8d2..6819d63cb167 100644
--- a/drivers/gpio/gpio-mvebu.c
+++ b/drivers/gpio/gpio-mvebu.c
@@ -547,7 +547,6 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
         mvchip->membase = devm_request_and_ioremap(&pdev->dev, res);
         if (! mvchip->membase) {
                 dev_err(&pdev->dev, "Cannot ioremap\n");
-                kfree(mvchip->chip.label);
                 return -ENOMEM;
         }
 
@@ -557,14 +556,12 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
                 res = platform_get_resource(pdev, IORESOURCE_MEM, 1);
                 if (! res) {
                         dev_err(&pdev->dev, "Cannot get memory resource\n");
-                        kfree(mvchip->chip.label);
                         return -ENODEV;
                 }
 
                 mvchip->percpu_membase = devm_request_and_ioremap(&pdev->dev, res);
                 if (! mvchip->percpu_membase) {
                         dev_err(&pdev->dev, "Cannot ioremap\n");
-                        kfree(mvchip->chip.label);
                         return -ENOMEM;
                 }
         }
@@ -625,7 +622,6 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
         mvchip->irqbase = irq_alloc_descs(-1, 0, ngpios, -1);
         if (mvchip->irqbase < 0) {
                 dev_err(&pdev->dev, "no irqs\n");
-                kfree(mvchip->chip.label);
                 return -ENOMEM;
         }
 
@@ -633,7 +629,6 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
                                     mvchip->membase, handle_level_irq);
         if (! gc) {
                 dev_err(&pdev->dev, "Cannot allocate generic irq_chip\n");
-                kfree(mvchip->chip.label);
                 return -ENOMEM;
         }
 
@@ -668,7 +663,6 @@ static int mvebu_gpio_probe(struct platform_device *pdev)
                 irq_remove_generic_chip(gc, IRQ_MSK(ngpios), IRQ_NOREQUEST,
                                         IRQ_LEVEL | IRQ_NOPROBE);
                 kfree(gc);
-                kfree(mvchip->chip.label);
                 return -ENODEV;
         }
 
diff --git a/drivers/gpio/gpio-samsung.c b/drivers/gpio/gpio-samsung.c
index 01f7fe955590..76be7eed79de 100644
--- a/drivers/gpio/gpio-samsung.c
+++ b/drivers/gpio/gpio-samsung.c
@@ -32,7 +32,6 @@
 
 #include <mach/hardware.h>
 #include <mach/map.h>
-#include <mach/regs-clock.h>
 #include <mach/regs-gpio.h>
 
 #include <plat/cpu.h>
@@ -446,7 +445,7 @@ static struct samsung_gpio_cfg s3c24xx_gpiocfg_banka = {
 };
 #endif
 
-#if defined(CONFIG_ARCH_EXYNOS4) || defined(CONFIG_ARCH_EXYNOS5)
+#if defined(CONFIG_ARCH_EXYNOS4) || defined(CONFIG_SOC_EXYNOS5250)
 static struct samsung_gpio_cfg exynos_gpio_cfg = {
         .set_pull       = exynos_gpio_setpull,
         .get_pull       = exynos_gpio_getpull,
@@ -2446,7 +2445,7 @@ static struct samsung_gpio_chip exynos4_gpios_3[] = {
 };
 #endif
 
-#ifdef CONFIG_ARCH_EXYNOS5
+#ifdef CONFIG_SOC_EXYNOS5250
 static struct samsung_gpio_chip exynos5_gpios_1[] = {
         {
                 .chip   = {
@@ -2614,7 +2613,7 @@ static struct samsung_gpio_chip exynos5_gpios_1[] = {
 };
 #endif
 
-#ifdef CONFIG_ARCH_EXYNOS5
+#ifdef CONFIG_SOC_EXYNOS5250
 static struct samsung_gpio_chip exynos5_gpios_2[] = {
         {
                 .chip   = {
@@ -2675,7 +2674,7 @@ static struct samsung_gpio_chip exynos5_gpios_2[] = {
 };
 #endif
 
-#ifdef CONFIG_ARCH_EXYNOS5
+#ifdef CONFIG_SOC_EXYNOS5250
 static struct samsung_gpio_chip exynos5_gpios_3[] = {
         {
                 .chip   = {
@@ -2711,7 +2710,7 @@ static struct samsung_gpio_chip exynos5_gpios_3[] = {
 };
 #endif
 
-#ifdef CONFIG_ARCH_EXYNOS5
+#ifdef CONFIG_SOC_EXYNOS5250
 static struct samsung_gpio_chip exynos5_gpios_4[] = {
         {
                 .chip   = {
@@ -3010,7 +3009,7 @@ static __init int samsung_gpiolib_init(void)
         int i, nr_chips;
         int group = 0;
 
-#ifdef CONFIG_PINCTRL_SAMSUNG
+#if defined(CONFIG_PINCTRL_EXYNOS) || defined(CONFIG_PINCTRL_EXYNOS5440)
         /*
         * This gpio driver includes support for device tree support and there
         * are platforms using it. In order to maintain compatibility with those
@@ -3026,6 +3025,7 @@ static __init int samsung_gpiolib_init(void)
         static const struct of_device_id exynos_pinctrl_ids[] = {
                 { .compatible = "samsung,pinctrl-exynos4210", },
                 { .compatible = "samsung,pinctrl-exynos4x12", },
+                { .compatible = "samsung,pinctrl-exynos5440", },
         };
         for_each_matching_node(pctrl_np, exynos_pinctrl_ids)
                 if (pctrl_np && of_device_is_available(pctrl_np))
diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
index 2bf9670ba29b..2aa331499f81 100644
--- a/drivers/gpu/drm/drm_mm.c
+++ b/drivers/gpu/drm/drm_mm.c
@@ -221,11 +221,13 @@ static void drm_mm_insert_helper_range(struct drm_mm_node *hole_node,
 
         BUG_ON(!hole_node->hole_follows || node->allocated);
 
-        if (mm->color_adjust)
-                mm->color_adjust(hole_node, color, &adj_start, &adj_end);
-
         if (adj_start < start)
                 adj_start = start;
+        if (adj_end > end)
+                adj_end = end;
+
+        if (mm->color_adjust)
+                mm->color_adjust(hole_node, color, &adj_start, &adj_end);
 
         if (alignment) {
                 unsigned tmp = adj_start % alignment;
@@ -506,7 +508,7 @@ void drm_mm_init_scan(struct drm_mm *mm,
         mm->scan_size = size;
         mm->scanned_blocks = 0;
         mm->scan_hit_start = 0;
-        mm->scan_hit_size = 0;
+        mm->scan_hit_end = 0;
         mm->scan_check_range = 0;
         mm->prev_scanned_node = NULL;
 }
@@ -533,7 +535,7 @@ void drm_mm_init_scan_with_range(struct drm_mm *mm,
         mm->scan_size = size;
         mm->scanned_blocks = 0;
         mm->scan_hit_start = 0;
-        mm->scan_hit_size = 0;
+        mm->scan_hit_end = 0;
         mm->scan_start = start;
         mm->scan_end = end;
         mm->scan_check_range = 1;
@@ -552,8 +554,7 @@ int drm_mm_scan_add_block(struct drm_mm_node *node)
         struct drm_mm *mm = node->mm;
         struct drm_mm_node *prev_node;
         unsigned long hole_start, hole_end;
-        unsigned long adj_start;
-        unsigned long adj_end;
+        unsigned long adj_start, adj_end;
 
         mm->scanned_blocks++;
 
@@ -570,14 +571,8 @@ int drm_mm_scan_add_block(struct drm_mm_node *node)
         node->node_list.next = &mm->prev_scanned_node->node_list;
         mm->prev_scanned_node = node;
 
-        hole_start = drm_mm_hole_node_start(prev_node);
-        hole_end = drm_mm_hole_node_end(prev_node);
-
-        adj_start = hole_start;
-        adj_end = hole_end;
-
-        if (mm->color_adjust)
-                mm->color_adjust(prev_node, mm->scan_color, &adj_start, &adj_end);
+        adj_start = hole_start = drm_mm_hole_node_start(prev_node);
+        adj_end = hole_end = drm_mm_hole_node_end(prev_node);
 
         if (mm->scan_check_range) {
                 if (adj_start < mm->scan_start)
@@ -586,11 +581,14 @@ int drm_mm_scan_add_block(struct drm_mm_node *node)
                         adj_end = mm->scan_end;
         }
 
+        if (mm->color_adjust)
+                mm->color_adjust(prev_node, mm->scan_color,
+                                 &adj_start, &adj_end);
+
         if (check_free_hole(adj_start, adj_end,
                             mm->scan_size, mm->scan_alignment)) {
                 mm->scan_hit_start = hole_start;
-                mm->scan_hit_size = hole_end;
-
+                mm->scan_hit_end = hole_end;
                 return 1;
         }
 
@@ -626,19 +624,10 @@ int drm_mm_scan_remove_block(struct drm_mm_node *node)
                                node_list);
 
         prev_node->hole_follows = node->scanned_preceeds_hole;
-        INIT_LIST_HEAD(&node->node_list);
         list_add(&node->node_list, &prev_node->node_list);
 
-        /* Only need to check for containement because start&size for the
-         * complete resulting free block (not just the desired part) is
-         * stored. */
-        if (node->start >= mm->scan_hit_start &&
-            node->start + node->size
-                        <= mm->scan_hit_start + mm->scan_hit_size) {
-                return 1;
-        }
-
-        return 0;
+         return (drm_mm_hole_node_end(node) > mm->scan_hit_start &&
+                 node->start < mm->scan_hit_end);
 }
 EXPORT_SYMBOL(drm_mm_scan_remove_block);
 
diff --git a/drivers/gpu/drm/exynos/Kconfig b/drivers/gpu/drm/exynos/Kconfig
index 1d1f1e5e33f0..046bcda36abe 100644
--- a/drivers/gpu/drm/exynos/Kconfig
+++ b/drivers/gpu/drm/exynos/Kconfig
@@ -24,7 +24,7 @@ config DRM_EXYNOS_DMABUF
 
 config DRM_EXYNOS_FIMD
         bool "Exynos DRM FIMD"
-        depends on DRM_EXYNOS && !FB_S3C
+        depends on DRM_EXYNOS && !FB_S3C && !ARCH_MULTIPLATFORM
         help
           Choose this option if you want to use Exynos FIMD for DRM.
 
@@ -48,7 +48,7 @@ config DRM_EXYNOS_G2D
 
 config DRM_EXYNOS_IPP
         bool "Exynos DRM IPP"
-        depends on DRM_EXYNOS
+        depends on DRM_EXYNOS && !ARCH_MULTIPLATFORM
         help
           Choose this option if you want to use IPP feature for DRM.
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_connector.c b/drivers/gpu/drm/exynos/exynos_drm_connector.c
index ab37437bad8a..4c5b6859c9ea 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_connector.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_connector.c
@@ -18,7 +18,6 @@
 #include "exynos_drm_drv.h"
 #include "exynos_drm_encoder.h"
 
-#define MAX_EDID 256
 #define to_exynos_connector(x)  container_of(x, struct exynos_drm_connector,\
                                 drm_connector)
 
@@ -96,7 +95,9 @@ static int exynos_drm_connector_get_modes(struct drm_connector *connector)
                                         to_exynos_connector(connector);
         struct exynos_drm_manager *manager = exynos_connector->manager;
         struct exynos_drm_display_ops *display_ops = manager->display_ops;
-        unsigned int count;
+        struct edid *edid = NULL;
+        unsigned int count = 0;
+        int ret;
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
@@ -114,27 +115,21 @@ static int exynos_drm_connector_get_modes(struct drm_connector *connector)
          * because lcd panel has only one mode.
          */
         if (display_ops->get_edid) {
-                int ret;
-                void *edid;
-
-                edid = kzalloc(MAX_EDID, GFP_KERNEL);
-                if (!edid) {
-                        DRM_ERROR("failed to allocate edid\n");
-                        return 0;
+                edid = display_ops->get_edid(manager->dev, connector);
+                if (IS_ERR_OR_NULL(edid)) {
+                        ret = PTR_ERR(edid);
+                        edid = NULL;
+                        DRM_ERROR("Panel operation get_edid failed %d\n", ret);
+                        goto out;
                 }
 
-                ret = display_ops->get_edid(manager->dev, connector,
-                                                edid, MAX_EDID);
-                if (ret < 0) {
-                        DRM_ERROR("failed to get edid data.\n");
-                        kfree(edid);
-                        edid = NULL;
-                        return 0;
+                count = drm_add_edid_modes(connector, edid);
+                if (count < 0) {
+                        DRM_ERROR("Add edid modes failed %d\n", count);
+                        goto out;
                 }
 
                 drm_mode_connector_update_edid_property(connector, edid);
-                count = drm_add_edid_modes(connector, edid);
-                kfree(edid);
         } else {
                 struct exynos_drm_panel_info *panel;
                 struct drm_display_mode *mode = drm_mode_create(connector->dev);
@@ -161,6 +156,8 @@ static int exynos_drm_connector_get_modes(struct drm_connector *connector)
                 count = 1;
         }
 
+out:
+        kfree(edid);
         return count;
 }
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c b/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c
index 9df97714b6c0..ba0a3aa78547 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dmabuf.c
@@ -19,6 +19,7 @@
 struct exynos_drm_dmabuf_attachment {
         struct sg_table sgt;
         enum dma_data_direction dir;
+        bool is_mapped;
 };
 
 static int exynos_gem_attach_dma_buf(struct dma_buf *dmabuf,
@@ -72,17 +73,10 @@ static struct sg_table *
 
         DRM_DEBUG_PRIME("%s\n", __FILE__);
 
-        if (WARN_ON(dir == DMA_NONE))
-                return ERR_PTR(-EINVAL);
-
         /* just return current sgt if already requested. */
-        if (exynos_attach->dir == dir)
+        if (exynos_attach->dir == dir && exynos_attach->is_mapped)
                 return &exynos_attach->sgt;
 
-        /* reattaching is not allowed. */
-        if (WARN_ON(exynos_attach->dir != DMA_NONE))
-                return ERR_PTR(-EBUSY);
-
         buf = gem_obj->buffer;
         if (!buf) {
                 DRM_ERROR("buffer is null.\n");
@@ -107,13 +101,17 @@ static struct sg_table *
                 wr = sg_next(wr);
         }
 
-        nents = dma_map_sg(attach->dev, sgt->sgl, sgt->orig_nents, dir);
-        if (!nents) {
-                DRM_ERROR("failed to map sgl with iommu.\n");
-                sgt = ERR_PTR(-EIO);
-                goto err_unlock;
+        if (dir != DMA_NONE) {
+                nents = dma_map_sg(attach->dev, sgt->sgl, sgt->orig_nents, dir);
+                if (!nents) {
+                        DRM_ERROR("failed to map sgl with iommu.\n");
+                        sg_free_table(sgt);
+                        sgt = ERR_PTR(-EIO);
+                        goto err_unlock;
+                }
         }
 
+        exynos_attach->is_mapped = true;
         exynos_attach->dir = dir;
         attach->priv = exynos_attach;
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_drv.h b/drivers/gpu/drm/exynos/exynos_drm_drv.h
index b9e51bc09e81..4606fac7241a 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_drv.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_drv.h
@@ -148,8 +148,8 @@ struct exynos_drm_overlay {
 struct exynos_drm_display_ops {
         enum exynos_drm_output_type type;
         bool (*is_connected)(struct device *dev);
-        int (*get_edid)(struct device *dev, struct drm_connector *connector,
-                                u8 *edid, int len);
+        struct edid *(*get_edid)(struct device *dev,
+                        struct drm_connector *connector);
         void *(*get_panel)(struct device *dev);
         int (*check_timing)(struct device *dev, void *timing);
         int (*power_on)(struct device *dev, int mode);
diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
index 36c3905536a6..9a4c08e7453c 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c
@@ -324,7 +324,7 @@ out:
         g2d_userptr = NULL;
 }
 
-dma_addr_t *g2d_userptr_get_dma_addr(struct drm_device *drm_dev,
+static dma_addr_t *g2d_userptr_get_dma_addr(struct drm_device *drm_dev,
                                         unsigned long userptr,
                                         unsigned long size,
                                         struct drm_file *filp,
diff --git a/drivers/gpu/drm/exynos/exynos_drm_hdmi.c b/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
index 850e9950b7da..28644539b305 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_hdmi.c
@@ -108,18 +108,17 @@ static bool drm_hdmi_is_connected(struct device *dev)
         return false;
 }
 
-static int drm_hdmi_get_edid(struct device *dev,
-                struct drm_connector *connector, u8 *edid, int len)
+static struct edid *drm_hdmi_get_edid(struct device *dev,
+                        struct drm_connector *connector)
 {
         struct drm_hdmi_context *ctx = to_context(dev);
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
         if (hdmi_ops && hdmi_ops->get_edid)
-                return hdmi_ops->get_edid(ctx->hdmi_ctx->ctx, connector, edid,
-                                          len);
+                return hdmi_ops->get_edid(ctx->hdmi_ctx->ctx, connector);
 
-        return 0;
+        return NULL;
 }
 
 static int drm_hdmi_check_timing(struct device *dev, void *timing)
diff --git a/drivers/gpu/drm/exynos/exynos_drm_hdmi.h b/drivers/gpu/drm/exynos/exynos_drm_hdmi.h
index 784a7e9a766c..d80516fc9ed7 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_hdmi.h
+++ b/drivers/gpu/drm/exynos/exynos_drm_hdmi.h
@@ -30,8 +30,8 @@ struct exynos_drm_hdmi_context {
 struct exynos_hdmi_ops {
         /* display */
         bool (*is_connected)(void *ctx);
-        int (*get_edid)(void *ctx, struct drm_connector *connector,
-                        u8 *edid, int len);
+        struct edid *(*get_edid)(void *ctx,
+                        struct drm_connector *connector);
         int (*check_timing)(void *ctx, void *timing);
         int (*power_on)(void *ctx, int mode);
 
diff --git a/drivers/gpu/drm/exynos/exynos_drm_ipp.c b/drivers/gpu/drm/exynos/exynos_drm_ipp.c
index 0bda96454a02..1a556354e92f 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_ipp.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_ipp.c
@@ -869,7 +869,7 @@ static void ipp_put_event(struct drm_exynos_ipp_cmd_node *c_node,
         }
 }
 
-void ipp_handle_cmd_work(struct device *dev,
+static void ipp_handle_cmd_work(struct device *dev,
                 struct exynos_drm_ippdrv *ippdrv,
                 struct drm_exynos_ipp_cmd_work *cmd_work,
                 struct drm_exynos_ipp_cmd_node *c_node)
diff --git a/drivers/gpu/drm/exynos/exynos_drm_rotator.c b/drivers/gpu/drm/exynos/exynos_drm_rotator.c
index e9e83ef688f0..f976e29def6e 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_rotator.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_rotator.c
@@ -734,7 +734,7 @@ static int rotator_remove(struct platform_device *pdev)
         return 0;
 }
 
-struct rot_limit_table rot_limit_tbl = {
+static struct rot_limit_table rot_limit_tbl = {
         .ycbcr420_2p = {
                 .min_w = 32,
                 .min_h = 32,
@@ -751,7 +751,7 @@ struct rot_limit_table rot_limit_tbl = {
         },
 };
 
-struct platform_device_id rotator_driver_ids[] = {
+static struct platform_device_id rotator_driver_ids[] = {
         {
                 .name           = "exynos-rot",
                 .driver_data    = (unsigned long)&rot_limit_tbl,
diff --git a/drivers/gpu/drm/exynos/exynos_drm_vidi.c b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
index d0ca3c4e06c6..13ccbd4bcfaa 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_vidi.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_vidi.c
@@ -98,10 +98,12 @@ static bool vidi_display_is_connected(struct device *dev)
         return ctx->connected ? true : false;
 }
 
-static int vidi_get_edid(struct device *dev, struct drm_connector *connector,
-                                u8 *edid, int len)
+static struct edid *vidi_get_edid(struct device *dev,
+                        struct drm_connector *connector)
 {
         struct vidi_context *ctx = get_vidi_context(dev);
+        struct edid *edid;
+        int edid_len;
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
 
@@ -111,13 +113,18 @@ static int vidi_get_edid(struct device *dev, struct drm_connector *connector,
          */
         if (!ctx->raw_edid) {
                 DRM_DEBUG_KMS("raw_edid is null.\n");
-                return -EFAULT;
+                return ERR_PTR(-EFAULT);
         }
 
-        memcpy(edid, ctx->raw_edid, min((1 + ctx->raw_edid->extensions)
-                                        * EDID_LENGTH, len));
+        edid_len = (1 + ctx->raw_edid->extensions) * EDID_LENGTH;
+        edid = kzalloc(edid_len, GFP_KERNEL);
+        if (!edid) {
+                DRM_DEBUG_KMS("failed to allocate edid\n");
+                return ERR_PTR(-ENOMEM);
+        }
 
-        return 0;
+        memcpy(edid, ctx->raw_edid, edid_len);
+        return edid;
 }
 
 static void *vidi_get_panel(struct device *dev)
@@ -514,7 +521,6 @@ int vidi_connection_ioctl(struct drm_device *drm_dev, void *data,
         struct exynos_drm_manager *manager;
         struct exynos_drm_display_ops *display_ops;
         struct drm_exynos_vidi_connection *vidi = data;
-        struct edid *raw_edid;
         int edid_len;
 
         DRM_DEBUG_KMS("%s\n", __FILE__);
@@ -551,11 +557,11 @@ int vidi_connection_ioctl(struct drm_device *drm_dev, void *data,
         }
 
         if (vidi->connection) {
-                if (!vidi->edid) {
-                        DRM_DEBUG_KMS("edid data is null.\n");
+                struct edid *raw_edid  = (struct edid *)(uint32_t)vidi->edid;
+                if (!drm_edid_is_valid(raw_edid)) {
+                        DRM_DEBUG_KMS("edid data is invalid.\n");
                         return -EINVAL;
                 }
-                raw_edid = (struct edid *)(uint32_t)vidi->edid;
                 edid_len = (1 + raw_edid->extensions) * EDID_LENGTH;
                 ctx->raw_edid = kzalloc(edid_len, GFP_KERNEL);
                 if (!ctx->raw_edid) {
diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
index 41ff79d8ac8e..fbab3c468603 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmi.c
@@ -34,7 +34,6 @@
 #include <linux/regulator/consumer.h>
 #include <linux/io.h>
 #include <linux/of_gpio.h>
-#include <plat/gpio-cfg.h>
 
 #include <drm/exynos_drm.h>
 
@@ -98,8 +97,7 @@ struct hdmi_context {
 
         void __iomem                    *regs;
         void                            *parent_ctx;
-        int                             external_irq;
-        int                             internal_irq;
+        int                             irq;
 
         struct i2c_client               *ddc_port;
         struct i2c_client               *hdmiphy_port;
@@ -1391,8 +1389,7 @@ static bool hdmi_is_connected(void *ctx)
         return hdata->hpd;
 }
 
-static int hdmi_get_edid(void *ctx, struct drm_connector *connector,
-                                u8 *edid, int len)
+static struct edid *hdmi_get_edid(void *ctx, struct drm_connector *connector)
 {
         struct edid *raw_edid;
         struct hdmi_context *hdata = ctx;
@@ -1400,22 +1397,18 @@ static int hdmi_get_edid(void *ctx, struct drm_connector *connector,
         DRM_DEBUG_KMS("[%d] %s\n", __LINE__, __func__);
 
         if (!hdata->ddc_port)
-                return -ENODEV;
+                return ERR_PTR(-ENODEV);
 
         raw_edid = drm_get_edid(connector, hdata->ddc_port->adapter);
-        if (raw_edid) {
-                hdata->dvi_mode = !drm_detect_hdmi_monitor(raw_edid);
-                memcpy(edid, raw_edid, min((1 + raw_edid->extensions)
-                                        * EDID_LENGTH, len));
-                DRM_DEBUG_KMS("%s : width[%d] x height[%d]\n",
-                        (hdata->dvi_mode ? "dvi monitor" : "hdmi monitor"),
-                        raw_edid->width_cm, raw_edid->height_cm);
-                kfree(raw_edid);
-        } else {
-                return -ENODEV;
-        }
+        if (!raw_edid)
+                return ERR_PTR(-ENODEV);
 
-        return 0;
+        hdata->dvi_mode = !drm_detect_hdmi_monitor(raw_edid);
+        DRM_DEBUG_KMS("%s : width[%d] x height[%d]\n",
+                (hdata->dvi_mode ? "dvi monitor" : "hdmi monitor"),
+                raw_edid->width_cm, raw_edid->height_cm);
+
+        return raw_edid;
 }
 
 static int hdmi_v13_check_timing(struct fb_videomode *check_timing)
@@ -1652,16 +1645,16 @@ static void hdmi_conf_reset(struct hdmi_context *hdata)
 
         /* resetting HDMI core */
         hdmi_reg_writemask(hdata, reg,  0, HDMI_CORE_SW_RSTOUT);
-        mdelay(10);
+        usleep_range(10000, 12000);
         hdmi_reg_writemask(hdata, reg, ~0, HDMI_CORE_SW_RSTOUT);
-        mdelay(10);
+        usleep_range(10000, 12000);
 }
 
 static void hdmi_conf_init(struct hdmi_context *hdata)
 {
         struct hdmi_infoframe infoframe;
 
-        /* disable HPD interrupts */
+        /* disable HPD interrupts from HDMI IP block, use GPIO instead */
         hdmi_reg_writemask(hdata, HDMI_INTC_CON, 0, HDMI_INTC_EN_GLOBAL |
                 HDMI_INTC_EN_HPD_PLUG | HDMI_INTC_EN_HPD_UNPLUG);
 
@@ -1779,7 +1772,7 @@ static void hdmi_v13_timing_apply(struct hdmi_context *hdata)
                 u32 val = hdmi_reg_read(hdata, HDMI_V13_PHY_STATUS);
                 if (val & HDMI_PHY_STATUS_READY)
                         break;
-                mdelay(1);
+                usleep_range(1000, 2000);
         }
         /* steady state not achieved */
         if (tries == 0) {
@@ -1946,7 +1939,7 @@ static void hdmi_v14_timing_apply(struct hdmi_context *hdata)
                 u32 val = hdmi_reg_read(hdata, HDMI_PHY_STATUS_0);
                 if (val & HDMI_PHY_STATUS_READY)
                         break;
-                mdelay(1);
+                usleep_range(1000, 2000);
         }
         /* steady state not achieved */
         if (tries == 0) {
@@ -1998,9 +1991,9 @@ static void hdmiphy_conf_reset(struct hdmi_context *hdata)
 
         /* reset hdmiphy */
         hdmi_reg_writemask(hdata, reg, ~0, HDMI_PHY_SW_RSTOUT);
-        mdelay(10);
+        usleep_range(10000, 12000);
         hdmi_reg_writemask(hdata, reg,  0, HDMI_PHY_SW_RSTOUT);
-        mdelay(10);
+        usleep_range(10000, 12000);
 }
 
 static void hdmiphy_poweron(struct hdmi_context *hdata)
@@ -2048,7 +2041,7 @@ static void hdmiphy_conf_apply(struct hdmi_context *hdata)
                 return;
         }
 
-        mdelay(10);
+        usleep_range(10000, 12000);
 
         /* operation mode */
         operation[0] = 0x1f;
@@ -2170,6 +2163,13 @@ static void hdmi_commit(void *ctx)
 
         DRM_DEBUG_KMS("[%d] %s\n", __LINE__, __func__);
 
+        mutex_lock(&hdata->hdmi_mutex);
+        if (!hdata->powered) {
+                mutex_unlock(&hdata->hdmi_mutex);
+                return;
+        }
+        mutex_unlock(&hdata->hdmi_mutex);
+
         hdmi_conf_apply(hdata);
 }
 
@@ -2265,7 +2265,7 @@ static struct exynos_hdmi_ops hdmi_ops = {
         .dpms           = hdmi_dpms,
 };
 
-static irqreturn_t hdmi_external_irq_thread(int irq, void *arg)
+static irqreturn_t hdmi_irq_thread(int irq, void *arg)
 {
         struct exynos_drm_hdmi_context *ctx = arg;
         struct hdmi_context *hdata = ctx->ctx;
@@ -2280,31 +2280,6 @@ static irqreturn_t hdmi_external_irq_thread(int irq, void *arg)
         return IRQ_HANDLED;
 }
 
-static irqreturn_t hdmi_internal_irq_thread(int irq, void *arg)
-{
-        struct exynos_drm_hdmi_context *ctx = arg;
-        struct hdmi_context *hdata = ctx->ctx;
-        u32 intc_flag;
-
-        intc_flag = hdmi_reg_read(hdata, HDMI_INTC_FLAG);
-        /* clearing flags for HPD plug/unplug */
-        if (intc_flag & HDMI_INTC_FLAG_HPD_UNPLUG) {
-                DRM_DEBUG_KMS("unplugged\n");
-                hdmi_reg_writemask(hdata, HDMI_INTC_FLAG, ~0,
-                        HDMI_INTC_FLAG_HPD_UNPLUG);
-        }
-        if (intc_flag & HDMI_INTC_FLAG_HPD_PLUG) {
-                DRM_DEBUG_KMS("plugged\n");
-                hdmi_reg_writemask(hdata, HDMI_INTC_FLAG, ~0,
-                        HDMI_INTC_FLAG_HPD_PLUG);
-        }
-
-        if (ctx->drm_dev)
-                drm_helper_hpd_irq_event(ctx->drm_dev);
-
-        return IRQ_HANDLED;
-}
-
 static int hdmi_resources_init(struct hdmi_context *hdata)
 {
         struct device *dev = hdata->dev;
@@ -2555,39 +2530,24 @@ static int hdmi_probe(struct platform_device *pdev)
 
         hdata->hdmiphy_port = hdmi_hdmiphy;
 
-        hdata->external_irq = gpio_to_irq(hdata->hpd_gpio);
-        if (hdata->external_irq < 0) {
-                DRM_ERROR("failed to get GPIO external irq\n");
-                ret = hdata->external_irq;
-                goto err_hdmiphy;
-        }
-
-        hdata->internal_irq = platform_get_irq(pdev, 0);
-        if (hdata->internal_irq < 0) {
-                DRM_ERROR("failed to get platform internal irq\n");
-                ret = hdata->internal_irq;
+        hdata->irq = gpio_to_irq(hdata->hpd_gpio);
+        if (hdata->irq < 0) {
+                DRM_ERROR("failed to get GPIO irq\n");
+                ret = hdata->irq;
                 goto err_hdmiphy;
         }
 
         hdata->hpd = gpio_get_value(hdata->hpd_gpio);
 
-        ret = request_threaded_irq(hdata->external_irq, NULL,
-                        hdmi_external_irq_thread, IRQF_TRIGGER_RISING |
+        ret = request_threaded_irq(hdata->irq, NULL,
+                        hdmi_irq_thread, IRQF_TRIGGER_RISING |
                         IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
-                        "hdmi_external", drm_hdmi_ctx);
+                        "hdmi", drm_hdmi_ctx);
         if (ret) {
-                DRM_ERROR("failed to register hdmi external interrupt\n");
+                DRM_ERROR("failed to register hdmi interrupt\n");
                 goto err_hdmiphy;
         }
 
-        ret = request_threaded_irq(hdata->internal_irq, NULL,
-                        hdmi_internal_irq_thread, IRQF_ONESHOT,
-                        "hdmi_internal", drm_hdmi_ctx);
-        if (ret) {
-                DRM_ERROR("failed to register hdmi internal interrupt\n");
-                goto err_free_irq;
-        }
-
         /* Attach HDMI Driver to common hdmi. */
         exynos_hdmi_drv_attach(drm_hdmi_ctx);
 
@@ -2598,8 +2558,6 @@ static int hdmi_probe(struct platform_device *pdev)
 
         return 0;
 
-err_free_irq:
-        free_irq(hdata->external_irq, drm_hdmi_ctx);
 err_hdmiphy:
         i2c_del_driver(&hdmiphy_driver);
 err_ddc:
@@ -2617,8 +2575,7 @@ static int hdmi_remove(struct platform_device *pdev)
 
         pm_runtime_disable(dev);
 
-        free_irq(hdata->internal_irq, hdata);
-        free_irq(hdata->external_irq, hdata);
+        free_irq(hdata->irq, hdata);
 
 
         /* hdmiphy i2c driver */
@@ -2637,8 +2594,7 @@ static int hdmi_suspend(struct device *dev)
 
         DRM_DEBUG_KMS("[%d] %s\n", __LINE__, __func__);
 
-        disable_irq(hdata->internal_irq);
-        disable_irq(hdata->external_irq);
+        disable_irq(hdata->irq);
 
         hdata->hpd = false;
         if (ctx->drm_dev)
@@ -2663,8 +2619,7 @@ static int hdmi_resume(struct device *dev)
 
         hdata->hpd = gpio_get_value(hdata->hpd_gpio);
 
-        enable_irq(hdata->external_irq);
-        enable_irq(hdata->internal_irq);
+        enable_irq(hdata->irq);
 
         if (!pm_runtime_suspended(dev)) {
                 DRM_DEBUG_KMS("%s : Already resumed\n", __func__);
diff --git a/drivers/gpu/drm/exynos/exynos_mixer.c b/drivers/gpu/drm/exynos/exynos_mixer.c
index c187ea33b748..c414584bfbae 100644
--- a/drivers/gpu/drm/exynos/exynos_mixer.c
+++ b/drivers/gpu/drm/exynos/exynos_mixer.c
@@ -600,7 +600,7 @@ static void vp_win_reset(struct mixer_context *ctx)
                 /* waiting until VP_SRESET_PROCESSING is 0 */
                 if (~vp_reg_read(res, VP_SRESET) & VP_SRESET_PROCESSING)
                         break;
-                mdelay(10);
+                usleep_range(10000, 12000);
         }
         WARN(tries == 0, "failed to reset Video Processor\n");
 }
@@ -776,6 +776,13 @@ static void mixer_win_commit(void *ctx, int win)
 
         DRM_DEBUG_KMS("[%d] %s, win: %d\n", __LINE__, __func__, win);
 
+        mutex_lock(&mixer_ctx->mixer_mutex);
+        if (!mixer_ctx->powered) {
+                mutex_unlock(&mixer_ctx->mixer_mutex);
+                return;
+        }
+        mutex_unlock(&mixer_ctx->mixer_mutex);
+
         if (win > 1 && mixer_ctx->vp_enabled)
                 vp_video_buffer(mixer_ctx, win);
         else
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index e6a11ca85eaf..9d4a2c2adf0e 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -30,6 +30,7 @@
 #include <linux/debugfs.h>
 #include <linux/slab.h>
 #include <linux/export.h>
+#include <generated/utsrelease.h>
 #include <drm/drmP.h>
 #include "intel_drv.h"
 #include "intel_ringbuffer.h"
@@ -641,6 +642,7 @@ static void i915_ring_error_state(struct seq_file *m,
         seq_printf(m, "%s command stream:\n", ring_str(ring));
         seq_printf(m, "  HEAD: 0x%08x\n", error->head[ring]);
         seq_printf(m, "  TAIL: 0x%08x\n", error->tail[ring]);
+        seq_printf(m, "  CTL: 0x%08x\n", error->ctl[ring]);
         seq_printf(m, "  ACTHD: 0x%08x\n", error->acthd[ring]);
         seq_printf(m, "  IPEIR: 0x%08x\n", error->ipeir[ring]);
         seq_printf(m, "  IPEHR: 0x%08x\n", error->ipehr[ring]);
@@ -689,10 +691,13 @@ static int i915_error_state(struct seq_file *m, void *unused)
 
         seq_printf(m, "Time: %ld s %ld us\n", error->time.tv_sec,
                    error->time.tv_usec);
+        seq_printf(m, "Kernel: " UTS_RELEASE);
         seq_printf(m, "PCI ID: 0x%04x\n", dev->pci_device);
         seq_printf(m, "EIR: 0x%08x\n", error->eir);
         seq_printf(m, "IER: 0x%08x\n", error->ier);
         seq_printf(m, "PGTBL_ER: 0x%08x\n", error->pgtbl_er);
+        seq_printf(m, "FORCEWAKE: 0x%08x\n", error->forcewake);
+        seq_printf(m, "DERRMR: 0x%08x\n", error->derrmr);
         seq_printf(m, "CCID: 0x%08x\n", error->ccid);
 
         for (i = 0; i < dev_priv->num_fence_regs; i++)
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index ed3059575576..12ab3bdea54d 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -188,10 +188,13 @@ struct drm_i915_error_state {
         u32 pgtbl_er;
         u32 ier;
         u32 ccid;
+        u32 derrmr;
+        u32 forcewake;
         bool waiting[I915_NUM_RINGS];
         u32 pipestat[I915_MAX_PIPES];
         u32 tail[I915_NUM_RINGS];
         u32 head[I915_NUM_RINGS];
+        u32 ctl[I915_NUM_RINGS];
         u32 ipeir[I915_NUM_RINGS];
         u32 ipehr[I915_NUM_RINGS];
         u32 instdone[I915_NUM_RINGS];
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index da3c82e301b1..8febea6daa08 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -1717,7 +1717,8 @@ i915_gem_object_put_pages(struct drm_i915_gem_object *obj)
 }
 
 static long
-i915_gem_purge(struct drm_i915_private *dev_priv, long target)
+__i915_gem_shrink(struct drm_i915_private *dev_priv, long target,
+                  bool purgeable_only)
 {
         struct drm_i915_gem_object *obj, *next;
         long count = 0;
@@ -1725,7 +1726,7 @@ i915_gem_purge(struct drm_i915_private *dev_priv, long target)
         list_for_each_entry_safe(obj, next,
                                  &dev_priv->mm.unbound_list,
                                  gtt_list) {
-                if (i915_gem_object_is_purgeable(obj) &&
+                if ((i915_gem_object_is_purgeable(obj) || !purgeable_only) &&
                     i915_gem_object_put_pages(obj) == 0) {
                         count += obj->base.size >> PAGE_SHIFT;
                         if (count >= target)
@@ -1736,7 +1737,7 @@ i915_gem_purge(struct drm_i915_private *dev_priv, long target)
         list_for_each_entry_safe(obj, next,
                                  &dev_priv->mm.inactive_list,
                                  mm_list) {
-                if (i915_gem_object_is_purgeable(obj) &&
+                if ((i915_gem_object_is_purgeable(obj) || !purgeable_only) &&
                     i915_gem_object_unbind(obj) == 0 &&
                     i915_gem_object_put_pages(obj) == 0) {
                         count += obj->base.size >> PAGE_SHIFT;
@@ -1748,6 +1749,12 @@ i915_gem_purge(struct drm_i915_private *dev_priv, long target)
         return count;
 }
 
+static long
+i915_gem_purge(struct drm_i915_private *dev_priv, long target)
+{
+        return __i915_gem_shrink(dev_priv, target, true);
+}
+
 static void
 i915_gem_shrink_all(struct drm_i915_private *dev_priv)
 {
@@ -3522,14 +3529,15 @@ i915_gem_pin_ioctl(struct drm_device *dev, void *data,
                 goto out;
         }
 
-        obj->user_pin_count++;
-        obj->pin_filp = file;
-        if (obj->user_pin_count == 1) {
+        if (obj->user_pin_count == 0) {
                 ret = i915_gem_object_pin(obj, args->alignment, true, false);
                 if (ret)
                         goto out;
         }
 
+        obj->user_pin_count++;
+        obj->pin_filp = file;
+
         /* XXX - flush the CPU caches for pinned objects
          * as the X server doesn't manage domains yet
          */
@@ -4395,6 +4403,9 @@ i915_gem_inactive_shrink(struct shrinker *shrinker, struct shrink_control *sc)
         if (nr_to_scan) {
                 nr_to_scan -= i915_gem_purge(dev_priv, nr_to_scan);
                 if (nr_to_scan > 0)
+                        nr_to_scan -= __i915_gem_shrink(dev_priv, nr_to_scan,
+                                                        false);
+                if (nr_to_scan > 0)
                         i915_gem_shrink_all(dev_priv);
         }
 
@@ -4402,7 +4413,7 @@ i915_gem_inactive_shrink(struct shrinker *shrinker, struct shrink_control *sc)
         list_for_each_entry(obj, &dev_priv->mm.unbound_list, gtt_list)
                 if (obj->pages_pin_count == 0)
                         cnt += obj->base.size >> PAGE_SHIFT;
-        list_for_each_entry(obj, &dev_priv->mm.bound_list, gtt_list)
+        list_for_each_entry(obj, &dev_priv->mm.inactive_list, gtt_list)
                 if (obj->pin_count == 0 && obj->pages_pin_count == 0)
                         cnt += obj->base.size >> PAGE_SHIFT;
 
diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
index d6a994a07393..26d08bb58218 100644
--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c
@@ -539,6 +539,8 @@ i915_gem_execbuffer_relocate_slow(struct drm_device *dev,
         total = 0;
         for (i = 0; i < count; i++) {
                 struct drm_i915_gem_relocation_entry __user *user_relocs;
+                u64 invalid_offset = (u64)-1;
+                int j;
 
                 user_relocs = (void __user *)(uintptr_t)exec[i].relocs_ptr;
 
@@ -549,6 +551,25 @@ i915_gem_execbuffer_relocate_slow(struct drm_device *dev,
                         goto err;
                 }
 
+                /* As we do not update the known relocation offsets after
+                 * relocating (due to the complexities in lock handling),
+                 * we need to mark them as invalid now so that we force the
+                 * relocation processing next time. Just in case the target
+                 * object is evicted and then rebound into its old
+                 * presumed_offset before the next execbuffer - if that
+                 * happened we would make the mistake of assuming that the
+                 * relocations were valid.
+                 */
+                for (j = 0; j < exec[i].relocation_count; j++) {
+                        if (copy_to_user(&user_relocs[j].presumed_offset,
+                                         &invalid_offset,
+                                         sizeof(invalid_offset))) {
+                                ret = -EFAULT;
+                                mutex_lock(&dev->struct_mutex);
+                                goto err;
+                        }
+                }
+
                 reloc_offset[i] = total;
                 total += exec[i].relocation_count;
         }
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 2220dec3e5d9..fe843389c7b4 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -1157,6 +1157,7 @@ static void i915_record_ring_state(struct drm_device *dev,
         error->acthd[ring->id] = intel_ring_get_active_head(ring);
         error->head[ring->id] = I915_READ_HEAD(ring);
         error->tail[ring->id] = I915_READ_TAIL(ring);
+        error->ctl[ring->id] = I915_READ_CTL(ring);
 
         error->cpu_ring_head[ring->id] = ring->head;
         error->cpu_ring_tail[ring->id] = ring->tail;
@@ -1251,6 +1252,16 @@ static void i915_capture_error_state(struct drm_device *dev)
         else
                 error->ier = I915_READ(IER);
 
+        if (INTEL_INFO(dev)->gen >= 6)
+                error->derrmr = I915_READ(DERRMR);
+
+        if (IS_VALLEYVIEW(dev))
+                error->forcewake = I915_READ(FORCEWAKE_VLV);
+        else if (INTEL_INFO(dev)->gen >= 7)
+                error->forcewake = I915_READ(FORCEWAKE_MT);
+        else if (INTEL_INFO(dev)->gen == 6)
+                error->forcewake = I915_READ(FORCEWAKE);
+
         for_each_pipe(pipe)
                 error->pipestat[pipe] = I915_READ(PIPESTAT(pipe));
 
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 186ee5c85b51..59afb7eb6db6 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -512,6 +512,8 @@
 #define GEN7_ERR_INT    0x44040
 #define   ERR_INT_MMIO_UNCLAIMED (1<<13)
 
+#define DERRMR          0x44050
+
 /* GM45+ chicken bits -- debug workaround bits that may be required
  * for various sorts of correct behavior.  The top 16 bits of each are
  * the enables for writing to the corresponding low bit.
@@ -531,6 +533,7 @@
 #define MI_MODE         0x0209c
 # define VS_TIMER_DISPATCH                              (1 << 6)
 # define MI_FLUSH_ENABLE                                (1 << 12)
+# define ASYNC_FLIP_PERF_DISABLE                        (1 << 14)
 
 #define GEN6_GT_MODE    0x20d0
 #define   GEN6_GT_MODE_HI                               (1 << 9)
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index a9fb046b94a1..da1ad9c80bb5 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -8598,19 +8598,30 @@ int intel_framebuffer_init(struct drm_device *dev,
 {
         int ret;
 
-        if (obj->tiling_mode == I915_TILING_Y)
+        if (obj->tiling_mode == I915_TILING_Y) {
+                DRM_DEBUG("hardware does not support tiling Y\n");
                 return -EINVAL;
+        }
 
-        if (mode_cmd->pitches[0] & 63)
+        if (mode_cmd->pitches[0] & 63) {
+                DRM_DEBUG("pitch (%d) must be at least 64 byte aligned\n",
+                          mode_cmd->pitches[0]);
                 return -EINVAL;
+        }
 
         /* FIXME <= Gen4 stride limits are bit unclear */
-        if (mode_cmd->pitches[0] > 32768)
+        if (mode_cmd->pitches[0] > 32768) {
+                DRM_DEBUG("pitch (%d) must be at less than 32768\n",
+                          mode_cmd->pitches[0]);
                 return -EINVAL;
+        }
 
         if (obj->tiling_mode != I915_TILING_NONE &&
-            mode_cmd->pitches[0] != obj->stride)
+            mode_cmd->pitches[0] != obj->stride) {
+                DRM_DEBUG("pitch (%d) must match tiling stride (%d)\n",
+                          mode_cmd->pitches[0], obj->stride);
                 return -EINVAL;
+        }
 
         /* Reject formats not supported by any plane early. */
         switch (mode_cmd->pixel_format) {
@@ -8621,8 +8632,10 @@ int intel_framebuffer_init(struct drm_device *dev,
                 break;
         case DRM_FORMAT_XRGB1555:
         case DRM_FORMAT_ARGB1555:
-                if (INTEL_INFO(dev)->gen > 3)
+                if (INTEL_INFO(dev)->gen > 3) {
+                        DRM_DEBUG("invalid format: 0x%08x\n", mode_cmd->pixel_format);
                         return -EINVAL;
+                }
                 break;
         case DRM_FORMAT_XBGR8888:
         case DRM_FORMAT_ABGR8888:
@@ -8630,18 +8643,22 @@ int intel_framebuffer_init(struct drm_device *dev,
         case DRM_FORMAT_ARGB2101010:
         case DRM_FORMAT_XBGR2101010:
         case DRM_FORMAT_ABGR2101010:
-                if (INTEL_INFO(dev)->gen < 4)
+                if (INTEL_INFO(dev)->gen < 4) {
+                        DRM_DEBUG("invalid format: 0x%08x\n", mode_cmd->pixel_format);
                         return -EINVAL;
+                }
                 break;
         case DRM_FORMAT_YUYV:
         case DRM_FORMAT_UYVY:
         case DRM_FORMAT_YVYU:
         case DRM_FORMAT_VYUY:
-                if (INTEL_INFO(dev)->gen < 6)
+                if (INTEL_INFO(dev)->gen < 5) {
+                        DRM_DEBUG("invalid format: 0x%08x\n", mode_cmd->pixel_format);
                         return -EINVAL;
+                }
                 break;
         default:
-                DRM_DEBUG_KMS("unsupported pixel format 0x%08x\n", mode_cmd->pixel_format);
+                DRM_DEBUG("unsupported pixel format 0x%08x\n", mode_cmd->pixel_format);
                 return -EINVAL;
         }
 
diff --git a/drivers/gpu/drm/i915/intel_dp.c b/drivers/gpu/drm/i915/intel_dp.c
index 1b63d55318a0..fb3715b4b09d 100644
--- a/drivers/gpu/drm/i915/intel_dp.c
+++ b/drivers/gpu/drm/i915/intel_dp.c
@@ -2579,7 +2579,8 @@ intel_dp_add_properties(struct intel_dp *intel_dp, struct drm_connector *connect
 
 static void
 intel_dp_init_panel_power_sequencer(struct drm_device *dev,
-                                    struct intel_dp *intel_dp)
+                                    struct intel_dp *intel_dp,
+                                    struct edp_power_seq *out)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct edp_power_seq cur, vbt, spec, final;
@@ -2650,16 +2651,35 @@ intel_dp_init_panel_power_sequencer(struct drm_device *dev,
         intel_dp->panel_power_cycle_delay = get_delay(t11_t12);
 #undef get_delay
 
+        DRM_DEBUG_KMS("panel power up delay %d, power down delay %d, power cycle delay %d\n",
+                      intel_dp->panel_power_up_delay, intel_dp->panel_power_down_delay,
+                      intel_dp->panel_power_cycle_delay);
+
+        DRM_DEBUG_KMS("backlight on delay %d, off delay %d\n",
+                      intel_dp->backlight_on_delay, intel_dp->backlight_off_delay);
+
+        if (out)
+                *out = final;
+}
+
+static void
+intel_dp_init_panel_power_sequencer_registers(struct drm_device *dev,
+                                              struct intel_dp *intel_dp,
+                                              struct edp_power_seq *seq)
+{
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        u32 pp_on, pp_off, pp_div;
+
         /* And finally store the new values in the power sequencer. */
-        pp_on = (final.t1_t3 << PANEL_POWER_UP_DELAY_SHIFT) |
-                (final.t8 << PANEL_LIGHT_ON_DELAY_SHIFT);
-        pp_off = (final.t9 << PANEL_LIGHT_OFF_DELAY_SHIFT) |
-                 (final.t10 << PANEL_POWER_DOWN_DELAY_SHIFT);
+        pp_on = (seq->t1_t3 << PANEL_POWER_UP_DELAY_SHIFT) |
+                (seq->t8 << PANEL_LIGHT_ON_DELAY_SHIFT);
+        pp_off = (seq->t9 << PANEL_LIGHT_OFF_DELAY_SHIFT) |
+                 (seq->t10 << PANEL_POWER_DOWN_DELAY_SHIFT);
         /* Compute the divisor for the pp clock, simply match the Bspec
          * formula. */
         pp_div = ((100 * intel_pch_rawclk(dev))/2 - 1)
                         << PP_REFERENCE_DIVIDER_SHIFT;
-        pp_div |= (DIV_ROUND_UP(final.t11_t12, 1000)
+        pp_div |= (DIV_ROUND_UP(seq->t11_t12, 1000)
                         << PANEL_POWER_CYCLE_DELAY_SHIFT);
 
         /* Haswell doesn't have any port selection bits for the panel
@@ -2675,14 +2695,6 @@ intel_dp_init_panel_power_sequencer(struct drm_device *dev,
         I915_WRITE(PCH_PP_OFF_DELAYS, pp_off);
         I915_WRITE(PCH_PP_DIVISOR, pp_div);
 
-
-        DRM_DEBUG_KMS("panel power up delay %d, power down delay %d, power cycle delay %d\n",
-                      intel_dp->panel_power_up_delay, intel_dp->panel_power_down_delay,
-                      intel_dp->panel_power_cycle_delay);
-
-        DRM_DEBUG_KMS("backlight on delay %d, off delay %d\n",
-                      intel_dp->backlight_on_delay, intel_dp->backlight_off_delay);
-
         DRM_DEBUG_KMS("panel power sequencer register settings: PP_ON %#x, PP_OFF %#x, PP_DIV %#x\n",
                       I915_READ(PCH_PP_ON_DELAYS),
                       I915_READ(PCH_PP_OFF_DELAYS),
@@ -2699,6 +2711,7 @@ intel_dp_init_connector(struct intel_digital_port *intel_dig_port,
         struct drm_device *dev = intel_encoder->base.dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
         struct drm_display_mode *fixed_mode = NULL;
+        struct edp_power_seq power_seq = { 0 };
         enum port port = intel_dig_port->port;
         const char *name = NULL;
         int type;
@@ -2771,7 +2784,7 @@ intel_dp_init_connector(struct intel_digital_port *intel_dig_port,
         }
 
         if (is_edp(intel_dp))
-                intel_dp_init_panel_power_sequencer(dev, intel_dp);
+                intel_dp_init_panel_power_sequencer(dev, intel_dp, &power_seq);
 
         intel_dp_i2c_init(intel_dp, intel_connector, name);
 
@@ -2798,6 +2811,10 @@ intel_dp_init_connector(struct intel_digital_port *intel_dig_port,
                         return;
                 }
 
+                /* We now know it's not a ghost, init power sequence regs. */
+                intel_dp_init_panel_power_sequencer_registers(dev, intel_dp,
+                                                              &power_seq);
+
                 ironlake_edp_panel_vdd_on(intel_dp);
                 edid = drm_get_edid(connector, &intel_dp->adapter);
                 if (edid) {
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index b9a660a53677..17aee74258ad 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -776,14 +776,6 @@ static const struct dmi_system_id intel_no_lvds[] = {
         },
         {
                 .callback = intel_no_lvds_dmi_callback,
-                .ident = "ZOTAC ZBOXSD-ID12/ID13",
-                .matches = {
-                        DMI_MATCH(DMI_BOARD_VENDOR, "ZOTAC"),
-                        DMI_MATCH(DMI_BOARD_NAME, "ZBOXSD-ID12/ID13"),
-                },
-        },
-        {
-                .callback = intel_no_lvds_dmi_callback,
                 .ident = "Gigabyte GA-D525TUD",
                 .matches = {
                         DMI_MATCH(DMI_BOARD_VENDOR, "Gigabyte Technology Co., Ltd."),
diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c
index e6f54ffab3ba..3280cffe50f4 100644
--- a/drivers/gpu/drm/i915/intel_pm.c
+++ b/drivers/gpu/drm/i915/intel_pm.c
@@ -44,6 +44,14 @@
  * i915.i915_enable_fbc parameter
  */
 
+static bool intel_crtc_active(struct drm_crtc *crtc)
+{
+        /* Be paranoid as we can arrive here with only partial
+         * state retrieved from the hardware during setup.
+         */
+        return to_intel_crtc(crtc)->active && crtc->fb && crtc->mode.clock;
+}
+
 static void i8xx_disable_fbc(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
@@ -405,9 +413,8 @@ void intel_update_fbc(struct drm_device *dev)
          *   - going to an unsupported config (interlace, pixel multiply, etc.)
          */
         list_for_each_entry(tmp_crtc, &dev->mode_config.crtc_list, head) {
-                if (to_intel_crtc(tmp_crtc)->active &&
-                    !to_intel_crtc(tmp_crtc)->primary_disabled &&
-                    tmp_crtc->fb) {
+                if (intel_crtc_active(tmp_crtc) &&
+                    !to_intel_crtc(tmp_crtc)->primary_disabled) {
                         if (crtc) {
                                 DRM_DEBUG_KMS("more than one pipe active, disabling compression\n");
                                 dev_priv->no_fbc_reason = FBC_MULTIPLE_PIPES;
@@ -992,7 +999,7 @@ static struct drm_crtc *single_enabled_crtc(struct drm_device *dev)
         struct drm_crtc *crtc, *enabled = NULL;
 
         list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
-                if (to_intel_crtc(crtc)->active && crtc->fb) {
+                if (intel_crtc_active(crtc)) {
                         if (enabled)
                                 return NULL;
                         enabled = crtc;
@@ -1086,7 +1093,7 @@ static bool g4x_compute_wm0(struct drm_device *dev,
         int entries, tlb_miss;
 
         crtc = intel_get_crtc_for_plane(dev, plane);
-        if (crtc->fb == NULL || !to_intel_crtc(crtc)->active) {
+        if (!intel_crtc_active(crtc)) {
                 *cursor_wm = cursor->guard_size;
                 *plane_wm = display->guard_size;
                 return false;
@@ -1215,7 +1222,7 @@ static bool vlv_compute_drain_latency(struct drm_device *dev,
         int entries;
 
         crtc = intel_get_crtc_for_plane(dev, plane);
-        if (crtc->fb == NULL || !to_intel_crtc(crtc)->active)
+        if (!intel_crtc_active(crtc))
                 return false;
 
         clock = crtc->mode.clock;       /* VESA DOT Clock */
@@ -1476,7 +1483,7 @@ static void i9xx_update_wm(struct drm_device *dev)
 
         fifo_size = dev_priv->display.get_fifo_size(dev, 0);
         crtc = intel_get_crtc_for_plane(dev, 0);
-        if (to_intel_crtc(crtc)->active && crtc->fb) {
+        if (intel_crtc_active(crtc)) {
                 int cpp = crtc->fb->bits_per_pixel / 8;
                 if (IS_GEN2(dev))
                         cpp = 4;
@@ -1490,7 +1497,7 @@ static void i9xx_update_wm(struct drm_device *dev)
 
         fifo_size = dev_priv->display.get_fifo_size(dev, 1);
         crtc = intel_get_crtc_for_plane(dev, 1);
-        if (to_intel_crtc(crtc)->active && crtc->fb) {
+        if (intel_crtc_active(crtc)) {
                 int cpp = crtc->fb->bits_per_pixel / 8;
                 if (IS_GEN2(dev))
                         cpp = 4;
@@ -2044,7 +2051,7 @@ sandybridge_compute_sprite_wm(struct drm_device *dev, int plane,
         int entries, tlb_miss;
 
         crtc = intel_get_crtc_for_plane(dev, plane);
-        if (crtc->fb == NULL || !to_intel_crtc(crtc)->active) {
+        if (!intel_crtc_active(crtc)) {
                 *sprite_wm = display->guard_size;
                 return false;
         }
@@ -4243,7 +4250,8 @@ static void __gen6_gt_force_wake_get(struct drm_i915_private *dev_priv)
 static void __gen6_gt_force_wake_mt_reset(struct drm_i915_private *dev_priv)
 {
         I915_WRITE_NOTRACE(FORCEWAKE_MT, _MASKED_BIT_DISABLE(0xffff));
-        POSTING_READ(ECOBUS); /* something from same cacheline, but !FORCEWAKE */
+        /* something from same cacheline, but !FORCEWAKE_MT */
+        POSTING_READ(ECOBUS);
 }
 
 static void __gen6_gt_force_wake_mt_get(struct drm_i915_private *dev_priv)
@@ -4260,7 +4268,8 @@ static void __gen6_gt_force_wake_mt_get(struct drm_i915_private *dev_priv)
                 DRM_ERROR("Timed out waiting for forcewake old ack to clear.\n");
 
         I915_WRITE_NOTRACE(FORCEWAKE_MT, _MASKED_BIT_ENABLE(FORCEWAKE_KERNEL));
-        POSTING_READ(ECOBUS); /* something from same cacheline, but !FORCEWAKE */
+        /* something from same cacheline, but !FORCEWAKE_MT */
+        POSTING_READ(ECOBUS);
 
         if (wait_for_atomic((I915_READ_NOTRACE(forcewake_ack) & 1),
                             FORCEWAKE_ACK_TIMEOUT_MS))
@@ -4297,14 +4306,16 @@ void gen6_gt_check_fifodbg(struct drm_i915_private *dev_priv)
 static void __gen6_gt_force_wake_put(struct drm_i915_private *dev_priv)
 {
         I915_WRITE_NOTRACE(FORCEWAKE, 0);
-        /* gen6_gt_check_fifodbg doubles as the POSTING_READ */
+        /* something from same cacheline, but !FORCEWAKE */
+        POSTING_READ(ECOBUS);
         gen6_gt_check_fifodbg(dev_priv);
 }
 
 static void __gen6_gt_force_wake_mt_put(struct drm_i915_private *dev_priv)
 {
         I915_WRITE_NOTRACE(FORCEWAKE_MT, _MASKED_BIT_DISABLE(FORCEWAKE_KERNEL));
-        /* gen6_gt_check_fifodbg doubles as the POSTING_READ */
+        /* something from same cacheline, but !FORCEWAKE_MT */
+        POSTING_READ(ECOBUS);
         gen6_gt_check_fifodbg(dev_priv);
 }
 
@@ -4344,6 +4355,8 @@ int __gen6_gt_wait_for_fifo(struct drm_i915_private *dev_priv)
 static void vlv_force_wake_reset(struct drm_i915_private *dev_priv)
 {
         I915_WRITE_NOTRACE(FORCEWAKE_VLV, _MASKED_BIT_DISABLE(0xffff));
+        /* something from same cacheline, but !FORCEWAKE_VLV */
+        POSTING_READ(FORCEWAKE_ACK_VLV);
 }
 
 static void vlv_force_wake_get(struct drm_i915_private *dev_priv)
@@ -4364,7 +4377,8 @@ static void vlv_force_wake_get(struct drm_i915_private *dev_priv)
 static void vlv_force_wake_put(struct drm_i915_private *dev_priv)
 {
         I915_WRITE_NOTRACE(FORCEWAKE_VLV, _MASKED_BIT_DISABLE(FORCEWAKE_KERNEL));
-        /* The below doubles as a POSTING_READ */
+        /* something from same cacheline, but !FORCEWAKE_VLV */
+        POSTING_READ(FORCEWAKE_ACK_VLV);
         gen6_gt_check_fifodbg(dev_priv);
 }
 
diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
index ae253e04c391..42ff97d667d2 100644
--- a/drivers/gpu/drm/i915/intel_ringbuffer.c
+++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
@@ -505,13 +505,25 @@ static int init_render_ring(struct intel_ring_buffer *ring)
         struct drm_i915_private *dev_priv = dev->dev_private;
         int ret = init_ring_common(ring);
 
-        if (INTEL_INFO(dev)->gen > 3) {
+        if (INTEL_INFO(dev)->gen > 3)
                 I915_WRITE(MI_MODE, _MASKED_BIT_ENABLE(VS_TIMER_DISPATCH));
-                if (IS_GEN7(dev))
-                        I915_WRITE(GFX_MODE_GEN7,
-                                   _MASKED_BIT_DISABLE(GFX_TLB_INVALIDATE_ALWAYS) |
-                                   _MASKED_BIT_ENABLE(GFX_REPLAY_MODE));
-        }
+
+        /* We need to disable the AsyncFlip performance optimisations in order
+         * to use MI_WAIT_FOR_EVENT within the CS. It should already be
+         * programmed to '1' on all products.
+         */
+        if (INTEL_INFO(dev)->gen >= 6)
+                I915_WRITE(MI_MODE, _MASKED_BIT_ENABLE(ASYNC_FLIP_PERF_DISABLE));
+
+        /* Required for the hardware to program scanline values for waiting */
+        if (INTEL_INFO(dev)->gen == 6)
+                I915_WRITE(GFX_MODE,
+                           _MASKED_BIT_ENABLE(GFX_TLB_INVALIDATE_ALWAYS));
+
+        if (IS_GEN7(dev))
+                I915_WRITE(GFX_MODE_GEN7,
+                           _MASKED_BIT_DISABLE(GFX_TLB_INVALIDATE_ALWAYS) |
+                           _MASKED_BIT_ENABLE(GFX_REPLAY_MODE));
 
         if (INTEL_INFO(dev)->gen >= 5) {
                 ret = init_pipe_control(ring);
diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c
index 827dcd4edf1c..d7b060e0a231 100644
--- a/drivers/gpu/drm/i915/intel_sprite.c
+++ b/drivers/gpu/drm/i915/intel_sprite.c
@@ -120,11 +120,10 @@ ivb_update_plane(struct drm_plane *plane, struct drm_framebuffer *fb,
         I915_WRITE(SPRSTRIDE(pipe), fb->pitches[0]);
         I915_WRITE(SPRPOS(pipe), (crtc_y << 16) | crtc_x);
 
-        linear_offset = y * fb->pitches[0] + x * (fb->bits_per_pixel / 8);
+        linear_offset = y * fb->pitches[0] + x * pixel_size;
         sprsurf_offset =
                 intel_gen4_compute_offset_xtiled(&x, &y,
-                                                 fb->bits_per_pixel / 8,
-                                                 fb->pitches[0]);
+                                                 pixel_size, fb->pitches[0]);
         linear_offset -= sprsurf_offset;
 
         /* HSW consolidates SPRTILEOFF and SPRLINOFF into a single SPROFFSET
@@ -286,11 +285,10 @@ ilk_update_plane(struct drm_plane *plane, struct drm_framebuffer *fb,
         I915_WRITE(DVSSTRIDE(pipe), fb->pitches[0]);
         I915_WRITE(DVSPOS(pipe), (crtc_y << 16) | crtc_x);
 
-        linear_offset = y * fb->pitches[0] + x * (fb->bits_per_pixel / 8);
+        linear_offset = y * fb->pitches[0] + x * pixel_size;
         dvssurf_offset =
                 intel_gen4_compute_offset_xtiled(&x, &y,
-                                                 fb->bits_per_pixel / 8,
-                                                 fb->pitches[0]);
+                                                 pixel_size, fb->pitches[0]);
         linear_offset -= dvssurf_offset;
 
         if (obj->tiling_mode != I915_TILING_NONE)
diff --git a/drivers/gpu/drm/nouveau/core/core/client.c b/drivers/gpu/drm/nouveau/core/core/client.c
index c617f0480071..8bbb58f94a19 100644
--- a/drivers/gpu/drm/nouveau/core/core/client.c
+++ b/drivers/gpu/drm/nouveau/core/core/client.c
@@ -66,10 +66,8 @@ nouveau_client_create_(const char *name, u64 devname, const char *cfg,
 
         ret = nouveau_handle_create(nv_object(client), ~0, ~0,
                                     nv_object(client), &client->root);
-        if (ret) {
-                nouveau_namedb_destroy(&client->base);
+        if (ret)
                 return ret;
-        }
 
         /* prevent init/fini being called, os in in charge of this */
         atomic_set(&nv_object(client)->usecount, 2);
diff --git a/drivers/gpu/drm/nouveau/core/core/falcon.c b/drivers/gpu/drm/nouveau/core/core/falcon.c
index 6b0843c33877..e05c15777588 100644
--- a/drivers/gpu/drm/nouveau/core/core/falcon.c
+++ b/drivers/gpu/drm/nouveau/core/core/falcon.c
@@ -73,8 +73,11 @@ _nouveau_falcon_init(struct nouveau_object *object)
         nv_debug(falcon, "data limit: %d\n", falcon->data.limit);
 
         /* wait for 'uc halted' to be signalled before continuing */
-        if (falcon->secret) {
-                nv_wait(falcon, 0x008, 0x00000010, 0x00000010);
+        if (falcon->secret && falcon->version < 4) {
+                if (!falcon->version)
+                        nv_wait(falcon, 0x008, 0x00000010, 0x00000010);
+                else
+                        nv_wait(falcon, 0x180, 0x80000000, 0);
                 nv_wo32(falcon, 0x004, 0x00000010);
         }
 
diff --git a/drivers/gpu/drm/nouveau/core/core/handle.c b/drivers/gpu/drm/nouveau/core/core/handle.c
index b8d2cbf8a7a7..264c2b338ac3 100644
--- a/drivers/gpu/drm/nouveau/core/core/handle.c
+++ b/drivers/gpu/drm/nouveau/core/core/handle.c
@@ -109,7 +109,7 @@ nouveau_handle_create(struct nouveau_object *parent, u32 _parent, u32 _handle,
         while (!nv_iclass(namedb, NV_NAMEDB_CLASS))
                 namedb = namedb->parent;
 
-        handle = *phandle = kzalloc(sizeof(*handle), GFP_KERNEL);
+        handle = kzalloc(sizeof(*handle), GFP_KERNEL);
         if (!handle)
                 return -ENOMEM;
 
@@ -146,6 +146,9 @@ nouveau_handle_create(struct nouveau_object *parent, u32 _parent, u32 _handle,
         }
 
         hprintk(handle, TRACE, "created\n");
+
+        *phandle = handle;
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/nouveau/core/core/subdev.c b/drivers/gpu/drm/nouveau/core/core/subdev.c
index f74c30aa33a0..48f06378d3f9 100644
--- a/drivers/gpu/drm/nouveau/core/core/subdev.c
+++ b/drivers/gpu/drm/nouveau/core/core/subdev.c
@@ -99,7 +99,7 @@ nouveau_subdev_create_(struct nouveau_object *parent,
         if (ret)
                 return ret;
 
-        mutex_init(&subdev->mutex);
+        __mutex_init(&subdev->mutex, subname, &oclass->lock_class_key);
         subdev->name = subname;
 
         if (parent) {
diff --git a/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c b/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c
index 0f09af135415..ca1a7d76a95b 100644
--- a/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/engine/disp/nv50.c
@@ -851,20 +851,23 @@ exec_script(struct nv50_disp_priv *priv, int head, int id)
         for (i = 0; !(ctrl & (1 << head)) && i < 3; i++)
                 ctrl = nv_rd32(priv, 0x610b5c + (i * 8));
 
-        if (nv_device(priv)->chipset  < 0x90 ||
-            nv_device(priv)->chipset == 0x92 ||
-            nv_device(priv)->chipset == 0xa0) {
-                for (i = 0; !(ctrl & (1 << head)) && i < 2; i++)
-                        ctrl = nv_rd32(priv, 0x610b74 + (i * 8));
-                i += 3;
-        } else {
-                for (i = 0; !(ctrl & (1 << head)) && i < 4; i++)
-                        ctrl = nv_rd32(priv, 0x610798 + (i * 8));
-                i += 3;
+        if (!(ctrl & (1 << head))) {
+                if (nv_device(priv)->chipset  < 0x90 ||
+                    nv_device(priv)->chipset == 0x92 ||
+                    nv_device(priv)->chipset == 0xa0) {
+                        for (i = 0; !(ctrl & (1 << head)) && i < 2; i++)
+                                ctrl = nv_rd32(priv, 0x610b74 + (i * 8));
+                        i += 4;
+                } else {
+                        for (i = 0; !(ctrl & (1 << head)) && i < 4; i++)
+                                ctrl = nv_rd32(priv, 0x610798 + (i * 8));
+                        i += 4;
+                }
         }
 
         if (!(ctrl & (1 << head)))
                 return false;
+        i--;
 
         data = exec_lookup(priv, head, i, ctrl, &dcb, &ver, &hdr, &cnt, &len, &info);
         if (data) {
@@ -898,20 +901,23 @@ exec_clkcmp(struct nv50_disp_priv *priv, int head, int id, u32 pclk,
         for (i = 0; !(ctrl & (1 << head)) && i < 3; i++)
                 ctrl = nv_rd32(priv, 0x610b58 + (i * 8));
 
-        if (nv_device(priv)->chipset  < 0x90 ||
-            nv_device(priv)->chipset == 0x92 ||
-            nv_device(priv)->chipset == 0xa0) {
-                for (i = 0; !(ctrl & (1 << head)) && i < 2; i++)
-                        ctrl = nv_rd32(priv, 0x610b70 + (i * 8));
-                i += 3;
-        } else {
-                for (i = 0; !(ctrl & (1 << head)) && i < 4; i++)
-                        ctrl = nv_rd32(priv, 0x610794 + (i * 8));
-                i += 3;
+        if (!(ctrl & (1 << head))) {
+                if (nv_device(priv)->chipset  < 0x90 ||
+                    nv_device(priv)->chipset == 0x92 ||
+                    nv_device(priv)->chipset == 0xa0) {
+                        for (i = 0; !(ctrl & (1 << head)) && i < 2; i++)
+                                ctrl = nv_rd32(priv, 0x610b70 + (i * 8));
+                        i += 4;
+                } else {
+                        for (i = 0; !(ctrl & (1 << head)) && i < 4; i++)
+                                ctrl = nv_rd32(priv, 0x610794 + (i * 8));
+                        i += 4;
+                }
         }
 
         if (!(ctrl & (1 << head)))
                 return 0x0000;
+        i--;
 
         data = exec_lookup(priv, head, i, ctrl, outp, &ver, &hdr, &cnt, &len, &info1);
         if (!data)
diff --git a/drivers/gpu/drm/nouveau/core/include/core/client.h b/drivers/gpu/drm/nouveau/core/include/core/client.h
index 0193532ceac9..63acc0346ff2 100644
--- a/drivers/gpu/drm/nouveau/core/include/core/client.h
+++ b/drivers/gpu/drm/nouveau/core/include/core/client.h
@@ -36,6 +36,9 @@ nouveau_client(void *obj)
 
 int  nouveau_client_create_(const char *name, u64 device, const char *cfg,
                             const char *dbg, int, void **);
+#define nouveau_client_destroy(p)                                              \
+        nouveau_namedb_destroy(&(p)->base)
+
 int  nouveau_client_init(struct nouveau_client *);
 int  nouveau_client_fini(struct nouveau_client *, bool suspend);
 
diff --git a/drivers/gpu/drm/nouveau/core/include/core/object.h b/drivers/gpu/drm/nouveau/core/include/core/object.h
index 5982935ee23a..106bb19fdd9a 100644
--- a/drivers/gpu/drm/nouveau/core/include/core/object.h
+++ b/drivers/gpu/drm/nouveau/core/include/core/object.h
@@ -50,10 +50,13 @@ int  nouveau_object_fini(struct nouveau_object *, bool suspend);
 
 extern struct nouveau_ofuncs nouveau_object_ofuncs;
 
+/* Don't allocate dynamically, because lockdep needs lock_class_keys to be in
+ * ".data". */
 struct nouveau_oclass {
         u32 handle;
-        struct nouveau_ofuncs *ofuncs;
-        struct nouveau_omthds *omthds;
+        struct nouveau_ofuncs * const ofuncs;
+        struct nouveau_omthds * const omthds;
+        struct lock_class_key lock_class_key;
 };
 
 #define nv_oclass(o)    nv_object(o)->oclass
diff --git a/drivers/gpu/drm/nouveau/core/include/subdev/bios/pll.h b/drivers/gpu/drm/nouveau/core/include/subdev/bios/pll.h
index c345097592f2..b2f3d4d0aa49 100644
--- a/drivers/gpu/drm/nouveau/core/include/subdev/bios/pll.h
+++ b/drivers/gpu/drm/nouveau/core/include/subdev/bios/pll.h
@@ -38,6 +38,8 @@ enum nvbios_pll_type {
         PLL_UNK42  = 0x42,
         PLL_VPLL0  = 0x80,
         PLL_VPLL1  = 0x81,
+        PLL_VPLL2  = 0x82,
+        PLL_VPLL3  = 0x83,
         PLL_MAX    = 0xff
 };
 
diff --git a/drivers/gpu/drm/nouveau/core/subdev/bios/init.c b/drivers/gpu/drm/nouveau/core/subdev/bios/init.c
index 2917d552689b..690ed438b2ad 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/bios/init.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/bios/init.c
@@ -1534,7 +1534,6 @@ init_io(struct nvbios_init *init)
                 mdelay(10);
                 init_wr32(init, 0x614100, 0x10000018);
                 init_wr32(init, 0x614900, 0x10000018);
-                return;
         }
 
         value = init_rdport(init, port) & mask;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/clock/nvc0.c b/drivers/gpu/drm/nouveau/core/subdev/clock/nvc0.c
index f6962c9b6c36..7c9626258a46 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/clock/nvc0.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/clock/nvc0.c
@@ -52,6 +52,8 @@ nvc0_clock_pll_set(struct nouveau_clock *clk, u32 type, u32 freq)
         switch (info.type) {
         case PLL_VPLL0:
         case PLL_VPLL1:
+        case PLL_VPLL2:
+        case PLL_VPLL3:
                 nv_mask(priv, info.reg + 0x0c, 0x00000000, 0x00000100);
                 nv_wr32(priv, info.reg + 0x04, (P << 16) | (N << 8) | M);
                 nv_wr32(priv, info.reg + 0x10, fN << 16);
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/base.c b/drivers/gpu/drm/nouveau/core/subdev/fb/base.c
index d6d16007ec1a..d62045f454b2 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/base.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/base.c
@@ -86,8 +86,8 @@ nouveau_fb_preinit(struct nouveau_fb *pfb)
                         return ret;
         }
 
-        if (!nouveau_mm_initialised(&pfb->tags) && tags) {
-                ret = nouveau_mm_init(&pfb->tags, 0, ++tags, 1);
+        if (!nouveau_mm_initialised(&pfb->tags)) {
+                ret = nouveau_mm_init(&pfb->tags, 0, tags ? ++tags : 0, 1);
                 if (ret)
                         return ret;
         }
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c b/drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c
index 487cb8c6c204..eac236ed19b2 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/nv50.c
@@ -99,7 +99,7 @@ nv50_fb_vram_init(struct nouveau_fb *pfb)
         struct nouveau_bios *bios = nouveau_bios(device);
         const u32 rsvd_head = ( 256 * 1024) >> 12; /* vga memory */
         const u32 rsvd_tail = (1024 * 1024) >> 12; /* vbios etc */
-        u32 size;
+        u32 size, tags = 0;
         int ret;
 
         pfb->ram.size = nv_rd32(pfb, 0x10020c);
@@ -140,10 +140,11 @@ nv50_fb_vram_init(struct nouveau_fb *pfb)
                         return ret;
 
                 pfb->ram.ranks = (nv_rd32(pfb, 0x100200) & 0x4) ? 2 : 1;
+                tags = nv_rd32(pfb, 0x100320);
                 break;
         }
 
-        return nv_rd32(pfb, 0x100320);
+        return tags;
 }
 
 static int
diff --git a/drivers/gpu/drm/nouveau/core/subdev/fb/nvc0.c b/drivers/gpu/drm/nouveau/core/subdev/fb/nvc0.c
index 306bdf121452..7606ed15b6fa 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/fb/nvc0.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/fb/nvc0.c
@@ -145,14 +145,14 @@ nvc0_fb_vram_new(struct nouveau_fb *pfb, u64 size, u32 align, u32 ncmin,
         mem->memtype = type;
         mem->size = size;
 
-        mutex_lock(&mm->mutex);
+        mutex_lock(&pfb->base.mutex);
         do {
                 if (back)
                         ret = nouveau_mm_tail(mm, 1, size, ncmin, align, &r);
                 else
                         ret = nouveau_mm_head(mm, 1, size, ncmin, align, &r);
                 if (ret) {
-                        mutex_unlock(&mm->mutex);
+                        mutex_unlock(&pfb->base.mutex);
                         pfb->ram.put(pfb, &mem);
                         return ret;
                 }
@@ -160,7 +160,7 @@ nvc0_fb_vram_new(struct nouveau_fb *pfb, u64 size, u32 align, u32 ncmin,
                 list_add_tail(&r->rl_entry, &mem->regions);
                 size -= r->length;
         } while (size);
-        mutex_unlock(&mm->mutex);
+        mutex_unlock(&pfb->base.mutex);
 
         r = list_first_entry(&mem->regions, struct nouveau_mm_node, rl_entry);
         mem->offset = (u64)r->offset << 12;
diff --git a/drivers/gpu/drm/nouveau/core/subdev/instmem/base.c b/drivers/gpu/drm/nouveau/core/subdev/instmem/base.c
index 1188227ca6aa..6565f3dbbe04 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/instmem/base.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/instmem/base.c
@@ -40,15 +40,21 @@ nouveau_instobj_create_(struct nouveau_object *parent,
         if (ret)
                 return ret;
 
+        mutex_lock(&imem->base.mutex);
         list_add(&iobj->head, &imem->list);
+        mutex_unlock(&imem->base.mutex);
         return 0;
 }
 
 void
 nouveau_instobj_destroy(struct nouveau_instobj *iobj)
 {
-        if (iobj->head.prev)
-                list_del(&iobj->head);
+        struct nouveau_subdev *subdev = nv_subdev(iobj->base.engine);
+
+        mutex_lock(&subdev->mutex);
+        list_del(&iobj->head);
+        mutex_unlock(&subdev->mutex);
+
         return nouveau_object_destroy(&iobj->base);
 }
 
@@ -88,6 +94,8 @@ nouveau_instmem_init(struct nouveau_instmem *imem)
         if (ret)
                 return ret;
 
+        mutex_lock(&imem->base.mutex);
+
         list_for_each_entry(iobj, &imem->list, head) {
                 if (iobj->suspend) {
                         for (i = 0; i < iobj->size; i += 4)
@@ -97,6 +105,8 @@ nouveau_instmem_init(struct nouveau_instmem *imem)
                 }
         }
 
+        mutex_unlock(&imem->base.mutex);
+
         return 0;
 }
 
@@ -104,17 +114,26 @@ int
 nouveau_instmem_fini(struct nouveau_instmem *imem, bool suspend)
 {
         struct nouveau_instobj *iobj;
-        int i;
+        int i, ret = 0;
 
         if (suspend) {
+                mutex_lock(&imem->base.mutex);
+
                 list_for_each_entry(iobj, &imem->list, head) {
                         iobj->suspend = vmalloc(iobj->size);
-                        if (iobj->suspend) {
-                                for (i = 0; i < iobj->size; i += 4)
-                                        iobj->suspend[i / 4] = nv_ro32(iobj, i);
-                        } else
-                                return -ENOMEM;
+                        if (!iobj->suspend) {
+                                ret = -ENOMEM;
+                                break;
+                        }
+
+                        for (i = 0; i < iobj->size; i += 4)
+                                iobj->suspend[i / 4] = nv_ro32(iobj, i);
                 }
+
+                mutex_unlock(&imem->base.mutex);
+
+                if (ret)
+                        return ret;
         }
 
         return nouveau_subdev_fini(&imem->base, suspend);
diff --git a/drivers/gpu/drm/nouveau/core/subdev/vm/base.c b/drivers/gpu/drm/nouveau/core/subdev/vm/base.c
index 082c11b75acb..77c67fc970e6 100644
--- a/drivers/gpu/drm/nouveau/core/subdev/vm/base.c
+++ b/drivers/gpu/drm/nouveau/core/subdev/vm/base.c
@@ -352,7 +352,7 @@ nouveau_vm_create(struct nouveau_vmmgr *vmm, u64 offset, u64 length,
         u64 mm_length = (offset + length) - mm_offset;
         int ret;
 
-        vm = *pvm = kzalloc(sizeof(*vm), GFP_KERNEL);
+        vm = kzalloc(sizeof(*vm), GFP_KERNEL);
         if (!vm)
                 return -ENOMEM;
 
@@ -376,6 +376,8 @@ nouveau_vm_create(struct nouveau_vmmgr *vmm, u64 offset, u64 length,
                 return ret;
         }
 
+        *pvm = vm;
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
index 69d7b1d0b9d6..1699a9083a2f 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -28,6 +28,7 @@
  */
 
 #include <core/engine.h>
+#include <linux/swiotlb.h>
 
 #include <subdev/fb.h>
 #include <subdev/vm.h>
diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
index ac340ba32017..e620ba8271b4 100644
--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
@@ -127,12 +127,26 @@ nouveau_connector_ddc_detect(struct drm_connector *connector,
                              struct nouveau_encoder **pnv_encoder)
 {
         struct drm_device *dev = connector->dev;
+        struct nouveau_connector *nv_connector = nouveau_connector(connector);
         struct nouveau_drm *drm = nouveau_drm(dev);
+        struct nouveau_gpio *gpio = nouveau_gpio(drm->device);
         struct nouveau_i2c *i2c = nouveau_i2c(drm->device);
-        int i;
+        struct nouveau_i2c_port *port = NULL;
+        int i, panel = -ENODEV;
+
+        /* eDP panels need powering on by us (if the VBIOS doesn't default it
+         * to on) before doing any AUX channel transactions.  LVDS panel power
+         * is handled by the SOR itself, and not required for LVDS DDC.
+         */
+        if (nv_connector->type == DCB_CONNECTOR_eDP) {
+                panel = gpio->get(gpio, 0, DCB_GPIO_PANEL_POWER, 0xff);
+                if (panel == 0) {
+                        gpio->set(gpio, 0, DCB_GPIO_PANEL_POWER, 0xff, 1);
+                        msleep(300);
+                }
+        }
 
         for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
-                struct nouveau_i2c_port *port = NULL;
                 struct nouveau_encoder *nv_encoder;
                 struct drm_mode_object *obj;
                 int id;
@@ -150,11 +164,19 @@ nouveau_connector_ddc_detect(struct drm_connector *connector,
                         port = i2c->find(i2c, nv_encoder->dcb->i2c_index);
                 if (port && nv_probe_i2c(port, 0x50)) {
                         *pnv_encoder = nv_encoder;
-                        return port;
+                        break;
                 }
+
+                port = NULL;
         }
 
-        return NULL;
+        /* eDP panel not detected, restore panel power GPIO to previous
+         * state to avoid confusing the SOR for other output types.
+         */
+        if (!port && panel == 0)
+                gpio->set(gpio, 0, DCB_GPIO_PANEL_POWER, 0xff, panel);
+
+        return port;
 }
 
 static struct nouveau_encoder *
diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
index e4188f24fc75..508b00a2ce0d 100644
--- a/drivers/gpu/drm/nouveau/nouveau_display.c
+++ b/drivers/gpu/drm/nouveau/nouveau_display.c
@@ -225,15 +225,6 @@ nouveau_display_init(struct drm_device *dev)
         if (ret)
                 return ret;
 
-        /* power on internal panel if it's not already.  the init tables of
-         * some vbios default this to off for some reason, causing the
-         * panel to not work after resume
-         */
-        if (gpio && gpio->get(gpio, 0, DCB_GPIO_PANEL_POWER, 0xff) == 0) {
-                gpio->set(gpio, 0, DCB_GPIO_PANEL_POWER, 0xff, 1);
-                msleep(300);
-        }
-
         /* enable polling for external displays */
         drm_kms_helper_poll_enable(dev);
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 180a45e3b525..5e7aef23825a 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -84,11 +84,16 @@ nouveau_cli_create(struct pci_dev *pdev, const char *name,
         struct nouveau_cli *cli;
         int ret;
 
+        *pcli = NULL;
         ret = nouveau_client_create_(name, nouveau_name(pdev), nouveau_config,
                                      nouveau_debug, size, pcli);
         cli = *pcli;
-        if (ret)
+        if (ret) {
+                if (cli)
+                        nouveau_client_destroy(&cli->base);
+                *pcli = NULL;
                 return ret;
+        }
 
         mutex_init(&cli->mutex);
         return 0;
@@ -240,6 +245,8 @@ static int nouveau_drm_probe(struct pci_dev *pdev,
         return 0;
 }
 
+static struct lock_class_key drm_client_lock_class_key;
+
 static int
 nouveau_drm_load(struct drm_device *dev, unsigned long flags)
 {
@@ -251,6 +258,7 @@ nouveau_drm_load(struct drm_device *dev, unsigned long flags)
         ret = nouveau_cli_create(pdev, "DRM", sizeof(*drm), (void**)&drm);
         if (ret)
                 return ret;
+        lockdep_set_class(&drm->client.mutex, &drm_client_lock_class_key);
 
         dev->dev_private = drm;
         drm->dev = dev;
diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.h b/drivers/gpu/drm/nouveau/nouveau_fence.h
index bedafd1c9539..cdb83acdffe2 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fence.h
+++ b/drivers/gpu/drm/nouveau/nouveau_fence.h
@@ -60,6 +60,7 @@ u32  nv10_fence_read(struct nouveau_channel *);
 void nv10_fence_context_del(struct nouveau_channel *);
 void nv10_fence_destroy(struct nouveau_drm *);
 int  nv10_fence_create(struct nouveau_drm *);
+void nv17_fence_resume(struct nouveau_drm *drm);
 
 int nv50_fence_create(struct nouveau_drm *);
 int nv84_fence_create(struct nouveau_drm *);
diff --git a/drivers/gpu/drm/nouveau/nv04_dfp.c b/drivers/gpu/drm/nouveau/nv04_dfp.c
index 184cdf806761..39ffc07f906b 100644
--- a/drivers/gpu/drm/nouveau/nv04_dfp.c
+++ b/drivers/gpu/drm/nouveau/nv04_dfp.c
@@ -505,7 +505,7 @@ static void nv04_dfp_update_backlight(struct drm_encoder *encoder, int mode)
 
 static inline bool is_powersaving_dpms(int mode)
 {
-        return (mode != DRM_MODE_DPMS_ON);
+        return mode != DRM_MODE_DPMS_ON && mode != NV_DPMS_CLEARED;
 }
 
 static void nv04_lvds_dpms(struct drm_encoder *encoder, int mode)
diff --git a/drivers/gpu/drm/nouveau/nv10_fence.c b/drivers/gpu/drm/nouveau/nv10_fence.c
index 7ae7f97a6d4d..03017f24d593 100644
--- a/drivers/gpu/drm/nouveau/nv10_fence.c
+++ b/drivers/gpu/drm/nouveau/nv10_fence.c
@@ -162,6 +162,13 @@ nv10_fence_destroy(struct nouveau_drm *drm)
         kfree(priv);
 }
 
+void nv17_fence_resume(struct nouveau_drm *drm)
+{
+        struct nv10_fence_priv *priv = drm->fence;
+
+        nouveau_bo_wr32(priv->bo, 0, priv->sequence);
+}
+
 int
 nv10_fence_create(struct nouveau_drm *drm)
 {
@@ -197,6 +204,7 @@ nv10_fence_create(struct nouveau_drm *drm)
                 if (ret == 0) {
                         nouveau_bo_wr32(priv->bo, 0x000, 0x00000000);
                         priv->base.sync = nv17_fence_sync;
+                        priv->base.resume = nv17_fence_resume;
                 }
         }
 
diff --git a/drivers/gpu/drm/nouveau/nv50_fence.c b/drivers/gpu/drm/nouveau/nv50_fence.c
index c20f2727ea0b..d889f3ac0d41 100644
--- a/drivers/gpu/drm/nouveau/nv50_fence.c
+++ b/drivers/gpu/drm/nouveau/nv50_fence.c
@@ -122,6 +122,7 @@ nv50_fence_create(struct nouveau_drm *drm)
         if (ret == 0) {
                 nouveau_bo_wr32(priv->bo, 0x000, 0x00000000);
                 priv->base.sync = nv17_fence_sync;
+                priv->base.resume = nv17_fence_resume;
         }
 
         if (ret)
diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c
index 061fa0a28900..a2d478e8692a 100644
--- a/drivers/gpu/drm/radeon/evergreen.c
+++ b/drivers/gpu/drm/radeon/evergreen.c
@@ -1313,14 +1313,18 @@ void evergreen_mc_stop(struct radeon_device *rdev, struct evergreen_mc_save *sav
                                 if (!(tmp & EVERGREEN_CRTC_BLANK_DATA_EN)) {
                                         radeon_wait_for_vblank(rdev, i);
                                         tmp |= EVERGREEN_CRTC_BLANK_DATA_EN;
+                                        WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 1);
                                         WREG32(EVERGREEN_CRTC_BLANK_CONTROL + crtc_offsets[i], tmp);
+                                        WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 0);
                                 }
                         } else {
                                 tmp = RREG32(EVERGREEN_CRTC_CONTROL + crtc_offsets[i]);
                                 if (!(tmp & EVERGREEN_CRTC_DISP_READ_REQUEST_DISABLE)) {
                                         radeon_wait_for_vblank(rdev, i);
                                         tmp |= EVERGREEN_CRTC_DISP_READ_REQUEST_DISABLE;
+                                        WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 1);
                                         WREG32(EVERGREEN_CRTC_CONTROL + crtc_offsets[i], tmp);
+                                        WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 0);
                                 }
                         }
                         /* wait for the next frame */
@@ -1345,6 +1349,8 @@ void evergreen_mc_stop(struct radeon_device *rdev, struct evergreen_mc_save *sav
                 blackout &= ~BLACKOUT_MODE_MASK;
                 WREG32(MC_SHARED_BLACKOUT_CNTL, blackout | 1);
         }
+        /* wait for the MC to settle */
+        udelay(100);
 }
 
 void evergreen_mc_resume(struct radeon_device *rdev, struct evergreen_mc_save *save)
@@ -1378,11 +1384,15 @@ void evergreen_mc_resume(struct radeon_device *rdev, struct evergreen_mc_save *s
                         if (ASIC_IS_DCE6(rdev)) {
                                 tmp = RREG32(EVERGREEN_CRTC_BLANK_CONTROL + crtc_offsets[i]);
                                 tmp |= EVERGREEN_CRTC_BLANK_DATA_EN;
+                                WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 1);
                                 WREG32(EVERGREEN_CRTC_BLANK_CONTROL + crtc_offsets[i], tmp);
+                                WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 0);
                         } else {
                                 tmp = RREG32(EVERGREEN_CRTC_CONTROL + crtc_offsets[i]);
                                 tmp &= ~EVERGREEN_CRTC_DISP_READ_REQUEST_DISABLE;
+                                WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 1);
                                 WREG32(EVERGREEN_CRTC_CONTROL + crtc_offsets[i], tmp);
+                                WREG32(EVERGREEN_CRTC_UPDATE_LOCK + crtc_offsets[i], 0);
                         }
                         /* wait for the next frame */
                         frame_count = radeon_get_vblank_counter(rdev, i);
@@ -2036,9 +2046,20 @@ static void evergreen_gpu_init(struct radeon_device *rdev)
         WREG32(HDP_ADDR_CONFIG, gb_addr_config);
         WREG32(DMA_TILING_CONFIG, gb_addr_config);
 
-        tmp = gb_addr_config & NUM_PIPES_MASK;
-        tmp = r6xx_remap_render_backend(rdev, tmp, rdev->config.evergreen.max_backends,
-                                        EVERGREEN_MAX_BACKENDS, disabled_rb_mask);
+        if ((rdev->config.evergreen.max_backends == 1) &&
+            (rdev->flags & RADEON_IS_IGP)) {
+                if ((disabled_rb_mask & 3) == 1) {
+                        /* RB0 disabled, RB1 enabled */
+                        tmp = 0x11111111;
+                } else {
+                        /* RB1 disabled, RB0 enabled */
+                        tmp = 0x00000000;
+                }
+        } else {
+                tmp = gb_addr_config & NUM_PIPES_MASK;
+                tmp = r6xx_remap_render_backend(rdev, tmp, rdev->config.evergreen.max_backends,
+                                                EVERGREEN_MAX_BACKENDS, disabled_rb_mask);
+        }
         WREG32(GB_BACKEND_MAP, tmp);
 
         WREG32(CGTS_SYS_TCC_DISABLE, 0);
@@ -2401,6 +2422,12 @@ static int evergreen_gpu_soft_reset(struct radeon_device *rdev, u32 reset_mask)
 {
         struct evergreen_mc_save save;
 
+        if (!(RREG32(GRBM_STATUS) & GUI_ACTIVE))
+                reset_mask &= ~(RADEON_RESET_GFX | RADEON_RESET_COMPUTE);
+
+        if (RREG32(DMA_STATUS_REG) & DMA_IDLE)
+                reset_mask &= ~RADEON_RESET_DMA;
+
         if (reset_mask == 0)
                 return 0;
 
diff --git a/drivers/gpu/drm/radeon/evergreen_cs.c b/drivers/gpu/drm/radeon/evergreen_cs.c
index 7a445666e71f..ee4cff534f10 100644
--- a/drivers/gpu/drm/radeon/evergreen_cs.c
+++ b/drivers/gpu/drm/radeon/evergreen_cs.c
@@ -2909,14 +2909,14 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                 return -EINVAL;
                         }
                         if (tiled) {
-                                dst_offset = ib[idx+1];
+                                dst_offset = radeon_get_ib_value(p, idx+1);
                                 dst_offset <<= 8;
 
                                 ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset >> 8);
                                 p->idx += count + 7;
                         } else {
-                                dst_offset = ib[idx+1];
-                                dst_offset |= ((u64)(ib[idx+2] & 0xff)) << 32;
+                                dst_offset = radeon_get_ib_value(p, idx+1);
+                                dst_offset |= ((u64)(radeon_get_ib_value(p, idx+2) & 0xff)) << 32;
 
                                 ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
                                 ib[idx+2] += upper_32_bits(dst_reloc->lobj.gpu_offset) & 0xff;
@@ -2954,12 +2954,12 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                                         DRM_ERROR("bad L2T, frame to fields DMA_PACKET_COPY\n");
                                                         return -EINVAL;
                                                 }
-                                                dst_offset = ib[idx+1];
+                                                dst_offset = radeon_get_ib_value(p, idx+1);
                                                 dst_offset <<= 8;
-                                                dst2_offset = ib[idx+2];
+                                                dst2_offset = radeon_get_ib_value(p, idx+2);
                                                 dst2_offset <<= 8;
-                                                src_offset = ib[idx+8];
-                                                src_offset |= ((u64)(ib[idx+9] & 0xff)) << 32;
+                                                src_offset = radeon_get_ib_value(p, idx+8);
+                                                src_offset |= ((u64)(radeon_get_ib_value(p, idx+9) & 0xff)) << 32;
                                                 if ((src_offset + (count * 4)) > radeon_bo_size(src_reloc->robj)) {
                                                         dev_warn(p->dev, "DMA L2T, frame to fields src buffer too small (%llu %lu)\n",
                                                                  src_offset + (count * 4), radeon_bo_size(src_reloc->robj));
@@ -3014,12 +3014,12 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                                         DRM_ERROR("bad L2T, broadcast DMA_PACKET_COPY\n");
                                                         return -EINVAL;
                                                 }
-                                                dst_offset = ib[idx+1];
+                                                dst_offset = radeon_get_ib_value(p, idx+1);
                                                 dst_offset <<= 8;
-                                                dst2_offset = ib[idx+2];
+                                                dst2_offset = radeon_get_ib_value(p, idx+2);
                                                 dst2_offset <<= 8;
-                                                src_offset = ib[idx+8];
-                                                src_offset |= ((u64)(ib[idx+9] & 0xff)) << 32;
+                                                src_offset = radeon_get_ib_value(p, idx+8);
+                                                src_offset |= ((u64)(radeon_get_ib_value(p, idx+9) & 0xff)) << 32;
                                                 if ((src_offset + (count * 4)) > radeon_bo_size(src_reloc->robj)) {
                                                         dev_warn(p->dev, "DMA L2T, broadcast src buffer too small (%llu %lu)\n",
                                                                  src_offset + (count * 4), radeon_bo_size(src_reloc->robj));
@@ -3046,22 +3046,22 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                                 /* detile bit */
                                                 if (idx_value & (1 << 31)) {
                                                         /* tiled src, linear dst */
-                                                        src_offset = ib[idx+1];
+                                                        src_offset = radeon_get_ib_value(p, idx+1);
                                                         src_offset <<= 8;
                                                         ib[idx+1] += (u32)(src_reloc->lobj.gpu_offset >> 8);
 
-                                                        dst_offset = ib[idx+7];
-                                                        dst_offset |= ((u64)(ib[idx+8] & 0xff)) << 32;
+                                                        dst_offset = radeon_get_ib_value(p, idx+7);
+                                                        dst_offset |= ((u64)(radeon_get_ib_value(p, idx+8) & 0xff)) << 32;
                                                         ib[idx+7] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
                                                         ib[idx+8] += upper_32_bits(dst_reloc->lobj.gpu_offset) & 0xff;
                                                 } else {
                                                         /* linear src, tiled dst */
-                                                        src_offset = ib[idx+7];
-                                                        src_offset |= ((u64)(ib[idx+8] & 0xff)) << 32;
+                                                        src_offset = radeon_get_ib_value(p, idx+7);
+                                                        src_offset |= ((u64)(radeon_get_ib_value(p, idx+8) & 0xff)) << 32;
                                                         ib[idx+7] += (u32)(src_reloc->lobj.gpu_offset & 0xfffffffc);
                                                         ib[idx+8] += upper_32_bits(src_reloc->lobj.gpu_offset) & 0xff;
 
-                                                        dst_offset = ib[idx+1];
+                                                        dst_offset = radeon_get_ib_value(p, idx+1);
                                                         dst_offset <<= 8;
                                                         ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset >> 8);
                                                 }
@@ -3098,12 +3098,12 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                                         DRM_ERROR("bad L2T, broadcast DMA_PACKET_COPY\n");
                                                         return -EINVAL;
                                                 }
-                                                dst_offset = ib[idx+1];
+                                                dst_offset = radeon_get_ib_value(p, idx+1);
                                                 dst_offset <<= 8;
-                                                dst2_offset = ib[idx+2];
+                                                dst2_offset = radeon_get_ib_value(p, idx+2);
                                                 dst2_offset <<= 8;
-                                                src_offset = ib[idx+8];
-                                                src_offset |= ((u64)(ib[idx+9] & 0xff)) << 32;
+                                                src_offset = radeon_get_ib_value(p, idx+8);
+                                                src_offset |= ((u64)(radeon_get_ib_value(p, idx+9) & 0xff)) << 32;
                                                 if ((src_offset + (count * 4)) > radeon_bo_size(src_reloc->robj)) {
                                                         dev_warn(p->dev, "DMA L2T, broadcast src buffer too small (%llu %lu)\n",
                                                                  src_offset + (count * 4), radeon_bo_size(src_reloc->robj));
@@ -3135,22 +3135,22 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                                 /* detile bit */
                                                 if (idx_value & (1 << 31)) {
                                                         /* tiled src, linear dst */
-                                                        src_offset = ib[idx+1];
+                                                        src_offset = radeon_get_ib_value(p, idx+1);
                                                         src_offset <<= 8;
                                                         ib[idx+1] += (u32)(src_reloc->lobj.gpu_offset >> 8);
 
-                                                        dst_offset = ib[idx+7];
-                                                        dst_offset |= ((u64)(ib[idx+8] & 0xff)) << 32;
+                                                        dst_offset = radeon_get_ib_value(p, idx+7);
+                                                        dst_offset |= ((u64)(radeon_get_ib_value(p, idx+8) & 0xff)) << 32;
                                                         ib[idx+7] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
                                                         ib[idx+8] += upper_32_bits(dst_reloc->lobj.gpu_offset) & 0xff;
                                                 } else {
                                                         /* linear src, tiled dst */
-                                                        src_offset = ib[idx+7];
-                                                        src_offset |= ((u64)(ib[idx+8] & 0xff)) << 32;
+                                                        src_offset = radeon_get_ib_value(p, idx+7);
+                                                        src_offset |= ((u64)(radeon_get_ib_value(p, idx+8) & 0xff)) << 32;
                                                         ib[idx+7] += (u32)(src_reloc->lobj.gpu_offset & 0xfffffffc);
                                                         ib[idx+8] += upper_32_bits(src_reloc->lobj.gpu_offset) & 0xff;
 
-                                                        dst_offset = ib[idx+1];
+                                                        dst_offset = radeon_get_ib_value(p, idx+1);
                                                         dst_offset <<= 8;
                                                         ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset >> 8);
                                                 }
@@ -3176,10 +3176,10 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                         switch (misc) {
                                         case 0:
                                                 /* L2L, byte */
-                                                src_offset = ib[idx+2];
-                                                src_offset |= ((u64)(ib[idx+4] & 0xff)) << 32;
-                                                dst_offset = ib[idx+1];
-                                                dst_offset |= ((u64)(ib[idx+3] & 0xff)) << 32;
+                                                src_offset = radeon_get_ib_value(p, idx+2);
+                                                src_offset |= ((u64)(radeon_get_ib_value(p, idx+4) & 0xff)) << 32;
+                                                dst_offset = radeon_get_ib_value(p, idx+1);
+                                                dst_offset |= ((u64)(radeon_get_ib_value(p, idx+3) & 0xff)) << 32;
                                                 if ((src_offset + count) > radeon_bo_size(src_reloc->robj)) {
                                                         dev_warn(p->dev, "DMA L2L, byte src buffer too small (%llu %lu)\n",
                                                                  src_offset + count, radeon_bo_size(src_reloc->robj));
@@ -3216,12 +3216,12 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                                         DRM_ERROR("bad L2L, dw, broadcast DMA_PACKET_COPY\n");
                                                         return -EINVAL;
                                                 }
-                                                dst_offset = ib[idx+1];
-                                                dst_offset |= ((u64)(ib[idx+4] & 0xff)) << 32;
-                                                dst2_offset = ib[idx+2];
-                                                dst2_offset |= ((u64)(ib[idx+5] & 0xff)) << 32;
-                                                src_offset = ib[idx+3];
-                                                src_offset |= ((u64)(ib[idx+6] & 0xff)) << 32;
+                                                dst_offset = radeon_get_ib_value(p, idx+1);
+                                                dst_offset |= ((u64)(radeon_get_ib_value(p, idx+4) & 0xff)) << 32;
+                                                dst2_offset = radeon_get_ib_value(p, idx+2);
+                                                dst2_offset |= ((u64)(radeon_get_ib_value(p, idx+5) & 0xff)) << 32;
+                                                src_offset = radeon_get_ib_value(p, idx+3);
+                                                src_offset |= ((u64)(radeon_get_ib_value(p, idx+6) & 0xff)) << 32;
                                                 if ((src_offset + (count * 4)) > radeon_bo_size(src_reloc->robj)) {
                                                         dev_warn(p->dev, "DMA L2L, dw, broadcast src buffer too small (%llu %lu)\n",
                                                                  src_offset + (count * 4), radeon_bo_size(src_reloc->robj));
@@ -3251,10 +3251,10 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                         }
                                 } else {
                                         /* L2L, dw */
-                                        src_offset = ib[idx+2];
-                                        src_offset |= ((u64)(ib[idx+4] & 0xff)) << 32;
-                                        dst_offset = ib[idx+1];
-                                        dst_offset |= ((u64)(ib[idx+3] & 0xff)) << 32;
+                                        src_offset = radeon_get_ib_value(p, idx+2);
+                                        src_offset |= ((u64)(radeon_get_ib_value(p, idx+4) & 0xff)) << 32;
+                                        dst_offset = radeon_get_ib_value(p, idx+1);
+                                        dst_offset |= ((u64)(radeon_get_ib_value(p, idx+3) & 0xff)) << 32;
                                         if ((src_offset + (count * 4)) > radeon_bo_size(src_reloc->robj)) {
                                                 dev_warn(p->dev, "DMA L2L, dw src buffer too small (%llu %lu)\n",
                                                          src_offset + (count * 4), radeon_bo_size(src_reloc->robj));
@@ -3279,8 +3279,8 @@ int evergreen_dma_cs_parse(struct radeon_cs_parser *p)
                                 DRM_ERROR("bad DMA_PACKET_CONSTANT_FILL\n");
                                 return -EINVAL;
                         }
-                        dst_offset = ib[idx+1];
-                        dst_offset |= ((u64)(ib[idx+3] & 0x00ff0000)) << 16;
+                        dst_offset = radeon_get_ib_value(p, idx+1);
+                        dst_offset |= ((u64)(radeon_get_ib_value(p, idx+3) & 0x00ff0000)) << 16;
                         if ((dst_offset + (count * 4)) > radeon_bo_size(dst_reloc->robj)) {
                                 dev_warn(p->dev, "DMA constant fill buffer too small (%llu %lu)\n",
                                          dst_offset, radeon_bo_size(dst_reloc->robj));
diff --git a/drivers/gpu/drm/radeon/ni.c b/drivers/gpu/drm/radeon/ni.c
index 896f1cbc58a5..835992d8d067 100644
--- a/drivers/gpu/drm/radeon/ni.c
+++ b/drivers/gpu/drm/radeon/ni.c
@@ -1216,7 +1216,7 @@ void cayman_dma_stop(struct radeon_device *rdev)
 int cayman_dma_resume(struct radeon_device *rdev)
 {
         struct radeon_ring *ring;
-        u32 rb_cntl, dma_cntl;
+        u32 rb_cntl, dma_cntl, ib_cntl;
         u32 rb_bufsz;
         u32 reg_offset, wb_offset;
         int i, r;
@@ -1265,7 +1265,11 @@ int cayman_dma_resume(struct radeon_device *rdev)
                 WREG32(DMA_RB_BASE + reg_offset, ring->gpu_addr >> 8);
 
                 /* enable DMA IBs */
-                WREG32(DMA_IB_CNTL + reg_offset, DMA_IB_ENABLE | CMD_VMID_FORCE);
+                ib_cntl = DMA_IB_ENABLE | CMD_VMID_FORCE;
+#ifdef __BIG_ENDIAN
+                ib_cntl |= DMA_IB_SWAP_ENABLE;
+#endif
+                WREG32(DMA_IB_CNTL + reg_offset, ib_cntl);
 
                 dma_cntl = RREG32(DMA_CNTL + reg_offset);
                 dma_cntl &= ~CTXEMPTY_INT_ENABLE;
@@ -1409,6 +1413,12 @@ static int cayman_gpu_soft_reset(struct radeon_device *rdev, u32 reset_mask)
 {
         struct evergreen_mc_save save;
 
+        if (!(RREG32(GRBM_STATUS) & GUI_ACTIVE))
+                reset_mask &= ~(RADEON_RESET_GFX | RADEON_RESET_COMPUTE);
+
+        if (RREG32(DMA_STATUS_REG) & DMA_IDLE)
+                reset_mask &= ~RADEON_RESET_DMA;
+
         if (reset_mask == 0)
                 return 0;
 
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index 537e259b3837..becb03e8b32f 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -1378,6 +1378,12 @@ static int r600_gpu_soft_reset(struct radeon_device *rdev, u32 reset_mask)
 {
         struct rv515_mc_save save;
 
+        if (!(RREG32(GRBM_STATUS) & GUI_ACTIVE))
+                reset_mask &= ~(RADEON_RESET_GFX | RADEON_RESET_COMPUTE);
+
+        if (RREG32(DMA_STATUS_REG) & DMA_IDLE)
+                reset_mask &= ~RADEON_RESET_DMA;
+
         if (reset_mask == 0)
                 return 0;
 
@@ -1456,12 +1462,15 @@ u32 r6xx_remap_render_backend(struct radeon_device *rdev,
                               u32 disabled_rb_mask)
 {
         u32 rendering_pipe_num, rb_num_width, req_rb_num;
-        u32 pipe_rb_ratio, pipe_rb_remain;
+        u32 pipe_rb_ratio, pipe_rb_remain, tmp;
         u32 data = 0, mask = 1 << (max_rb_num - 1);
         unsigned i, j;
 
         /* mask out the RBs that don't exist on that asic */
-        disabled_rb_mask |= (0xff << max_rb_num) & 0xff;
+        tmp = disabled_rb_mask | ((0xff << max_rb_num) & 0xff);
+        /* make sure at least one RB is available */
+        if ((tmp & 0xff) != 0xff)
+                disabled_rb_mask = tmp;
 
         rendering_pipe_num = 1 << tiling_pipe_num;
         req_rb_num = total_max_rb_num - r600_count_pipe_bits(disabled_rb_mask);
@@ -2307,7 +2316,7 @@ void r600_dma_stop(struct radeon_device *rdev)
 int r600_dma_resume(struct radeon_device *rdev)
 {
         struct radeon_ring *ring = &rdev->ring[R600_RING_TYPE_DMA_INDEX];
-        u32 rb_cntl, dma_cntl;
+        u32 rb_cntl, dma_cntl, ib_cntl;
         u32 rb_bufsz;
         int r;
 
@@ -2347,7 +2356,11 @@ int r600_dma_resume(struct radeon_device *rdev)
         WREG32(DMA_RB_BASE, ring->gpu_addr >> 8);
 
         /* enable DMA IBs */
-        WREG32(DMA_IB_CNTL, DMA_IB_ENABLE);
+        ib_cntl = DMA_IB_ENABLE;
+#ifdef __BIG_ENDIAN
+        ib_cntl |= DMA_IB_SWAP_ENABLE;
+#endif
+        WREG32(DMA_IB_CNTL, ib_cntl);
 
         dma_cntl = RREG32(DMA_CNTL);
         dma_cntl &= ~CTXEMPTY_INT_ENABLE;
diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
index 03191a56eb44..9b2512bf1a46 100644
--- a/drivers/gpu/drm/radeon/r600_cs.c
+++ b/drivers/gpu/drm/radeon/r600_cs.c
@@ -2476,8 +2476,10 @@ static void r600_cs_parser_fini(struct radeon_cs_parser *parser, int error)
         kfree(parser->relocs);
         for (i = 0; i < parser->nchunks; i++) {
                 kfree(parser->chunks[i].kdata);
-                kfree(parser->chunks[i].kpage[0]);
-                kfree(parser->chunks[i].kpage[1]);
+                if (parser->rdev && (parser->rdev->flags & RADEON_IS_AGP)) {
+                        kfree(parser->chunks[i].kpage[0]);
+                        kfree(parser->chunks[i].kpage[1]);
+                }
         }
         kfree(parser->chunks);
         kfree(parser->chunks_array);
@@ -2561,16 +2563,16 @@ int r600_dma_cs_next_reloc(struct radeon_cs_parser *p,
         struct radeon_cs_chunk *relocs_chunk;
         unsigned idx;
 
+        *cs_reloc = NULL;
         if (p->chunk_relocs_idx == -1) {
                 DRM_ERROR("No relocation chunk !\n");
                 return -EINVAL;
         }
-        *cs_reloc = NULL;
         relocs_chunk = &p->chunks[p->chunk_relocs_idx];
         idx = p->dma_reloc_idx;
-        if (idx >= relocs_chunk->length_dw) {
+        if (idx >= p->nrelocs) {
                 DRM_ERROR("Relocs at %d after relocations chunk end %d !\n",
-                          idx, relocs_chunk->length_dw);
+                          idx, p->nrelocs);
                 return -EINVAL;
         }
         *cs_reloc = p->relocs_ptr[idx];
@@ -2621,14 +2623,14 @@ int r600_dma_cs_parse(struct radeon_cs_parser *p)
                                 return -EINVAL;
                         }
                         if (tiled) {
-                                dst_offset = ib[idx+1];
+                                dst_offset = radeon_get_ib_value(p, idx+1);
                                 dst_offset <<= 8;
 
                                 ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset >> 8);
                                 p->idx += count + 5;
                         } else {
-                                dst_offset = ib[idx+1];
-                                dst_offset |= ((u64)(ib[idx+2] & 0xff)) << 32;
+                                dst_offset = radeon_get_ib_value(p, idx+1);
+                                dst_offset |= ((u64)(radeon_get_ib_value(p, idx+2) & 0xff)) << 32;
 
                                 ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
                                 ib[idx+2] += upper_32_bits(dst_reloc->lobj.gpu_offset) & 0xff;
@@ -2656,32 +2658,32 @@ int r600_dma_cs_parse(struct radeon_cs_parser *p)
                                 /* detile bit */
                                 if (idx_value & (1 << 31)) {
                                         /* tiled src, linear dst */
-                                        src_offset = ib[idx+1];
+                                        src_offset = radeon_get_ib_value(p, idx+1);
                                         src_offset <<= 8;
                                         ib[idx+1] += (u32)(src_reloc->lobj.gpu_offset >> 8);
 
-                                        dst_offset = ib[idx+5];
-                                        dst_offset |= ((u64)(ib[idx+6] & 0xff)) << 32;
+                                        dst_offset = radeon_get_ib_value(p, idx+5);
+                                        dst_offset |= ((u64)(radeon_get_ib_value(p, idx+6) & 0xff)) << 32;
                                         ib[idx+5] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
                                         ib[idx+6] += upper_32_bits(dst_reloc->lobj.gpu_offset) & 0xff;
                                 } else {
                                         /* linear src, tiled dst */
-                                        src_offset = ib[idx+5];
-                                        src_offset |= ((u64)(ib[idx+6] & 0xff)) << 32;
+                                        src_offset = radeon_get_ib_value(p, idx+5);
+                                        src_offset |= ((u64)(radeon_get_ib_value(p, idx+6) & 0xff)) << 32;
                                         ib[idx+5] += (u32)(src_reloc->lobj.gpu_offset & 0xfffffffc);
                                         ib[idx+6] += upper_32_bits(src_reloc->lobj.gpu_offset) & 0xff;
 
-                                        dst_offset = ib[idx+1];
+                                        dst_offset = radeon_get_ib_value(p, idx+1);
                                         dst_offset <<= 8;
                                         ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset >> 8);
                                 }
                                 p->idx += 7;
                         } else {
                                 if (p->family >= CHIP_RV770) {
-                                        src_offset = ib[idx+2];
-                                        src_offset |= ((u64)(ib[idx+4] & 0xff)) << 32;
-                                        dst_offset = ib[idx+1];
-                                        dst_offset |= ((u64)(ib[idx+3] & 0xff)) << 32;
+                                        src_offset = radeon_get_ib_value(p, idx+2);
+                                        src_offset |= ((u64)(radeon_get_ib_value(p, idx+4) & 0xff)) << 32;
+                                        dst_offset = radeon_get_ib_value(p, idx+1);
+                                        dst_offset |= ((u64)(radeon_get_ib_value(p, idx+3) & 0xff)) << 32;
 
                                         ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
                                         ib[idx+2] += (u32)(src_reloc->lobj.gpu_offset & 0xfffffffc);
@@ -2689,10 +2691,10 @@ int r600_dma_cs_parse(struct radeon_cs_parser *p)
                                         ib[idx+4] += upper_32_bits(src_reloc->lobj.gpu_offset) & 0xff;
                                         p->idx += 5;
                                 } else {
-                                        src_offset = ib[idx+2];
-                                        src_offset |= ((u64)(ib[idx+3] & 0xff)) << 32;
-                                        dst_offset = ib[idx+1];
-                                        dst_offset |= ((u64)(ib[idx+3] & 0xff0000)) << 16;
+                                        src_offset = radeon_get_ib_value(p, idx+2);
+                                        src_offset |= ((u64)(radeon_get_ib_value(p, idx+3) & 0xff)) << 32;
+                                        dst_offset = radeon_get_ib_value(p, idx+1);
+                                        dst_offset |= ((u64)(radeon_get_ib_value(p, idx+3) & 0xff0000)) << 16;
 
                                         ib[idx+1] += (u32)(dst_reloc->lobj.gpu_offset & 0xfffffffc);
                                         ib[idx+2] += (u32)(src_reloc->lobj.gpu_offset & 0xfffffffc);
@@ -2722,8 +2724,8 @@ int r600_dma_cs_parse(struct radeon_cs_parser *p)
                                 DRM_ERROR("bad DMA_PACKET_WRITE\n");
                                 return -EINVAL;
                         }
-                        dst_offset = ib[idx+1];
-                        dst_offset |= ((u64)(ib[idx+3] & 0x00ff0000)) << 16;
+                        dst_offset = radeon_get_ib_value(p, idx+1);
+                        dst_offset |= ((u64)(radeon_get_ib_value(p, idx+3) & 0x00ff0000)) << 16;
                         if ((dst_offset + (count * 4)) > radeon_bo_size(dst_reloc->robj)) {
                                 dev_warn(p->dev, "DMA constant fill buffer too small (%llu %lu)\n",
                                          dst_offset + (count * 4), radeon_bo_size(dst_reloc->robj));
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index 34e52304a525..a08f657329a0 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -324,7 +324,6 @@ struct radeon_bo {
         struct list_head                list;
         /* Protected by tbo.reserved */
         u32                             placements[3];
-        u32                             busy_placements[3];
         struct ttm_placement            placement;
         struct ttm_buffer_object        tbo;
         struct ttm_bo_kmap_obj          kmap;
@@ -654,6 +653,8 @@ struct radeon_ring {
         u32                     ptr_reg_mask;
         u32                     nop;
         u32                     idx;
+        u64                     last_semaphore_signal_addr;
+        u64                     last_semaphore_wait_addr;
 };
 
 /*
diff --git a/drivers/gpu/drm/radeon/radeon_asic.c b/drivers/gpu/drm/radeon/radeon_asic.c
index 9056fafb00ea..0b202c07fe50 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.c
+++ b/drivers/gpu/drm/radeon/radeon_asic.c
@@ -1445,7 +1445,7 @@ static struct radeon_asic cayman_asic = {
         .vm = {
                 .init = &cayman_vm_init,
                 .fini = &cayman_vm_fini,
-                .pt_ring_index = R600_RING_TYPE_DMA_INDEX,
+                .pt_ring_index = RADEON_RING_TYPE_GFX_INDEX,
                 .set_page = &cayman_vm_set_page,
         },
         .ring = {
@@ -1572,7 +1572,7 @@ static struct radeon_asic trinity_asic = {
         .vm = {
                 .init = &cayman_vm_init,
                 .fini = &cayman_vm_fini,
-                .pt_ring_index = R600_RING_TYPE_DMA_INDEX,
+                .pt_ring_index = RADEON_RING_TYPE_GFX_INDEX,
                 .set_page = &cayman_vm_set_page,
         },
         .ring = {
@@ -1699,7 +1699,7 @@ static struct radeon_asic si_asic = {
         .vm = {
                 .init = &si_vm_init,
                 .fini = &si_vm_fini,
-                .pt_ring_index = R600_RING_TYPE_DMA_INDEX,
+                .pt_ring_index = RADEON_RING_TYPE_GFX_INDEX,
                 .set_page = &si_vm_set_page,
         },
         .ring = {
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index 33a56a09ff10..3e403bdda58f 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -2470,6 +2470,14 @@ bool radeon_get_legacy_connector_info_from_bios(struct drm_device *dev)
                                                                    1),
                                                                   ATOM_DEVICE_CRT1_SUPPORT);
                                 }
+                                /* RV100 board with external TDMS bit mis-set.
+                                 * Actually uses internal TMDS, clear the bit.
+                                 */
+                                if (dev->pdev->device == 0x5159 &&
+                                    dev->pdev->subsystem_vendor == 0x1014 &&
+                                    dev->pdev->subsystem_device == 0x029A) {
+                                        tmp &= ~(1 << 4);
+                                }
                                 if ((tmp >> 4) & 0x1) {
                                         devices |= ATOM_DEVICE_DFP2_SUPPORT;
                                         radeon_add_legacy_encoder(dev,
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index 396baba0141a..5407459e56d2 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -279,13 +279,15 @@ int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
                                   p->chunks[p->chunk_ib_idx].length_dw);
                         return -EINVAL;
                 }
-                if ((p->rdev->flags & RADEON_IS_AGP)) {
+                if (p->rdev && (p->rdev->flags & RADEON_IS_AGP)) {
                         p->chunks[p->chunk_ib_idx].kpage[0] = kmalloc(PAGE_SIZE, GFP_KERNEL);
                         p->chunks[p->chunk_ib_idx].kpage[1] = kmalloc(PAGE_SIZE, GFP_KERNEL);
                         if (p->chunks[p->chunk_ib_idx].kpage[0] == NULL ||
                             p->chunks[p->chunk_ib_idx].kpage[1] == NULL) {
-                                kfree(p->chunks[i].kpage[0]);
-                                kfree(p->chunks[i].kpage[1]);
+                                kfree(p->chunks[p->chunk_ib_idx].kpage[0]);
+                                kfree(p->chunks[p->chunk_ib_idx].kpage[1]);
+                                p->chunks[p->chunk_ib_idx].kpage[0] = NULL;
+                                p->chunks[p->chunk_ib_idx].kpage[1] = NULL;
                                 return -ENOMEM;
                         }
                 }
@@ -583,7 +585,8 @@ static int radeon_cs_update_pages(struct radeon_cs_parser *p, int pg_idx)
         struct radeon_cs_chunk *ibc = &p->chunks[p->chunk_ib_idx];
         int i;
         int size = PAGE_SIZE;
-        bool copy1 = (p->rdev->flags & RADEON_IS_AGP) ? false : true;
+        bool copy1 = (p->rdev && (p->rdev->flags & RADEON_IS_AGP)) ?
+                false : true;
 
         for (i = ibc->last_copied_page + 1; i < pg_idx; i++) {
                 if (DRM_COPY_FROM_USER(p->ib.ptr + (i * (PAGE_SIZE/4)),
diff --git a/drivers/gpu/drm/radeon/radeon_cursor.c b/drivers/gpu/drm/radeon/radeon_cursor.c
index ad6df625e8b8..0d67674b64b1 100644
--- a/drivers/gpu/drm/radeon/radeon_cursor.c
+++ b/drivers/gpu/drm/radeon/radeon_cursor.c
@@ -241,7 +241,8 @@ int radeon_crtc_cursor_move(struct drm_crtc *crtc,
                 y = 0;
         }
 
-        if (ASIC_IS_AVIVO(rdev)) {
+        /* fixed on DCE6 and newer */
+        if (ASIC_IS_AVIVO(rdev) && !ASIC_IS_DCE6(rdev)) {
                 int i = 0;
                 struct drm_crtc *crtc_p;
 
diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c
index edfc54e41842..0d6562bb0c93 100644
--- a/drivers/gpu/drm/radeon/radeon_device.c
+++ b/drivers/gpu/drm/radeon/radeon_device.c
@@ -429,7 +429,8 @@ bool radeon_card_posted(struct radeon_device *rdev)
 {
         uint32_t reg;
 
-        if (efi_enabled && rdev->pdev->subsystem_vendor == PCI_VENDOR_ID_APPLE)
+        if (efi_enabled(EFI_BOOT) &&
+            rdev->pdev->subsystem_vendor == PCI_VENDOR_ID_APPLE)
                 return false;
 
         /* first check CRTCs */
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index 1da2386d7cf7..05c96fa0b051 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -1115,14 +1115,16 @@ radeon_user_framebuffer_create(struct drm_device *dev,
         }
 
         radeon_fb = kzalloc(sizeof(*radeon_fb), GFP_KERNEL);
-        if (radeon_fb == NULL)
+        if (radeon_fb == NULL) {
+                drm_gem_object_unreference_unlocked(obj);
                 return ERR_PTR(-ENOMEM);
+        }
 
         ret = radeon_framebuffer_init(dev, radeon_fb, mode_cmd, obj);
         if (ret) {
                 kfree(radeon_fb);
                 drm_gem_object_unreference_unlocked(obj);
-                return NULL;
+                return ERR_PTR(ret);
         }
 
         return &radeon_fb->base;
diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
index dff6cf77f953..d9bf96ee299a 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.c
+++ b/drivers/gpu/drm/radeon/radeon_drv.c
@@ -69,9 +69,10 @@
  *   2.26.0 - r600-eg: fix htile size computation
  *   2.27.0 - r600-SI: Add CS ioctl support for async DMA
  *   2.28.0 - r600-eg: Add MEM_WRITE packet support
+ *   2.29.0 - R500 FP16 color clear registers
  */
 #define KMS_DRIVER_MAJOR        2
-#define KMS_DRIVER_MINOR        28
+#define KMS_DRIVER_MINOR        29
 #define KMS_DRIVER_PATCHLEVEL   0
 int radeon_driver_load_kms(struct drm_device *dev, unsigned long flags);
 int radeon_driver_unload_kms(struct drm_device *dev);
diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
index f5ba2241dacc..62cd512f5c8d 100644
--- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c
@@ -640,6 +640,14 @@ static enum drm_connector_status radeon_legacy_primary_dac_detect(struct drm_enc
         enum drm_connector_status found = connector_status_disconnected;
         bool color = true;
 
+        /* just don't bother on RN50 those chip are often connected to remoting
+         * console hw and often we get failure to load detect those. So to make
+         * everyone happy report the encoder as always connected.
+         */
+        if (ASIC_IS_RN50(rdev)) {
+                return connector_status_connected;
+        }
+
         /* save the regs we need */
         vclk_ecp_cntl = RREG32_PLL(RADEON_VCLK_ECP_CNTL);
         crtc_ext_cntl = RREG32(RADEON_CRTC_EXT_CNTL);
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index 883c95d8d90f..d3aface2d12d 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -84,6 +84,7 @@ void radeon_ttm_placement_from_domain(struct radeon_bo *rbo, u32 domain)
         rbo->placement.fpfn = 0;
         rbo->placement.lpfn = 0;
         rbo->placement.placement = rbo->placements;
+        rbo->placement.busy_placement = rbo->placements;
         if (domain & RADEON_GEM_DOMAIN_VRAM)
                 rbo->placements[c++] = TTM_PL_FLAG_WC | TTM_PL_FLAG_UNCACHED |
                                         TTM_PL_FLAG_VRAM;
@@ -104,14 +105,6 @@ void radeon_ttm_placement_from_domain(struct radeon_bo *rbo, u32 domain)
         if (!c)
                 rbo->placements[c++] = TTM_PL_MASK_CACHING | TTM_PL_FLAG_SYSTEM;
         rbo->placement.num_placement = c;
-
-        c = 0;
-        rbo->placement.busy_placement = rbo->busy_placements;
-        if (rbo->rdev->flags & RADEON_IS_AGP) {
-                rbo->busy_placements[c++] = TTM_PL_FLAG_WC | TTM_PL_FLAG_TT;
-        } else {
-                rbo->busy_placements[c++] = TTM_PL_FLAG_CACHED | TTM_PL_FLAG_TT;
-        }
         rbo->placement.num_busy_placement = c;
 }
 
@@ -357,6 +350,7 @@ int radeon_bo_list_validate(struct list_head *head)
 {
         struct radeon_bo_list *lobj;
         struct radeon_bo *bo;
+        u32 domain;
         int r;
 
         r = ttm_eu_reserve_buffers(head);
@@ -366,9 +360,17 @@ int radeon_bo_list_validate(struct list_head *head)
         list_for_each_entry(lobj, head, tv.head) {
                 bo = lobj->bo;
                 if (!bo->pin_count) {
+                        domain = lobj->wdomain ? lobj->wdomain : lobj->rdomain;
+                        
+                retry:
+                        radeon_ttm_placement_from_domain(bo, domain);
                         r = ttm_bo_validate(&bo->tbo, &bo->placement,
                                                 true, false);
                         if (unlikely(r)) {
+                                if (r != -ERESTARTSYS && domain == RADEON_GEM_DOMAIN_VRAM) {
+                                        domain |= RADEON_GEM_DOMAIN_GTT;
+                                        goto retry;
+                                }
                                 return r;
                         }
                 }
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
index 141f2b6a9cf2..cd72062d5a91 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -377,6 +377,9 @@ int radeon_ring_alloc(struct radeon_device *rdev, struct radeon_ring *ring, unsi
 {
         int r;
 
+        /* make sure we aren't trying to allocate more space than there is on the ring */
+        if (ndw > (ring->ring_size / 4))
+                return -ENOMEM;
         /* Align requested size with padding so unlock_commit can
          * pad safely */
         ndw = (ndw + ring->align_mask) & ~ring->align_mask;
@@ -784,6 +787,8 @@ static int radeon_debugfs_ring_info(struct seq_file *m, void *data)
         }
         seq_printf(m, "driver's copy of the wptr: 0x%08x [%5d]\n", ring->wptr, ring->wptr);
         seq_printf(m, "driver's copy of the rptr: 0x%08x [%5d]\n", ring->rptr, ring->rptr);
+        seq_printf(m, "last semaphore signal addr : 0x%016llx\n", ring->last_semaphore_signal_addr);
+        seq_printf(m, "last semaphore wait addr   : 0x%016llx\n", ring->last_semaphore_wait_addr);
         seq_printf(m, "%u free dwords in ring\n", ring->ring_free_dw);
         seq_printf(m, "%u dwords in ring\n", count);
         /* print 8 dw before current rptr as often it's the last executed
diff --git a/drivers/gpu/drm/radeon/radeon_semaphore.c b/drivers/gpu/drm/radeon/radeon_semaphore.c
index 97f3ece81cd2..8dcc20f53d73 100644
--- a/drivers/gpu/drm/radeon/radeon_semaphore.c
+++ b/drivers/gpu/drm/radeon/radeon_semaphore.c
@@ -95,6 +95,10 @@ int radeon_semaphore_sync_rings(struct radeon_device *rdev,
         /* we assume caller has already allocated space on waiters ring */
         radeon_semaphore_emit_wait(rdev, waiter, semaphore);
 
+        /* for debugging lockup only, used by sysfs debug files */
+        rdev->ring[signaler].last_semaphore_signal_addr = semaphore->gpu_addr;
+        rdev->ring[waiter].last_semaphore_wait_addr = semaphore->gpu_addr;
+
         return 0;
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
index 1d8ff2f850ba..93f760e27a92 100644
--- a/drivers/gpu/drm/radeon/radeon_ttm.c
+++ b/drivers/gpu/drm/radeon/radeon_ttm.c
@@ -38,6 +38,7 @@
 #include <drm/radeon_drm.h>
 #include <linux/seq_file.h>
 #include <linux/slab.h>
+#include <linux/swiotlb.h>
 #include "radeon_reg.h"
 #include "radeon.h"
 
diff --git a/drivers/gpu/drm/radeon/reg_srcs/cayman b/drivers/gpu/drm/radeon/reg_srcs/cayman
index 0f656b111c15..a072fa8c46b0 100644
--- a/drivers/gpu/drm/radeon/reg_srcs/cayman
+++ b/drivers/gpu/drm/radeon/reg_srcs/cayman
@@ -1,5 +1,6 @@
 cayman 0x9400
 0x0000802C GRBM_GFX_INDEX
+0x00008040 WAIT_UNTIL
 0x000084FC CP_STRMOUT_CNTL
 0x000085F0 CP_COHER_CNTL
 0x000085F4 CP_COHER_SIZE
diff --git a/drivers/gpu/drm/radeon/reg_srcs/rv515 b/drivers/gpu/drm/radeon/reg_srcs/rv515
index 911a8fbd32bb..78d5e99d759d 100644
--- a/drivers/gpu/drm/radeon/reg_srcs/rv515
+++ b/drivers/gpu/drm/radeon/reg_srcs/rv515
@@ -324,6 +324,8 @@ rv515 0x6d40
 0x46AC US_OUT_FMT_2
 0x46B0 US_OUT_FMT_3
 0x46B4 US_W_FMT
+0x46C0 RB3D_COLOR_CLEAR_VALUE_AR
+0x46C4 RB3D_COLOR_CLEAR_VALUE_GB
 0x4BC0 FG_FOG_BLEND
 0x4BC4 FG_FOG_FACTOR
 0x4BC8 FG_FOG_COLOR_R
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index 2bb6d0e84b3d..435ed3551364 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -336,6 +336,8 @@ void rv515_mc_stop(struct radeon_device *rdev, struct rv515_mc_save *save)
                                 WREG32(R600_CITF_CNTL, blackout);
                 }
         }
+        /* wait for the MC to settle */
+        udelay(100);
 }
 
 void rv515_mc_resume(struct radeon_device *rdev, struct rv515_mc_save *save)
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 3240a3d64f30..ae8b48205a6c 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -2215,6 +2215,12 @@ static int si_gpu_soft_reset(struct radeon_device *rdev, u32 reset_mask)
 {
         struct evergreen_mc_save save;
 
+        if (!(RREG32(GRBM_STATUS) & GUI_ACTIVE))
+                reset_mask &= ~(RADEON_RESET_GFX | RADEON_RESET_COMPUTE);
+
+        if (RREG32(DMA_STATUS_REG) & DMA_IDLE)
+                reset_mask &= ~RADEON_RESET_DMA;
+
         if (reset_mask == 0)
                 return 0;
 
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 33d20be87db5..52b20b12c83a 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -434,6 +434,7 @@ static int ttm_bo_handle_move_mem(struct ttm_buffer_object *bo,
                         bo->mem = tmp_mem;
                         bdev->driver->move_notify(bo, mem);
                         bo->mem = *mem;
+                        *mem = tmp_mem;
                 }
 
                 goto out_err;
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index d73d6e3e17b2..8be35c809c7b 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -344,8 +344,12 @@ int ttm_bo_move_memcpy(struct ttm_buffer_object *bo,
 
         if (ttm->state == tt_unpopulated) {
                 ret = ttm->bdev->driver->ttm_tt_populate(ttm);
-                if (ret)
+                if (ret) {
+                        /* if we fail here don't nuke the mm node
+                         * as the bo still owns it */
+                        old_copy.mm_node = NULL;
                         goto out1;
+                }
         }
 
         add = 0;
@@ -371,8 +375,11 @@ int ttm_bo_move_memcpy(struct ttm_buffer_object *bo,
                                                    prot);
                 } else
                         ret = ttm_copy_io_page(new_iomap, old_iomap, page);
-                if (ret)
+                if (ret) {
+                        /* failing here, means keep old copy as-is */
+                        old_copy.mm_node = NULL;
                         goto out1;
+                }
         }
         mb();
 out2:
@@ -422,7 +429,7 @@ static int ttm_buffer_object_transfer(struct ttm_buffer_object *bo,
         struct ttm_bo_device *bdev = bo->bdev;
         struct ttm_bo_driver *driver = bdev->driver;
 
-        fbo = kzalloc(sizeof(*fbo), GFP_KERNEL);
+        fbo = kmalloc(sizeof(*fbo), GFP_KERNEL);
         if (!fbo)
                 return -ENOMEM;
 
@@ -441,7 +448,12 @@ static int ttm_buffer_object_transfer(struct ttm_buffer_object *bo,
         fbo->vm_node = NULL;
         atomic_set(&fbo->cpu_writers, 0);
 
-        fbo->sync_obj = driver->sync_obj_ref(bo->sync_obj);
+        spin_lock(&bdev->fence_lock);
+        if (bo->sync_obj)
+                fbo->sync_obj = driver->sync_obj_ref(bo->sync_obj);
+        else
+                fbo->sync_obj = NULL;
+        spin_unlock(&bdev->fence_lock);
         kref_init(&fbo->list_kref);
         kref_init(&fbo->kref);
         fbo->destroy = &ttm_transfered_destroy;
@@ -654,13 +666,11 @@ int ttm_bo_move_accel_cleanup(struct ttm_buffer_object *bo,
                  */
 
                 set_bit(TTM_BO_PRIV_FLAG_MOVING, &bo->priv_flags);
-
-                /* ttm_buffer_object_transfer accesses bo->sync_obj */
-                ret = ttm_buffer_object_transfer(bo, &ghost_obj);
                 spin_unlock(&bdev->fence_lock);
                 if (tmp_obj)
                         driver->sync_obj_unref(&tmp_obj);
 
+                ret = ttm_buffer_object_transfer(bo, &ghost_obj);
                 if (ret)
                         return ret;
 
diff --git a/drivers/gpu/drm/udl/udl_connector.c b/drivers/gpu/drm/udl/udl_connector.c
index 512f44add89f..fe5cdbcf2636 100644
--- a/drivers/gpu/drm/udl/udl_connector.c
+++ b/drivers/gpu/drm/udl/udl_connector.c
@@ -22,13 +22,17 @@
 static u8 *udl_get_edid(struct udl_device *udl)
 {
         u8 *block;
-        char rbuf[3];
+        char *rbuf;
         int ret, i;
 
         block = kmalloc(EDID_LENGTH, GFP_KERNEL);
         if (block == NULL)
                 return NULL;
 
+        rbuf = kmalloc(2, GFP_KERNEL);
+        if (rbuf == NULL)
+                goto error;
+
         for (i = 0; i < EDID_LENGTH; i++) {
                 ret = usb_control_msg(udl->ddev->usbdev,
                                       usb_rcvctrlpipe(udl->ddev->usbdev, 0), (0x02),
@@ -36,16 +40,17 @@ static u8 *udl_get_edid(struct udl_device *udl)
                                       HZ);
                 if (ret < 1) {
                         DRM_ERROR("Read EDID byte %d failed err %x\n", i, ret);
-                        i--;
                         goto error;
                 }
                 block[i] = rbuf[1];
         }
 
+        kfree(rbuf);
         return block;
 
 error:
         kfree(block);
+        kfree(rbuf);
         return NULL;
 }
 
@@ -57,6 +62,14 @@ static int udl_get_modes(struct drm_connector *connector)
 
         edid = (struct edid *)udl_get_edid(udl);
 
+        /*
+         * We only read the main block, but if the monitor reports extension
+         * blocks then the drm edid code expects them to be present, so patch
+         * the extension count to 0.
+         */
+        edid->checksum += edid->extensions;
+        edid->extensions = 0;
+
         drm_mode_connector_update_edid_property(connector, edid);
         ret = drm_add_edid_modes(connector, edid);
         kfree(edid);
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 4dfa605e2d14..34e25471aeaa 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -306,6 +306,9 @@
 #define USB_VENDOR_ID_EZKEY             0x0518
 #define USB_DEVICE_ID_BTC_8193          0x0002
 
+#define USB_VENDOR_ID_FORMOSA          0x147a
+#define USB_DEVICE_ID_FORMOSA_IR_RECEIVER      0xe03e
+
 #define USB_VENDOR_ID_FREESCALE         0x15A2
 #define USB_DEVICE_ID_FREESCALE_MX28    0x004F
 
diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c
index 12e4fdc810bf..e766b5614ef5 100644
--- a/drivers/hid/i2c-hid/i2c-hid.c
+++ b/drivers/hid/i2c-hid/i2c-hid.c
@@ -540,13 +540,24 @@ static int i2c_hid_output_raw_report(struct hid_device *hid, __u8 *buf,
 {
         struct i2c_client *client = hid->driver_data;
         int report_id = buf[0];
+        int ret;
 
         if (report_type == HID_INPUT_REPORT)
                 return -EINVAL;
 
-        return i2c_hid_set_report(client,
+        if (report_id) {
+                buf++;
+                count--;
+        }
+
+        ret = i2c_hid_set_report(client,
                                 report_type == HID_FEATURE_REPORT ? 0x03 : 0x02,
                                 report_id, buf, count);
+
+        if (report_id && ret >= 0)
+                ret++; /* add report_id to the number of transfered bytes */
+
+        return ret;
 }
 
 static int i2c_hid_parse(struct hid_device *hid)
diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
index ac9e35228254..e0e6abf1cd3b 100644
--- a/drivers/hid/usbhid/hid-quirks.c
+++ b/drivers/hid/usbhid/hid-quirks.c
@@ -70,6 +70,7 @@ static const struct hid_blacklist {
         { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_AXIS_295, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_ELO, USB_DEVICE_ID_ELO_TS2700, HID_QUIRK_NOGET },
+        { USB_VENDOR_ID_FORMOSA, USB_DEVICE_ID_FORMOSA_IR_RECEIVER, HID_QUIRK_NO_INIT_REPORTS },
         { USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET },
         { USB_VENDOR_ID_NOVATEK, USB_DEVICE_ID_NOVATEK_MOUSE, HID_QUIRK_NO_INIT_REPORTS },
diff --git a/drivers/hv/Kconfig b/drivers/hv/Kconfig
index b38ef6d8d049..64630f15f181 100644
--- a/drivers/hv/Kconfig
+++ b/drivers/hv/Kconfig
@@ -2,7 +2,7 @@ menu "Microsoft Hyper-V guest support"
 
 config HYPERV
         tristate "Microsoft Hyper-V client drivers"
-        depends on X86 && ACPI && PCI
+        depends on X86 && ACPI && PCI && X86_LOCAL_APIC
         help
           Select this option to run Linux as a Hyper-V client operating
           system.
diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c
index f6c0011a0337..dd289fd179ca 100644
--- a/drivers/hv/hv_balloon.c
+++ b/drivers/hv/hv_balloon.c
@@ -403,7 +403,7 @@ struct dm_info_header {
  */
 
 struct dm_info_msg {
-        struct dm_info_header header;
+        struct dm_header hdr;
         __u32 reserved;
         __u32 info_size;
         __u8  info[];
@@ -503,13 +503,17 @@ static void hot_add_req(struct hv_dynmem_device *dm, struct dm_hot_add *msg)
 
 static void process_info(struct hv_dynmem_device *dm, struct dm_info_msg *msg)
 {
-        switch (msg->header.type) {
+        struct dm_info_header *info_hdr;
+
+        info_hdr = (struct dm_info_header *)msg->info;
+
+        switch (info_hdr->type) {
         case INFO_TYPE_MAX_PAGE_CNT:
                 pr_info("Received INFO_TYPE_MAX_PAGE_CNT\n");
-                pr_info("Data Size is %d\n", msg->header.data_size);
+                pr_info("Data Size is %d\n", info_hdr->data_size);
                 break;
         default:
-                pr_info("Received Unknown type: %d\n", msg->header.type);
+                pr_info("Received Unknown type: %d\n", info_hdr->type);
         }
 }
 
@@ -879,7 +883,7 @@ static int balloon_probe(struct hv_device *dev,
                         balloon_onchannelcallback, dev);
 
         if (ret)
-                return ret;
+                goto probe_error0;
 
         dm_device.dev = dev;
         dm_device.state = DM_INITIALIZING;
@@ -891,7 +895,7 @@ static int balloon_probe(struct hv_device *dev,
                  kthread_run(dm_thread_func, &dm_device, "hv_balloon");
         if (IS_ERR(dm_device.thread)) {
                 ret = PTR_ERR(dm_device.thread);
-                goto probe_error0;
+                goto probe_error1;
         }
 
         hv_set_drvdata(dev, &dm_device);
@@ -914,12 +918,12 @@ static int balloon_probe(struct hv_device *dev,
                                 VM_PKT_DATA_INBAND,
                                 VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED);
         if (ret)
-                goto probe_error1;
+                goto probe_error2;
 
         t = wait_for_completion_timeout(&dm_device.host_event, 5*HZ);
         if (t == 0) {
                 ret = -ETIMEDOUT;
-                goto probe_error1;
+                goto probe_error2;
         }
 
         /*
@@ -928,7 +932,7 @@ static int balloon_probe(struct hv_device *dev,
          */
         if (dm_device.state == DM_INIT_ERROR) {
                 ret = -ETIMEDOUT;
-                goto probe_error1;
+                goto probe_error2;
         }
         /*
          * Now submit our capabilities to the host.
@@ -961,12 +965,12 @@ static int balloon_probe(struct hv_device *dev,
                                 VM_PKT_DATA_INBAND,
                                 VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED);
         if (ret)
-                goto probe_error1;
+                goto probe_error2;
 
         t = wait_for_completion_timeout(&dm_device.host_event, 5*HZ);
         if (t == 0) {
                 ret = -ETIMEDOUT;
-                goto probe_error1;
+                goto probe_error2;
         }
 
         /*
@@ -975,18 +979,20 @@ static int balloon_probe(struct hv_device *dev,
          */
         if (dm_device.state == DM_INIT_ERROR) {
                 ret = -ETIMEDOUT;
-                goto probe_error1;
+                goto probe_error2;
         }
 
         dm_device.state = DM_INITIALIZED;
 
         return 0;
 
-probe_error1:
+probe_error2:
         kthread_stop(dm_device.thread);
 
-probe_error0:
+probe_error1:
         vmbus_close(dev->channel);
+probe_error0:
+        kfree(send_buffer);
         return ret;
 }
 
@@ -999,6 +1005,7 @@ static int balloon_remove(struct hv_device *dev)
 
         vmbus_close(dev->channel);
         kthread_stop(dm->thread);
+        kfree(send_buffer);
 
         return 0;
 }
diff --git a/drivers/hwmon/vexpress.c b/drivers/hwmon/vexpress.c
index 86d7f6d858b1..d867e6bb2be1 100644
--- a/drivers/hwmon/vexpress.c
+++ b/drivers/hwmon/vexpress.c
@@ -19,6 +19,7 @@
 #include <linux/hwmon.h>
 #include <linux/hwmon-sysfs.h>
 #include <linux/module.h>
+#include <linux/of.h>
 #include <linux/of_device.h>
 #include <linux/platform_device.h>
 #include <linux/vexpress.h>
diff --git a/drivers/i2c/busses/i2c-designware-core.c b/drivers/i2c/busses/i2c-designware-core.c
index cbba7db9ad59..f5258c205de5 100644
--- a/drivers/i2c/busses/i2c-designware-core.c
+++ b/drivers/i2c/busses/i2c-designware-core.c
@@ -34,6 +34,7 @@
 #include <linux/io.h>
 #include <linux/pm_runtime.h>
 #include <linux/delay.h>
+#include <linux/module.h>
 #include "i2c-designware-core.h"
 
 /*
@@ -725,3 +726,6 @@ u32 i2c_dw_read_comp_param(struct dw_i2c_dev *dev)
         return dw_readl(dev, DW_IC_COMP_PARAM_1);
 }
 EXPORT_SYMBOL_GPL(i2c_dw_read_comp_param);
+
+MODULE_DESCRIPTION("Synopsys DesignWare I2C bus adapter core");
+MODULE_LICENSE("GPL");
diff --git a/drivers/i2c/busses/i2c-mxs.c b/drivers/i2c/busses/i2c-mxs.c
index 1b1a936eccc9..d6abaf2cf2e3 100644
--- a/drivers/i2c/busses/i2c-mxs.c
+++ b/drivers/i2c/busses/i2c-mxs.c
@@ -127,7 +127,7 @@ struct mxs_i2c_dev {
         struct device *dev;
         void __iomem *regs;
         struct completion cmd_complete;
-        u32 cmd_err;
+        int cmd_err;
         struct i2c_adapter adapter;
         const struct mxs_i2c_speed_config *speed;
 
@@ -316,7 +316,7 @@ static int mxs_i2c_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg,
         if (msg->len == 0)
                 return -EINVAL;
 
-        init_completion(&i2c->cmd_complete);
+        INIT_COMPLETION(i2c->cmd_complete);
         i2c->cmd_err = 0;
 
         ret = mxs_i2c_dma_setup_xfer(adap, msg, flags);
@@ -473,6 +473,8 @@ static int mxs_i2c_probe(struct platform_device *pdev)
         i2c->dev = dev;
         i2c->speed = &mxs_i2c_95kHz_config;
 
+        init_completion(&i2c->cmd_complete);
+
         if (dev->of_node) {
                 err = mxs_i2c_get_ofdata(i2c);
                 if (err)
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index 20d41bfa7c19..4cc2f0528c88 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -803,7 +803,7 @@ static int errata_omap3_i462(struct omap_i2c_dev *dev)
                         if (stat & OMAP_I2C_STAT_AL) {
                                 dev_err(dev->dev, "Arbitration lost\n");
                                 dev->cmd_err |= OMAP_I2C_STAT_AL;
-                                omap_i2c_ack_stat(dev, OMAP_I2C_STAT_NACK);
+                                omap_i2c_ack_stat(dev, OMAP_I2C_STAT_AL);
                         }
 
                         return -EIO;
@@ -963,7 +963,7 @@ omap_i2c_isr_thread(int this_irq, void *dev_id)
                                 i2c_omap_errata_i207(dev, stat);
 
                         omap_i2c_ack_stat(dev, OMAP_I2C_STAT_RDR);
-                        break;
+                        continue;
                 }
 
                 if (stat & OMAP_I2C_STAT_RRDY) {
@@ -989,7 +989,7 @@ omap_i2c_isr_thread(int this_irq, void *dev_id)
                                 break;
 
                         omap_i2c_ack_stat(dev, OMAP_I2C_STAT_XDR);
-                        break;
+                        continue;
                 }
 
                 if (stat & OMAP_I2C_STAT_XRDY) {
diff --git a/drivers/i2c/busses/i2c-sirf.c b/drivers/i2c/busses/i2c-sirf.c
index 3f1818b87974..e03381aee34f 100644
--- a/drivers/i2c/busses/i2c-sirf.c
+++ b/drivers/i2c/busses/i2c-sirf.c
@@ -12,6 +12,7 @@
 #include <linux/slab.h>
 #include <linux/platform_device.h>
 #include <linux/i2c.h>
+#include <linux/of_i2c.h>
 #include <linux/clk.h>
 #include <linux/err.h>
 #include <linux/io.h>
@@ -328,6 +329,7 @@ static int i2c_sirfsoc_probe(struct platform_device *pdev)
         adap->algo = &i2c_sirfsoc_algo;
         adap->algo_data = siic;
 
+        adap->dev.of_node = pdev->dev.of_node;
         adap->dev.parent = &pdev->dev;
         adap->nr = pdev->id;
 
@@ -371,6 +373,8 @@ static int i2c_sirfsoc_probe(struct platform_device *pdev)
 
         clk_disable(clk);
 
+        of_i2c_register_devices(adap);
+
         dev_info(&pdev->dev, " I2C adapter ready to operate\n");
 
         return 0;
diff --git a/drivers/i2c/muxes/i2c-mux-pinctrl.c b/drivers/i2c/muxes/i2c-mux-pinctrl.c
index 1e44d04d1b22..a43c0ce5e3d8 100644
--- a/drivers/i2c/muxes/i2c-mux-pinctrl.c
+++ b/drivers/i2c/muxes/i2c-mux-pinctrl.c
@@ -167,7 +167,7 @@ static int i2c_mux_pinctrl_probe(struct platform_device *pdev)
         }
 
         mux->busses = devm_kzalloc(&pdev->dev,
-                                   sizeof(mux->busses) * mux->pdata->bus_count,
+                                   sizeof(*mux->busses) * mux->pdata->bus_count,
                                    GFP_KERNEL);
         if (!mux->busses) {
                 dev_err(&pdev->dev, "Cannot allocate busses\n");
diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
index 4ba384f1ab54..2df9414a72f7 100644
--- a/drivers/idle/intel_idle.c
+++ b/drivers/idle/intel_idle.c
@@ -448,8 +448,6 @@ static int intel_idle_probe(void)
         else
                 on_each_cpu(__setup_broadcast_timer, (void *)true, 1);
 
-        register_cpu_notifier(&cpu_hotplug_notifier);
-
         pr_debug(PREFIX "v" INTEL_IDLE_VERSION
                 " model 0x%X\n", boot_cpu_data.x86_model);
 
@@ -612,6 +610,7 @@ static int __init intel_idle_init(void)
                         return retval;
                 }
         }
+        register_cpu_notifier(&cpu_hotplug_notifier);
 
         return 0;
 }
diff --git a/drivers/iio/accel/Kconfig b/drivers/iio/accel/Kconfig
index fe4bcd7c5b12..05e996fafc9d 100644
--- a/drivers/iio/accel/Kconfig
+++ b/drivers/iio/accel/Kconfig
@@ -8,6 +8,7 @@ config HID_SENSOR_ACCEL_3D
         select IIO_BUFFER
         select IIO_TRIGGERED_BUFFER
         select HID_SENSOR_IIO_COMMON
+        select HID_SENSOR_IIO_TRIGGER
         tristate "HID Accelerometers 3D"
         help
           Say yes here to build support for the HID SENSOR
diff --git a/drivers/iio/adc/ad7266.c b/drivers/iio/adc/ad7266.c
index 4a5f639bc684..bbad9b94cd75 100644
--- a/drivers/iio/adc/ad7266.c
+++ b/drivers/iio/adc/ad7266.c
@@ -411,7 +411,11 @@ static int ad7266_probe(struct spi_device *spi)
                 if (ret)
                         goto error_put_reg;
 
-                st->vref_uv = regulator_get_voltage(st->reg);
+                ret = regulator_get_voltage(st->reg);
+                if (ret < 0)
+                        goto error_disable_reg;
+
+                st->vref_uv = ret;
         } else {
                 /* Use internal reference */
                 st->vref_uv = 2500000;
diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
index 04b013561f0f..a526c0e3aaa8 100644
--- a/drivers/iio/adc/at91_adc.c
+++ b/drivers/iio/adc/at91_adc.c
@@ -80,7 +80,7 @@ static irqreturn_t at91_adc_trigger_handler(int irq, void *p)
                 *timestamp = pf->timestamp;
         }
 
-        iio_push_to_buffers(indio_dev, (u8 *)st->buffer);
+        iio_push_to_buffers(idev, (u8 *)st->buffer);
 
         iio_trigger_notify_done(idev->trig);
 
diff --git a/drivers/iio/adc/max1363.c b/drivers/iio/adc/max1363.c
index b5669be6f396..03b25b3dc71e 100644
--- a/drivers/iio/adc/max1363.c
+++ b/drivers/iio/adc/max1363.c
@@ -1605,19 +1605,20 @@ static int max1363_probe(struct i2c_client *client,
 
         return 0;
 error_free_irq:
-        free_irq(st->client->irq, indio_dev);
+        if (client->irq)
+                free_irq(st->client->irq, indio_dev);
 error_uninit_buffer:
         iio_buffer_unregister(indio_dev);
 error_cleanup_buffer:
         max1363_buffer_cleanup(indio_dev);
 error_free_available_scan_masks:
         kfree(indio_dev->available_scan_masks);
-error_unregister_map:
-        iio_map_array_unregister(indio_dev, client->dev.platform_data);
 error_disable_reg:
         regulator_disable(st->reg);
 error_put_reg:
         regulator_put(st->reg);
+error_unregister_map:
+        iio_map_array_unregister(indio_dev, client->dev.platform_data);
 error_free_device:
         iio_device_free(indio_dev);
 error_out:
@@ -1635,10 +1636,8 @@ static int max1363_remove(struct i2c_client *client)
         iio_buffer_unregister(indio_dev);
         max1363_buffer_cleanup(indio_dev);
         kfree(indio_dev->available_scan_masks);
-        if (!IS_ERR(st->reg)) {
-                regulator_disable(st->reg);
-                regulator_put(st->reg);
-        }
+        regulator_disable(st->reg);
+        regulator_put(st->reg);
         iio_map_array_unregister(indio_dev, client->dev.platform_data);
         iio_device_free(indio_dev);
 
diff --git a/drivers/iio/common/hid-sensors/Kconfig b/drivers/iio/common/hid-sensors/Kconfig
index ae10778da7aa..1178121b55b0 100644
--- a/drivers/iio/common/hid-sensors/Kconfig
+++ b/drivers/iio/common/hid-sensors/Kconfig
@@ -6,7 +6,7 @@ menu "Hid Sensor IIO Common"
 config HID_SENSOR_IIO_COMMON
         tristate "Common modules for all HID Sensor IIO drivers"
         depends on HID_SENSOR_HUB
-        select IIO_TRIGGER if IIO_BUFFER
+        select HID_SENSOR_IIO_TRIGGER if IIO_BUFFER
         help
           Say yes here to build support for HID sensor to use
           HID sensor common processing for attributes and IIO triggers.
@@ -14,6 +14,17 @@ config HID_SENSOR_IIO_COMMON
           HID sensor drivers, this module contains processing for those
           attributes.
 
+config HID_SENSOR_IIO_TRIGGER
+        tristate "Common module (trigger) for all HID Sensor IIO drivers"
+        depends on HID_SENSOR_HUB && HID_SENSOR_IIO_COMMON
+        select IIO_TRIGGER
+        help
+          Say yes here to build trigger support for HID sensors.
+          Triggers will be send if all requested attributes were read.
+
+          If this driver is compiled as a module, it will be named
+          hid-sensor-trigger.
+
 config HID_SENSOR_ENUM_BASE_QUIRKS
         bool "ENUM base quirks for HID Sensor IIO drivers"
         depends on HID_SENSOR_IIO_COMMON
diff --git a/drivers/iio/common/hid-sensors/Makefile b/drivers/iio/common/hid-sensors/Makefile
index 1f463e00c242..22e7c5a82325 100644
--- a/drivers/iio/common/hid-sensors/Makefile
+++ b/drivers/iio/common/hid-sensors/Makefile
@@ -3,4 +3,5 @@
 #
 
 obj-$(CONFIG_HID_SENSOR_IIO_COMMON) += hid-sensor-iio-common.o
-hid-sensor-iio-common-y := hid-sensor-attributes.o hid-sensor-trigger.o
+obj-$(CONFIG_HID_SENSOR_IIO_TRIGGER) += hid-sensor-trigger.o
+hid-sensor-iio-common-y := hid-sensor-attributes.o
diff --git a/drivers/iio/dac/ad5380.c b/drivers/iio/dac/ad5380.c
index 6c7898c765d9..483fc379a2da 100644
--- a/drivers/iio/dac/ad5380.c
+++ b/drivers/iio/dac/ad5380.c
@@ -406,7 +406,11 @@ static int ad5380_probe(struct device *dev, struct regmap *regmap,
                         goto error_free_reg;
                 }
 
-                st->vref = regulator_get_voltage(st->vref_reg);
+                ret = regulator_get_voltage(st->vref_reg);
+                if (ret < 0)
+                        goto error_disable_reg;
+
+                st->vref = ret;
         } else {
                 st->vref = st->chip_info->int_vref;
                 ctrl |= AD5380_CTRL_INT_VREF_EN;
diff --git a/drivers/iio/dac/ad5446.c b/drivers/iio/dac/ad5446.c
index 29f653dab2f7..f5583aedfb59 100644
--- a/drivers/iio/dac/ad5446.c
+++ b/drivers/iio/dac/ad5446.c
@@ -226,7 +226,11 @@ static int ad5446_probe(struct device *dev, const char *name,
                 if (ret)
                         goto error_put_reg;
 
-                voltage_uv = regulator_get_voltage(reg);
+                ret = regulator_get_voltage(reg);
+                if (ret < 0)
+                        goto error_disable_reg;
+
+                voltage_uv = ret;
         }
 
         indio_dev = iio_device_alloc(sizeof(*st));
diff --git a/drivers/iio/dac/ad5504.c b/drivers/iio/dac/ad5504.c
index b2a31a0468ed..0661829f2773 100644
--- a/drivers/iio/dac/ad5504.c
+++ b/drivers/iio/dac/ad5504.c
@@ -296,7 +296,11 @@ static int ad5504_probe(struct spi_device *spi)
                 if (ret)
                         goto error_put_reg;
 
-                voltage_uv = regulator_get_voltage(reg);
+                ret = regulator_get_voltage(reg);
+                if (ret < 0)
+                        goto error_disable_reg;
+
+                voltage_uv = ret;
         }
 
         spi_set_drvdata(spi, indio_dev);
diff --git a/drivers/iio/dac/ad5624r_spi.c b/drivers/iio/dac/ad5624r_spi.c
index e9947969f9fe..f6e116627b71 100644
--- a/drivers/iio/dac/ad5624r_spi.c
+++ b/drivers/iio/dac/ad5624r_spi.c
@@ -238,7 +238,11 @@ static int ad5624r_probe(struct spi_device *spi)
                 if (ret)
                         goto error_put_reg;
 
-                voltage_uv = regulator_get_voltage(st->reg);
+                ret = regulator_get_voltage(st->reg);
+                if (ret < 0)
+                        goto error_disable_reg;
+
+                voltage_uv = ret;
         }
 
         spi_set_drvdata(spi, indio_dev);
diff --git a/drivers/iio/dac/ad5686.c b/drivers/iio/dac/ad5686.c
index 36e51382ae52..ca9609d7a15c 100644
--- a/drivers/iio/dac/ad5686.c
+++ b/drivers/iio/dac/ad5686.c
@@ -332,7 +332,11 @@ static int ad5686_probe(struct spi_device *spi)
                 if (ret)
                         goto error_put_reg;
 
-                voltage_uv = regulator_get_voltage(st->reg);
+                ret = regulator_get_voltage(st->reg);
+                if (ret < 0)
+                        goto error_disable_reg;
+
+                voltage_uv = ret;
         }
 
         st->chip_info =
diff --git a/drivers/iio/dac/ad5791.c b/drivers/iio/dac/ad5791.c
index c84180f23139..6407b5407ddd 100644
--- a/drivers/iio/dac/ad5791.c
+++ b/drivers/iio/dac/ad5791.c
@@ -365,7 +365,11 @@ static int ad5791_probe(struct spi_device *spi)
                 if (ret)
                         goto error_put_reg_pos;
 
-                pos_voltage_uv = regulator_get_voltage(st->reg_vdd);
+                ret = regulator_get_voltage(st->reg_vdd);
+                if (ret < 0)
+                        goto error_disable_reg_pos;
+
+                pos_voltage_uv = ret;
         }
 
         st->reg_vss = regulator_get(&spi->dev, "vss");
@@ -374,7 +378,11 @@ static int ad5791_probe(struct spi_device *spi)
                 if (ret)
                         goto error_put_reg_neg;
 
-                neg_voltage_uv = regulator_get_voltage(st->reg_vss);
+                ret = regulator_get_voltage(st->reg_vss);
+                if (ret < 0)
+                        goto error_disable_reg_neg;
+
+                neg_voltage_uv = ret;
         }
 
         st->pwr_down = true;
@@ -428,6 +436,7 @@ error_put_reg_neg:
         if (!IS_ERR(st->reg_vss))
                 regulator_put(st->reg_vss);
 
+error_disable_reg_pos:
         if (!IS_ERR(st->reg_vdd))
                 regulator_disable(st->reg_vdd);
 error_put_reg_pos:
diff --git a/drivers/iio/frequency/adf4350.c b/drivers/iio/frequency/adf4350.c
index e5033b4cfba0..a884252ac66b 100644
--- a/drivers/iio/frequency/adf4350.c
+++ b/drivers/iio/frequency/adf4350.c
@@ -173,7 +173,7 @@ static int adf4350_set_freq(struct adf4350_state *st, unsigned long long freq)
                         } while ((st->r1_mod > ADF4350_MAX_MODULUS) && r_cnt);
                 } while (r_cnt == 0);
 
-                tmp = freq * (u64)st->r1_mod + (st->fpfd > 1);
+                tmp = freq * (u64)st->r1_mod + (st->fpfd >> 1);
                 do_div(tmp, st->fpfd); /* Div round closest (n + d/2)/d */
                 st->r0_fract = do_div(tmp, st->r1_mod);
                 st->r0_int = tmp;
diff --git a/drivers/iio/gyro/Kconfig b/drivers/iio/gyro/Kconfig
index 48ed1483ff27..96b68f63a902 100644
--- a/drivers/iio/gyro/Kconfig
+++ b/drivers/iio/gyro/Kconfig
@@ -17,6 +17,7 @@ config HID_SENSOR_GYRO_3D
         select IIO_BUFFER
         select IIO_TRIGGERED_BUFFER
         select HID_SENSOR_IIO_COMMON
+        select HID_SENSOR_IIO_TRIGGER
         tristate "HID Gyroscope 3D"
         help
           Say yes here to build support for the HID SENSOR
diff --git a/drivers/iio/light/Kconfig b/drivers/iio/light/Kconfig
index 1763c9bcb98a..dbf80abc834f 100644
--- a/drivers/iio/light/Kconfig
+++ b/drivers/iio/light/Kconfig
@@ -47,6 +47,7 @@ config HID_SENSOR_ALS
         select IIO_BUFFER
         select IIO_TRIGGERED_BUFFER
         select HID_SENSOR_IIO_COMMON
+        select HID_SENSOR_IIO_TRIGGER
         tristate "HID ALS"
         help
           Say yes here to build support for the HID SENSOR
diff --git a/drivers/iio/magnetometer/Kconfig b/drivers/iio/magnetometer/Kconfig
index c1f0cdd57037..ff11d68225cf 100644
--- a/drivers/iio/magnetometer/Kconfig
+++ b/drivers/iio/magnetometer/Kconfig
@@ -8,6 +8,7 @@ config HID_SENSOR_MAGNETOMETER_3D
         select IIO_BUFFER
         select IIO_TRIGGERED_BUFFER
         select HID_SENSOR_IIO_COMMON
+        select HID_SENSOR_IIO_TRIGGER
         tristate "HID Magenetometer 3D"
         help
           Say yes here to build support for the HID SENSOR
diff --git a/drivers/infiniband/hw/qib/qib_qp.c b/drivers/infiniband/hw/qib/qib_qp.c
index 4850d03870c2..35275099cafd 100644
--- a/drivers/infiniband/hw/qib/qib_qp.c
+++ b/drivers/infiniband/hw/qib/qib_qp.c
@@ -263,20 +263,15 @@ static void remove_qp(struct qib_ibdev *dev, struct qib_qp *qp)
                 struct qib_qp __rcu **qpp;
 
                 qpp = &dev->qp_table[n];
-                q = rcu_dereference_protected(*qpp,
-                        lockdep_is_held(&dev->qpt_lock));
-                for (; q; qpp = &q->next) {
+                for (; (q = rcu_dereference_protected(*qpp,
+                                lockdep_is_held(&dev->qpt_lock))) != NULL;
+                                qpp = &q->next)
                         if (q == qp) {
                                 atomic_dec(&qp->refcount);
                                 *qpp = qp->next;
                                 rcu_assign_pointer(qp->next, NULL);
-                                q = rcu_dereference_protected(*qpp,
-                                        lockdep_is_held(&dev->qpt_lock));
                                 break;
                         }
-                        q = rcu_dereference_protected(*qpp,
-                                lockdep_is_held(&dev->qpt_lock));
-                }
         }
 
         spin_unlock_irqrestore(&dev->qpt_lock, flags);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 03103d2bd641..67b0c1d23678 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
@@ -741,6 +741,9 @@ void ipoib_cm_send(struct net_device *dev, struct sk_buff *skb, struct ipoib_cm_
 
         tx_req->mapping = addr;
 
+        skb_orphan(skb);
+        skb_dst_drop(skb);
+
         rc = post_send(priv, tx, tx->tx_head & (ipoib_sendq_size - 1),
                        addr, skb->len);
         if (unlikely(rc)) {
@@ -752,9 +755,6 @@ void ipoib_cm_send(struct net_device *dev, struct sk_buff *skb, struct ipoib_cm_
                 dev->trans_start = jiffies;
                 ++tx->tx_head;
 
-                skb_orphan(skb);
-                skb_dst_drop(skb);
-
                 if (++priv->tx_outstanding == ipoib_sendq_size) {
                         ipoib_dbg(priv, "TX ring 0x%x full, stopping kernel net queue\n",
                                   tx->qp->qp_num);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index a1bca70e20aa..2cfa76f5d99e 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -600,6 +600,9 @@ void ipoib_send(struct net_device *dev, struct sk_buff *skb,
                 netif_stop_queue(dev);
         }
 
+        skb_orphan(skb);
+        skb_dst_drop(skb);
+
         rc = post_send(priv, priv->tx_head & (ipoib_sendq_size - 1),
                        address->ah, qpn, tx_req, phead, hlen);
         if (unlikely(rc)) {
@@ -615,9 +618,6 @@ void ipoib_send(struct net_device *dev, struct sk_buff *skb,
 
                 address->last_send = priv->tx_head;
                 ++priv->tx_head;
-
-                skb_orphan(skb);
-                skb_dst_drop(skb);
         }
 
         if (unlikely(priv->tx_outstanding > MAX_SEND_CQE))
diff --git a/drivers/input/input.c b/drivers/input/input.c
index ce01332f7b3a..c04469928925 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -1785,12 +1785,13 @@ static void devm_input_device_release(struct device *dev, void *res)
  * its driver (or binding fails). Once managed input device is allocated,
  * it is ready to be set up and registered in the same fashion as regular
  * input device. There are no special devm_input_device_[un]register()
- * variants, regular ones work with both managed and unmanaged devices.
+ * variants, regular ones work with both managed and unmanaged devices,
+ * should you need them. In most cases however, managed input device need
+ * not be explicitly unregistered or freed.
  *
  * NOTE: the owner device is set up as parent of input device and users
  * should not override it.
  */
-
 struct input_dev *devm_input_allocate_device(struct device *dev)
 {
         struct input_dev *input;
@@ -2004,6 +2005,17 @@ static void devm_input_device_unregister(struct device *dev, void *res)
  * Once device has been successfully registered it can be unregistered
  * with input_unregister_device(); input_free_device() should not be
  * called in this case.
+ *
+ * Note that this function is also used to register managed input devices
+ * (ones allocated with devm_input_allocate_device()). Such managed input
+ * devices need not be explicitly unregistered or freed, their tear down
+ * is controlled by the devres infrastructure. It is also worth noting
+ * that tear down of managed input devices is internally a 2-step process:
+ * registered managed input device is first unregistered, but stays in
+ * memory and can still handle input_event() calls (although events will
+ * not be delivered anywhere). The freeing of managed input device will
+ * happen later, when devres stack is unwound to the point where device
+ * allocation was made.
  */
 int input_register_device(struct input_dev *dev)
 {
diff --git a/drivers/input/joystick/analog.c b/drivers/input/joystick/analog.c
index 358cd7ee905b..7cd74e29cbc8 100644
--- a/drivers/input/joystick/analog.c
+++ b/drivers/input/joystick/analog.c
@@ -162,7 +162,7 @@ static unsigned int get_time_pit(void)
 #define GET_TIME(x)     do { x = get_cycles(); } while (0)
 #define DELTA(x,y)      ((y)-(x))
 #define TIME_NAME       "PCC"
-#elif defined(CONFIG_MN10300)
+#elif defined(CONFIG_MN10300) || defined(CONFIG_TILE)
 #define GET_TIME(x)     do { x = get_cycles(); } while (0)
 #define DELTA(x, y)     ((x) - (y))
 #define TIME_NAME       "TSC"
diff --git a/drivers/input/keyboard/lm8323.c b/drivers/input/keyboard/lm8323.c
index 93c812662134..0de23f41b2d3 100644
--- a/drivers/input/keyboard/lm8323.c
+++ b/drivers/input/keyboard/lm8323.c
@@ -398,7 +398,7 @@ static irqreturn_t lm8323_irq(int irq, void *_lm)
                         lm8323_configure(lm);
                 }
                 for (i = 0; i < LM8323_NUM_PWMS; i++) {
-                        if (ints & (1 << (INT_PWM1 + i))) {
+                        if (ints & (INT_PWM1 << i)) {
                                 dev_vdbg(&lm->client->dev,
                                          "pwm%d engine completed\n", i);
                                 pwm_done(&lm->pwm[i]);
diff --git a/drivers/input/tablet/wacom_sys.c b/drivers/input/tablet/wacom_sys.c
index f92d34f45a1c..aaf23aeae2ea 100644
--- a/drivers/input/tablet/wacom_sys.c
+++ b/drivers/input/tablet/wacom_sys.c
@@ -553,10 +553,10 @@ static int wacom_set_device_mode(struct usb_interface *intf, int report_id, int
         if (!rep_data)
                 return error;
 
-        rep_data[0] = report_id;
-        rep_data[1] = mode;
-
         do {
+                rep_data[0] = report_id;
+                rep_data[1] = mode;
+
                 error = wacom_set_report(intf, WAC_HID_FEATURE_REPORT,
                                          report_id, rep_data, length, 1);
                 if (error >= 0)
diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c
index c1c74e030a58..d33eaaf783ad 100644
--- a/drivers/iommu/amd_iommu.c
+++ b/drivers/iommu/amd_iommu.c
@@ -4017,10 +4017,10 @@ static int alloc_irq_index(struct irq_cfg *cfg, u16 devid, int count)
 
                         index -= count - 1;
 
+                        cfg->remapped         = 1;
                         irte_info             = &cfg->irq_2_iommu;
                         irte_info->sub_handle = devid;
                         irte_info->irte_index = index;
-                        irte_info->iommu      = (void *)cfg;
 
                         goto out;
                 }
@@ -4127,9 +4127,9 @@ static int setup_ioapic_entry(int irq, struct IO_APIC_route_entry *entry,
         index = attr->ioapic_pin;
 
         /* Setup IRQ remapping info */
+        cfg->remapped         = 1;
         irte_info->sub_handle = devid;
         irte_info->irte_index = index;
-        irte_info->iommu      = (void *)cfg;
 
         /* Setup IRTE for IOMMU */
         irte.val                = 0;
@@ -4288,9 +4288,9 @@ static int msi_setup_irq(struct pci_dev *pdev, unsigned int irq,
         devid           = get_device_id(&pdev->dev);
         irte_info       = &cfg->irq_2_iommu;
 
+        cfg->remapped         = 1;
         irte_info->sub_handle = devid;
         irte_info->irte_index = index + offset;
-        irte_info->iommu      = (void *)cfg;
 
         return 0;
 }
@@ -4314,9 +4314,9 @@ static int setup_hpet_msi(unsigned int irq, unsigned int id)
         if (index < 0)
                 return index;
 
+        cfg->remapped         = 1;
         irte_info->sub_handle = devid;
         irte_info->irte_index = index;
-        irte_info->iommu      = (void *)cfg;
 
         return 0;
 }
diff --git a/drivers/iommu/amd_iommu_init.c b/drivers/iommu/amd_iommu_init.c
index 81837b0710a9..faf10ba1ed9a 100644
--- a/drivers/iommu/amd_iommu_init.c
+++ b/drivers/iommu/amd_iommu_init.c
@@ -975,6 +975,38 @@ static void __init free_iommu_all(void)
 }
 
 /*
+ * Family15h Model 10h-1fh erratum 746 (IOMMU Logging May Stall Translations)
+ * Workaround:
+ *     BIOS should disable L2B micellaneous clock gating by setting
+ *     L2_L2B_CK_GATE_CONTROL[CKGateL2BMiscDisable](D0F2xF4_x90[2]) = 1b
+ */
+static void __init amd_iommu_erratum_746_workaround(struct amd_iommu *iommu)
+{
+        u32 value;
+
+        if ((boot_cpu_data.x86 != 0x15) ||
+            (boot_cpu_data.x86_model < 0x10) ||
+            (boot_cpu_data.x86_model > 0x1f))
+                return;
+
+        pci_write_config_dword(iommu->dev, 0xf0, 0x90);
+        pci_read_config_dword(iommu->dev, 0xf4, &value);
+
+        if (value & BIT(2))
+                return;
+
+        /* Select NB indirect register 0x90 and enable writing */
+        pci_write_config_dword(iommu->dev, 0xf0, 0x90 | (1 << 8));
+
+        pci_write_config_dword(iommu->dev, 0xf4, value | 0x4);
+        pr_info("AMD-Vi: Applying erratum 746 workaround for IOMMU at %s\n",
+                dev_name(&iommu->dev->dev));
+
+        /* Clear the enable writing bit */
+        pci_write_config_dword(iommu->dev, 0xf0, 0x90);
+}
+
+/*
  * This function clues the initialization function for one IOMMU
  * together and also allocates the command buffer and programs the
  * hardware. It does NOT enable the IOMMU. This is done afterwards.
@@ -1172,6 +1204,8 @@ static int iommu_init_pci(struct amd_iommu *iommu)
                         iommu->stored_l2[i] = iommu_read_l2(iommu, i);
         }
 
+        amd_iommu_erratum_746_workaround(iommu);
+
         return pci_enable_device(iommu->dev);
 }
 
diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c
index 86e2f4a62b9a..174bb654453d 100644
--- a/drivers/iommu/dmar.c
+++ b/drivers/iommu/dmar.c
@@ -41,6 +41,8 @@
 #include <asm/irq_remapping.h>
 #include <asm/iommu_table.h>
 
+#include "irq_remapping.h"
+
 /* No locks are needed as DMA remapping hardware unit
  * list is constructed at boot time and hotplug of
  * these units are not supported by the architecture.
diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index b9d091157884..43d5c8b8e7ad 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -46,6 +46,8 @@
 #include <asm/cacheflush.h>
 #include <asm/iommu.h>
 
+#include "irq_remapping.h"
+
 #define ROOT_SIZE               VTD_PAGE_SIZE
 #define CONTEXT_SIZE            VTD_PAGE_SIZE
 
@@ -4234,6 +4236,21 @@ static struct iommu_ops intel_iommu_ops = {
         .pgsize_bitmap  = INTEL_IOMMU_PGSIZES,
 };
 
+static void quirk_iommu_g4x_gfx(struct pci_dev *dev)
+{
+        /* G4x/GM45 integrated gfx dmar support is totally busted. */
+        printk(KERN_INFO "DMAR: Disabling IOMMU for graphics on this chipset\n");
+        dmar_map_gfx = 0;
+}
+
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_g4x_gfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e00, quirk_iommu_g4x_gfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e10, quirk_iommu_g4x_gfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e20, quirk_iommu_g4x_gfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e30, quirk_iommu_g4x_gfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e40, quirk_iommu_g4x_gfx);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2e90, quirk_iommu_g4x_gfx);
+
 static void quirk_iommu_rwbf(struct pci_dev *dev)
 {
         /*
@@ -4242,12 +4259,6 @@ static void quirk_iommu_rwbf(struct pci_dev *dev)
          */
         printk(KERN_INFO "DMAR: Forcing write-buffer flush capability\n");
         rwbf_quirk = 1;
-
-        /* https://bugzilla.redhat.com/show_bug.cgi?id=538163 */
-        if (dev->revision == 0x07) {
-                printk(KERN_INFO "DMAR: Disabling IOMMU for graphics on this chipset\n");
-                dmar_map_gfx = 0;
-        }
 }
 
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_INTEL, 0x2a40, quirk_iommu_rwbf);
diff --git a/drivers/iommu/intel_irq_remapping.c b/drivers/iommu/intel_irq_remapping.c
index af8904de1d44..f3b8f23b5d8f 100644
--- a/drivers/iommu/intel_irq_remapping.c
+++ b/drivers/iommu/intel_irq_remapping.c
@@ -68,6 +68,7 @@ static int alloc_irte(struct intel_iommu *iommu, int irq, u16 count)
 {
         struct ir_table *table = iommu->ir_table;
         struct irq_2_iommu *irq_iommu = irq_2_iommu(irq);
+        struct irq_cfg *cfg = irq_get_chip_data(irq);
         u16 index, start_index;
         unsigned int mask = 0;
         unsigned long flags;
@@ -115,6 +116,7 @@ static int alloc_irte(struct intel_iommu *iommu, int irq, u16 count)
         for (i = index; i < index + count; i++)
                 table->base[i].present = 1;
 
+        cfg->remapped = 1;
         irq_iommu->iommu = iommu;
         irq_iommu->irte_index =  index;
         irq_iommu->sub_handle = 0;
@@ -155,6 +157,7 @@ static int map_irq_to_irte_handle(int irq, u16 *sub_handle)
 static int set_irte_irq(int irq, struct intel_iommu *iommu, u16 index, u16 subhandle)
 {
         struct irq_2_iommu *irq_iommu = irq_2_iommu(irq);
+        struct irq_cfg *cfg = irq_get_chip_data(irq);
         unsigned long flags;
 
         if (!irq_iommu)
@@ -162,6 +165,7 @@ static int set_irte_irq(int irq, struct intel_iommu *iommu, u16 index, u16 subha
 
         raw_spin_lock_irqsave(&irq_2_ir_lock, flags);
 
+        cfg->remapped = 1;
         irq_iommu->iommu = iommu;
         irq_iommu->irte_index = index;
         irq_iommu->sub_handle = subhandle;
@@ -425,11 +429,22 @@ static void iommu_set_irq_remapping(struct intel_iommu *iommu, int mode)
 
         /* Enable interrupt-remapping */
         iommu->gcmd |= DMA_GCMD_IRE;
+        iommu->gcmd &= ~DMA_GCMD_CFI;  /* Block compatibility-format MSIs */
         writel(iommu->gcmd, iommu->reg + DMAR_GCMD_REG);
 
         IOMMU_WAIT_OP(iommu, DMAR_GSTS_REG,
                       readl, (sts & DMA_GSTS_IRES), sts);
 
+        /*
+         * With CFI clear in the Global Command register, we should be
+         * protected from dangerous (i.e. compatibility) interrupts
+         * regardless of x2apic status.  Check just to be sure.
+         */
+        if (sts & DMA_GSTS_CFIS)
+                WARN(1, KERN_WARNING
+                        "Compatibility-format IRQs enabled despite intr remapping;\n"
+                        "you are vulnerable to IRQ injection.\n");
+
         raw_spin_unlock_irqrestore(&iommu->register_lock, flags);
 }
 
@@ -526,20 +541,24 @@ static int __init intel_irq_remapping_supported(void)
 static int __init intel_enable_irq_remapping(void)
 {
         struct dmar_drhd_unit *drhd;
+        bool x2apic_present;
         int setup = 0;
         int eim = 0;
 
+        x2apic_present = x2apic_supported();
+
         if (parse_ioapics_under_ir() != 1) {
                 printk(KERN_INFO "Not enable interrupt remapping\n");
-                return -1;
+                goto error;
         }
 
-        if (x2apic_supported()) {
+        if (x2apic_present) {
                 eim = !dmar_x2apic_optout();
-                WARN(!eim, KERN_WARNING
-                           "Your BIOS is broken and requested that x2apic be disabled\n"
-                           "This will leave your machine vulnerable to irq-injection attacks\n"
-                           "Use 'intremap=no_x2apic_optout' to override BIOS request\n");
+                if (!eim)
+                        printk(KERN_WARNING
+                                "Your BIOS is broken and requested that x2apic be disabled.\n"
+                                "This will slightly decrease performance.\n"
+                                "Use 'intremap=no_x2apic_optout' to override BIOS request.\n");
         }
 
         for_each_drhd_unit(drhd) {
@@ -578,7 +597,7 @@ static int __init intel_enable_irq_remapping(void)
                 if (eim && !ecap_eim_support(iommu->ecap)) {
                         printk(KERN_INFO "DRHD %Lx: EIM not supported by DRHD, "
                                " ecap %Lx\n", drhd->reg_base_addr, iommu->ecap);
-                        return -1;
+                        goto error;
                 }
         }
 
@@ -594,7 +613,7 @@ static int __init intel_enable_irq_remapping(void)
                         printk(KERN_ERR "DRHD %Lx: failed to enable queued, "
                                " invalidation, ecap %Lx, ret %d\n",
                                drhd->reg_base_addr, iommu->ecap, ret);
-                        return -1;
+                        goto error;
                 }
         }
 
@@ -617,6 +636,14 @@ static int __init intel_enable_irq_remapping(void)
                 goto error;
 
         irq_remapping_enabled = 1;
+
+        /*
+         * VT-d has a different layout for IO-APIC entries when
+         * interrupt remapping is enabled. So it needs a special routine
+         * to print IO-APIC entries for debugging purposes too.
+         */
+        x86_io_apic_ops.print_entries = intel_ir_io_apic_print_entries;
+
         pr_info("Enabled IRQ remapping in %s mode\n", eim ? "x2apic" : "xapic");
 
         return eim ? IRQ_REMAP_X2APIC_MODE : IRQ_REMAP_XAPIC_MODE;
@@ -625,6 +652,11 @@ error:
         /*
          * handle error condition gracefully here!
          */
+
+        if (x2apic_present)
+                WARN(1, KERN_WARNING
+                        "Failed to enable irq remapping.  You are vulnerable to irq-injection attacks.\n");
+
         return -1;
 }
 
diff --git a/drivers/iommu/irq_remapping.c b/drivers/iommu/irq_remapping.c
index faf85d6e33fe..d56f8c17c5fe 100644
--- a/drivers/iommu/irq_remapping.c
+++ b/drivers/iommu/irq_remapping.c
@@ -1,11 +1,18 @@
+#include <linux/seq_file.h>
+#include <linux/cpumask.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
 #include <linux/cpumask.h>
 #include <linux/errno.h>
 #include <linux/msi.h>
+#include <linux/irq.h>
+#include <linux/pci.h>
 
 #include <asm/hw_irq.h>
 #include <asm/irq_remapping.h>
+#include <asm/processor.h>
+#include <asm/x86_init.h>
+#include <asm/apic.h>
 
 #include "irq_remapping.h"
 
@@ -17,6 +24,152 @@ int no_x2apic_optout;
 
 static struct irq_remap_ops *remap_ops;
 
+static int msi_alloc_remapped_irq(struct pci_dev *pdev, int irq, int nvec);
+static int msi_setup_remapped_irq(struct pci_dev *pdev, unsigned int irq,
+                                  int index, int sub_handle);
+static int set_remapped_irq_affinity(struct irq_data *data,
+                                     const struct cpumask *mask,
+                                     bool force);
+
+static bool irq_remapped(struct irq_cfg *cfg)
+{
+        return (cfg->remapped == 1);
+}
+
+static void irq_remapping_disable_io_apic(void)
+{
+        /*
+         * With interrupt-remapping, for now we will use virtual wire A
+         * mode, as virtual wire B is little complex (need to configure
+         * both IOAPIC RTE as well as interrupt-remapping table entry).
+         * As this gets called during crash dump, keep this simple for
+         * now.
+         */
+        if (cpu_has_apic || apic_from_smp_config())
+                disconnect_bsp_APIC(0);
+}
+
+static int do_setup_msi_irqs(struct pci_dev *dev, int nvec)
+{
+        int node, ret, sub_handle, index = 0;
+        unsigned int irq;
+        struct msi_desc *msidesc;
+
+        nvec = __roundup_pow_of_two(nvec);
+
+        WARN_ON(!list_is_singular(&dev->msi_list));
+        msidesc = list_entry(dev->msi_list.next, struct msi_desc, list);
+        WARN_ON(msidesc->irq);
+        WARN_ON(msidesc->msi_attrib.multiple);
+
+        node = dev_to_node(&dev->dev);
+        irq = __create_irqs(get_nr_irqs_gsi(), nvec, node);
+        if (irq == 0)
+                return -ENOSPC;
+
+        msidesc->msi_attrib.multiple = ilog2(nvec);
+        for (sub_handle = 0; sub_handle < nvec; sub_handle++) {
+                if (!sub_handle) {
+                        index = msi_alloc_remapped_irq(dev, irq, nvec);
+                        if (index < 0) {
+                                ret = index;
+                                goto error;
+                        }
+                } else {
+                        ret = msi_setup_remapped_irq(dev, irq + sub_handle,
+                                                     index, sub_handle);
+                        if (ret < 0)
+                                goto error;
+                }
+                ret = setup_msi_irq(dev, msidesc, irq, sub_handle);
+                if (ret < 0)
+                        goto error;
+        }
+        return 0;
+
+error:
+        destroy_irqs(irq, nvec);
+
+        /*
+         * Restore altered MSI descriptor fields and prevent just destroyed
+         * IRQs from tearing down again in default_teardown_msi_irqs()
+         */
+        msidesc->irq = 0;
+        msidesc->msi_attrib.multiple = 0;
+
+        return ret;
+}
+
+static int do_setup_msix_irqs(struct pci_dev *dev, int nvec)
+{
+        int node, ret, sub_handle, index = 0;
+        struct msi_desc *msidesc;
+        unsigned int irq;
+
+        node            = dev_to_node(&dev->dev);
+        irq             = get_nr_irqs_gsi();
+        sub_handle      = 0;
+
+        list_for_each_entry(msidesc, &dev->msi_list, list) {
+
+                irq = create_irq_nr(irq, node);
+                if (irq == 0)
+                        return -1;
+
+                if (sub_handle == 0)
+                        ret = index = msi_alloc_remapped_irq(dev, irq, nvec);
+                else
+                        ret = msi_setup_remapped_irq(dev, irq, index, sub_handle);
+
+                if (ret < 0)
+                        goto error;
+
+                ret = setup_msi_irq(dev, msidesc, irq, 0);
+                if (ret < 0)
+                        goto error;
+
+                sub_handle += 1;
+                irq        += 1;
+        }
+
+        return 0;
+
+error:
+        destroy_irq(irq);
+        return ret;
+}
+
+static int irq_remapping_setup_msi_irqs(struct pci_dev *dev,
+                                        int nvec, int type)
+{
+        if (type == PCI_CAP_ID_MSI)
+                return do_setup_msi_irqs(dev, nvec);
+        else
+                return do_setup_msix_irqs(dev, nvec);
+}
+
+void eoi_ioapic_pin_remapped(int apic, int pin, int vector)
+{
+        /*
+         * Intr-remapping uses pin number as the virtual vector
+         * in the RTE. Actual vector is programmed in
+         * intr-remapping table entry. Hence for the io-apic
+         * EOI we use the pin number.
+         */
+        io_apic_eoi(apic, pin);
+}
+
+static void __init irq_remapping_modify_x86_ops(void)
+{
+        x86_io_apic_ops.disable         = irq_remapping_disable_io_apic;
+        x86_io_apic_ops.set_affinity    = set_remapped_irq_affinity;
+        x86_io_apic_ops.setup_entry     = setup_ioapic_remapped_entry;
+        x86_io_apic_ops.eoi_ioapic_pin  = eoi_ioapic_pin_remapped;
+        x86_msi.setup_msi_irqs          = irq_remapping_setup_msi_irqs;
+        x86_msi.setup_hpet_msi          = setup_hpet_msi_remapped;
+        x86_msi.compose_msi_msg         = compose_remapped_msi_msg;
+}
+
 static __init int setup_nointremap(char *str)
 {
         disable_irq_remap = 1;
@@ -79,15 +232,24 @@ int __init irq_remapping_prepare(void)
 
 int __init irq_remapping_enable(void)
 {
+        int ret;
+
         if (!remap_ops || !remap_ops->enable)
                 return -ENODEV;
 
-        return remap_ops->enable();
+        ret = remap_ops->enable();
+
+        if (irq_remapping_enabled)
+                irq_remapping_modify_x86_ops();
+
+        return ret;
 }
 
 void irq_remapping_disable(void)
 {
-        if (!remap_ops || !remap_ops->disable)
+        if (!irq_remapping_enabled ||
+            !remap_ops ||
+            !remap_ops->disable)
                 return;
 
         remap_ops->disable();
@@ -95,7 +257,9 @@ void irq_remapping_disable(void)
 
 int irq_remapping_reenable(int mode)
 {
-        if (!remap_ops || !remap_ops->reenable)
+        if (!irq_remapping_enabled ||
+            !remap_ops ||
+            !remap_ops->reenable)
                 return 0;
 
         return remap_ops->reenable(mode);
@@ -103,6 +267,9 @@ int irq_remapping_reenable(int mode)
 
 int __init irq_remap_enable_fault_handling(void)
 {
+        if (!irq_remapping_enabled)
+                return 0;
+
         if (!remap_ops || !remap_ops->enable_faulting)
                 return -ENODEV;
 
@@ -133,23 +300,28 @@ int set_remapped_irq_affinity(struct irq_data *data, const struct cpumask *mask,
 
 void free_remapped_irq(int irq)
 {
+        struct irq_cfg *cfg = irq_get_chip_data(irq);
+
         if (!remap_ops || !remap_ops->free_irq)
                 return;
 
-        remap_ops->free_irq(irq);
+        if (irq_remapped(cfg))
+                remap_ops->free_irq(irq);
 }
 
 void compose_remapped_msi_msg(struct pci_dev *pdev,
                               unsigned int irq, unsigned int dest,
                               struct msi_msg *msg, u8 hpet_id)
 {
-        if (!remap_ops || !remap_ops->compose_msi_msg)
-                return;
+        struct irq_cfg *cfg = irq_get_chip_data(irq);
 
-        remap_ops->compose_msi_msg(pdev, irq, dest, msg, hpet_id);
+        if (!irq_remapped(cfg))
+                native_compose_msi_msg(pdev, irq, dest, msg, hpet_id);
+        else if (remap_ops && remap_ops->compose_msi_msg)
+                remap_ops->compose_msi_msg(pdev, irq, dest, msg, hpet_id);
 }
 
-int msi_alloc_remapped_irq(struct pci_dev *pdev, int irq, int nvec)
+static int msi_alloc_remapped_irq(struct pci_dev *pdev, int irq, int nvec)
 {
         if (!remap_ops || !remap_ops->msi_alloc_irq)
                 return -ENODEV;
@@ -157,8 +329,8 @@ int msi_alloc_remapped_irq(struct pci_dev *pdev, int irq, int nvec)
         return remap_ops->msi_alloc_irq(pdev, irq, nvec);
 }
 
-int msi_setup_remapped_irq(struct pci_dev *pdev, unsigned int irq,
-                           int index, int sub_handle)
+static int msi_setup_remapped_irq(struct pci_dev *pdev, unsigned int irq,
+                                  int index, int sub_handle)
 {
         if (!remap_ops || !remap_ops->msi_setup_irq)
                 return -ENODEV;
@@ -173,3 +345,42 @@ int setup_hpet_msi_remapped(unsigned int irq, unsigned int id)
 
         return remap_ops->setup_hpet_msi(irq, id);
 }
+
+void panic_if_irq_remap(const char *msg)
+{
+        if (irq_remapping_enabled)
+                panic(msg);
+}
+
+static void ir_ack_apic_edge(struct irq_data *data)
+{
+        ack_APIC_irq();
+}
+
+static void ir_ack_apic_level(struct irq_data *data)
+{
+        ack_APIC_irq();
+        eoi_ioapic_irq(data->irq, data->chip_data);
+}
+
+static void ir_print_prefix(struct irq_data *data, struct seq_file *p)
+{
+        seq_printf(p, " IR-%s", data->chip->name);
+}
+
+void irq_remap_modify_chip_defaults(struct irq_chip *chip)
+{
+        chip->irq_print_chip = ir_print_prefix;
+        chip->irq_ack = ir_ack_apic_edge;
+        chip->irq_eoi = ir_ack_apic_level;
+        chip->irq_set_affinity = x86_io_apic_ops.set_affinity;
+}
+
+bool setup_remapped_irq(int irq, struct irq_cfg *cfg, struct irq_chip *chip)
+{
+        if (!irq_remapped(cfg))
+                return false;
+        irq_set_status_flags(irq, IRQ_MOVE_PCNTXT);
+        irq_remap_modify_chip_defaults(chip);
+        return true;
+}
diff --git a/drivers/iommu/irq_remapping.h b/drivers/iommu/irq_remapping.h
index 95363acb583f..ecb637670405 100644
--- a/drivers/iommu/irq_remapping.h
+++ b/drivers/iommu/irq_remapping.h
@@ -34,6 +34,7 @@ struct msi_msg;
 extern int disable_irq_remap;
 extern int disable_sourceid_checking;
 extern int no_x2apic_optout;
+extern int irq_remapping_enabled;
 
 struct irq_remap_ops {
         /* Check whether Interrupt Remapping is supported */
diff --git a/drivers/isdn/gigaset/capi.c b/drivers/isdn/gigaset/capi.c
index 68452b768da2..03a0a01a4054 100644
--- a/drivers/isdn/gigaset/capi.c
+++ b/drivers/isdn/gigaset/capi.c
@@ -248,6 +248,8 @@ static inline void dump_rawmsg(enum debuglevel level, const char *tag,
                 CAPIMSG_APPID(data), CAPIMSG_MSGID(data), l,
                 CAPIMSG_CONTROL(data));
         l -= 12;
+        if (l <= 0)
+                return;
         dbgline = kmalloc(3 * l, GFP_ATOMIC);
         if (!dbgline)
                 return;
diff --git a/drivers/isdn/mISDN/stack.c b/drivers/isdn/mISDN/stack.c
index 5f21f629b7ae..deda591f70b9 100644
--- a/drivers/isdn/mISDN/stack.c
+++ b/drivers/isdn/mISDN/stack.c
@@ -18,6 +18,7 @@
 #include <linux/slab.h>
 #include <linux/mISDNif.h>
 #include <linux/kthread.h>
+#include <linux/sched.h>
 #include "core.h"
 
 static u_int    *debug;
@@ -202,6 +203,9 @@ static int
 mISDNStackd(void *data)
 {
         struct mISDNstack *st = data;
+#ifdef MISDN_MSG_STATS
+        cputime_t utime, stime;
+#endif
         int err = 0;
 
         sigfillset(&current->blocked);
@@ -303,9 +307,10 @@ mISDNStackd(void *data)
                "msg %d sleep %d stopped\n",
                dev_name(&st->dev->dev), st->msg_cnt, st->sleep_cnt,
                st->stopped_cnt);
+        task_cputime(st->thread, &utime, &stime);
         printk(KERN_DEBUG
                "mISDNStackd daemon for %s utime(%ld) stime(%ld)\n",
-               dev_name(&st->dev->dev), st->thread->utime, st->thread->stime);
+               dev_name(&st->dev->dev), utime, stime);
         printk(KERN_DEBUG
                "mISDNStackd daemon for %s nvcsw(%ld) nivcsw(%ld)\n",
                dev_name(&st->dev->dev), st->thread->nvcsw, st->thread->nivcsw);
diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c
index 3d8984edeff7..9e58dbd8d8cb 100644
--- a/drivers/md/dm-raid.c
+++ b/drivers/md/dm-raid.c
@@ -340,24 +340,22 @@ static int validate_region_size(struct raid_set *rs, unsigned long region_size)
 }
 
 /*
- * validate_rebuild_devices
+ * validate_raid_redundancy
  * @rs
  *
- * Determine if the devices specified for rebuild can result in a valid
- * usable array that is capable of rebuilding the given devices.
+ * Determine if there are enough devices in the array that haven't
+ * failed (or are being rebuilt) to form a usable array.
  *
  * Returns: 0 on success, -EINVAL on failure.
  */
-static int validate_rebuild_devices(struct raid_set *rs)
+static int validate_raid_redundancy(struct raid_set *rs)
 {
         unsigned i, rebuild_cnt = 0;
         unsigned rebuilds_per_group, copies, d;
 
-        if (!(rs->print_flags & DMPF_REBUILD))
-                return 0;
-
         for (i = 0; i < rs->md.raid_disks; i++)
-                if (!test_bit(In_sync, &rs->dev[i].rdev.flags))
+                if (!test_bit(In_sync, &rs->dev[i].rdev.flags) ||
+                    !rs->dev[i].rdev.sb_page)
                         rebuild_cnt++;
 
         switch (rs->raid_type->level) {
@@ -393,27 +391,24 @@ static int validate_rebuild_devices(struct raid_set *rs)
                  *          A    A    B    B    C
                  *          C    D    D    E    E
                  */
-                rebuilds_per_group = 0;
                 for (i = 0; i < rs->md.raid_disks * copies; i++) {
+                        if (!(i % copies))
+                                rebuilds_per_group = 0;
                         d = i % rs->md.raid_disks;
-                        if (!test_bit(In_sync, &rs->dev[d].rdev.flags) &&
+                        if ((!rs->dev[d].rdev.sb_page ||
+                             !test_bit(In_sync, &rs->dev[d].rdev.flags)) &&
                             (++rebuilds_per_group >= copies))
                                 goto too_many;
-                        if (!((i + 1) % copies))
-                                rebuilds_per_group = 0;
                 }
                 break;
         default:
-                DMERR("The rebuild parameter is not supported for %s",
-                      rs->raid_type->name);
-                rs->ti->error = "Rebuild not supported for this RAID type";
-                return -EINVAL;
+                if (rebuild_cnt)
+                        return -EINVAL;
         }
 
         return 0;
 
 too_many:
-        rs->ti->error = "Too many rebuild devices specified";
         return -EINVAL;
 }
 
@@ -664,9 +659,6 @@ static int parse_raid_params(struct raid_set *rs, char **argv,
         }
         rs->md.dev_sectors = sectors_per_dev;
 
-        if (validate_rebuild_devices(rs))
-                return -EINVAL;
-
         /* Assume there are no metadata devices until the drives are parsed */
         rs->md.persistent = 0;
         rs->md.external = 1;
@@ -995,28 +987,10 @@ static int super_validate(struct mddev *mddev, struct md_rdev *rdev)
 static int analyse_superblocks(struct dm_target *ti, struct raid_set *rs)
 {
         int ret;
-        unsigned redundancy = 0;
         struct raid_dev *dev;
         struct md_rdev *rdev, *tmp, *freshest;
         struct mddev *mddev = &rs->md;
 
-        switch (rs->raid_type->level) {
-        case 1:
-                redundancy = rs->md.raid_disks - 1;
-                break;
-        case 4:
-        case 5:
-        case 6:
-                redundancy = rs->raid_type->parity_devs;
-                break;
-        case 10:
-                redundancy = raid10_md_layout_to_copies(mddev->layout) - 1;
-                break;
-        default:
-                ti->error = "Unknown RAID type";
-                return -EINVAL;
-        }
-
         freshest = NULL;
         rdev_for_each_safe(rdev, tmp, mddev) {
                 /*
@@ -1045,44 +1019,43 @@ static int analyse_superblocks(struct dm_target *ti, struct raid_set *rs)
                         break;
                 default:
                         dev = container_of(rdev, struct raid_dev, rdev);
-                        if (redundancy--) {
-                                if (dev->meta_dev)
-                                        dm_put_device(ti, dev->meta_dev);
-
-                                dev->meta_dev = NULL;
-                                rdev->meta_bdev = NULL;
+                        if (dev->meta_dev)
+                                dm_put_device(ti, dev->meta_dev);
 
-                                if (rdev->sb_page)
-                                        put_page(rdev->sb_page);
+                        dev->meta_dev = NULL;
+                        rdev->meta_bdev = NULL;
 
-                                rdev->sb_page = NULL;
+                        if (rdev->sb_page)
+                                put_page(rdev->sb_page);
 
-                                rdev->sb_loaded = 0;
+                        rdev->sb_page = NULL;
 
-                                /*
-                                 * We might be able to salvage the data device
-                                 * even though the meta device has failed.  For
-                                 * now, we behave as though '- -' had been
-                                 * set for this device in the table.
-                                 */
-                                if (dev->data_dev)
-                                        dm_put_device(ti, dev->data_dev);
+                        rdev->sb_loaded = 0;
 
-                                dev->data_dev = NULL;
-                                rdev->bdev = NULL;
+                        /*
+                         * We might be able to salvage the data device
+                         * even though the meta device has failed.  For
+                         * now, we behave as though '- -' had been
+                         * set for this device in the table.
+                         */
+                        if (dev->data_dev)
+                                dm_put_device(ti, dev->data_dev);
 
-                                list_del(&rdev->same_set);
+                        dev->data_dev = NULL;
+                        rdev->bdev = NULL;
 
-                                continue;
-                        }
-                        ti->error = "Failed to load superblock";
-                        return ret;
+                        list_del(&rdev->same_set);
                 }
         }
 
         if (!freshest)
                 return 0;
 
+        if (validate_raid_redundancy(rs)) {
+                rs->ti->error = "Insufficient redundancy to activate array";
+                return -EINVAL;
+        }
+
         /*
          * Validation of the freshest device provides the source of
          * validation for the remaining devices.
@@ -1432,7 +1405,7 @@ static void raid_resume(struct dm_target *ti)
 
 static struct target_type raid_target = {
         .name = "raid",
-        .version = {1, 4, 0},
+        .version = {1, 4, 1},
         .module = THIS_MODULE,
         .ctr = raid_ctr,
         .dtr = raid_dtr,
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index 675ae5274016..5409607d4875 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -2746,19 +2746,9 @@ static int thin_iterate_devices(struct dm_target *ti,
         return 0;
 }
 
-/*
- * A thin device always inherits its queue limits from its pool.
- */
-static void thin_io_hints(struct dm_target *ti, struct queue_limits *limits)
-{
-        struct thin_c *tc = ti->private;
-
-        *limits = bdev_get_queue(tc->pool_dev->bdev)->limits;
-}
-
 static struct target_type thin_target = {
         .name = "thin",
-        .version = {1, 6, 0},
+        .version = {1, 7, 0},
         .module = THIS_MODULE,
         .ctr = thin_ctr,
         .dtr = thin_dtr,
@@ -2767,7 +2757,6 @@ static struct target_type thin_target = {
         .postsuspend = thin_postsuspend,
         .status = thin_status,
         .iterate_devices = thin_iterate_devices,
-        .io_hints = thin_io_hints,
 };
 
 /*----------------------------------------------------------------*/
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index c72e4d5a9617..314a0e2faf79 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -1188,6 +1188,7 @@ static int __clone_and_map_changing_extent_only(struct clone_info *ci,
 {
         struct dm_target *ti;
         sector_t len;
+        unsigned num_requests;
 
         do {
                 ti = dm_table_find_target(ci->map, ci->sector);
@@ -1200,7 +1201,8 @@ static int __clone_and_map_changing_extent_only(struct clone_info *ci,
                  * reconfiguration might also have changed that since the
                  * check was performed.
                  */
-                if (!get_num_requests || !get_num_requests(ti))
+                num_requests = get_num_requests ? get_num_requests(ti) : 0;
+                if (!num_requests)
                         return -EOPNOTSUPP;
 
                 if (is_split_required && !is_split_required(ti))
@@ -1208,7 +1210,7 @@ static int __clone_and_map_changing_extent_only(struct clone_info *ci,
                 else
                         len = min(ci->sector_count, max_io_len(ci->sector, ti));
 
-                __issue_target_requests(ci, ti, ti->num_discard_requests, len);
+                __issue_target_requests(ci, ti, num_requests, len);
 
                 ci->sector += len;
         } while (ci->sector_count -= len);
diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c
index 49d95040096a..0223ad255cb4 100644
--- a/drivers/media/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb-core/dvb_frontend.c
@@ -1820,7 +1820,7 @@ static int dvb_frontend_ioctl(struct file *file,
         struct dvb_frontend *fe = dvbdev->priv;
         struct dtv_frontend_properties *c = &fe->dtv_property_cache;
         struct dvb_frontend_private *fepriv = fe->frontend_priv;
-        int err = -ENOTTY;
+        int err = -EOPNOTSUPP;
 
         dev_dbg(fe->dvb->device, "%s: (%d)\n", __func__, _IOC_NR(cmd));
         if (fepriv->exit != DVB_FE_NO_EXIT)
@@ -1938,7 +1938,7 @@ static int dvb_frontend_ioctl_properties(struct file *file,
                 }
 
         } else
-                err = -ENOTTY;
+                err = -EOPNOTSUPP;
 
 out:
         kfree(tvp);
@@ -2071,7 +2071,7 @@ static int dvb_frontend_ioctl_legacy(struct file *file,
         struct dvb_frontend *fe = dvbdev->priv;
         struct dvb_frontend_private *fepriv = fe->frontend_priv;
         struct dtv_frontend_properties *c = &fe->dtv_property_cache;
-        int err = -ENOTTY;
+        int err = -EOPNOTSUPP;
 
         switch (cmd) {
         case FE_GET_INFO: {
diff --git a/drivers/media/i2c/m5mols/m5mols_core.c b/drivers/media/i2c/m5mols/m5mols_core.c
index 8a8d42fe2633..d4e7567b367c 100644
--- a/drivers/media/i2c/m5mols/m5mols_core.c
+++ b/drivers/media/i2c/m5mols/m5mols_core.c
@@ -556,7 +556,7 @@ static int m5mols_get_fmt(struct v4l2_subdev *sd, struct v4l2_subdev_fh *fh,
         mutex_lock(&info->lock);
 
         format = __find_format(info, fh, fmt->which, info->res_type);
-        if (!format)
+        if (format)
                 fmt->format = *format;
         else
                 ret = -EINVAL;
diff --git a/drivers/media/platform/coda.c b/drivers/media/platform/coda.c
index 1cf8293c0fb0..4a980e029ca7 100644
--- a/drivers/media/platform/coda.c
+++ b/drivers/media/platform/coda.c
@@ -23,8 +23,8 @@
 #include <linux/slab.h>
 #include <linux/videodev2.h>
 #include <linux/of.h>
+#include <linux/platform_data/imx-iram.h>
 
-#include <mach/iram.h>
 #include <media/v4l2-ctrls.h>
 #include <media/v4l2-device.h>
 #include <media/v4l2-ioctl.h>
diff --git a/drivers/media/platform/omap3isp/ispvideo.c b/drivers/media/platform/omap3isp/ispvideo.c
index e0d73a642186..8dac17511e61 100644
--- a/drivers/media/platform/omap3isp/ispvideo.c
+++ b/drivers/media/platform/omap3isp/ispvideo.c
@@ -35,9 +35,6 @@
 #include <linux/vmalloc.h>
 #include <media/v4l2-dev.h>
 #include <media/v4l2-ioctl.h>
-#include <plat/iommu.h>
-#include <plat/iovmm.h>
-#include <plat/omap-pm.h>
 
 #include "ispvideo.h"
 #include "isp.h"
diff --git a/drivers/media/platform/s5p-fimc/fimc-mdevice.c b/drivers/media/platform/s5p-fimc/fimc-mdevice.c
index 4ab99f3a7b09..b4a68ecf0ca7 100644
--- a/drivers/media/platform/s5p-fimc/fimc-mdevice.c
+++ b/drivers/media/platform/s5p-fimc/fimc-mdevice.c
@@ -593,7 +593,7 @@ static int __fimc_md_create_flite_source_links(struct fimc_md *fmd)
 {
         struct media_entity *source, *sink;
         unsigned int flags = MEDIA_LNK_FL_ENABLED;
-        int i, ret;
+        int i, ret = 0;
 
         for (i = 0; i < FIMC_LITE_MAX_DEVS; i++) {
                 struct fimc_lite *fimc = fmd->fimc_lite[i];
diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c
index 379f57433711..681bc6ba149d 100644
--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c
+++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c
@@ -412,62 +412,48 @@ leave_handle_frame:
 }
 
 /* Error handling for interrupt */
-static void s5p_mfc_handle_error(struct s5p_mfc_ctx *ctx,
-                                 unsigned int reason, unsigned int err)
+static void s5p_mfc_handle_error(struct s5p_mfc_dev *dev,
+                struct s5p_mfc_ctx *ctx, unsigned int reason, unsigned int err)
 {
-        struct s5p_mfc_dev *dev;
         unsigned long flags;
 
-        /* If no context is available then all necessary
-         * processing has been done. */
-        if (ctx == NULL)
-                return;
-
-        dev = ctx->dev;
         mfc_err("Interrupt Error: %08x\n", err);
-        s5p_mfc_hw_call(dev->mfc_ops, clear_int_flags, dev);
-        wake_up_dev(dev, reason, err);
 
-        /* Error recovery is dependent on the state of context */
-        switch (ctx->state) {
-        case MFCINST_INIT:
-                /* This error had to happen while acquireing instance */
-        case MFCINST_GOT_INST:
-                /* This error had to happen while parsing the header */
-        case MFCINST_HEAD_PARSED:
-                /* This error had to happen while setting dst buffers */
-        case MFCINST_RETURN_INST:
-                /* This error had to happen while releasing instance */
-                clear_work_bit(ctx);
-                wake_up_ctx(ctx, reason, err);
-                if (test_and_clear_bit(0, &dev->hw_lock) == 0)
-                        BUG();
-                s5p_mfc_clock_off();
-                ctx->state = MFCINST_ERROR;
-                break;
-        case MFCINST_FINISHING:
-        case MFCINST_FINISHED:
-        case MFCINST_RUNNING:
-                /* It is higly probable that an error occured
-                 * while decoding a frame */
-                clear_work_bit(ctx);
-                ctx->state = MFCINST_ERROR;
-                /* Mark all dst buffers as having an error */
-                spin_lock_irqsave(&dev->irqlock, flags);
-                s5p_mfc_hw_call(dev->mfc_ops, cleanup_queue, &ctx->dst_queue,
-                                &ctx->vq_dst);
-                /* Mark all src buffers as having an error */
-                s5p_mfc_hw_call(dev->mfc_ops, cleanup_queue, &ctx->src_queue,
-                                &ctx->vq_src);
-                spin_unlock_irqrestore(&dev->irqlock, flags);
-                if (test_and_clear_bit(0, &dev->hw_lock) == 0)
-                        BUG();
-                s5p_mfc_clock_off();
-                break;
-        default:
-                mfc_err("Encountered an error interrupt which had not been handled\n");
-                break;
+        if (ctx != NULL) {
+                /* Error recovery is dependent on the state of context */
+                switch (ctx->state) {
+                case MFCINST_RES_CHANGE_INIT:
+                case MFCINST_RES_CHANGE_FLUSH:
+                case MFCINST_RES_CHANGE_END:
+                case MFCINST_FINISHING:
+                case MFCINST_FINISHED:
+                case MFCINST_RUNNING:
+                        /* It is higly probable that an error occured
+                         * while decoding a frame */
+                        clear_work_bit(ctx);
+                        ctx->state = MFCINST_ERROR;
+                        /* Mark all dst buffers as having an error */
+                        spin_lock_irqsave(&dev->irqlock, flags);
+                        s5p_mfc_hw_call(dev->mfc_ops, cleanup_queue,
+                                                &ctx->dst_queue, &ctx->vq_dst);
+                        /* Mark all src buffers as having an error */
+                        s5p_mfc_hw_call(dev->mfc_ops, cleanup_queue,
+                                                &ctx->src_queue, &ctx->vq_src);
+                        spin_unlock_irqrestore(&dev->irqlock, flags);
+                        wake_up_ctx(ctx, reason, err);
+                        break;
+                default:
+                        clear_work_bit(ctx);
+                        ctx->state = MFCINST_ERROR;
+                        wake_up_ctx(ctx, reason, err);
+                        break;
+                }
         }
+        if (test_and_clear_bit(0, &dev->hw_lock) == 0)
+                BUG();
+        s5p_mfc_hw_call(dev->mfc_ops, clear_int_flags, dev);
+        s5p_mfc_clock_off();
+        wake_up_dev(dev, reason, err);
         return;
 }
 
@@ -632,7 +618,7 @@ static irqreturn_t s5p_mfc_irq(int irq, void *priv)
                                 dev->warn_start)
                         s5p_mfc_handle_frame(ctx, reason, err);
                 else
-                        s5p_mfc_handle_error(ctx, reason, err);
+                        s5p_mfc_handle_error(dev, ctx, reason, err);
                 clear_bit(0, &dev->enter_suspend);
                 break;
 
diff --git a/drivers/media/radio/radio-keene.c b/drivers/media/radio/radio-keene.c
index e10e525f33e5..296941a9ae25 100644
--- a/drivers/media/radio/radio-keene.c
+++ b/drivers/media/radio/radio-keene.c
@@ -374,6 +374,7 @@ static int usb_keene_probe(struct usb_interface *intf,
         radio->vdev.ioctl_ops = &usb_keene_ioctl_ops;
         radio->vdev.lock = &radio->lock;
         radio->vdev.release = video_device_release_empty;
+        radio->vdev.vfl_dir = VFL_DIR_TX;
 
         radio->usbdev = interface_to_usbdev(intf);
         radio->intf = intf;
diff --git a/drivers/media/radio/radio-si4713.c b/drivers/media/radio/radio-si4713.c
index a082e400ed0f..1507c9d508d7 100644
--- a/drivers/media/radio/radio-si4713.c
+++ b/drivers/media/radio/radio-si4713.c
@@ -250,6 +250,7 @@ static struct video_device radio_si4713_vdev_template = {
         .name                   = "radio-si4713",
         .release                = video_device_release,
         .ioctl_ops              = &radio_si4713_ioctl_ops,
+        .vfl_dir                = VFL_DIR_TX,
 };
 
 /* Platform driver interface */
diff --git a/drivers/media/radio/radio-wl1273.c b/drivers/media/radio/radio-wl1273.c
index c48be195bbad..cabbe3adf435 100644
--- a/drivers/media/radio/radio-wl1273.c
+++ b/drivers/media/radio/radio-wl1273.c
@@ -1971,6 +1971,7 @@ static struct video_device wl1273_viddev_template = {
         .ioctl_ops              = &wl1273_ioctl_ops,
         .name                   = WL1273_FM_DRIVER_NAME,
         .release                = wl1273_vdev_release,
+        .vfl_dir                = VFL_DIR_TX,
 };
 
 static int wl1273_fm_radio_remove(struct platform_device *pdev)
diff --git a/drivers/media/radio/wl128x/fmdrv_v4l2.c b/drivers/media/radio/wl128x/fmdrv_v4l2.c
index 048de4536036..0a8ee8fab924 100644
--- a/drivers/media/radio/wl128x/fmdrv_v4l2.c
+++ b/drivers/media/radio/wl128x/fmdrv_v4l2.c
@@ -518,6 +518,16 @@ static struct video_device fm_viddev_template = {
         .ioctl_ops = &fm_drv_ioctl_ops,
         .name = FM_DRV_NAME,
         .release = video_device_release,
+        /*
+         * To ensure both the tuner and modulator ioctls are accessible we
+         * set the vfl_dir to M2M to indicate this.
+         *
+         * It is not really a mem2mem device of course, but it can both receive
+         * and transmit using the same radio device. It's the only radio driver
+         * that does this and it should really be split in two radio devices,
+         * but that would affect applications using this driver.
+         */
+        .vfl_dir = VFL_DIR_M2M,
 };
 
 int fm_v4l2_init_video_device(struct fmdev *fmdev, int radio_nr)
diff --git a/drivers/media/usb/gspca/kinect.c b/drivers/media/usb/gspca/kinect.c
index 40ad6687ee5d..3773a8a745df 100644
--- a/drivers/media/usb/gspca/kinect.c
+++ b/drivers/media/usb/gspca/kinect.c
@@ -381,6 +381,7 @@ static const struct sd_desc sd_desc = {
 /* -- module initialisation -- */
 static const struct usb_device_id device_table[] = {
         {USB_DEVICE(0x045e, 0x02ae)},
+        {USB_DEVICE(0x045e, 0x02bf)},
         {}
 };
 
diff --git a/drivers/media/usb/gspca/sonixb.c b/drivers/media/usb/gspca/sonixb.c
index 70511d5f9538..1220340e7602 100644
--- a/drivers/media/usb/gspca/sonixb.c
+++ b/drivers/media/usb/gspca/sonixb.c
@@ -496,7 +496,7 @@ static void reg_w(struct gspca_dev *gspca_dev,
         }
 }
 
-static void i2c_w(struct gspca_dev *gspca_dev, const __u8 *buffer)
+static void i2c_w(struct gspca_dev *gspca_dev, const u8 *buf)
 {
         int retry = 60;
 
@@ -504,16 +504,19 @@ static void i2c_w(struct gspca_dev *gspca_dev, const __u8 *buffer)
                 return;
 
         /* is i2c ready */
-        reg_w(gspca_dev, 0x08, buffer, 8);
+        reg_w(gspca_dev, 0x08, buf, 8);
         while (retry--) {
                 if (gspca_dev->usb_err < 0)
                         return;
-                msleep(10);
+                msleep(1);
                 reg_r(gspca_dev, 0x08);
                 if (gspca_dev->usb_buf[0] & 0x04) {
                         if (gspca_dev->usb_buf[0] & 0x08) {
                                 dev_err(gspca_dev->v4l2_dev.dev,
-                                        "i2c write error\n");
+                                        "i2c error writing %02x %02x %02x %02x"
+                                        " %02x %02x %02x %02x\n",
+                                        buf[0], buf[1], buf[2], buf[3],
+                                        buf[4], buf[5], buf[6], buf[7]);
                                 gspca_dev->usb_err = -EIO;
                         }
                         return;
@@ -530,7 +533,7 @@ static void i2c_w_vector(struct gspca_dev *gspca_dev,
         for (;;) {
                 if (gspca_dev->usb_err < 0)
                         return;
-                reg_w(gspca_dev, 0x08, *buffer, 8);
+                i2c_w(gspca_dev, *buffer);
                 len -= 8;
                 if (len <= 0)
                         break;
diff --git a/drivers/media/usb/gspca/sonixj.c b/drivers/media/usb/gspca/sonixj.c
index 5a86047b846f..36307a9028a9 100644
--- a/drivers/media/usb/gspca/sonixj.c
+++ b/drivers/media/usb/gspca/sonixj.c
@@ -1550,6 +1550,7 @@ static void i2c_w1(struct gspca_dev *gspca_dev, u8 reg, u8 val)
                         0,
                         gspca_dev->usb_buf, 8,
                         500);
+        msleep(2);
         if (ret < 0) {
                 pr_err("i2c_w1 err %d\n", ret);
                 gspca_dev->usb_err = ret;
diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c
index 2bb7613ddebb..d5baab17a5ef 100644
--- a/drivers/media/usb/uvc/uvc_ctrl.c
+++ b/drivers/media/usb/uvc/uvc_ctrl.c
@@ -1431,8 +1431,10 @@ int uvc_ctrl_set(struct uvc_video_chain *chain,
         int ret;
 
         ctrl = uvc_find_control(chain, xctrl->id, &mapping);
-        if (ctrl == NULL || (ctrl->info.flags & UVC_CTRL_FLAG_SET_CUR) == 0)
+        if (ctrl == NULL)
                 return -EINVAL;
+        if (!(ctrl->info.flags & UVC_CTRL_FLAG_SET_CUR))
+                return -EACCES;
 
         /* Clamp out of range values. */
         switch (mapping->v4l2_type) {
diff --git a/drivers/media/usb/uvc/uvc_v4l2.c b/drivers/media/usb/uvc/uvc_v4l2.c
index f2ee8c6b0d8d..68d59b527492 100644
--- a/drivers/media/usb/uvc/uvc_v4l2.c
+++ b/drivers/media/usb/uvc/uvc_v4l2.c
@@ -657,8 +657,7 @@ static long uvc_v4l2_do_ioctl(struct file *file, unsigned int cmd, void *arg)
                         ret = uvc_ctrl_get(chain, ctrl);
                         if (ret < 0) {
                                 uvc_ctrl_rollback(handle);
-                                ctrls->error_idx = ret == -ENOENT
-                                                 ? ctrls->count : i;
+                                ctrls->error_idx = i;
                                 return ret;
                         }
                 }
@@ -686,8 +685,7 @@ static long uvc_v4l2_do_ioctl(struct file *file, unsigned int cmd, void *arg)
                         ret = uvc_ctrl_set(chain, ctrl);
                         if (ret < 0) {
                                 uvc_ctrl_rollback(handle);
-                                ctrls->error_idx = (ret == -ENOENT &&
-                                                    cmd == VIDIOC_S_EXT_CTRLS)
+                                ctrls->error_idx = cmd == VIDIOC_S_EXT_CTRLS
                                                  ? ctrls->count : i;
                                 return ret;
                         }
diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c
index 9f81be23a81f..e02c4797b1c6 100644
--- a/drivers/media/v4l2-core/videobuf2-core.c
+++ b/drivers/media/v4l2-core/videobuf2-core.c
@@ -921,8 +921,10 @@ static void __fill_vb2_buffer(struct vb2_buffer *vb, const struct v4l2_buffer *b
                  * In videobuf we use our internal V4l2_planes struct for
                  * single-planar buffers as well, for simplicity.
                  */
-                if (V4L2_TYPE_IS_OUTPUT(b->type))
+                if (V4L2_TYPE_IS_OUTPUT(b->type)) {
                         v4l2_planes[0].bytesused = b->bytesused;
+                        v4l2_planes[0].data_offset = 0;
+                }
 
                 if (b->memory == V4L2_MEMORY_USERPTR) {
                         v4l2_planes[0].m.userptr = b->m.userptr;
diff --git a/drivers/mfd/Kconfig b/drivers/mfd/Kconfig
index 1c0abd4dfc43..ff553babf455 100644
--- a/drivers/mfd/Kconfig
+++ b/drivers/mfd/Kconfig
@@ -237,6 +237,7 @@ config MFD_TPS65910
         depends on I2C=y && GPIOLIB
         select MFD_CORE
         select REGMAP_I2C
+        select REGMAP_IRQ
         select IRQ_DOMAIN
         help
           if you say yes here you get support for the TPS65910 series of
@@ -292,6 +293,7 @@ config TWL4030_CORE
         bool "Texas Instruments TWL4030/TWL5030/TWL6030/TPS659x0 Support"
         depends on I2C=y && GENERIC_HARDIRQS
         select IRQ_DOMAIN
+        select REGMAP_I2C
         help
           Say yes here if you have TWL4030 / TWL6030 family chip on your board.
           This core driver provides register access and IRQ handling
diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c
index e1650badd106..4778bb124efe 100644
--- a/drivers/mfd/ab8500-core.c
+++ b/drivers/mfd/ab8500-core.c
@@ -19,6 +19,7 @@
 #include <linux/mfd/core.h>
 #include <linux/mfd/abx500.h>
 #include <linux/mfd/abx500/ab8500.h>
+#include <linux/mfd/abx500/ab8500-bm.h>
 #include <linux/mfd/dbx500-prcmu.h>
 #include <linux/regulator/ab8500.h>
 #include <linux/of.h>
diff --git a/drivers/mfd/arizona-core.c b/drivers/mfd/arizona-core.c
index bc8a3edb6bbf..222c03a5ddc0 100644
--- a/drivers/mfd/arizona-core.c
+++ b/drivers/mfd/arizona-core.c
@@ -239,7 +239,12 @@ static int arizona_runtime_resume(struct device *dev)
                 return ret;
         }
 
-        regcache_sync(arizona->regmap);
+        ret = regcache_sync(arizona->regmap);
+        if (ret != 0) {
+                dev_err(arizona->dev, "Failed to restore register cache\n");
+                regulator_disable(arizona->dcvdd);
+                return ret;
+        }
 
         return 0;
 }
diff --git a/drivers/mfd/arizona-irq.c b/drivers/mfd/arizona-irq.c
index 74713bf5371f..2bec5f0db3ee 100644
--- a/drivers/mfd/arizona-irq.c
+++ b/drivers/mfd/arizona-irq.c
@@ -176,14 +176,7 @@ int arizona_irq_init(struct arizona *arizona)
                 aod = &wm5102_aod;
                 irq = &wm5102_irq;
 
-                switch (arizona->rev) {
-                case 0:
-                case 1:
-                        ctrlif_error = false;
-                        break;
-                default:
-                        break;
-                }
+                ctrlif_error = false;
                 break;
 #endif
 #ifdef CONFIG_MFD_WM5110
@@ -191,14 +184,7 @@ int arizona_irq_init(struct arizona *arizona)
                 aod = &wm5110_aod;
                 irq = &wm5110_irq;
 
-                switch (arizona->rev) {
-                case 0:
-                case 1:
-                        ctrlif_error = false;
-                        break;
-                default:
-                        break;
-                }
+                ctrlif_error = false;
                 break;
 #endif
         default:
diff --git a/drivers/mfd/da9052-i2c.c b/drivers/mfd/da9052-i2c.c
index ac74a4d1daea..885e56780358 100644
--- a/drivers/mfd/da9052-i2c.c
+++ b/drivers/mfd/da9052-i2c.c
@@ -27,6 +27,66 @@
 #include <linux/of_device.h>
 #endif
 
+/* I2C safe register check */
+static inline bool i2c_safe_reg(unsigned char reg)
+{
+        switch (reg) {
+        case DA9052_STATUS_A_REG:
+        case DA9052_STATUS_B_REG:
+        case DA9052_STATUS_C_REG:
+        case DA9052_STATUS_D_REG:
+        case DA9052_ADC_RES_L_REG:
+        case DA9052_ADC_RES_H_REG:
+        case DA9052_VDD_RES_REG:
+        case DA9052_ICHG_AV_REG:
+        case DA9052_TBAT_RES_REG:
+        case DA9052_ADCIN4_RES_REG:
+        case DA9052_ADCIN5_RES_REG:
+        case DA9052_ADCIN6_RES_REG:
+        case DA9052_TJUNC_RES_REG:
+        case DA9052_TSI_X_MSB_REG:
+        case DA9052_TSI_Y_MSB_REG:
+        case DA9052_TSI_LSB_REG:
+        case DA9052_TSI_Z_MSB_REG:
+                return true;
+        default:
+                return false;
+        }
+}
+
+/*
+ * There is an issue with DA9052 and DA9053_AA/BA/BB PMIC where the PMIC
+ * gets lockup up or fails to respond following a system reset.
+ * This fix is to follow any read or write with a dummy read to a safe
+ * register.
+ */
+int da9052_i2c_fix(struct da9052 *da9052, unsigned char reg)
+{
+        int val;
+
+        switch (da9052->chip_id) {
+        case DA9052:
+        case DA9053_AA:
+        case DA9053_BA:
+        case DA9053_BB:
+                /* A dummy read to a safe register address. */
+        if (!i2c_safe_reg(reg))
+                        return regmap_read(da9052->regmap,
+                                           DA9052_PARK_REGISTER,
+                                           &val);
+                break;
+        default:
+                /*
+                 * For other chips parking of I2C register
+                 * to a safe place is not required.
+                 */
+                break;
+        }
+
+        return 0;
+}
+EXPORT_SYMBOL(da9052_i2c_fix);
+
 static int da9052_i2c_enable_multiwrite(struct da9052 *da9052)
 {
         int reg_val, ret;
@@ -83,6 +143,7 @@ static int da9052_i2c_probe(struct i2c_client *client,
 
         da9052->dev = &client->dev;
         da9052->chip_irq = client->irq;
+        da9052->fix_io = da9052_i2c_fix;
 
         i2c_set_clientdata(client, da9052);
 
diff --git a/drivers/mfd/db8500-prcmu.c b/drivers/mfd/db8500-prcmu.c
index dc8826d8d69d..268f45d42394 100644
--- a/drivers/mfd/db8500-prcmu.c
+++ b/drivers/mfd/db8500-prcmu.c
@@ -2524,7 +2524,7 @@ static bool read_mailbox_0(void)
 
                 for (n = 0; n < NUM_PRCMU_WAKEUPS; n++) {
                         if (ev & prcmu_irq_bit[n])
-                                generic_handle_irq(IRQ_PRCMU_BASE + n);
+                                generic_handle_irq(irq_find_mapping(db8500_irq_domain, n));
                 }
                 r = true;
                 break;
@@ -2737,13 +2737,14 @@ static int db8500_irq_map(struct irq_domain *d, unsigned int virq,
 }
 
 static struct irq_domain_ops db8500_irq_ops = {
-        .map    = db8500_irq_map,
-        .xlate  = irq_domain_xlate_twocell,
+        .map    = db8500_irq_map,
+        .xlate  = irq_domain_xlate_twocell,
 };
 
 static int db8500_irq_init(struct device_node *np)
 {
-        int irq_base = -1;
+        int irq_base = 0;
+        int i;
 
         /* In the device tree case, just take some IRQs */
         if (!np)
@@ -2758,6 +2759,10 @@ static int db8500_irq_init(struct device_node *np)
                 return -ENOSYS;
         }
 
+        /* All wakeups will be used, so create mappings for all */
+        for (i = 0; i < NUM_PRCMU_WAKEUPS; i++)
+                irq_create_mapping(db8500_irq_domain, i);
+
         return 0;
 }
 
diff --git a/drivers/mfd/max77686.c b/drivers/mfd/max77686.c
index f6878f8db57d..4d73963cd8f0 100644
--- a/drivers/mfd/max77686.c
+++ b/drivers/mfd/max77686.c
@@ -93,15 +93,6 @@ static int max77686_i2c_probe(struct i2c_client *i2c,
         if (max77686 == NULL)
                 return -ENOMEM;
 
-        max77686->regmap = regmap_init_i2c(i2c, &max77686_regmap_config);
-        if (IS_ERR(max77686->regmap)) {
-                ret = PTR_ERR(max77686->regmap);
-                dev_err(max77686->dev, "Failed to allocate register map: %d\n",
-                                ret);
-                kfree(max77686);
-                return ret;
-        }
-
         i2c_set_clientdata(i2c, max77686);
         max77686->dev = &i2c->dev;
         max77686->i2c = i2c;
@@ -111,6 +102,15 @@ static int max77686_i2c_probe(struct i2c_client *i2c,
         max77686->irq_gpio = pdata->irq_gpio;
         max77686->irq = i2c->irq;
 
+        max77686->regmap = regmap_init_i2c(i2c, &max77686_regmap_config);
+        if (IS_ERR(max77686->regmap)) {
+                ret = PTR_ERR(max77686->regmap);
+                dev_err(max77686->dev, "Failed to allocate register map: %d\n",
+                                ret);
+                kfree(max77686);
+                return ret;
+        }
+
         if (regmap_read(max77686->regmap,
                          MAX77686_REG_DEVICE_ID, &data) < 0) {
                 dev_err(max77686->dev,
diff --git a/drivers/mfd/max77693.c b/drivers/mfd/max77693.c
index cc5155e20494..9e60fed5ff82 100644
--- a/drivers/mfd/max77693.c
+++ b/drivers/mfd/max77693.c
@@ -114,35 +114,37 @@ static int max77693_i2c_probe(struct i2c_client *i2c,
         u8 reg_data;
         int ret = 0;
 
+        if (!pdata) {
+                dev_err(&i2c->dev, "No platform data found.\n");
+                return -EINVAL;
+        }
+
         max77693 = devm_kzalloc(&i2c->dev,
                         sizeof(struct max77693_dev), GFP_KERNEL);
         if (max77693 == NULL)
                 return -ENOMEM;
 
-        max77693->regmap = devm_regmap_init_i2c(i2c, &max77693_regmap_config);
-        if (IS_ERR(max77693->regmap)) {
-                ret = PTR_ERR(max77693->regmap);
-                dev_err(max77693->dev,"failed to allocate register map: %d\n",
-                                ret);
-                goto err_regmap;
-        }
-
         i2c_set_clientdata(i2c, max77693);
         max77693->dev = &i2c->dev;
         max77693->i2c = i2c;
         max77693->irq = i2c->irq;
         max77693->type = id->driver_data;
 
-        if (!pdata)
-                goto err_regmap;
+        max77693->regmap = devm_regmap_init_i2c(i2c, &max77693_regmap_config);
+        if (IS_ERR(max77693->regmap)) {
+                ret = PTR_ERR(max77693->regmap);
+                dev_err(max77693->dev, "failed to allocate register map: %d\n",
+                                ret);
+                return ret;
+        }
 
         max77693->wakeup = pdata->wakeup;
 
-        if (max77693_read_reg(max77693->regmap,
-                                MAX77693_PMIC_REG_PMIC_ID2, &reg_data) < 0) {
+        ret = max77693_read_reg(max77693->regmap, MAX77693_PMIC_REG_PMIC_ID2,
+                                &reg_data);
+        if (ret < 0) {
                 dev_err(max77693->dev, "device not found on this channel\n");
-                ret = -ENODEV;
-                goto err_regmap;
+                return ret;
         } else
                 dev_info(max77693->dev, "device ID: 0x%x\n", reg_data);
 
@@ -163,7 +165,7 @@ static int max77693_i2c_probe(struct i2c_client *i2c,
                 ret = PTR_ERR(max77693->regmap_muic);
                 dev_err(max77693->dev,
                         "failed to allocate register map: %d\n", ret);
-                goto err_regmap;
+                goto err_regmap_muic;
         }
 
         ret = max77693_irq_init(max77693);
@@ -184,9 +186,9 @@ static int max77693_i2c_probe(struct i2c_client *i2c,
 err_mfd:
         max77693_irq_exit(max77693);
 err_irq:
+err_regmap_muic:
         i2c_unregister_device(max77693->muic);
         i2c_unregister_device(max77693->haptic);
-err_regmap:
         return ret;
 }
 
diff --git a/drivers/mfd/pcf50633-core.c b/drivers/mfd/pcf50633-core.c
index 64803f13bcec..d11567307fbe 100644
--- a/drivers/mfd/pcf50633-core.c
+++ b/drivers/mfd/pcf50633-core.c
@@ -208,6 +208,8 @@ static int pcf50633_probe(struct i2c_client *client,
         if (!pcf)
                 return -ENOMEM;
 
+        i2c_set_clientdata(client, pcf);
+        pcf->dev = &client->dev;
         pcf->pdata = pdata;
 
         mutex_init(&pcf->lock);
@@ -219,9 +221,6 @@ static int pcf50633_probe(struct i2c_client *client,
                 return ret;
         }
 
-        i2c_set_clientdata(client, pcf);
-        pcf->dev = &client->dev;
-
         version = pcf50633_reg_read(pcf, 0);
         variant = pcf50633_reg_read(pcf, 1);
         if (version < 0 || variant < 0) {
diff --git a/drivers/mfd/rtl8411.c b/drivers/mfd/rtl8411.c
index 89f046ca9e41..3d3b4addf81a 100644
--- a/drivers/mfd/rtl8411.c
+++ b/drivers/mfd/rtl8411.c
@@ -112,6 +112,21 @@ static int rtl8411_card_power_off(struct rtsx_pcr *pcr, int card)
                         BPP_LDO_POWB, BPP_LDO_SUSPEND);
 }
 
+static int rtl8411_switch_output_voltage(struct rtsx_pcr *pcr, u8 voltage)
+{
+        u8 mask, val;
+
+        mask = (BPP_REG_TUNED18 << BPP_TUNED18_SHIFT_8411) | BPP_PAD_MASK;
+        if (voltage == OUTPUT_3V3)
+                val = (BPP_ASIC_3V3 << BPP_TUNED18_SHIFT_8411) | BPP_PAD_3V3;
+        else if (voltage == OUTPUT_1V8)
+                val = (BPP_ASIC_1V8 << BPP_TUNED18_SHIFT_8411) | BPP_PAD_1V8;
+        else
+                return -EINVAL;
+
+        return rtsx_pci_write_register(pcr, LDO_CTL, mask, val);
+}
+
 static unsigned int rtl8411_cd_deglitch(struct rtsx_pcr *pcr)
 {
         unsigned int card_exist;
@@ -163,6 +178,18 @@ static unsigned int rtl8411_cd_deglitch(struct rtsx_pcr *pcr)
         return card_exist;
 }
 
+static int rtl8411_conv_clk_and_div_n(int input, int dir)
+{
+        int output;
+
+        if (dir == CLK_TO_DIV_N)
+                output = input * 4 / 5 - 2;
+        else
+                output = (input + 2) * 5 / 4;
+
+        return output;
+}
+
 static const struct pcr_ops rtl8411_pcr_ops = {
         .extra_init_hw = rtl8411_extra_init_hw,
         .optimize_phy = NULL,
@@ -172,7 +199,9 @@ static const struct pcr_ops rtl8411_pcr_ops = {
         .disable_auto_blink = rtl8411_disable_auto_blink,
         .card_power_on = rtl8411_card_power_on,
         .card_power_off = rtl8411_card_power_off,
+        .switch_output_voltage = rtl8411_switch_output_voltage,
         .cd_deglitch = rtl8411_cd_deglitch,
+        .conv_clk_and_div_n = rtl8411_conv_clk_and_div_n,
 };
 
 /* SD Pull Control Enable:
diff --git a/drivers/mfd/rts5209.c b/drivers/mfd/rts5209.c
index 283a4f148084..98fe0f39463e 100644
--- a/drivers/mfd/rts5209.c
+++ b/drivers/mfd/rts5209.c
@@ -144,6 +144,25 @@ static int rts5209_card_power_off(struct rtsx_pcr *pcr, int card)
         return rtsx_pci_send_cmd(pcr, 100);
 }
 
+static int rts5209_switch_output_voltage(struct rtsx_pcr *pcr, u8 voltage)
+{
+        int err;
+
+        if (voltage == OUTPUT_3V3) {
+                err = rtsx_pci_write_phy_register(pcr, 0x08, 0x4FC0 | 0x24);
+                if (err < 0)
+                        return err;
+        } else if (voltage == OUTPUT_1V8) {
+                err = rtsx_pci_write_phy_register(pcr, 0x08, 0x4C40 | 0x24);
+                if (err < 0)
+                        return err;
+        } else {
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
 static const struct pcr_ops rts5209_pcr_ops = {
         .extra_init_hw = rts5209_extra_init_hw,
         .optimize_phy = rts5209_optimize_phy,
@@ -153,7 +172,9 @@ static const struct pcr_ops rts5209_pcr_ops = {
         .disable_auto_blink = rts5209_disable_auto_blink,
         .card_power_on = rts5209_card_power_on,
         .card_power_off = rts5209_card_power_off,
+        .switch_output_voltage = rts5209_switch_output_voltage,
         .cd_deglitch = NULL,
+        .conv_clk_and_div_n = NULL,
 };
 
 /* SD Pull Control Enable:
diff --git a/drivers/mfd/rts5229.c b/drivers/mfd/rts5229.c
index b9dbab266fda..29d889cbb9c5 100644
--- a/drivers/mfd/rts5229.c
+++ b/drivers/mfd/rts5229.c
@@ -114,6 +114,25 @@ static int rts5229_card_power_off(struct rtsx_pcr *pcr, int card)
         return rtsx_pci_send_cmd(pcr, 100);
 }
 
+static int rts5229_switch_output_voltage(struct rtsx_pcr *pcr, u8 voltage)
+{
+        int err;
+
+        if (voltage == OUTPUT_3V3) {
+                err = rtsx_pci_write_phy_register(pcr, 0x08, 0x4FC0 | 0x24);
+                if (err < 0)
+                        return err;
+        } else if (voltage == OUTPUT_1V8) {
+                err = rtsx_pci_write_phy_register(pcr, 0x08, 0x4C40 | 0x24);
+                if (err < 0)
+                        return err;
+        } else {
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
 static const struct pcr_ops rts5229_pcr_ops = {
         .extra_init_hw = rts5229_extra_init_hw,
         .optimize_phy = rts5229_optimize_phy,
@@ -123,7 +142,9 @@ static const struct pcr_ops rts5229_pcr_ops = {
         .disable_auto_blink = rts5229_disable_auto_blink,
         .card_power_on = rts5229_card_power_on,
         .card_power_off = rts5229_card_power_off,
+        .switch_output_voltage = rts5229_switch_output_voltage,
         .cd_deglitch = NULL,
+        .conv_clk_and_div_n = NULL,
 };
 
 /* SD Pull Control Enable:
diff --git a/drivers/mfd/rtsx_pcr.c b/drivers/mfd/rtsx_pcr.c
index 7a7b0bda4618..9fc57009e228 100644
--- a/drivers/mfd/rtsx_pcr.c
+++ b/drivers/mfd/rtsx_pcr.c
@@ -630,7 +630,10 @@ int rtsx_pci_switch_clock(struct rtsx_pcr *pcr, unsigned int card_clock,
         if (clk == pcr->cur_clock)
                 return 0;
 
-        N = (u8)(clk - 2);
+        if (pcr->ops->conv_clk_and_div_n)
+                N = (u8)pcr->ops->conv_clk_and_div_n(clk, CLK_TO_DIV_N);
+        else
+                N = (u8)(clk - 2);
         if ((clk <= 2) || (N > max_N))
                 return -EINVAL;
 
@@ -641,7 +644,14 @@ int rtsx_pci_switch_clock(struct rtsx_pcr *pcr, unsigned int card_clock,
         /* Make sure that the SSC clock div_n is equal or greater than min_N */
         div = CLK_DIV_1;
         while ((N < min_N) && (div < max_div)) {
-                N = (N + 2) * 2 - 2;
+                if (pcr->ops->conv_clk_and_div_n) {
+                        int dbl_clk = pcr->ops->conv_clk_and_div_n(N,
+                                        DIV_N_TO_CLK) * 2;
+                        N = (u8)pcr->ops->conv_clk_and_div_n(dbl_clk,
+                                        CLK_TO_DIV_N);
+                } else {
+                        N = (N + 2) * 2 - 2;
+                }
                 div++;
         }
         dev_dbg(&(pcr->pci->dev), "N = %d, div = %d\n", N, div);
@@ -703,6 +713,15 @@ int rtsx_pci_card_power_off(struct rtsx_pcr *pcr, int card)
 }
 EXPORT_SYMBOL_GPL(rtsx_pci_card_power_off);
 
+int rtsx_pci_switch_output_voltage(struct rtsx_pcr *pcr, u8 voltage)
+{
+        if (pcr->ops->switch_output_voltage)
+                return pcr->ops->switch_output_voltage(pcr, voltage);
+
+        return 0;
+}
+EXPORT_SYMBOL_GPL(rtsx_pci_switch_output_voltage);
+
 unsigned int rtsx_pci_card_exist(struct rtsx_pcr *pcr)
 {
         unsigned int val;
@@ -767,10 +786,10 @@ static void rtsx_pci_card_detect(struct work_struct *work)
 
         spin_unlock_irqrestore(&pcr->lock, flags);
 
-        if (card_detect & SD_EXIST)
+        if ((card_detect & SD_EXIST) && pcr->slots[RTSX_SD_CARD].card_event)
                 pcr->slots[RTSX_SD_CARD].card_event(
                                 pcr->slots[RTSX_SD_CARD].p_dev);
-        if (card_detect & MS_EXIST)
+        if ((card_detect & MS_EXIST) && pcr->slots[RTSX_MS_CARD].card_event)
                 pcr->slots[RTSX_MS_CARD].card_event(
                                 pcr->slots[RTSX_MS_CARD].p_dev);
 }
diff --git a/drivers/mfd/sec-core.c b/drivers/mfd/sec-core.c
index 49d361a618d0..77ee26ef5941 100644
--- a/drivers/mfd/sec-core.c
+++ b/drivers/mfd/sec-core.c
@@ -17,6 +17,7 @@
 #include <linux/err.h>
 #include <linux/slab.h>
 #include <linux/i2c.h>
+#include <linux/of_irq.h>
 #include <linux/interrupt.h>
 #include <linux/pm_runtime.h>
 #include <linux/mutex.h>
@@ -60,6 +61,15 @@ static struct mfd_cell s2mps11_devs[] = {
         },
 };
 
+#ifdef CONFIG_OF
+static struct of_device_id sec_dt_match[] = {
+        {       .compatible = "samsung,s5m8767-pmic",
+                .data = (void *)S5M8767X,
+        },
+        {},
+};
+#endif
+
 int sec_reg_read(struct sec_pmic_dev *sec_pmic, u8 reg, void *dest)
 {
         return regmap_read(sec_pmic->regmap, reg, dest);
@@ -95,6 +105,57 @@ static struct regmap_config sec_regmap_config = {
         .val_bits = 8,
 };
 
+
+#ifdef CONFIG_OF
+/*
+ * Only the common platform data elements for s5m8767 are parsed here from the
+ * device tree. Other sub-modules of s5m8767 such as pmic, rtc , charger and
+ * others have to parse their own platform data elements from device tree.
+ *
+ * The s5m8767 platform data structure is instantiated here and the drivers for
+ * the sub-modules need not instantiate another instance while parsing their
+ * platform data.
+ */
+static struct sec_platform_data *sec_pmic_i2c_parse_dt_pdata(
+                                        struct device *dev)
+{
+        struct sec_platform_data *pd;
+
+        pd = devm_kzalloc(dev, sizeof(*pd), GFP_KERNEL);
+        if (!pd) {
+                dev_err(dev, "could not allocate memory for pdata\n");
+                return ERR_PTR(-ENOMEM);
+        }
+
+        /*
+         * ToDo: the 'wakeup' member in the platform data is more of a linux
+         * specfic information. Hence, there is no binding for that yet and
+         * not parsed here.
+         */
+
+        return pd;
+}
+#else
+static struct sec_platform_data *sec_pmic_i2c_parse_dt_pdata(
+                                        struct device *dev)
+{
+        return 0;
+}
+#endif
+
+static inline int sec_i2c_get_driver_data(struct i2c_client *i2c,
+                                                const struct i2c_device_id *id)
+{
+#ifdef CONFIG_OF
+        if (i2c->dev.of_node) {
+                const struct of_device_id *match;
+                match = of_match_node(sec_dt_match, i2c->dev.of_node);
+                return (int)match->data;
+        }
+#endif
+        return (int)id->driver_data;
+}
+
 static int sec_pmic_probe(struct i2c_client *i2c,
                             const struct i2c_device_id *id)
 {
@@ -111,13 +172,22 @@ static int sec_pmic_probe(struct i2c_client *i2c,
         sec_pmic->dev = &i2c->dev;
         sec_pmic->i2c = i2c;
         sec_pmic->irq = i2c->irq;
-        sec_pmic->type = id->driver_data;
-
+        sec_pmic->type = sec_i2c_get_driver_data(i2c, id);
+
+        if (sec_pmic->dev->of_node) {
+                pdata = sec_pmic_i2c_parse_dt_pdata(sec_pmic->dev);
+                if (IS_ERR(pdata)) {
+                        ret = PTR_ERR(pdata);
+                        return ret;
+                }
+                pdata->device_type = sec_pmic->type;
+        }
         if (pdata) {
                 sec_pmic->device_type = pdata->device_type;
                 sec_pmic->ono = pdata->ono;
                 sec_pmic->irq_base = pdata->irq_base;
                 sec_pmic->wakeup = pdata->wakeup;
+                sec_pmic->pdata = pdata;
         }
 
         sec_pmic->regmap = devm_regmap_init_i2c(i2c, &sec_regmap_config);
@@ -192,6 +262,7 @@ static struct i2c_driver sec_pmic_driver = {
         .driver = {
                    .name = "sec_pmic",
                    .owner = THIS_MODULE,
+                   .of_match_table = of_match_ptr(sec_dt_match),
         },
         .probe = sec_pmic_probe,
         .remove = sec_pmic_remove,
diff --git a/drivers/mfd/tc3589x.c b/drivers/mfd/tc3589x.c
index a06d66b929b1..ecc092c7f745 100644
--- a/drivers/mfd/tc3589x.c
+++ b/drivers/mfd/tc3589x.c
@@ -219,25 +219,18 @@ static void tc3589x_irq_unmap(struct irq_domain *d, unsigned int virq)
 }
 
 static struct irq_domain_ops tc3589x_irq_ops = {
-        .map    = tc3589x_irq_map,
+        .map    = tc3589x_irq_map,
         .unmap  = tc3589x_irq_unmap,
-        .xlate  = irq_domain_xlate_twocell,
+        .xlate  = irq_domain_xlate_twocell,
 };
 
 static int tc3589x_irq_init(struct tc3589x *tc3589x, struct device_node *np)
 {
         int base = tc3589x->irq_base;
 
-        if (base) {
-                tc3589x->domain = irq_domain_add_legacy(
-                        NULL, TC3589x_NR_INTERNAL_IRQS, base,
-                        0, &tc3589x_irq_ops, tc3589x);
-        }
-        else {
-                tc3589x->domain = irq_domain_add_linear(
-                        np, TC3589x_NR_INTERNAL_IRQS,
-                        &tc3589x_irq_ops, tc3589x);
-        }
+        tc3589x->domain = irq_domain_add_simple(
+                np, TC3589x_NR_INTERNAL_IRQS, base,
+                &tc3589x_irq_ops, tc3589x);
 
         if (!tc3589x->domain) {
                 dev_err(tc3589x->dev, "Failed to create irqdomain\n");
diff --git a/drivers/mfd/twl4030-power.c b/drivers/mfd/twl4030-power.c
index 4dae241e5017..dd362c1078e1 100644
--- a/drivers/mfd/twl4030-power.c
+++ b/drivers/mfd/twl4030-power.c
@@ -159,7 +159,7 @@ out:
 static int twl4030_write_script(u8 address, struct twl4030_ins *script,
                                        int len)
 {
-        int err;
+        int err = -EINVAL;
 
         for (; len; len--, address++, script++) {
                 if (len == 1) {
diff --git a/drivers/mfd/vexpress-config.c b/drivers/mfd/vexpress-config.c
index fae15d880758..3c1723aa6225 100644
--- a/drivers/mfd/vexpress-config.c
+++ b/drivers/mfd/vexpress-config.c
@@ -67,6 +67,7 @@ struct vexpress_config_bridge *vexpress_config_bridge_register(
 
         return bridge;
 }
+EXPORT_SYMBOL(vexpress_config_bridge_register);
 
 void vexpress_config_bridge_unregister(struct vexpress_config_bridge *bridge)
 {
@@ -83,6 +84,7 @@ void vexpress_config_bridge_unregister(struct vexpress_config_bridge *bridge)
         while (!list_empty(&__bridge.transactions))
                 cpu_relax();
 }
+EXPORT_SYMBOL(vexpress_config_bridge_unregister);
 
 
 struct vexpress_config_func {
@@ -142,6 +144,7 @@ struct vexpress_config_func *__vexpress_config_func_get(struct device *dev,
 
         return func;
 }
+EXPORT_SYMBOL(__vexpress_config_func_get);
 
 void vexpress_config_func_put(struct vexpress_config_func *func)
 {
@@ -149,7 +152,7 @@ void vexpress_config_func_put(struct vexpress_config_func *func)
         of_node_put(func->bridge->node);
         kfree(func);
 }
-
+EXPORT_SYMBOL(vexpress_config_func_put);
 
 struct vexpress_config_trans {
         struct vexpress_config_func *func;
@@ -229,6 +232,7 @@ void vexpress_config_complete(struct vexpress_config_bridge *bridge,
 
         complete(&trans->completion);
 }
+EXPORT_SYMBOL(vexpress_config_complete);
 
 int vexpress_config_wait(struct vexpress_config_trans *trans)
 {
@@ -236,7 +240,7 @@ int vexpress_config_wait(struct vexpress_config_trans *trans)
 
         return trans->status;
 }
-
+EXPORT_SYMBOL(vexpress_config_wait);
 
 int vexpress_config_read(struct vexpress_config_func *func, int offset,
                 u32 *data)
diff --git a/drivers/mfd/vexpress-sysreg.c b/drivers/mfd/vexpress-sysreg.c
index e5d8f63b252a..77048b18439e 100644
--- a/drivers/mfd/vexpress-sysreg.c
+++ b/drivers/mfd/vexpress-sysreg.c
@@ -313,19 +313,11 @@ static void vexpress_sysreg_config_complete(unsigned long data)
 }
 
 
-void __init vexpress_sysreg_early_init(void __iomem *base)
+void __init vexpress_sysreg_setup(struct device_node *node)
 {
-        struct device_node *node = of_find_compatible_node(NULL, NULL,
-                        "arm,vexpress-sysreg");
-
-        if (node)
-                base = of_iomap(node, 0);
-
-        if (WARN_ON(!base))
+        if (WARN_ON(!vexpress_sysreg_base))
                 return;
 
-        vexpress_sysreg_base = base;
-
         if (readl(vexpress_sysreg_base + SYS_MISC) & SYS_MISC_MASTERSITE)
                 vexpress_master_site = VEXPRESS_SITE_DB2;
         else
@@ -336,9 +328,23 @@ void __init vexpress_sysreg_early_init(void __iomem *base)
         WARN_ON(!vexpress_sysreg_config_bridge);
 }
 
+void __init vexpress_sysreg_early_init(void __iomem *base)
+{
+        vexpress_sysreg_base = base;
+        vexpress_sysreg_setup(NULL);
+}
+
 void __init vexpress_sysreg_of_early_init(void)
 {
-        vexpress_sysreg_early_init(NULL);
+        struct device_node *node = of_find_compatible_node(NULL, NULL,
+                        "arm,vexpress-sysreg");
+
+        if (node) {
+                vexpress_sysreg_base = of_iomap(node, 0);
+                vexpress_sysreg_setup(node);
+        } else {
+                pr_info("vexpress-sysreg: No Device Tree node found.");
+        }
 }
 
 
@@ -426,9 +432,11 @@ static int vexpress_sysreg_probe(struct platform_device *pdev)
                 return -EBUSY;
         }
 
-        if (!vexpress_sysreg_base)
+        if (!vexpress_sysreg_base) {
                 vexpress_sysreg_base = devm_ioremap(&pdev->dev, res->start,
                                 resource_size(res));
+                vexpress_sysreg_setup(pdev->dev.of_node);
+        }
 
         if (!vexpress_sysreg_base) {
                 dev_err(&pdev->dev, "Failed to obtain base address!\n");
diff --git a/drivers/mfd/wm5102-tables.c b/drivers/mfd/wm5102-tables.c
index 088872ab6338..f6fcb87b3504 100644
--- a/drivers/mfd/wm5102-tables.c
+++ b/drivers/mfd/wm5102-tables.c
@@ -96,6 +96,7 @@ const struct regmap_irq_chip wm5102_aod = {
         .mask_base = ARIZONA_AOD_IRQ_MASK_IRQ1,
         .ack_base = ARIZONA_AOD_IRQ1,
         .wake_base = ARIZONA_WAKE_CONTROL,
+        .wake_invert = 1,
         .num_regs = 1,
         .irqs = wm5102_aod_irqs,
         .num_irqs = ARRAY_SIZE(wm5102_aod_irqs),
@@ -1882,7 +1883,7 @@ static bool wm5102_volatile_register(struct device *dev, unsigned int reg)
         }
 }
 
-#define WM5102_MAX_REGISTER 0x1a8fff
+#define WM5102_MAX_REGISTER 0x1a9800
 
 const struct regmap_config wm5102_spi_regmap = {
         .reg_bits = 32,
diff --git a/drivers/mfd/wm5110-tables.c b/drivers/mfd/wm5110-tables.c
index adda6b10b90d..c41599815299 100644
--- a/drivers/mfd/wm5110-tables.c
+++ b/drivers/mfd/wm5110-tables.c
@@ -255,6 +255,7 @@ const struct regmap_irq_chip wm5110_aod = {
         .mask_base = ARIZONA_AOD_IRQ_MASK_IRQ1,
         .ack_base = ARIZONA_AOD_IRQ1,
         .wake_base = ARIZONA_WAKE_CONTROL,
+        .wake_invert = 1,
         .num_regs = 1,
         .irqs = wm5110_aod_irqs,
         .num_irqs = ARRAY_SIZE(wm5110_aod_irqs),
diff --git a/drivers/misc/atmel-ssc.c b/drivers/misc/atmel-ssc.c
index 158da5a81a66..3c09cbb70b1d 100644
--- a/drivers/misc/atmel-ssc.c
+++ b/drivers/misc/atmel-ssc.c
@@ -19,6 +19,7 @@
 #include <linux/module.h>
 
 #include <linux/of.h>
+#include <linux/pinctrl/consumer.h>
 
 /* Serialize access to ssc_list and user count */
 static DEFINE_SPINLOCK(user_lock);
@@ -131,6 +132,13 @@ static int ssc_probe(struct platform_device *pdev)
         struct resource *regs;
         struct ssc_device *ssc;
         const struct atmel_ssc_platform_data *plat_dat;
+        struct pinctrl *pinctrl;
+
+        pinctrl = devm_pinctrl_get_select_default(&pdev->dev);
+        if (IS_ERR(pinctrl)) {
+                dev_err(&pdev->dev, "Failed to request pinctrl\n");
+                return PTR_ERR(pinctrl);
+        }
 
         ssc = devm_kzalloc(&pdev->dev, sizeof(struct ssc_device), GFP_KERNEL);
         if (!ssc) {
diff --git a/drivers/misc/mei/amthif.c b/drivers/misc/mei/amthif.c
index 18794aea6062..e40ffd9502d1 100644
--- a/drivers/misc/mei/amthif.c
+++ b/drivers/misc/mei/amthif.c
@@ -187,13 +187,13 @@ int mei_amthif_read(struct mei_device *dev, struct file *file,
                 wait_ret = wait_event_interruptible(dev->iamthif_cl.wait,
                         (cb = mei_amthif_find_read_list_entry(dev, file)));
 
+                /* Locking again the Mutex */
+                mutex_lock(&dev->device_lock);
+
                 if (wait_ret)
                         return -ERESTARTSYS;
 
                 dev_dbg(&dev->pdev->dev, "woke up from sleep\n");
-
-                /* Locking again the Mutex */
-                mutex_lock(&dev->device_lock);
         }
 
 
diff --git a/drivers/misc/sgi-gru/grufile.c b/drivers/misc/sgi-gru/grufile.c
index 492c8cac69ac..44d273c5e19d 100644
--- a/drivers/misc/sgi-gru/grufile.c
+++ b/drivers/misc/sgi-gru/grufile.c
@@ -517,7 +517,7 @@ static int __init gru_init(void)
 {
         int ret;
 
-        if (!is_uv_system())
+        if (!is_uv_system() || (is_uvx_hub() && !is_uv2_hub()))
                 return 0;
 
 #if defined CONFIG_IA64
diff --git a/drivers/misc/ti-st/st_kim.c b/drivers/misc/ti-st/st_kim.c
index 9ff942a346ed..83269f1d16e3 100644
--- a/drivers/misc/ti-st/st_kim.c
+++ b/drivers/misc/ti-st/st_kim.c
@@ -468,6 +468,11 @@ long st_kim_start(void *kim_data)
                 if (pdata->chip_enable)
                         pdata->chip_enable(kim_gdata);
 
+                /* Configure BT nShutdown to HIGH state */
+                gpio_set_value(kim_gdata->nshutdown, GPIO_LOW);
+                mdelay(5);      /* FIXME: a proper toggle */
+                gpio_set_value(kim_gdata->nshutdown, GPIO_HIGH);
+                mdelay(100);
                 /* re-initialize the completion */
                 INIT_COMPLETION(kim_gdata->ldisc_installed);
                 /* send notification to UIM */
@@ -509,7 +514,8 @@ long st_kim_start(void *kim_data)
  *      (b) upon failure to either install ldisc or download firmware.
  *      The function is responsible to (a) notify UIM about un-installation,
  *      (b) flush UART if the ldisc was installed.
- *      (c) invoke platform's chip disabling routine.
+ *      (c) reset BT_EN - pull down nshutdown at the end.
+ *      (d) invoke platform's chip disabling routine.
  */
 long st_kim_stop(void *kim_data)
 {
@@ -541,6 +547,13 @@ long st_kim_stop(void *kim_data)
                 err = -ETIMEDOUT;
         }
 
+        /* By default configure BT nShutdown to LOW state */
+        gpio_set_value(kim_gdata->nshutdown, GPIO_LOW);
+        mdelay(1);
+        gpio_set_value(kim_gdata->nshutdown, GPIO_HIGH);
+        mdelay(1);
+        gpio_set_value(kim_gdata->nshutdown, GPIO_LOW);
+
         /* platform specific disable */
         if (pdata->chip_disable)
                 pdata->chip_disable(kim_gdata);
@@ -733,6 +746,20 @@ static int kim_probe(struct platform_device *pdev)
         /* refer to itself */
         kim_gdata->core_data->kim_data = kim_gdata;
 
+        /* Claim the chip enable nShutdown gpio from the system */
+        kim_gdata->nshutdown = pdata->nshutdown_gpio;
+        err = gpio_request(kim_gdata->nshutdown, "kim");
+        if (unlikely(err)) {
+                pr_err(" gpio %ld request failed ", kim_gdata->nshutdown);
+                return err;
+        }
+
+        /* Configure nShutdown GPIO as output=0 */
+        err = gpio_direction_output(kim_gdata->nshutdown, 0);
+        if (unlikely(err)) {
+                pr_err(" unable to configure gpio %ld", kim_gdata->nshutdown);
+                return err;
+        }
         /* get reference of pdev for request_firmware
          */
         kim_gdata->kim_pdev = pdev;
@@ -779,10 +806,18 @@ err_core_init:
 
 static int kim_remove(struct platform_device *pdev)
 {
+        /* free the GPIOs requested */
+        struct ti_st_plat_data  *pdata = pdev->dev.platform_data;
         struct kim_data_s       *kim_gdata;
 
         kim_gdata = dev_get_drvdata(&pdev->dev);
 
+        /* Free the Bluetooth/FM/GPIO
+         * nShutdown gpio from the system
+         */
+        gpio_free(pdata->nshutdown_gpio);
+        pr_info("nshutdown GPIO Freed");
+
         debugfs_remove_recursive(kim_debugfs_dir);
         sysfs_remove_group(&pdev->dev.kobj, &uim_attr_grp);
         pr_info("sysfs entries removed");
diff --git a/drivers/mmc/host/mvsdio.c b/drivers/mmc/host/mvsdio.c
index de4c20b3936c..f8dd36102949 100644
--- a/drivers/mmc/host/mvsdio.c
+++ b/drivers/mmc/host/mvsdio.c
@@ -50,8 +50,6 @@ struct mvsd_host {
         struct timer_list timer;
         struct mmc_host *mmc;
         struct device *dev;
-        struct resource *res;
-        int irq;
         struct clk *clk;
         int gpio_card_detect;
         int gpio_write_protect;
@@ -718,10 +716,6 @@ static int __init mvsd_probe(struct platform_device *pdev)
         if (!r || irq < 0 || !mvsd_data)
                 return -ENXIO;
 
-        r = request_mem_region(r->start, SZ_1K, DRIVER_NAME);
-        if (!r)
-                return -EBUSY;
-
         mmc = mmc_alloc_host(sizeof(struct mvsd_host), &pdev->dev);
         if (!mmc) {
                 ret = -ENOMEM;
@@ -731,8 +725,8 @@ static int __init mvsd_probe(struct platform_device *pdev)
         host = mmc_priv(mmc);
         host->mmc = mmc;
         host->dev = &pdev->dev;
-        host->res = r;
         host->base_clock = mvsd_data->clock / 2;
+        host->clk = ERR_PTR(-EINVAL);
 
         mmc->ops = &mvsd_ops;
 
@@ -752,7 +746,7 @@ static int __init mvsd_probe(struct platform_device *pdev)
 
         spin_lock_init(&host->lock);
 
-        host->base = ioremap(r->start, SZ_4K);
+        host->base = devm_request_and_ioremap(&pdev->dev, r);
         if (!host->base) {
                 ret = -ENOMEM;
                 goto out;
@@ -765,44 +759,45 @@ static int __init mvsd_probe(struct platform_device *pdev)
 
         mvsd_power_down(host);
 
-        ret = request_irq(irq, mvsd_irq, 0, DRIVER_NAME, host);
+        ret = devm_request_irq(&pdev->dev, irq, mvsd_irq, 0, DRIVER_NAME, host);
         if (ret) {
                 pr_err("%s: cannot assign irq %d\n", DRIVER_NAME, irq);
                 goto out;
-        } else
-                host->irq = irq;
+        }
 
         /* Not all platforms can gate the clock, so it is not
            an error if the clock does not exists. */
-        host->clk = clk_get(&pdev->dev, NULL);
-        if (!IS_ERR(host->clk)) {
+        host->clk = devm_clk_get(&pdev->dev, NULL);
+        if (!IS_ERR(host->clk))
                 clk_prepare_enable(host->clk);
-        }
 
         if (mvsd_data->gpio_card_detect) {
-                ret = gpio_request(mvsd_data->gpio_card_detect,
-                                   DRIVER_NAME " cd");
+                ret = devm_gpio_request_one(&pdev->dev,
+                                            mvsd_data->gpio_card_detect,
+                                            GPIOF_IN, DRIVER_NAME " cd");
                 if (ret == 0) {
-                        gpio_direction_input(mvsd_data->gpio_card_detect);
                         irq = gpio_to_irq(mvsd_data->gpio_card_detect);
-                        ret = request_irq(irq, mvsd_card_detect_irq,
-                                          IRQ_TYPE_EDGE_RISING | IRQ_TYPE_EDGE_FALLING,
-                                          DRIVER_NAME " cd", host);
+                        ret = devm_request_irq(&pdev->dev, irq,
+                                               mvsd_card_detect_irq,
+                                               IRQ_TYPE_EDGE_RISING |
+                                               IRQ_TYPE_EDGE_FALLING,
+                                               DRIVER_NAME " cd", host);
                         if (ret == 0)
                                 host->gpio_card_detect =
                                         mvsd_data->gpio_card_detect;
                         else
-                                gpio_free(mvsd_data->gpio_card_detect);
+                                devm_gpio_free(&pdev->dev,
+                                               mvsd_data->gpio_card_detect);
                 }
         }
         if (!host->gpio_card_detect)
                 mmc->caps |= MMC_CAP_NEEDS_POLL;
 
         if (mvsd_data->gpio_write_protect) {
-                ret = gpio_request(mvsd_data->gpio_write_protect,
-                                   DRIVER_NAME " wp");
+                ret = devm_gpio_request_one(&pdev->dev,
+                                            mvsd_data->gpio_write_protect,
+                                            GPIOF_IN, DRIVER_NAME " wp");
                 if (ret == 0) {
-                        gpio_direction_input(mvsd_data->gpio_write_protect);
                         host->gpio_write_protect =
                                 mvsd_data->gpio_write_protect;
                 }
@@ -824,26 +819,11 @@ static int __init mvsd_probe(struct platform_device *pdev)
         return 0;
 
 out:
-        if (host) {
-                if (host->irq)
-                        free_irq(host->irq, host);
-                if (host->gpio_card_detect) {
-                        free_irq(gpio_to_irq(host->gpio_card_detect), host);
-                        gpio_free(host->gpio_card_detect);
-                }
-                if (host->gpio_write_protect)
-                        gpio_free(host->gpio_write_protect);
-                if (host->base)
-                        iounmap(host->base);
-        }
-        if (r)
-                release_resource(r);
-        if (mmc)
-                if (!IS_ERR_OR_NULL(host->clk)) {
+        if (mmc) {
+                if (!IS_ERR(host->clk))
                         clk_disable_unprepare(host->clk);
-                        clk_put(host->clk);
-                }
                 mmc_free_host(mmc);
+        }
 
         return ret;
 }
@@ -852,28 +832,16 @@ static int __exit mvsd_remove(struct platform_device *pdev)
 {
         struct mmc_host *mmc = platform_get_drvdata(pdev);
 
-        if (mmc) {
-                struct mvsd_host *host = mmc_priv(mmc);
+        struct mvsd_host *host = mmc_priv(mmc);
 
-                if (host->gpio_card_detect) {
-                        free_irq(gpio_to_irq(host->gpio_card_detect), host);
-                        gpio_free(host->gpio_card_detect);
-                }
-                mmc_remove_host(mmc);
-                free_irq(host->irq, host);
-                if (host->gpio_write_protect)
-                        gpio_free(host->gpio_write_protect);
-                del_timer_sync(&host->timer);
-                mvsd_power_down(host);
-                iounmap(host->base);
-                release_resource(host->res);
+        mmc_remove_host(mmc);
+        del_timer_sync(&host->timer);
+        mvsd_power_down(host);
+
+        if (!IS_ERR(host->clk))
+                clk_disable_unprepare(host->clk);
+        mmc_free_host(mmc);
 
-                if (!IS_ERR(host->clk)) {
-                        clk_disable_unprepare(host->clk);
-                        clk_put(host->clk);
-                }
-                mmc_free_host(mmc);
-        }
         platform_set_drvdata(pdev, NULL);
         return 0;
 }
diff --git a/drivers/mmc/host/rtsx_pci_sdmmc.c b/drivers/mmc/host/rtsx_pci_sdmmc.c
index 571915dfb218..f74b5adca642 100644
--- a/drivers/mmc/host/rtsx_pci_sdmmc.c
+++ b/drivers/mmc/host/rtsx_pci_sdmmc.c
@@ -1060,26 +1060,6 @@ static int sd_wait_voltage_stable_2(struct realtek_pci_sdmmc *host)
         return 0;
 }
 
-static int sd_change_bank_voltage(struct realtek_pci_sdmmc *host, u8 voltage)
-{
-        struct rtsx_pcr *pcr = host->pcr;
-        int err;
-
-        if (voltage == SD_IO_3V3) {
-                err = rtsx_pci_write_phy_register(pcr, 0x08, 0x4FC0 | 0x24);
-                if (err < 0)
-                        return err;
-        } else if (voltage == SD_IO_1V8) {
-                err = rtsx_pci_write_phy_register(pcr, 0x08, 0x4C40 | 0x24);
-                if (err < 0)
-                        return err;
-        } else {
-                return -EINVAL;
-        }
-
-        return 0;
-}
-
 static int sdmmc_switch_voltage(struct mmc_host *mmc, struct mmc_ios *ios)
 {
         struct realtek_pci_sdmmc *host = mmc_priv(mmc);
@@ -1098,11 +1078,11 @@ static int sdmmc_switch_voltage(struct mmc_host *mmc, struct mmc_ios *ios)
         rtsx_pci_start_run(pcr);
 
         if (ios->signal_voltage == MMC_SIGNAL_VOLTAGE_330)
-                voltage = SD_IO_3V3;
+                voltage = OUTPUT_3V3;
         else
-                voltage = SD_IO_1V8;
+                voltage = OUTPUT_1V8;
 
-        if (voltage == SD_IO_1V8) {
+        if (voltage == OUTPUT_1V8) {
                 err = rtsx_pci_write_register(pcr,
                                 SD30_DRIVE_SEL, 0x07, DRIVER_TYPE_B);
                 if (err < 0)
@@ -1113,11 +1093,11 @@ static int sdmmc_switch_voltage(struct mmc_host *mmc, struct mmc_ios *ios)
                         goto out;
         }
 
-        err = sd_change_bank_voltage(host, voltage);
+        err = rtsx_pci_switch_output_voltage(pcr, voltage);
         if (err < 0)
                 goto out;
 
-        if (voltage == SD_IO_1V8) {
+        if (voltage == OUTPUT_1V8) {
                 err = sd_wait_voltage_stable_2(host);
                 if (err < 0)
                         goto out;
diff --git a/drivers/mtd/devices/Kconfig b/drivers/mtd/devices/Kconfig
index 27f80cd8aef3..46dcb54c32ec 100644
--- a/drivers/mtd/devices/Kconfig
+++ b/drivers/mtd/devices/Kconfig
@@ -272,6 +272,7 @@ config MTD_DOCG3
         tristate "M-Systems Disk-On-Chip G3"
         select BCH
         select BCH_CONST_PARAMS
+        select BITREVERSE
         ---help---
           This provides an MTD device driver for the M-Systems DiskOnChip
           G3 devices.
diff --git a/drivers/mtd/maps/physmap_of.c b/drivers/mtd/maps/physmap_of.c
index 67cc73c18ddd..7901d72c9242 100644
--- a/drivers/mtd/maps/physmap_of.c
+++ b/drivers/mtd/maps/physmap_of.c
@@ -170,7 +170,7 @@ static int of_flash_probe(struct platform_device *dev)
         resource_size_t res_size;
         struct mtd_part_parser_data ppdata;
         bool map_indirect;
-        const char *mtd_name;
+        const char *mtd_name = NULL;
 
         match = of_match_device(of_flash_match, &dev->dev);
         if (!match)
diff --git a/drivers/mtd/nand/bcm47xxnflash/ops_bcm4706.c b/drivers/mtd/nand/bcm47xxnflash/ops_bcm4706.c
index 86c9a79b89b3..595de4012e71 100644
--- a/drivers/mtd/nand/bcm47xxnflash/ops_bcm4706.c
+++ b/drivers/mtd/nand/bcm47xxnflash/ops_bcm4706.c
@@ -17,8 +17,8 @@
 #include "bcm47xxnflash.h"
 
 /* Broadcom uses 1'000'000 but it seems to be too many. Tests on WNDR4500 has
- * shown 164 retries as maxiumum. */
-#define NFLASH_READY_RETRIES            1000
+ * shown ~1000 retries as maxiumum. */
+#define NFLASH_READY_RETRIES            10000
 
 #define NFLASH_SECTOR_SIZE              512
 
diff --git a/drivers/mtd/nand/davinci_nand.c b/drivers/mtd/nand/davinci_nand.c
index 3502606f6480..feae55c7b880 100644
--- a/drivers/mtd/nand/davinci_nand.c
+++ b/drivers/mtd/nand/davinci_nand.c
@@ -523,7 +523,7 @@ static struct nand_ecclayout hwecc4_2048 __initconst = {
 static const struct of_device_id davinci_nand_of_match[] = {
         {.compatible = "ti,davinci-nand", },
         {},
-}
+};
 MODULE_DEVICE_TABLE(of, davinci_nand_of_match);
 
 static struct davinci_nand_pdata
diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
index 8323ac991ad1..3766682a0289 100644
--- a/drivers/mtd/nand/nand_base.c
+++ b/drivers/mtd/nand/nand_base.c
@@ -2857,8 +2857,11 @@ static int nand_flash_detect_onfi(struct mtd_info *mtd, struct nand_chip *chip,
         int i;
         int val;
 
-        /* ONFI need to be probed in 8 bits mode */
-        WARN_ON(chip->options & NAND_BUSWIDTH_16);
+        /* ONFI need to be probed in 8 bits mode, and 16 bits should be selected with NAND_BUSWIDTH_AUTO */
+        if (chip->options & NAND_BUSWIDTH_16) {
+                pr_err("Trying ONFI probe in 16 bits mode, aborting !\n");
+                return 0;
+        }
         /* Try ONFI for unknown chip or LP */
         chip->cmdfunc(mtd, NAND_CMD_READID, 0x20, -1);
         if (chip->read_byte(mtd) != 'O' || chip->read_byte(mtd) != 'N' ||
diff --git a/drivers/net/bonding/bond_sysfs.c b/drivers/net/bonding/bond_sysfs.c
index 1877ed7ca086..1c9e09fbdff8 100644
--- a/drivers/net/bonding/bond_sysfs.c
+++ b/drivers/net/bonding/bond_sysfs.c
@@ -1053,6 +1053,7 @@ static ssize_t bonding_store_primary(struct device *d,
                 pr_info("%s: Setting primary slave to None.\n",
                         bond->dev->name);
                 bond->primary_slave = NULL;
+                memset(bond->params.primary, 0, sizeof(bond->params.primary));
                 bond_select_active_slave(bond);
                 goto out;
         }
diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c
index 5233b8f58d77..2282b1ae9765 100644
--- a/drivers/net/can/c_can/c_can.c
+++ b/drivers/net/can/c_can/c_can.c
@@ -488,8 +488,12 @@ static void c_can_setup_receive_object(struct net_device *dev, int iface,
 
         priv->write_reg(priv, C_CAN_IFACE(MASK1_REG, iface),
                         IFX_WRITE_LOW_16BIT(mask));
+
+        /* According to C_CAN documentation, the reserved bit
+         * in IFx_MASK2 register is fixed 1
+         */
         priv->write_reg(priv, C_CAN_IFACE(MASK2_REG, iface),
-                        IFX_WRITE_HIGH_16BIT(mask));
+                        IFX_WRITE_HIGH_16BIT(mask) | BIT(13));
 
         priv->write_reg(priv, C_CAN_IFACE(ARB1_REG, iface),
                         IFX_WRITE_LOW_16BIT(id));
@@ -960,7 +964,7 @@ static int c_can_handle_bus_err(struct net_device *dev,
                 break;
         case LEC_ACK_ERROR:
                 netdev_dbg(dev, "ack error\n");
-                cf->data[2] |= (CAN_ERR_PROT_LOC_ACK |
+                cf->data[3] |= (CAN_ERR_PROT_LOC_ACK |
                                 CAN_ERR_PROT_LOC_ACK_DEL);
                 break;
         case LEC_BIT1_ERROR:
@@ -973,7 +977,7 @@ static int c_can_handle_bus_err(struct net_device *dev,
                 break;
         case LEC_CRC_ERROR:
                 netdev_dbg(dev, "CRC error\n");
-                cf->data[2] |= (CAN_ERR_PROT_LOC_CRC_SEQ |
+                cf->data[3] |= (CAN_ERR_PROT_LOC_CRC_SEQ |
                                 CAN_ERR_PROT_LOC_CRC_DEL);
                 break;
         default:
diff --git a/drivers/net/can/pch_can.c b/drivers/net/can/pch_can.c
index 7d1748575b1f..5c314a961970 100644
--- a/drivers/net/can/pch_can.c
+++ b/drivers/net/can/pch_can.c
@@ -560,7 +560,7 @@ static void pch_can_error(struct net_device *ndev, u32 status)
                 stats->rx_errors++;
                 break;
         case PCH_CRC_ERR:
-                cf->data[2] |= CAN_ERR_PROT_LOC_CRC_SEQ |
+                cf->data[3] |= CAN_ERR_PROT_LOC_CRC_SEQ |
                                CAN_ERR_PROT_LOC_CRC_DEL;
                 priv->can.can_stats.bus_error++;
                 stats->rx_errors++;
diff --git a/drivers/net/can/sja1000/peak_pci.c b/drivers/net/can/sja1000/peak_pci.c
index d84888f03d92..600ac7226e5c 100644
--- a/drivers/net/can/sja1000/peak_pci.c
+++ b/drivers/net/can/sja1000/peak_pci.c
@@ -339,8 +339,7 @@ static void peak_pciec_set_leds(struct peak_pciec_card *card, u8 led_mask, u8 s)
  */
 static void peak_pciec_start_led_work(struct peak_pciec_card *card)
 {
-        if (!delayed_work_pending(&card->led_work))
-                schedule_delayed_work(&card->led_work, HZ);
+        schedule_delayed_work(&card->led_work, HZ);
 }
 
 /*
diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c
index f898c6363729..300581b24ff3 100644
--- a/drivers/net/can/ti_hecc.c
+++ b/drivers/net/can/ti_hecc.c
@@ -746,12 +746,12 @@ static int ti_hecc_error(struct net_device *ndev, int int_status,
                 }
                 if (err_status & HECC_CANES_CRCE) {
                         hecc_set_bit(priv, HECC_CANES, HECC_CANES_CRCE);
-                        cf->data[2] |= CAN_ERR_PROT_LOC_CRC_SEQ |
+                        cf->data[3] |= CAN_ERR_PROT_LOC_CRC_SEQ |
                                         CAN_ERR_PROT_LOC_CRC_DEL;
                 }
                 if (err_status & HECC_CANES_ACKE) {
                         hecc_set_bit(priv, HECC_CANES, HECC_CANES_ACKE);
-                        cf->data[2] |= CAN_ERR_PROT_LOC_ACK |
+                        cf->data[3] |= CAN_ERR_PROT_LOC_ACK |
                                         CAN_ERR_PROT_LOC_ACK_DEL;
                 }
         }
diff --git a/drivers/net/ethernet/3com/3c574_cs.c b/drivers/net/ethernet/3com/3c574_cs.c
index 66df93638085..ffd8de28a76a 100644
--- a/drivers/net/ethernet/3com/3c574_cs.c
+++ b/drivers/net/ethernet/3com/3c574_cs.c
@@ -432,7 +432,7 @@ static int tc574_config(struct pcmcia_device *link)
         netdev_info(dev, "%s at io %#3lx, irq %d, hw_addr %pM\n",
                     cardname, dev->base_addr, dev->irq, dev->dev_addr);
         netdev_info(dev, " %dK FIFO split %s Rx:Tx, %sMII interface.\n",
-                    8 << config & Ram_size,
+                    8 << (config & Ram_size),
                     ram_split[(config & Ram_split) >> Ram_split_shift],
                     config & Autoselect ? "autoselect " : "");
 
diff --git a/drivers/net/ethernet/adi/Kconfig b/drivers/net/ethernet/adi/Kconfig
index e49c0eff040b..a9481606bbcd 100644
--- a/drivers/net/ethernet/adi/Kconfig
+++ b/drivers/net/ethernet/adi/Kconfig
@@ -61,6 +61,7 @@ config BFIN_RX_DESC_NUM
 
 config BFIN_MAC_USE_HWSTAMP
         bool "Use IEEE 1588 hwstamp"
+        depends on BFIN_MAC && BF518
         select PTP_1588_CLOCK
         default y
         ---help---
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
index 56d3f697e0c7..0035c01660b6 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
@@ -21,7 +21,7 @@
 
 #include "atl1c.h"
 
-#define ATL1C_DRV_VERSION "1.0.1.0-NAPI"
+#define ATL1C_DRV_VERSION "1.0.1.1-NAPI"
 char atl1c_driver_name[] = "atl1c";
 char atl1c_driver_version[] = ATL1C_DRV_VERSION;
 
@@ -1652,6 +1652,7 @@ static int atl1c_alloc_rx_buffer(struct atl1c_adapter *adapter)
         u16 num_alloc = 0;
         u16 rfd_next_to_use, next_next;
         struct atl1c_rx_free_desc *rfd_desc;
+        dma_addr_t mapping;
 
         next_next = rfd_next_to_use = rfd_ring->next_to_use;
         if (++next_next == rfd_ring->count)
@@ -1678,9 +1679,18 @@ static int atl1c_alloc_rx_buffer(struct atl1c_adapter *adapter)
                 ATL1C_SET_BUFFER_STATE(buffer_info, ATL1C_BUFFER_BUSY);
                 buffer_info->skb = skb;
                 buffer_info->length = adapter->rx_buffer_len;
-                buffer_info->dma = pci_map_single(pdev, vir_addr,
+                mapping = pci_map_single(pdev, vir_addr,
                                                 buffer_info->length,
                                                 PCI_DMA_FROMDEVICE);
+                if (unlikely(pci_dma_mapping_error(pdev, mapping))) {
+                        dev_kfree_skb(skb);
+                        buffer_info->skb = NULL;
+                        buffer_info->length = 0;
+                        ATL1C_SET_BUFFER_STATE(buffer_info, ATL1C_BUFFER_FREE);
+                        netif_warn(adapter, rx_err, adapter->netdev, "RX pci_map_single failed");
+                        break;
+                }
+                buffer_info->dma = mapping;
                 ATL1C_SET_PCIMAP_TYPE(buffer_info, ATL1C_PCIMAP_SINGLE,
                         ATL1C_PCIMAP_FROMDEVICE);
                 rfd_desc->buffer_addr = cpu_to_le64(buffer_info->dma);
@@ -2015,7 +2025,29 @@ check_sum:
         return 0;
 }
 
-static void atl1c_tx_map(struct atl1c_adapter *adapter,
+static void atl1c_tx_rollback(struct atl1c_adapter *adpt,
+                              struct atl1c_tpd_desc *first_tpd,
+                              enum atl1c_trans_queue type)
+{
+        struct atl1c_tpd_ring *tpd_ring = &adpt->tpd_ring[type];
+        struct atl1c_buffer *buffer_info;
+        struct atl1c_tpd_desc *tpd;
+        u16 first_index, index;
+
+        first_index = first_tpd - (struct atl1c_tpd_desc *)tpd_ring->desc;
+        index = first_index;
+        while (index != tpd_ring->next_to_use) {
+                tpd = ATL1C_TPD_DESC(tpd_ring, index);
+                buffer_info = &tpd_ring->buffer_info[index];
+                atl1c_clean_buffer(adpt->pdev, buffer_info, 0);
+                memset(tpd, 0, sizeof(struct atl1c_tpd_desc));
+                if (++index == tpd_ring->count)
+                        index = 0;
+        }
+        tpd_ring->next_to_use = first_index;
+}
+
+static int atl1c_tx_map(struct atl1c_adapter *adapter,
                       struct sk_buff *skb, struct atl1c_tpd_desc *tpd,
                         enum atl1c_trans_queue type)
 {
@@ -2040,7 +2072,10 @@ static void atl1c_tx_map(struct atl1c_adapter *adapter,
                 buffer_info->length = map_len;
                 buffer_info->dma = pci_map_single(adapter->pdev,
                                         skb->data, hdr_len, PCI_DMA_TODEVICE);
-                ATL1C_SET_BUFFER_STATE(buffer_info, ATL1C_BUFFER_BUSY);
+                if (unlikely(pci_dma_mapping_error(adapter->pdev,
+                                                   buffer_info->dma)))
+                        goto err_dma;
+
                 ATL1C_SET_PCIMAP_TYPE(buffer_info, ATL1C_PCIMAP_SINGLE,
                         ATL1C_PCIMAP_TODEVICE);
                 mapped_len += map_len;
@@ -2062,6 +2097,10 @@ static void atl1c_tx_map(struct atl1c_adapter *adapter,
                 buffer_info->dma =
                         pci_map_single(adapter->pdev, skb->data + mapped_len,
                                         buffer_info->length, PCI_DMA_TODEVICE);
+                if (unlikely(pci_dma_mapping_error(adapter->pdev,
+                                                   buffer_info->dma)))
+                        goto err_dma;
+
                 ATL1C_SET_BUFFER_STATE(buffer_info, ATL1C_BUFFER_BUSY);
                 ATL1C_SET_PCIMAP_TYPE(buffer_info, ATL1C_PCIMAP_SINGLE,
                         ATL1C_PCIMAP_TODEVICE);
@@ -2083,6 +2122,9 @@ static void atl1c_tx_map(struct atl1c_adapter *adapter,
                                                     frag, 0,
                                                     buffer_info->length,
                                                     DMA_TO_DEVICE);
+                if (dma_mapping_error(&adapter->pdev->dev, buffer_info->dma))
+                        goto err_dma;
+
                 ATL1C_SET_BUFFER_STATE(buffer_info, ATL1C_BUFFER_BUSY);
                 ATL1C_SET_PCIMAP_TYPE(buffer_info, ATL1C_PCIMAP_PAGE,
                         ATL1C_PCIMAP_TODEVICE);
@@ -2095,6 +2137,13 @@ static void atl1c_tx_map(struct atl1c_adapter *adapter,
         /* The last buffer info contain the skb address,
            so it will be free after unmap */
         buffer_info->skb = skb;
+
+        return 0;
+
+err_dma:
+        buffer_info->dma = 0;
+        buffer_info->length = 0;
+        return -1;
 }
 
 static void atl1c_tx_queue(struct atl1c_adapter *adapter, struct sk_buff *skb,
@@ -2157,10 +2206,18 @@ static netdev_tx_t atl1c_xmit_frame(struct sk_buff *skb,
         if (skb_network_offset(skb) != ETH_HLEN)
                 tpd->word1 |= 1 << TPD_ETH_TYPE_SHIFT; /* Ethernet frame */
 
-        atl1c_tx_map(adapter, skb, tpd, type);
-        atl1c_tx_queue(adapter, skb, tpd, type);
+        if (atl1c_tx_map(adapter, skb, tpd, type) < 0) {
+                netif_info(adapter, tx_done, adapter->netdev,
+                           "tx-skb droppted due to dma error\n");
+                /* roll back tpd/buffer */
+                atl1c_tx_rollback(adapter, tpd, type);
+                spin_unlock_irqrestore(&adapter->tx_lock, flags);
+                dev_kfree_skb(skb);
+        } else {
+                atl1c_tx_queue(adapter, skb, tpd, type);
+                spin_unlock_irqrestore(&adapter->tx_lock, flags);
+        }
 
-        spin_unlock_irqrestore(&adapter->tx_lock, flags);
         return NETDEV_TX_OK;
 }
 
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
index 01588b66a38c..a5edac8df67b 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
@@ -80,12 +80,37 @@ static inline void bnx2x_move_fp(struct bnx2x *bp, int from, int to)
                 new_txdata_index = new_max_eth_txqs + FCOE_TXQ_IDX_OFFSET;
         }
 
-        memcpy(&bp->bnx2x_txq[old_txdata_index],
-               &bp->bnx2x_txq[new_txdata_index],
+        memcpy(&bp->bnx2x_txq[new_txdata_index],
+               &bp->bnx2x_txq[old_txdata_index],
                sizeof(struct bnx2x_fp_txdata));
         to_fp->txdata_ptr[0] = &bp->bnx2x_txq[new_txdata_index];
 }
 
+/**
+ * bnx2x_shrink_eth_fp - guarantees fastpath structures stay intact
+ *
+ * @bp: driver handle
+ * @delta:      number of eth queues which were not allocated
+ */
+static void bnx2x_shrink_eth_fp(struct bnx2x *bp, int delta)
+{
+        int i, cos, old_eth_num = BNX2X_NUM_ETH_QUEUES(bp);
+
+        /* Queue pointer cannot be re-set on an fp-basis, as moving pointer
+         * backward along the array could cause memory to be overriden
+         */
+        for (cos = 1; cos < bp->max_cos; cos++) {
+                for (i = 0; i < old_eth_num - delta; i++) {
+                        struct bnx2x_fastpath *fp = &bp->fp[i];
+                        int new_idx = cos * (old_eth_num - delta) + i;
+
+                        memcpy(&bp->bnx2x_txq[new_idx], fp->txdata_ptr[cos],
+                               sizeof(struct bnx2x_fp_txdata));
+                        fp->txdata_ptr[cos] = &bp->bnx2x_txq[new_idx];
+                }
+        }
+}
+
 int load_count[2][3] = { {0} }; /* per-path: 0-common, 1-port0, 2-port1 */
 
 /* free skb in the packet ring at pos idx
@@ -479,13 +504,11 @@ static int bnx2x_fill_frag_skb(struct bnx2x *bp, struct bnx2x_fastpath *fp,
                 skb_shinfo(skb)->gso_size = bnx2x_set_lro_mss(bp,
                                         tpa_info->parsing_flags, len_on_bd);
 
-                /* set for GRO */
-                if (fp->mode == TPA_MODE_GRO)
-                        skb_shinfo(skb)->gso_type =
-                            (GET_FLAG(tpa_info->parsing_flags,
-                                      PARSING_FLAGS_OVER_ETHERNET_PROTOCOL) ==
-                                                PRS_FLAG_OVERETH_IPV6) ?
-                                SKB_GSO_TCPV6 : SKB_GSO_TCPV4;
+                skb_shinfo(skb)->gso_type =
+                        (GET_FLAG(tpa_info->parsing_flags,
+                                  PARSING_FLAGS_OVER_ETHERNET_PROTOCOL) ==
+                         PRS_FLAG_OVERETH_IPV6) ?
+                        SKB_GSO_TCPV6 : SKB_GSO_TCPV4;
         }
 
 
@@ -3863,6 +3886,7 @@ int bnx2x_alloc_fp_mem(struct bnx2x *bp)
                 int delta = BNX2X_NUM_ETH_QUEUES(bp) - i;
 
                 WARN_ON(delta < 0);
+                bnx2x_shrink_eth_fp(bp, delta);
                 if (CNIC_SUPPORT(bp))
                         /* move non eth FPs next to last eth FP
                          * must be done in that order
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
index 277f17e3c8f8..a427b49a886c 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_ethtool.c
@@ -2777,10 +2777,10 @@ static int bnx2x_set_rss_flags(struct bnx2x *bp, struct ethtool_rxnfc *info)
                 } else if ((info->flow_type == UDP_V6_FLOW) &&
                            (bp->rss_conf_obj.udp_rss_v6 != udp_rss_requested)) {
                         bp->rss_conf_obj.udp_rss_v6 = udp_rss_requested;
-                        return bnx2x_config_rss_pf(bp, &bp->rss_conf_obj, 0);
                         DP(BNX2X_MSG_ETHTOOL,
                            "rss re-configured, UDP 4-tupple %s\n",
                            udp_rss_requested ? "enabled" : "disabled");
+                        return bnx2x_config_rss_pf(bp, &bp->rss_conf_obj, 0);
                 } else {
                         return 0;
                 }
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index 940ef859dc60..5523da3afcdc 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -127,6 +127,17 @@ MODULE_PARM_DESC(debug, " Default debug msglevel");
 
 struct workqueue_struct *bnx2x_wq;
 
+struct bnx2x_mac_vals {
+        u32 xmac_addr;
+        u32 xmac_val;
+        u32 emac_addr;
+        u32 emac_val;
+        u32 umac_addr;
+        u32 umac_val;
+        u32 bmac_addr;
+        u32 bmac_val[2];
+};
+
 enum bnx2x_board_type {
         BCM57710 = 0,
         BCM57711,
@@ -9420,12 +9431,19 @@ static inline void bnx2x_undi_int_disable(struct bnx2x *bp)
                 bnx2x_undi_int_disable_e1h(bp);
 }
 
-static void bnx2x_prev_unload_close_mac(struct bnx2x *bp)
+static void bnx2x_prev_unload_close_mac(struct bnx2x *bp,
+                                        struct bnx2x_mac_vals *vals)
 {
         u32 val, base_addr, offset, mask, reset_reg;
         bool mac_stopped = false;
         u8 port = BP_PORT(bp);
 
+        /* reset addresses as they also mark which values were changed */
+        vals->bmac_addr = 0;
+        vals->umac_addr = 0;
+        vals->xmac_addr = 0;
+        vals->emac_addr = 0;
+
         reset_reg = REG_RD(bp, MISC_REG_RESET_REG_2);
 
         if (!CHIP_IS_E3(bp)) {
@@ -9447,14 +9465,18 @@ static void bnx2x_prev_unload_close_mac(struct bnx2x *bp)
                          */
                         wb_data[0] = REG_RD(bp, base_addr + offset);
                         wb_data[1] = REG_RD(bp, base_addr + offset + 0x4);
+                        vals->bmac_addr = base_addr + offset;
+                        vals->bmac_val[0] = wb_data[0];
+                        vals->bmac_val[1] = wb_data[1];
                         wb_data[0] &= ~BMAC_CONTROL_RX_ENABLE;
-                        REG_WR(bp, base_addr + offset, wb_data[0]);
-                        REG_WR(bp, base_addr + offset + 0x4, wb_data[1]);
+                        REG_WR(bp, vals->bmac_addr, wb_data[0]);
+                        REG_WR(bp, vals->bmac_addr + 0x4, wb_data[1]);
 
                 }
                 BNX2X_DEV_INFO("Disable emac Rx\n");
-                REG_WR(bp, NIG_REG_NIG_EMAC0_EN + BP_PORT(bp)*4, 0);
-
+                vals->emac_addr = NIG_REG_NIG_EMAC0_EN + BP_PORT(bp)*4;
+                vals->emac_val = REG_RD(bp, vals->emac_addr);
+                REG_WR(bp, vals->emac_addr, 0);
                 mac_stopped = true;
         } else {
                 if (reset_reg & MISC_REGISTERS_RESET_REG_2_XMAC) {
@@ -9465,14 +9487,18 @@ static void bnx2x_prev_unload_close_mac(struct bnx2x *bp)
                                val & ~(1 << 1));
                         REG_WR(bp, base_addr + XMAC_REG_PFC_CTRL_HI,
                                val | (1 << 1));
-                        REG_WR(bp, base_addr + XMAC_REG_CTRL, 0);
+                        vals->xmac_addr = base_addr + XMAC_REG_CTRL;
+                        vals->xmac_val = REG_RD(bp, vals->xmac_addr);
+                        REG_WR(bp, vals->xmac_addr, 0);
                         mac_stopped = true;
                 }
                 mask = MISC_REGISTERS_RESET_REG_2_UMAC0 << port;
                 if (mask & reset_reg) {
                         BNX2X_DEV_INFO("Disable umac Rx\n");
                         base_addr = BP_PORT(bp) ? GRCBASE_UMAC1 : GRCBASE_UMAC0;
-                        REG_WR(bp, base_addr + UMAC_REG_COMMAND_CONFIG, 0);
+                        vals->umac_addr = base_addr + UMAC_REG_COMMAND_CONFIG;
+                        vals->umac_val = REG_RD(bp, vals->umac_addr);
+                        REG_WR(bp, vals->umac_addr, 0);
                         mac_stopped = true;
                 }
         }
@@ -9664,12 +9690,16 @@ static int bnx2x_prev_unload_common(struct bnx2x *bp)
 {
         u32 reset_reg, tmp_reg = 0, rc;
         bool prev_undi = false;
+        struct bnx2x_mac_vals mac_vals;
+
         /* It is possible a previous function received 'common' answer,
          * but hasn't loaded yet, therefore creating a scenario of
          * multiple functions receiving 'common' on the same path.
          */
         BNX2X_DEV_INFO("Common unload Flow\n");
 
+        memset(&mac_vals, 0, sizeof(mac_vals));
+
         if (bnx2x_prev_is_path_marked(bp))
                 return bnx2x_prev_mcp_done(bp);
 
@@ -9680,7 +9710,10 @@ static int bnx2x_prev_unload_common(struct bnx2x *bp)
                 u32 timer_count = 1000;
 
                 /* Close the MAC Rx to prevent BRB from filling up */
-                bnx2x_prev_unload_close_mac(bp);
+                bnx2x_prev_unload_close_mac(bp, &mac_vals);
+
+                /* close LLH filters towards the BRB */
+                bnx2x_set_rx_filter(&bp->link_params, 0);
 
                 /* Check if the UNDI driver was previously loaded
                  * UNDI driver initializes CID offset for normal bell to 0x7
@@ -9727,6 +9760,17 @@ static int bnx2x_prev_unload_common(struct bnx2x *bp)
         /* No packets are in the pipeline, path is ready for reset */
         bnx2x_reset_common(bp);
 
+        if (mac_vals.xmac_addr)
+                REG_WR(bp, mac_vals.xmac_addr, mac_vals.xmac_val);
+        if (mac_vals.umac_addr)
+                REG_WR(bp, mac_vals.umac_addr, mac_vals.umac_val);
+        if (mac_vals.emac_addr)
+                REG_WR(bp, mac_vals.emac_addr, mac_vals.emac_val);
+        if (mac_vals.bmac_addr) {
+                REG_WR(bp, mac_vals.bmac_addr, mac_vals.bmac_val[0]);
+                REG_WR(bp, mac_vals.bmac_addr + 4, mac_vals.bmac_val[1]);
+        }
+
         rc = bnx2x_prev_mark_path(bp, prev_undi);
         if (rc) {
                 bnx2x_prev_mcp_done(bp);
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index 78ea90c40e19..bdb086934cd9 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -1283,14 +1283,26 @@ static int tg3_phy_auxctl_write(struct tg3 *tp, int reg, u32 set)
         return tg3_writephy(tp, MII_TG3_AUX_CTRL, set | reg);
 }
 
-#define TG3_PHY_AUXCTL_SMDSP_ENABLE(tp) \
-        tg3_phy_auxctl_write((tp), MII_TG3_AUXCTL_SHDWSEL_AUXCTL, \
-                             MII_TG3_AUXCTL_ACTL_SMDSP_ENA | \
-                             MII_TG3_AUXCTL_ACTL_TX_6DB)
+static int tg3_phy_toggle_auxctl_smdsp(struct tg3 *tp, bool enable)
+{
+        u32 val;
+        int err;
 
-#define TG3_PHY_AUXCTL_SMDSP_DISABLE(tp) \
-        tg3_phy_auxctl_write((tp), MII_TG3_AUXCTL_SHDWSEL_AUXCTL, \
-                             MII_TG3_AUXCTL_ACTL_TX_6DB);
+        err = tg3_phy_auxctl_read(tp, MII_TG3_AUXCTL_SHDWSEL_AUXCTL, &val);
+
+        if (err)
+                return err;
+        if (enable)
+
+                val |= MII_TG3_AUXCTL_ACTL_SMDSP_ENA;
+        else
+                val &= ~MII_TG3_AUXCTL_ACTL_SMDSP_ENA;
+
+        err = tg3_phy_auxctl_write((tp), MII_TG3_AUXCTL_SHDWSEL_AUXCTL,
+                                   val | MII_TG3_AUXCTL_ACTL_TX_6DB);
+
+        return err;
+}
 
 static int tg3_bmcr_reset(struct tg3 *tp)
 {
@@ -2223,7 +2235,7 @@ static void tg3_phy_apply_otp(struct tg3 *tp)
 
         otp = tp->phy_otp;
 
-        if (TG3_PHY_AUXCTL_SMDSP_ENABLE(tp))
+        if (tg3_phy_toggle_auxctl_smdsp(tp, true))
                 return;
 
         phy = ((otp & TG3_OTP_AGCTGT_MASK) >> TG3_OTP_AGCTGT_SHIFT);
@@ -2248,7 +2260,7 @@ static void tg3_phy_apply_otp(struct tg3 *tp)
               ((otp & TG3_OTP_RCOFF_MASK) >> TG3_OTP_RCOFF_SHIFT);
         tg3_phydsp_write(tp, MII_TG3_DSP_EXP97, phy);
 
-        TG3_PHY_AUXCTL_SMDSP_DISABLE(tp);
+        tg3_phy_toggle_auxctl_smdsp(tp, false);
 }
 
 static void tg3_phy_eee_adjust(struct tg3 *tp, u32 current_link_up)
@@ -2284,9 +2296,9 @@ static void tg3_phy_eee_adjust(struct tg3 *tp, u32 current_link_up)
 
         if (!tp->setlpicnt) {
                 if (current_link_up == 1 &&
-                   !TG3_PHY_AUXCTL_SMDSP_ENABLE(tp)) {
+                   !tg3_phy_toggle_auxctl_smdsp(tp, true)) {
                         tg3_phydsp_write(tp, MII_TG3_DSP_TAP26, 0x0000);
-                        TG3_PHY_AUXCTL_SMDSP_DISABLE(tp);
+                        tg3_phy_toggle_auxctl_smdsp(tp, false);
                 }
 
                 val = tr32(TG3_CPMU_EEE_MODE);
@@ -2302,11 +2314,11 @@ static void tg3_phy_eee_enable(struct tg3 *tp)
             (GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5717 ||
              GET_ASIC_REV(tp->pci_chip_rev_id) == ASIC_REV_5719 ||
              tg3_flag(tp, 57765_CLASS)) &&
-            !TG3_PHY_AUXCTL_SMDSP_ENABLE(tp)) {
+            !tg3_phy_toggle_auxctl_smdsp(tp, true)) {
                 val = MII_TG3_DSP_TAP26_ALNOKO |
                       MII_TG3_DSP_TAP26_RMRXSTO;
                 tg3_phydsp_write(tp, MII_TG3_DSP_TAP26, val);
-                TG3_PHY_AUXCTL_SMDSP_DISABLE(tp);
+                tg3_phy_toggle_auxctl_smdsp(tp, false);
         }
 
         val = tr32(TG3_CPMU_EEE_MODE);
@@ -2450,7 +2462,7 @@ static int tg3_phy_reset_5703_4_5(struct tg3 *tp)
                 tg3_writephy(tp, MII_CTRL1000,
                              CTL1000_AS_MASTER | CTL1000_ENABLE_MASTER);
 
-                err = TG3_PHY_AUXCTL_SMDSP_ENABLE(tp);
+                err = tg3_phy_toggle_auxctl_smdsp(tp, true);
                 if (err)
                         return err;
 
@@ -2471,7 +2483,7 @@ static int tg3_phy_reset_5703_4_5(struct tg3 *tp)
         tg3_writephy(tp, MII_TG3_DSP_ADDRESS, 0x8200);
         tg3_writephy(tp, MII_TG3_DSP_CONTROL, 0x0000);
 
-        TG3_PHY_AUXCTL_SMDSP_DISABLE(tp);
+        tg3_phy_toggle_auxctl_smdsp(tp, false);
 
         tg3_writephy(tp, MII_CTRL1000, phy9_orig);
 
@@ -2572,10 +2584,10 @@ static int tg3_phy_reset(struct tg3 *tp)
 
 out:
         if ((tp->phy_flags & TG3_PHYFLG_ADC_BUG) &&
-            !TG3_PHY_AUXCTL_SMDSP_ENABLE(tp)) {
+            !tg3_phy_toggle_auxctl_smdsp(tp, true)) {
                 tg3_phydsp_write(tp, 0x201f, 0x2aaa);
                 tg3_phydsp_write(tp, 0x000a, 0x0323);
-                TG3_PHY_AUXCTL_SMDSP_DISABLE(tp);
+                tg3_phy_toggle_auxctl_smdsp(tp, false);
         }
 
         if (tp->phy_flags & TG3_PHYFLG_5704_A0_BUG) {
@@ -2584,14 +2596,14 @@ out:
         }
 
         if (tp->phy_flags & TG3_PHYFLG_BER_BUG) {
-                if (!TG3_PHY_AUXCTL_SMDSP_ENABLE(tp)) {
+                if (!tg3_phy_toggle_auxctl_smdsp(tp, true)) {
                         tg3_phydsp_write(tp, 0x000a, 0x310b);
                         tg3_phydsp_write(tp, 0x201f, 0x9506);
                         tg3_phydsp_write(tp, 0x401f, 0x14e2);
-                        TG3_PHY_AUXCTL_SMDSP_DISABLE(tp);
+                        tg3_phy_toggle_auxctl_smdsp(tp, false);
                 }
         } else if (tp->phy_flags & TG3_PHYFLG_JITTER_BUG) {
-                if (!TG3_PHY_AUXCTL_SMDSP_ENABLE(tp)) {
+                if (!tg3_phy_toggle_auxctl_smdsp(tp, true)) {
                         tg3_writephy(tp, MII_TG3_DSP_ADDRESS, 0x000a);
                         if (tp->phy_flags & TG3_PHYFLG_ADJUST_TRIM) {
                                 tg3_writephy(tp, MII_TG3_DSP_RW_PORT, 0x110b);
@@ -2600,7 +2612,7 @@ out:
                         } else
                                 tg3_writephy(tp, MII_TG3_DSP_RW_PORT, 0x010b);
 
-                        TG3_PHY_AUXCTL_SMDSP_DISABLE(tp);
+                        tg3_phy_toggle_auxctl_smdsp(tp, false);
                 }
         }
 
@@ -4009,7 +4021,7 @@ static int tg3_phy_autoneg_cfg(struct tg3 *tp, u32 advertise, u32 flowctrl)
         tw32(TG3_CPMU_EEE_MODE,
              tr32(TG3_CPMU_EEE_MODE) & ~TG3_CPMU_EEEMD_LPI_ENABLE);
 
-        err = TG3_PHY_AUXCTL_SMDSP_ENABLE(tp);
+        err = tg3_phy_toggle_auxctl_smdsp(tp, true);
         if (!err) {
                 u32 err2;
 
@@ -4042,7 +4054,7 @@ static int tg3_phy_autoneg_cfg(struct tg3 *tp, u32 advertise, u32 flowctrl)
                                                  MII_TG3_DSP_CH34TP2_HIBW01);
                 }
 
-                err2 = TG3_PHY_AUXCTL_SMDSP_DISABLE(tp);
+                err2 = tg3_phy_toggle_auxctl_smdsp(tp, false);
                 if (!err)
                         err = err2;
         }
@@ -6950,6 +6962,9 @@ static void tg3_poll_controller(struct net_device *dev)
         int i;
         struct tg3 *tp = netdev_priv(dev);
 
+        if (tg3_irq_sync(tp))
+                return;
+
         for (i = 0; i < tp->irq_cnt; i++)
                 tg3_interrupt(tp->napi[i].irq_vec, &tp->napi[i]);
 }
@@ -16367,6 +16382,7 @@ static int tg3_init_one(struct pci_dev *pdev,
         tp->pm_cap = pm_cap;
         tp->rx_mode = TG3_DEF_RX_MODE;
         tp->tx_mode = TG3_DEF_TX_MODE;
+        tp->irq_sync = 1;
 
         if (tg3_debug > 0)
                 tp->msg_enable = tg3_debug;
diff --git a/drivers/net/ethernet/cadence/macb.c b/drivers/net/ethernet/cadence/macb.c
index a9b0830fb39d..b9d4bb9530e5 100644
--- a/drivers/net/ethernet/cadence/macb.c
+++ b/drivers/net/ethernet/cadence/macb.c
@@ -693,6 +693,11 @@ static int macb_poll(struct napi_struct *napi, int budget)
                  * get notified when new packets arrive.
                  */
                 macb_writel(bp, IER, MACB_RX_INT_FLAGS);
+
+                /* Packets received while interrupts were disabled */
+                status = macb_readl(bp, RSR);
+                if (unlikely(status))
+                        napi_reschedule(napi);
         }
 
         /* TODO: Handle errors */
diff --git a/drivers/net/ethernet/calxeda/xgmac.c b/drivers/net/ethernet/calxeda/xgmac.c
index b407043ce9b0..f7f02900f650 100644
--- a/drivers/net/ethernet/calxeda/xgmac.c
+++ b/drivers/net/ethernet/calxeda/xgmac.c
@@ -548,6 +548,10 @@ static int desc_get_rx_status(struct xgmac_priv *priv, struct xgmac_dma_desc *p)
                 return -1;
         }
 
+        /* All frames should fit into a single buffer */
+        if (!(status & RXDESC_FIRST_SEG) || !(status & RXDESC_LAST_SEG))
+                return -1;
+
         /* Check if packet has checksum already */
         if ((status & RXDESC_FRAME_TYPE) && (status & RXDESC_EXT_STATUS) &&
                 !(ext_status & RXDESC_IP_PAYLOAD_MASK))
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index f0718e1a8369..c306df7d4568 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -1994,9 +1994,20 @@ static int set_coalesce(struct net_device *dev, struct ethtool_coalesce *c)
 {
         const struct port_info *pi = netdev_priv(dev);
         struct adapter *adap = pi->adapter;
-
-        return set_rxq_intr_params(adap, &adap->sge.ethrxq[pi->first_qset].rspq,
-                        c->rx_coalesce_usecs, c->rx_max_coalesced_frames);
+        struct sge_rspq *q;
+        int i;
+        int r = 0;
+
+        for (i = pi->first_qset; i < pi->first_qset + pi->nqsets; i++) {
+                q = &adap->sge.ethrxq[i].rspq;
+                r = set_rxq_intr_params(adap, q, c->rx_coalesce_usecs,
+                        c->rx_max_coalesced_frames);
+                if (r) {
+                        dev_err(&dev->dev, "failed to set coalesce %d\n", r);
+                        break;
+                }
+        }
+        return r;
 }
 
 static int get_coalesce(struct net_device *dev, struct ethtool_coalesce *c)
diff --git a/drivers/net/ethernet/emulex/benet/be.h b/drivers/net/ethernet/emulex/benet/be.h
index 3bc1912afba9..f1b3df167ff2 100644
--- a/drivers/net/ethernet/emulex/benet/be.h
+++ b/drivers/net/ethernet/emulex/benet/be.h
@@ -36,13 +36,13 @@
 
 #define DRV_VER                 "4.4.161.0u"
 #define DRV_NAME                "be2net"
-#define BE_NAME                 "ServerEngines BladeEngine2 10Gbps NIC"
-#define BE3_NAME                "ServerEngines BladeEngine3 10Gbps NIC"
-#define OC_NAME                 "Emulex OneConnect 10Gbps NIC"
+#define BE_NAME                 "Emulex BladeEngine2"
+#define BE3_NAME                "Emulex BladeEngine3"
+#define OC_NAME                 "Emulex OneConnect"
 #define OC_NAME_BE              OC_NAME "(be3)"
 #define OC_NAME_LANCER          OC_NAME "(Lancer)"
 #define OC_NAME_SH              OC_NAME "(Skyhawk)"
-#define DRV_DESC                "ServerEngines BladeEngine 10Gbps NIC Driver"
+#define DRV_DESC                "Emulex OneConnect 10Gbps NIC Driver"
 
 #define BE_VENDOR_ID            0x19a2
 #define EMULEX_VENDOR_ID        0x10df
@@ -190,6 +190,7 @@ struct be_eq_obj {
 
         u8 idx;                 /* array index */
         u16 tx_budget;
+        u16 spurious_intr;
         struct napi_struct napi;
         struct be_adapter *adapter;
 } ____cacheline_aligned_in_smp;
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index 9dca22be8125..4d6f3c54427a 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -25,7 +25,7 @@
 MODULE_VERSION(DRV_VER);
 MODULE_DEVICE_TABLE(pci, be_dev_ids);
 MODULE_DESCRIPTION(DRV_DESC " " DRV_VER);
-MODULE_AUTHOR("ServerEngines Corporation");
+MODULE_AUTHOR("Emulex Corporation");
 MODULE_LICENSE("GPL");
 
 static unsigned int num_vfs;
@@ -2026,19 +2026,30 @@ static irqreturn_t be_intx(int irq, void *dev)
         struct be_adapter *adapter = eqo->adapter;
         int num_evts = 0;
 
-        /* On Lancer, clear-intr bit of the EQ DB does not work.
-         * INTx is de-asserted only on notifying num evts.
+        /* IRQ is not expected when NAPI is scheduled as the EQ
+         * will not be armed.
+         * But, this can happen on Lancer INTx where it takes
+         * a while to de-assert INTx or in BE2 where occasionaly
+         * an interrupt may be raised even when EQ is unarmed.
+         * If NAPI is already scheduled, then counting & notifying
+         * events will orphan them.
          */
-        if (lancer_chip(adapter))
+        if (napi_schedule_prep(&eqo->napi)) {
                 num_evts = events_get(eqo);
+                __napi_schedule(&eqo->napi);
+                if (num_evts)
+                        eqo->spurious_intr = 0;
+        }
+        be_eq_notify(adapter, eqo->q.id, false, true, num_evts);
 
-        /* The EQ-notify may not de-assert INTx rightaway, causing
-         * the ISR to be invoked again. So, return HANDLED even when
-         * num_evts is zero.
+        /* Return IRQ_HANDLED only for the the first spurious intr
+         * after a valid intr to stop the kernel from branding
+         * this irq as a bad one!
          */
-        be_eq_notify(adapter, eqo->q.id, false, true, num_evts);
-        napi_schedule(&eqo->napi);
-        return IRQ_HANDLED;
+        if (num_evts || eqo->spurious_intr++ == 0)
+                return IRQ_HANDLED;
+        else
+                return IRQ_NONE;
 }
 
 static irqreturn_t be_msix(int irq, void *dev)
diff --git a/drivers/net/ethernet/intel/e1000e/defines.h b/drivers/net/ethernet/intel/e1000e/defines.h
index 02a12b69555f..4dab6fc265a2 100644
--- a/drivers/net/ethernet/intel/e1000e/defines.h
+++ b/drivers/net/ethernet/intel/e1000e/defines.h
@@ -232,6 +232,7 @@
 #define E1000_CTRL_FRCDPX   0x00001000  /* Force Duplex */
 #define E1000_CTRL_LANPHYPC_OVERRIDE 0x00010000 /* SW control of LANPHYPC */
 #define E1000_CTRL_LANPHYPC_VALUE    0x00020000 /* SW value of LANPHYPC */
+#define E1000_CTRL_MEHE     0x00080000  /* Memory Error Handling Enable */
 #define E1000_CTRL_SWDPIN0  0x00040000  /* SWDPIN 0 value */
 #define E1000_CTRL_SWDPIN1  0x00080000  /* SWDPIN 1 value */
 #define E1000_CTRL_SWDPIO0  0x00400000  /* SWDPIN 0 Input or output */
@@ -389,6 +390,12 @@
 
 #define E1000_PBS_16K E1000_PBA_16K
 
+/* Uncorrectable/correctable ECC Error counts and enable bits */
+#define E1000_PBECCSTS_CORR_ERR_CNT_MASK        0x000000FF
+#define E1000_PBECCSTS_UNCORR_ERR_CNT_MASK      0x0000FF00
+#define E1000_PBECCSTS_UNCORR_ERR_CNT_SHIFT     8
+#define E1000_PBECCSTS_ECC_ENABLE               0x00010000
+
 #define IFS_MAX       80
 #define IFS_MIN       40
 #define IFS_RATIO     4
@@ -408,6 +415,7 @@
 #define E1000_ICR_RXSEQ         0x00000008 /* Rx sequence error */
 #define E1000_ICR_RXDMT0        0x00000010 /* Rx desc min. threshold (0) */
 #define E1000_ICR_RXT0          0x00000080 /* Rx timer intr (ring 0) */
+#define E1000_ICR_ECCER         0x00400000 /* Uncorrectable ECC Error */
 #define E1000_ICR_INT_ASSERTED  0x80000000 /* If this bit asserted, the driver should claim the interrupt */
 #define E1000_ICR_RXQ0          0x00100000 /* Rx Queue 0 Interrupt */
 #define E1000_ICR_RXQ1          0x00200000 /* Rx Queue 1 Interrupt */
@@ -443,6 +451,7 @@
 #define E1000_IMS_RXSEQ     E1000_ICR_RXSEQ     /* Rx sequence error */
 #define E1000_IMS_RXDMT0    E1000_ICR_RXDMT0    /* Rx desc min. threshold */
 #define E1000_IMS_RXT0      E1000_ICR_RXT0      /* Rx timer intr */
+#define E1000_IMS_ECCER     E1000_ICR_ECCER     /* Uncorrectable ECC Error */
 #define E1000_IMS_RXQ0      E1000_ICR_RXQ0      /* Rx Queue 0 Interrupt */
 #define E1000_IMS_RXQ1      E1000_ICR_RXQ1      /* Rx Queue 1 Interrupt */
 #define E1000_IMS_TXQ0      E1000_ICR_TXQ0      /* Tx Queue 0 Interrupt */
diff --git a/drivers/net/ethernet/intel/e1000e/e1000.h b/drivers/net/ethernet/intel/e1000e/e1000.h
index 6782a2eea1bc..7e95f221d60b 100644
--- a/drivers/net/ethernet/intel/e1000e/e1000.h
+++ b/drivers/net/ethernet/intel/e1000e/e1000.h
@@ -309,6 +309,8 @@ struct e1000_adapter {
 
         struct napi_struct napi;
 
+        unsigned int uncorr_errors;     /* uncorrectable ECC errors */
+        unsigned int corr_errors;       /* correctable ECC errors */
         unsigned int restart_queue;
         u32 txd_cmd;
 
diff --git a/drivers/net/ethernet/intel/e1000e/ethtool.c b/drivers/net/ethernet/intel/e1000e/ethtool.c
index f95bc6ee1c22..fd4772a2691c 100644
--- a/drivers/net/ethernet/intel/e1000e/ethtool.c
+++ b/drivers/net/ethernet/intel/e1000e/ethtool.c
@@ -108,6 +108,8 @@ static const struct e1000_stats e1000_gstrings_stats[] = {
         E1000_STAT("dropped_smbus", stats.mgpdc),
         E1000_STAT("rx_dma_failed", rx_dma_failed),
         E1000_STAT("tx_dma_failed", tx_dma_failed),
+        E1000_STAT("uncorr_ecc_errors", uncorr_errors),
+        E1000_STAT("corr_ecc_errors", corr_errors),
 };
 
 #define E1000_GLOBAL_STATS_LEN  ARRAY_SIZE(e1000_gstrings_stats)
diff --git a/drivers/net/ethernet/intel/e1000e/hw.h b/drivers/net/ethernet/intel/e1000e/hw.h
index cf217777586c..b88676ff3d86 100644
--- a/drivers/net/ethernet/intel/e1000e/hw.h
+++ b/drivers/net/ethernet/intel/e1000e/hw.h
@@ -77,6 +77,7 @@ enum e1e_registers {
 #define E1000_POEMB     E1000_PHY_CTRL  /* PHY OEM Bits */
         E1000_PBA      = 0x01000, /* Packet Buffer Allocation - RW */
         E1000_PBS      = 0x01008, /* Packet Buffer Size */
+        E1000_PBECCSTS = 0x0100C, /* Packet Buffer ECC Status - RW */
         E1000_EEMNGCTL = 0x01010, /* MNG EEprom Control */
         E1000_EEWR     = 0x0102C, /* EEPROM Write Register - RW */
         E1000_FLOP     = 0x0103C, /* FLASH Opcode Register */
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
index 976336547607..24d9f61956f0 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -3624,6 +3624,17 @@ static void e1000_initialize_hw_bits_ich8lan(struct e1000_hw *hw)
         if (hw->mac.type == e1000_ich8lan)
                 reg |= (E1000_RFCTL_IPV6_EX_DIS | E1000_RFCTL_NEW_IPV6_EXT_DIS);
         ew32(RFCTL, reg);
+
+        /* Enable ECC on Lynxpoint */
+        if (hw->mac.type == e1000_pch_lpt) {
+                reg = er32(PBECCSTS);
+                reg |= E1000_PBECCSTS_ECC_ENABLE;
+                ew32(PBECCSTS, reg);
+
+                reg = er32(CTRL);
+                reg |= E1000_CTRL_MEHE;
+                ew32(CTRL, reg);
+        }
 }
 
 /**
diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c
index fbf75fdca994..643c883dd795 100644
--- a/drivers/net/ethernet/intel/e1000e/netdev.c
+++ b/drivers/net/ethernet/intel/e1000e/netdev.c
@@ -1678,6 +1678,23 @@ static irqreturn_t e1000_intr_msi(int irq, void *data)
                         mod_timer(&adapter->watchdog_timer, jiffies + 1);
         }
 
+        /* Reset on uncorrectable ECC error */
+        if ((icr & E1000_ICR_ECCER) && (hw->mac.type == e1000_pch_lpt)) {
+                u32 pbeccsts = er32(PBECCSTS);
+
+                adapter->corr_errors +=
+                    pbeccsts & E1000_PBECCSTS_CORR_ERR_CNT_MASK;
+                adapter->uncorr_errors +=
+                    (pbeccsts & E1000_PBECCSTS_UNCORR_ERR_CNT_MASK) >>
+                    E1000_PBECCSTS_UNCORR_ERR_CNT_SHIFT;
+
+                /* Do the reset outside of interrupt context */
+                schedule_work(&adapter->reset_task);
+
+                /* return immediately since reset is imminent */
+                return IRQ_HANDLED;
+        }
+
         if (napi_schedule_prep(&adapter->napi)) {
                 adapter->total_tx_bytes = 0;
                 adapter->total_tx_packets = 0;
@@ -1741,6 +1758,23 @@ static irqreturn_t e1000_intr(int irq, void *data)
                         mod_timer(&adapter->watchdog_timer, jiffies + 1);
         }
 
+        /* Reset on uncorrectable ECC error */
+        if ((icr & E1000_ICR_ECCER) && (hw->mac.type == e1000_pch_lpt)) {
+                u32 pbeccsts = er32(PBECCSTS);
+
+                adapter->corr_errors +=
+                    pbeccsts & E1000_PBECCSTS_CORR_ERR_CNT_MASK;
+                adapter->uncorr_errors +=
+                    (pbeccsts & E1000_PBECCSTS_UNCORR_ERR_CNT_MASK) >>
+                    E1000_PBECCSTS_UNCORR_ERR_CNT_SHIFT;
+
+                /* Do the reset outside of interrupt context */
+                schedule_work(&adapter->reset_task);
+
+                /* return immediately since reset is imminent */
+                return IRQ_HANDLED;
+        }
+
         if (napi_schedule_prep(&adapter->napi)) {
                 adapter->total_tx_bytes = 0;
                 adapter->total_tx_packets = 0;
@@ -2104,6 +2138,8 @@ static void e1000_irq_enable(struct e1000_adapter *adapter)
         if (adapter->msix_entries) {
                 ew32(EIAC_82574, adapter->eiac_mask & E1000_EIAC_MASK_82574);
                 ew32(IMS, adapter->eiac_mask | E1000_IMS_OTHER | E1000_IMS_LSC);
+        } else if (hw->mac.type == e1000_pch_lpt) {
+                ew32(IMS, IMS_ENABLE_MASK | E1000_IMS_ECCER);
         } else {
                 ew32(IMS, IMS_ENABLE_MASK);
         }
@@ -4251,6 +4287,16 @@ static void e1000e_update_stats(struct e1000_adapter *adapter)
         adapter->stats.mgptc += er32(MGTPTC);
         adapter->stats.mgprc += er32(MGTPRC);
         adapter->stats.mgpdc += er32(MGTPDC);
+
+        /* Correctable ECC Errors */
+        if (hw->mac.type == e1000_pch_lpt) {
+                u32 pbeccsts = er32(PBECCSTS);
+                adapter->corr_errors +=
+                    pbeccsts & E1000_PBECCSTS_CORR_ERR_CNT_MASK;
+                adapter->uncorr_errors +=
+                    (pbeccsts & E1000_PBECCSTS_UNCORR_ERR_CNT_MASK) >>
+                    E1000_PBECCSTS_UNCORR_ERR_CNT_SHIFT;
+        }
 }
 
 /**
diff --git a/drivers/net/ethernet/intel/ixgbe/Makefile b/drivers/net/ethernet/intel/ixgbe/Makefile
index f3a632bf8d96..687c83d1bdab 100644
--- a/drivers/net/ethernet/intel/ixgbe/Makefile
+++ b/drivers/net/ethernet/intel/ixgbe/Makefile
@@ -32,7 +32,7 @@
 
 obj-$(CONFIG_IXGBE) += ixgbe.o
 
-ixgbe-objs := ixgbe_main.o ixgbe_common.o ixgbe_ethtool.o ixgbe_debugfs.o\
+ixgbe-objs := ixgbe_main.o ixgbe_common.o ixgbe_ethtool.o \
               ixgbe_82599.o ixgbe_82598.o ixgbe_phy.o ixgbe_sriov.o \
               ixgbe_mbx.o ixgbe_x540.o ixgbe_lib.o ixgbe_ptp.o
 
@@ -40,4 +40,5 @@ ixgbe-$(CONFIG_IXGBE_DCB) +=  ixgbe_dcb.o ixgbe_dcb_82598.o \
                               ixgbe_dcb_82599.o ixgbe_dcb_nl.o
 
 ixgbe-$(CONFIG_IXGBE_HWMON) += ixgbe_sysfs.o
+ixgbe-$(CONFIG_DEBUG_FS) += ixgbe_debugfs.o
 ixgbe-$(CONFIG_FCOE:m=y) += ixgbe_fcoe.o
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_debugfs.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_debugfs.c
index 50aa546b8c7a..3504686d3af5 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_debugfs.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_debugfs.c
@@ -24,9 +24,6 @@
   Intel Corporation, 5200 N.E. Elam Young Parkway, Hillsboro, OR 97124-6497
 
 *******************************************************************************/
-
-#ifdef CONFIG_DEBUG_FS
-
 #include <linux/debugfs.h>
 #include <linux/module.h>
 
@@ -277,5 +274,3 @@ void ixgbe_dbg_exit(void)
 {
         debugfs_remove_recursive(ixgbe_dbg_root);
 }
-
-#endif /* CONFIG_DEBUG_FS */
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 20a5af6d87d0..b3e3294cfe53 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -1401,6 +1401,7 @@ static void ixgbe_set_rsc_gso_size(struct ixgbe_ring *ring,
         /* set gso_size to avoid messing up TCP MSS */
         skb_shinfo(skb)->gso_size = DIV_ROUND_UP((skb->len - hdr_len),
                                                  IXGBE_CB(skb)->append_cnt);
+        skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
 }
 
 static void ixgbe_update_rsc_stats(struct ixgbe_ring *rx_ring,
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
index 1a751c9d09c4..bb9256a1b0a9 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
@@ -660,11 +660,11 @@ int ixgbe_ptp_hwtstamp_ioctl(struct ixgbe_adapter *adapter,
                 break;
         case HWTSTAMP_FILTER_PTP_V1_L4_SYNC:
                 tsync_rx_ctl |= IXGBE_TSYNCRXCTL_TYPE_L4_V1;
-                tsync_rx_mtrl = IXGBE_RXMTRL_V1_SYNC_MSG;
+                tsync_rx_mtrl |= IXGBE_RXMTRL_V1_SYNC_MSG;
                 break;
         case HWTSTAMP_FILTER_PTP_V1_L4_DELAY_REQ:
                 tsync_rx_ctl |= IXGBE_TSYNCRXCTL_TYPE_L4_V1;
-                tsync_rx_mtrl = IXGBE_RXMTRL_V1_DELAY_REQ_MSG;
+                tsync_rx_mtrl |= IXGBE_RXMTRL_V1_DELAY_REQ_MSG;
                 break;
         case HWTSTAMP_FILTER_PTP_V2_EVENT:
         case HWTSTAMP_FILTER_PTP_V2_L2_EVENT:
diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
index 2b799f4f1c37..6771b69f40d5 100644
--- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
+++ b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -630,10 +630,15 @@ netdev_tx_t mlx4_en_xmit(struct sk_buff *skb, struct net_device *dev)
                 ring->tx_csum++;
         }
 
-        /* Copy dst mac address to wqe */
-        ethh = (struct ethhdr *)skb->data;
-        tx_desc->ctrl.srcrb_flags16[0] = get_unaligned((__be16 *)ethh->h_dest);
-        tx_desc->ctrl.imm = get_unaligned((__be32 *)(ethh->h_dest + 2));
+        if (mlx4_is_mfunc(mdev->dev) || priv->validate_loopback) {
+                /* Copy dst mac address to wqe. This allows loopback in eSwitch,
+                 * so that VFs and PF can communicate with each other
+                 */
+                ethh = (struct ethhdr *)skb->data;
+                tx_desc->ctrl.srcrb_flags16[0] = get_unaligned((__be16 *)ethh->h_dest);
+                tx_desc->ctrl.imm = get_unaligned((__be32 *)(ethh->h_dest + 2));
+        }
+
         /* Handle LSO (TSO) packets */
         if (lso_header_size) {
                 /* Mark opcode as LSO */
diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
index e1bafffbc3b1..5163af314990 100644
--- a/drivers/net/ethernet/mellanox/mlx4/main.c
+++ b/drivers/net/ethernet/mellanox/mlx4/main.c
@@ -380,7 +380,7 @@ static int mlx4_dev_cap(struct mlx4_dev *dev, struct mlx4_dev_cap *dev_cap)
                 }
         }
 
-        if ((dev_cap->flags &
+        if ((dev->caps.flags &
             (MLX4_DEV_CAP_FLAG_64B_CQE | MLX4_DEV_CAP_FLAG_64B_EQE)) &&
             mlx4_is_master(dev))
                 dev->caps.function_caps |= MLX4_FUNC_CAP_64B_EQE_CQE;
@@ -1790,15 +1790,8 @@ static void mlx4_enable_msi_x(struct mlx4_dev *dev)
         int i;
 
         if (msi_x) {
-                /* In multifunction mode each function gets 2 msi-X vectors
-                 * one for data path completions anf the other for asynch events
-                 * or command completions */
-                if (mlx4_is_mfunc(dev)) {
-                        nreq = 2;
-                } else {
-                        nreq = min_t(int, dev->caps.num_eqs -
-                                     dev->caps.reserved_eqs, nreq);
-                }
+                nreq = min_t(int, dev->caps.num_eqs - dev->caps.reserved_eqs,
+                             nreq);
 
                 entries = kcalloc(nreq, sizeof *entries, GFP_KERNEL);
                 if (!entries)
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
index bc165f4d0f65..695667d471a1 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_init.c
@@ -144,7 +144,7 @@ void netxen_release_tx_buffers(struct netxen_adapter *adapter)
                                          buffrag->length, PCI_DMA_TODEVICE);
                         buffrag->dma = 0ULL;
                 }
-                for (j = 0; j < cmd_buf->frag_count; j++) {
+                for (j = 1; j < cmd_buf->frag_count; j++) {
                         buffrag++;
                         if (buffrag->dma) {
                                 pci_unmap_page(adapter->pdev, buffrag->dma,
diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
index 6098fd4adfeb..69e321a65077 100644
--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
+++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
@@ -1963,10 +1963,12 @@ unwind:
         while (--i >= 0) {
                 nf = &pbuf->frag_array[i+1];
                 pci_unmap_page(pdev, nf->dma, nf->length, PCI_DMA_TODEVICE);
+                nf->dma = 0ULL;
         }
 
         nf = &pbuf->frag_array[0];
         pci_unmap_single(pdev, nf->dma, skb_headlen(skb), PCI_DMA_TODEVICE);
+        nf->dma = 0ULL;
 
 out_err:
         return -ENOMEM;
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
index 6f82812d0fab..09aa310b6194 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c
@@ -986,8 +986,13 @@ qlcnic_process_lro(struct qlcnic_adapter *adapter,
         th->seq = htonl(seq_number);
         length = skb->len;
 
-        if (adapter->flags & QLCNIC_FW_LRO_MSS_CAP)
+        if (adapter->flags & QLCNIC_FW_LRO_MSS_CAP) {
                 skb_shinfo(skb)->gso_size = qlcnic_get_lro_sts_mss(sts_data1);
+                if (skb->protocol == htons(ETH_P_IPV6))
+                        skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6;
+                else
+                        skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4;
+        }
 
         if (vid != 0xffff)
                 __vlan_hwaccel_put_tag(skb, vid);
diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
index f80cd975daed..3e73742024b0 100644
--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
@@ -4678,7 +4678,7 @@ static int qlge_probe(struct pci_dev *pdev,
         qdev = netdev_priv(ndev);
         SET_NETDEV_DEV(ndev, &pdev->dev);
         ndev->hw_features = NETIF_F_SG | NETIF_F_IP_CSUM |
-                NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_TSO_ECN |
+                NETIF_F_TSO | NETIF_F_TSO_ECN |
                 NETIF_F_HW_VLAN_TX | NETIF_F_RXCSUM;
         ndev->features = ndev->hw_features |
                 NETIF_F_HW_VLAN_RX | NETIF_F_HW_VLAN_FILTER;
diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
index ed96f309bca8..998974f78742 100644
--- a/drivers/net/ethernet/realtek/r8169.c
+++ b/drivers/net/ethernet/realtek/r8169.c
@@ -450,7 +450,6 @@ enum rtl8168_registers {
 #define PWM_EN                          (1 << 22)
 #define RXDV_GATED_EN                   (1 << 19)
 #define EARLY_TALLY_EN                  (1 << 16)
-#define FORCE_CLK                       (1 << 15) /* force clock request */
 };
 
 enum rtl_register_content {
@@ -514,7 +513,6 @@ enum rtl_register_content {
         PMEnable        = (1 << 0),     /* Power Management Enable */
 
         /* Config2 register p. 25 */
-        ClkReqEn        = (1 << 7),     /* Clock Request Enable */
         MSIEnable       = (1 << 5),     /* 8169 only. Reserved in the 8168. */
         PCI_Clock_66MHz = 0x01,
         PCI_Clock_33MHz = 0x00,
@@ -535,7 +533,6 @@ enum rtl_register_content {
         Spi_en          = (1 << 3),
         LanWake         = (1 << 1),     /* LanWake enable/disable */
         PMEStatus       = (1 << 0),     /* PME status can be reset by PCI RST# */
-        ASPM_en         = (1 << 0),     /* ASPM enable */
 
         /* TBICSR p.28 */
         TBIReset        = 0x80000000,
@@ -684,7 +681,6 @@ enum features {
         RTL_FEATURE_WOL         = (1 << 0),
         RTL_FEATURE_MSI         = (1 << 1),
         RTL_FEATURE_GMII        = (1 << 2),
-        RTL_FEATURE_FW_LOADED   = (1 << 3),
 };
 
 struct rtl8169_counters {
@@ -1826,8 +1822,6 @@ static void rtl8169_rx_vlan_tag(struct RxDesc *desc, struct sk_buff *skb)
 
         if (opts2 & RxVlanTag)
                 __vlan_hwaccel_put_tag(skb, swab16(opts2 & 0xffff));
-
-        desc->opts2 = 0;
 }
 
 static int rtl8169_gset_tbi(struct net_device *dev, struct ethtool_cmd *cmd)
@@ -2391,10 +2385,8 @@ static void rtl_apply_firmware(struct rtl8169_private *tp)
         struct rtl_fw *rtl_fw = tp->rtl_fw;
 
         /* TODO: release firmware once rtl_phy_write_fw signals failures. */
-        if (!IS_ERR_OR_NULL(rtl_fw)) {
+        if (!IS_ERR_OR_NULL(rtl_fw))
                 rtl_phy_write_fw(tp, rtl_fw);
-                tp->features |= RTL_FEATURE_FW_LOADED;
-        }
 }
 
 static void rtl_apply_firmware_cond(struct rtl8169_private *tp, u8 reg, u16 val)
@@ -2405,31 +2397,6 @@ static void rtl_apply_firmware_cond(struct rtl8169_private *tp, u8 reg, u16 val)
                 rtl_apply_firmware(tp);
 }
 
-static void r810x_aldps_disable(struct rtl8169_private *tp)
-{
-        rtl_writephy(tp, 0x1f, 0x0000);
-        rtl_writephy(tp, 0x18, 0x0310);
-        msleep(100);
-}
-
-static void r810x_aldps_enable(struct rtl8169_private *tp)
-{
-        if (!(tp->features & RTL_FEATURE_FW_LOADED))
-                return;
-
-        rtl_writephy(tp, 0x1f, 0x0000);
-        rtl_writephy(tp, 0x18, 0x8310);
-}
-
-static void r8168_aldps_enable_1(struct rtl8169_private *tp)
-{
-        if (!(tp->features & RTL_FEATURE_FW_LOADED))
-                return;
-
-        rtl_writephy(tp, 0x1f, 0x0000);
-        rtl_w1w0_phy(tp, 0x15, 0x1000, 0x0000);
-}
-
 static void rtl8169s_hw_phy_config(struct rtl8169_private *tp)
 {
         static const struct phy_reg phy_reg_init[] = {
@@ -3220,8 +3187,6 @@ static void rtl8168e_2_hw_phy_config(struct rtl8169_private *tp)
         rtl_w1w0_phy(tp, 0x10, 0x0000, 0x0400);
         rtl_writephy(tp, 0x1f, 0x0000);
 
-        r8168_aldps_enable_1(tp);
-
         /* Broken BIOS workaround: feed GigaMAC registers with MAC address. */
         rtl_rar_exgmac_set(tp, tp->dev->dev_addr);
 }
@@ -3296,8 +3261,6 @@ static void rtl8168f_1_hw_phy_config(struct rtl8169_private *tp)
         rtl_writephy(tp, 0x05, 0x8b85);
         rtl_w1w0_phy(tp, 0x06, 0x4000, 0x0000);
         rtl_writephy(tp, 0x1f, 0x0000);
-
-        r8168_aldps_enable_1(tp);
 }
 
 static void rtl8168f_2_hw_phy_config(struct rtl8169_private *tp)
@@ -3305,8 +3268,6 @@ static void rtl8168f_2_hw_phy_config(struct rtl8169_private *tp)
         rtl_apply_firmware(tp);
 
         rtl8168f_hw_phy_config(tp);
-
-        r8168_aldps_enable_1(tp);
 }
 
 static void rtl8411_hw_phy_config(struct rtl8169_private *tp)
@@ -3404,8 +3365,6 @@ static void rtl8411_hw_phy_config(struct rtl8169_private *tp)
         rtl_w1w0_phy(tp, 0x19, 0x0000, 0x0001);
         rtl_w1w0_phy(tp, 0x10, 0x0000, 0x0400);
         rtl_writephy(tp, 0x1f, 0x0000);
-
-        r8168_aldps_enable_1(tp);
 }
 
 static void rtl8168g_1_hw_phy_config(struct rtl8169_private *tp)
@@ -3491,19 +3450,21 @@ static void rtl8105e_hw_phy_config(struct rtl8169_private *tp)
         };
 
         /* Disable ALDPS before ram code */
-        r810x_aldps_disable(tp);
+        rtl_writephy(tp, 0x1f, 0x0000);
+        rtl_writephy(tp, 0x18, 0x0310);
+        msleep(100);
 
         rtl_apply_firmware(tp);
 
         rtl_writephy_batch(tp, phy_reg_init, ARRAY_SIZE(phy_reg_init));
-
-        r810x_aldps_enable(tp);
 }
 
 static void rtl8402_hw_phy_config(struct rtl8169_private *tp)
 {
         /* Disable ALDPS before setting firmware */
-        r810x_aldps_disable(tp);
+        rtl_writephy(tp, 0x1f, 0x0000);
+        rtl_writephy(tp, 0x18, 0x0310);
+        msleep(20);
 
         rtl_apply_firmware(tp);
 
@@ -3513,8 +3474,6 @@ static void rtl8402_hw_phy_config(struct rtl8169_private *tp)
         rtl_writephy(tp, 0x10, 0x401f);
         rtl_writephy(tp, 0x19, 0x7030);
         rtl_writephy(tp, 0x1f, 0x0000);
-
-        r810x_aldps_enable(tp);
 }
 
 static void rtl8106e_hw_phy_config(struct rtl8169_private *tp)
@@ -3527,7 +3486,9 @@ static void rtl8106e_hw_phy_config(struct rtl8169_private *tp)
         };
 
         /* Disable ALDPS before ram code */
-        r810x_aldps_disable(tp);
+        rtl_writephy(tp, 0x1f, 0x0000);
+        rtl_writephy(tp, 0x18, 0x0310);
+        msleep(100);
 
         rtl_apply_firmware(tp);
 
@@ -3535,8 +3496,6 @@ static void rtl8106e_hw_phy_config(struct rtl8169_private *tp)
         rtl_writephy_batch(tp, phy_reg_init, ARRAY_SIZE(phy_reg_init));
 
         rtl_eri_write(tp, 0x1d0, ERIAR_MASK_0011, 0x0000, ERIAR_EXGMAC);
-
-        r810x_aldps_enable(tp);
 }
 
 static void rtl_hw_phy_config(struct net_device *dev)
@@ -5053,6 +5012,8 @@ static void rtl_hw_start_8168e_2(struct rtl8169_private *tp)
 
         RTL_W8(MaxTxPacketSize, EarlySize);
 
+        rtl_disable_clock_request(pdev);
+
         RTL_W32(TxConfig, RTL_R32(TxConfig) | TXCFG_AUTO_FIFO);
         RTL_W8(MCU, RTL_R8(MCU) & ~NOW_IS_OOB);
 
@@ -5061,8 +5022,7 @@ static void rtl_hw_start_8168e_2(struct rtl8169_private *tp)
 
         RTL_W8(DLLPR, RTL_R8(DLLPR) | PFM_EN);
         RTL_W32(MISC, RTL_R32(MISC) | PWM_EN);
-        RTL_W8(Config5, (RTL_R8(Config5) & ~Spi_en) | ASPM_en);
-        RTL_W8(Config2, RTL_R8(Config2) | ClkReqEn);
+        RTL_W8(Config5, RTL_R8(Config5) & ~Spi_en);
 }
 
 static void rtl_hw_start_8168f(struct rtl8169_private *tp)
@@ -5087,12 +5047,13 @@ static void rtl_hw_start_8168f(struct rtl8169_private *tp)
 
         RTL_W8(MaxTxPacketSize, EarlySize);
 
+        rtl_disable_clock_request(pdev);
+
         RTL_W32(TxConfig, RTL_R32(TxConfig) | TXCFG_AUTO_FIFO);
         RTL_W8(MCU, RTL_R8(MCU) & ~NOW_IS_OOB);
         RTL_W8(DLLPR, RTL_R8(DLLPR) | PFM_EN);
-        RTL_W32(MISC, RTL_R32(MISC) | PWM_EN | FORCE_CLK);
-        RTL_W8(Config5, (RTL_R8(Config5) & ~Spi_en) | ASPM_en);
-        RTL_W8(Config2, RTL_R8(Config2) | ClkReqEn);
+        RTL_W32(MISC, RTL_R32(MISC) | PWM_EN);
+        RTL_W8(Config5, RTL_R8(Config5) & ~Spi_en);
 }
 
 static void rtl_hw_start_8168f_1(struct rtl8169_private *tp)
@@ -5149,10 +5110,8 @@ static void rtl_hw_start_8168g_1(struct rtl8169_private *tp)
         rtl_w1w0_eri(tp, 0xdc, ERIAR_MASK_0001, 0x01, 0x00, ERIAR_EXGMAC);
 
         RTL_W8(ChipCmd, CmdTxEnb | CmdRxEnb);
-        RTL_W32(MISC, (RTL_R32(MISC) | FORCE_CLK) & ~RXDV_GATED_EN);
+        RTL_W32(MISC, RTL_R32(MISC) & ~RXDV_GATED_EN);
         RTL_W8(MaxTxPacketSize, EarlySize);
-        RTL_W8(Config5, RTL_R8(Config5) | ASPM_en);
-        RTL_W8(Config2, RTL_R8(Config2) | ClkReqEn);
 
         rtl_eri_write(tp, 0xc0, ERIAR_MASK_0011, 0x0000, ERIAR_EXGMAC);
         rtl_eri_write(tp, 0xb8, ERIAR_MASK_0011, 0x0000, ERIAR_EXGMAC);
@@ -5368,9 +5327,6 @@ static void rtl_hw_start_8105e_1(struct rtl8169_private *tp)
 
         RTL_W8(MCU, RTL_R8(MCU) | EN_NDP | EN_OOB_RESET);
         RTL_W8(DLLPR, RTL_R8(DLLPR) | PFM_EN);
-        RTL_W8(Config5, RTL_R8(Config5) | ASPM_en);
-        RTL_W8(Config2, RTL_R8(Config2) | ClkReqEn);
-        RTL_W32(MISC, RTL_R32(MISC) | FORCE_CLK);
 
         rtl_ephy_init(tp, e_info_8105e_1, ARRAY_SIZE(e_info_8105e_1));
 }
@@ -5396,9 +5352,6 @@ static void rtl_hw_start_8402(struct rtl8169_private *tp)
 
         RTL_W32(TxConfig, RTL_R32(TxConfig) | TXCFG_AUTO_FIFO);
         RTL_W8(MCU, RTL_R8(MCU) & ~NOW_IS_OOB);
-        RTL_W8(Config5, RTL_R8(Config5) | ASPM_en);
-        RTL_W8(Config2, RTL_R8(Config2) | ClkReqEn);
-        RTL_W32(MISC, RTL_R32(MISC) | FORCE_CLK);
 
         rtl_ephy_init(tp, e_info_8402, ARRAY_SIZE(e_info_8402));
 
@@ -5420,10 +5373,7 @@ static void rtl_hw_start_8106(struct rtl8169_private *tp)
         /* Force LAN exit from ASPM if Rx/Tx are not idle */
         RTL_W32(FuncEvent, RTL_R32(FuncEvent) | 0x002800);
 
-        RTL_W32(MISC,
-                (RTL_R32(MISC) | DISABLE_LAN_EN | FORCE_CLK) & ~EARLY_TALLY_EN);
-        RTL_W8(Config5, RTL_R8(Config5) | ASPM_en);
-        RTL_W8(Config2, RTL_R8(Config2) | ClkReqEn);
+        RTL_W32(MISC, (RTL_R32(MISC) | DISABLE_LAN_EN) & ~EARLY_TALLY_EN);
         RTL_W8(MCU, RTL_R8(MCU) | EN_NDP | EN_OOB_RESET);
         RTL_W8(DLLPR, RTL_R8(DLLPR) & ~PFM_EN);
 }
@@ -6064,8 +6014,6 @@ static int rtl_rx(struct net_device *dev, struct rtl8169_private *tp, u32 budget
                             !(status & (RxRWT | RxFOVF)) &&
                             (dev->features & NETIF_F_RXALL))
                                 goto process_pkt;
-
-                        rtl8169_mark_to_asic(desc, rx_buf_sz);
                 } else {
                         struct sk_buff *skb;
                         dma_addr_t addr;
@@ -6086,16 +6034,14 @@ process_pkt:
                         if (unlikely(rtl8169_fragmented_frame(status))) {
                                 dev->stats.rx_dropped++;
                                 dev->stats.rx_length_errors++;
-                                rtl8169_mark_to_asic(desc, rx_buf_sz);
-                                continue;
+                                goto release_descriptor;
                         }
 
                         skb = rtl8169_try_rx_copy(tp->Rx_databuff[entry],
                                                   tp, pkt_size, addr);
-                        rtl8169_mark_to_asic(desc, rx_buf_sz);
                         if (!skb) {
                                 dev->stats.rx_dropped++;
-                                continue;
+                                goto release_descriptor;
                         }
 
                         rtl8169_rx_csum(skb, status);
@@ -6111,13 +6057,10 @@ process_pkt:
                         tp->rx_stats.bytes += pkt_size;
                         u64_stats_update_end(&tp->rx_stats.syncp);
                 }
-
-                /* Work around for AMD plateform. */
-                if ((desc->opts2 & cpu_to_le32(0xfffe000)) &&
-                    (tp->mac_version == RTL_GIGA_MAC_VER_05)) {
-                        desc->opts2 = 0;
-                        cur_rx++;
-                }
+release_descriptor:
+                desc->opts2 = 0;
+                wmb();
+                rtl8169_mark_to_asic(desc, rx_buf_sz);
         }
 
         count = cur_rx - tp->cur_rx;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index f07c0612abf6..b75f4b286895 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -69,7 +69,7 @@
 
 #undef STMMAC_XMIT_DEBUG
 /*#define STMMAC_XMIT_DEBUG*/
-#ifdef STMMAC_TX_DEBUG
+#ifdef STMMAC_XMIT_DEBUG
 #define TX_DBG(fmt, args...)  printk(fmt, ## args)
 #else
 #define TX_DBG(fmt, args...)  do { } while (0)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
index 0376a5e6b2bf..0b9829fe3eea 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c
@@ -188,8 +188,6 @@ int stmmac_mdio_register(struct net_device *ndev)
                 goto bus_register_fail;
         }
 
-        priv->mii = new_bus;
-
         found = 0;
         for (addr = 0; addr < PHY_MAX_ADDR; addr++) {
                 struct phy_device *phydev = new_bus->phy_map[addr];
@@ -237,8 +235,14 @@ int stmmac_mdio_register(struct net_device *ndev)
                 }
         }
 
-        if (!found)
+        if (!found) {
                 pr_warning("%s: No PHY found\n", ndev->name);
+                mdiobus_unregister(new_bus);
+                mdiobus_free(new_bus);
+                return -ENODEV;
+        }
+
+        priv->mii = new_bus;
 
         return 0;
 
diff --git a/drivers/net/ethernet/via/via-rhine.c b/drivers/net/ethernet/via/via-rhine.c
index 7992b3e05d3d..78ace59efd29 100644
--- a/drivers/net/ethernet/via/via-rhine.c
+++ b/drivers/net/ethernet/via/via-rhine.c
@@ -1801,7 +1801,7 @@ static void rhine_tx(struct net_device *dev)
                                          rp->tx_skbuff[entry]->len,
                                          PCI_DMA_TODEVICE);
                 }
-                dev_kfree_skb_irq(rp->tx_skbuff[entry]);
+                dev_kfree_skb(rp->tx_skbuff[entry]);
                 rp->tx_skbuff[entry] = NULL;
                 entry = (++rp->dirty_tx) % TX_RING_SIZE;
         }
@@ -2010,11 +2010,7 @@ static void rhine_slow_event_task(struct work_struct *work)
         if (intr_status & IntrPCIErr)
                 netif_warn(rp, hw, dev, "PCI error\n");
 
-        napi_disable(&rp->napi);
-        rhine_irq_disable(rp);
-        /* Slow and safe. Consider __napi_schedule as a replacement ? */
-        napi_enable(&rp->napi);
-        napi_schedule(&rp->napi);
+        iowrite16(RHINE_EVENT & 0xffff, rp->base + IntrEnable);
 
 out_unlock:
         mutex_unlock(&rp->task_lock);
diff --git a/drivers/net/ethernet/xilinx/Kconfig b/drivers/net/ethernet/xilinx/Kconfig
index 5778a4ae1164..122d60c0481b 100644
--- a/drivers/net/ethernet/xilinx/Kconfig
+++ b/drivers/net/ethernet/xilinx/Kconfig
@@ -27,7 +27,7 @@ config XILINX_EMACLITE
 
 config XILINX_AXI_EMAC
         tristate "Xilinx 10/100/1000 AXI Ethernet support"
-        depends on (PPC32 || MICROBLAZE)
+        depends on MICROBLAZE
         select PHYLIB
         ---help---
           This driver supports the 10/100/1000 Ethernet from Xilinx for the
diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
index d9f69b82cc4f..6f47100e58d7 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
@@ -1590,7 +1590,7 @@ static int axienet_of_probe(struct platform_device *op)
         lp->rx_irq = irq_of_parse_and_map(np, 1);
         lp->tx_irq = irq_of_parse_and_map(np, 0);
         of_node_put(np);
-        if ((lp->rx_irq == NO_IRQ) || (lp->tx_irq == NO_IRQ)) {
+        if ((lp->rx_irq <= 0) || (lp->tx_irq <= 0)) {
                 dev_err(&op->dev, "could not determine irqs\n");
                 ret = -ENOMEM;
                 goto err_iounmap_2;
diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h
index 5fd6f4674326..e6fe0d80d612 100644
--- a/drivers/net/hyperv/hyperv_net.h
+++ b/drivers/net/hyperv/hyperv_net.h
@@ -84,7 +84,7 @@ struct hv_netvsc_packet {
 };
 
 struct netvsc_device_info {
-        unsigned char mac_adr[6];
+        unsigned char mac_adr[ETH_ALEN];
         bool link_state;        /* 0 - link up, 1 - link down */
         int  ring_size;
 };
diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
index f825a629a699..8264f0ef7692 100644
--- a/drivers/net/hyperv/netvsc_drv.c
+++ b/drivers/net/hyperv/netvsc_drv.c
@@ -349,7 +349,7 @@ static int netvsc_set_mac_addr(struct net_device *ndev, void *p)
         struct net_device_context *ndevctx = netdev_priv(ndev);
         struct hv_device *hdev =  ndevctx->device_ctx;
         struct sockaddr *addr = p;
-        char save_adr[14];
+        char save_adr[ETH_ALEN];
         unsigned char save_aatype;
         int err;
 
diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c
index 81f8f9e31db5..fcbf680c3e62 100644
--- a/drivers/net/loopback.c
+++ b/drivers/net/loopback.c
@@ -77,6 +77,11 @@ static netdev_tx_t loopback_xmit(struct sk_buff *skb,
 
         skb_orphan(skb);
 
+        /* Before queueing this packet to netif_rx(),
+         * make sure dst is refcounted.
+         */
+        skb_dst_force(skb);
+
         skb->protocol = eth_type_trans(skb, dev);
 
         /* it's OK to use per_cpu_ptr() because BHs are off */
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 68a43fe602e7..d3fb97d97cbc 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -822,7 +822,10 @@ static int macvlan_changelink(struct net_device *dev,
 
 static size_t macvlan_get_size(const struct net_device *dev)
 {
-        return nla_total_size(4);
+        return (0
+                + nla_total_size(4) /* IFLA_MACVLAN_MODE */
+                + nla_total_size(2) /* IFLA_MACVLAN_FLAGS */
+                );
 }
 
 static int macvlan_fill_info(struct sk_buff *skb,
diff --git a/drivers/net/phy/icplus.c b/drivers/net/phy/icplus.c
index d5199cb4caec..b5ddd5077a80 100644
--- a/drivers/net/phy/icplus.c
+++ b/drivers/net/phy/icplus.c
@@ -36,8 +36,9 @@ MODULE_LICENSE("GPL");
 
 /* IP101A/G - IP1001 */
 #define IP10XX_SPEC_CTRL_STATUS         16      /* Spec. Control Register */
+#define IP1001_RXPHASE_SEL              (1<<0)  /* Add delay on RX_CLK */
+#define IP1001_TXPHASE_SEL              (1<<1)  /* Add delay on TX_CLK */
 #define IP1001_SPEC_CTRL_STATUS_2       20      /* IP1001 Spec. Control Reg 2 */
-#define IP1001_PHASE_SEL_MASK           3       /* IP1001 RX/TXPHASE_SEL */
 #define IP1001_APS_ON                   11      /* IP1001 APS Mode  bit */
 #define IP101A_G_APS_ON                 2       /* IP101A/G APS Mode bit */
 #define IP101A_G_IRQ_CONF_STATUS        0x11    /* Conf Info IRQ & Status Reg */
@@ -138,19 +139,24 @@ static int ip1001_config_init(struct phy_device *phydev)
         if (c < 0)
                 return c;
 
-        /* INTR pin used: speed/link/duplex will cause an interrupt */
-        c = phy_write(phydev, IP101A_G_IRQ_CONF_STATUS, IP101A_G_IRQ_DEFAULT);
-        if (c < 0)
-                return c;
+        if ((phydev->interface == PHY_INTERFACE_MODE_RGMII) ||
+            (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID) ||
+            (phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID) ||
+            (phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID)) {
 
-        if (phydev->interface == PHY_INTERFACE_MODE_RGMII) {
-                /* Additional delay (2ns) used to adjust RX clock phase
-                 * at RGMII interface */
                 c = phy_read(phydev, IP10XX_SPEC_CTRL_STATUS);
                 if (c < 0)
                         return c;
 
-                c |= IP1001_PHASE_SEL_MASK;
+                c &= ~(IP1001_RXPHASE_SEL | IP1001_TXPHASE_SEL);
+
+                if (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID)
+                        c |= (IP1001_RXPHASE_SEL | IP1001_TXPHASE_SEL);
+                else if (phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID)
+                        c |= IP1001_RXPHASE_SEL;
+                else if (phydev->interface == PHY_INTERFACE_MODE_RGMII_TXID)
+                        c |= IP1001_TXPHASE_SEL;
+
                 c = phy_write(phydev, IP10XX_SPEC_CTRL_STATUS, c);
                 if (c < 0)
                         return c;
@@ -167,6 +173,11 @@ static int ip101a_g_config_init(struct phy_device *phydev)
         if (c < 0)
                 return c;
 
+        /* INTR pin used: speed/link/duplex will cause an interrupt */
+        c = phy_write(phydev, IP101A_G_IRQ_CONF_STATUS, IP101A_G_IRQ_DEFAULT);
+        if (c < 0)
+                return c;
+
         /* Enable Auto Power Saving mode */
         c = phy_read(phydev, IP10XX_SPEC_CTRL_STATUS);
         c |= IP101A_G_APS_ON;
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 5d2a3f215887..22dec9c7ef05 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -353,15 +353,6 @@ static int m88e1111_config_init(struct phy_device *phydev)
         int err;
         int temp;
 
-        /* Enable Fiber/Copper auto selection */
-        temp = phy_read(phydev, MII_M1111_PHY_EXT_SR);
-        temp &= ~MII_M1111_HWCFG_FIBER_COPPER_AUTO;
-        phy_write(phydev, MII_M1111_PHY_EXT_SR, temp);
-
-        temp = phy_read(phydev, MII_BMCR);
-        temp |= BMCR_RESET;
-        phy_write(phydev, MII_BMCR, temp);
-
         if ((phydev->interface == PHY_INTERFACE_MODE_RGMII) ||
             (phydev->interface == PHY_INTERFACE_MODE_RGMII_ID) ||
             (phydev->interface == PHY_INTERFACE_MODE_RGMII_RXID) ||
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index fbd106edbe59..2917a86f4c43 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -109,11 +109,11 @@ struct tap_filter {
         unsigned char   addr[FLT_EXACT_COUNT][ETH_ALEN];
 };
 
-/* 1024 is probably a high enough limit: modern hypervisors seem to support on
- * the order of 100-200 CPUs so this leaves us some breathing space if we want
- * to match a queue per guest CPU.
- */
-#define MAX_TAP_QUEUES 1024
+/* DEFAULT_MAX_NUM_RSS_QUEUES were choosed to let the rx/tx queues allocated for
+ * the netdevice to be fit in one page. So we can make sure the success of
+ * memory allocation. TODO: increase the limit. */
+#define MAX_TAP_QUEUES DEFAULT_MAX_NUM_RSS_QUEUES
+#define MAX_TAP_FLOWS  4096
 
 #define TUN_FLOW_EXPIRE (3 * HZ)
 
@@ -185,6 +185,8 @@ struct tun_struct {
         unsigned long ageing_time;
         unsigned int numdisabled;
         struct list_head disabled;
+        void *security;
+        u32 flow_count;
 };
 
 static inline u32 tun_hashfn(u32 rxhash)
@@ -218,6 +220,7 @@ static struct tun_flow_entry *tun_flow_create(struct tun_struct *tun,
                 e->queue_index = queue_index;
                 e->tun = tun;
                 hlist_add_head_rcu(&e->hash_link, head);
+                ++tun->flow_count;
         }
         return e;
 }
@@ -228,6 +231,7 @@ static void tun_flow_delete(struct tun_struct *tun, struct tun_flow_entry *e)
                   e->rxhash, e->queue_index);
         hlist_del_rcu(&e->hash_link);
         kfree_rcu(e, rcu);
+        --tun->flow_count;
 }
 
 static void tun_flow_flush(struct tun_struct *tun)
@@ -294,11 +298,12 @@ static void tun_flow_cleanup(unsigned long data)
 }
 
 static void tun_flow_update(struct tun_struct *tun, u32 rxhash,
-                            u16 queue_index)
+                            struct tun_file *tfile)
 {
         struct hlist_head *head;
         struct tun_flow_entry *e;
         unsigned long delay = tun->ageing_time;
+        u16 queue_index = tfile->queue_index;
 
         if (!rxhash)
                 return;
@@ -307,7 +312,9 @@ static void tun_flow_update(struct tun_struct *tun, u32 rxhash,
 
         rcu_read_lock();
 
-        if (tun->numqueues == 1)
+        /* We may get a very small possibility of OOO during switching, not
+         * worth to optimize.*/
+        if (tun->numqueues == 1 || tfile->detached)
                 goto unlock;
 
         e = tun_flow_find(head, rxhash);
@@ -317,7 +324,8 @@ static void tun_flow_update(struct tun_struct *tun, u32 rxhash,
                 e->updated = jiffies;
         } else {
                 spin_lock_bh(&tun->lock);
-                if (!tun_flow_find(head, rxhash))
+                if (!tun_flow_find(head, rxhash) &&
+                    tun->flow_count < MAX_TAP_FLOWS)
                         tun_flow_create(tun, head, rxhash, queue_index);
 
                 if (!timer_pending(&tun->flow_gc_timer))
@@ -404,24 +412,23 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
         struct tun_struct *tun;
         struct net_device *dev;
 
-        tun = rcu_dereference_protected(tfile->tun,
-                                        lockdep_rtnl_is_held());
-        if (tun) {
+        tun = rtnl_dereference(tfile->tun);
+
+        if (tun && !tfile->detached) {
                 u16 index = tfile->queue_index;
                 BUG_ON(index >= tun->numqueues);
                 dev = tun->dev;
 
                 rcu_assign_pointer(tun->tfiles[index],
                                    tun->tfiles[tun->numqueues - 1]);
-                rcu_assign_pointer(tfile->tun, NULL);
-                ntfile = rcu_dereference_protected(tun->tfiles[index],
-                                                   lockdep_rtnl_is_held());
+                ntfile = rtnl_dereference(tun->tfiles[index]);
                 ntfile->queue_index = index;
 
                 --tun->numqueues;
-                if (clean)
+                if (clean) {
+                        rcu_assign_pointer(tfile->tun, NULL);
                         sock_put(&tfile->sk);
-                else
+                } else
                         tun_disable_queue(tun, tfile);
 
                 synchronize_net();
@@ -429,14 +436,19 @@ static void __tun_detach(struct tun_file *tfile, bool clean)
                 /* Drop read queue */
                 skb_queue_purge(&tfile->sk.sk_receive_queue);
                 tun_set_real_num_queues(tun);
-        } else if (tfile->detached && clean)
+        } else if (tfile->detached && clean) {
                 tun = tun_enable_queue(tfile);
+                sock_put(&tfile->sk);
+        }
 
         if (clean) {
-                if (tun && tun->numqueues == 0 && tun->numdisabled == 0 &&
-                    !(tun->flags & TUN_PERSIST))
-                        if (tun->dev->reg_state == NETREG_REGISTERED)
+                if (tun && tun->numqueues == 0 && tun->numdisabled == 0) {
+                        netif_carrier_off(tun->dev);
+
+                        if (!(tun->flags & TUN_PERSIST) &&
+                            tun->dev->reg_state == NETREG_REGISTERED)
                                 unregister_netdevice(tun->dev);
+                }
 
                 BUG_ON(!test_bit(SOCK_EXTERNALLY_ALLOCATED,
                                  &tfile->socket.flags));
@@ -458,19 +470,21 @@ static void tun_detach_all(struct net_device *dev)
         int i, n = tun->numqueues;
 
         for (i = 0; i < n; i++) {
-                tfile = rcu_dereference_protected(tun->tfiles[i],
-                                                  lockdep_rtnl_is_held());
+                tfile = rtnl_dereference(tun->tfiles[i]);
                 BUG_ON(!tfile);
                 wake_up_all(&tfile->wq.wait);
                 rcu_assign_pointer(tfile->tun, NULL);
                 --tun->numqueues;
         }
+        list_for_each_entry(tfile, &tun->disabled, next) {
+                wake_up_all(&tfile->wq.wait);
+                rcu_assign_pointer(tfile->tun, NULL);
+        }
         BUG_ON(tun->numqueues != 0);
 
         synchronize_net();
         for (i = 0; i < n; i++) {
-                tfile = rcu_dereference_protected(tun->tfiles[i],
-                                                  lockdep_rtnl_is_held());
+                tfile = rtnl_dereference(tun->tfiles[i]);
                 /* Drop read queue */
                 skb_queue_purge(&tfile->sk.sk_receive_queue);
                 sock_put(&tfile->sk);
@@ -481,6 +495,9 @@ static void tun_detach_all(struct net_device *dev)
                 sock_put(&tfile->sk);
         }
         BUG_ON(tun->numdisabled != 0);
+
+        if (tun->flags & TUN_PERSIST)
+                module_put(THIS_MODULE);
 }
 
 static int tun_attach(struct tun_struct *tun, struct file *file)
@@ -488,8 +505,12 @@ static int tun_attach(struct tun_struct *tun, struct file *file)
         struct tun_file *tfile = file->private_data;
         int err;
 
+        err = security_tun_dev_attach(tfile->socket.sk, tun->security);
+        if (err < 0)
+                goto out;
+
         err = -EINVAL;
-        if (rcu_dereference_protected(tfile->tun, lockdep_rtnl_is_held()))
+        if (rtnl_dereference(tfile->tun) && !tfile->detached)
                 goto out;
 
         err = -EBUSY;
@@ -1188,7 +1209,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
         tun->dev->stats.rx_packets++;
         tun->dev->stats.rx_bytes += len;
 
-        tun_flow_update(tun, rxhash, tfile->queue_index);
+        tun_flow_update(tun, rxhash, tfile);
         return total_len;
 }
 
@@ -1371,6 +1392,7 @@ static void tun_free_netdev(struct net_device *dev)
 
         BUG_ON(!(list_empty(&tun->disabled)));
         tun_flow_uninit(tun);
+        security_tun_dev_free_security(tun->security);
         free_netdev(dev);
 }
 
@@ -1544,6 +1566,9 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
         struct net_device *dev;
         int err;
 
+        if (tfile->detached)
+                return -EINVAL;
+
         dev = __dev_get_by_name(net, ifr->ifr_name);
         if (dev) {
                 if (ifr->ifr_flags & IFF_TUN_EXCL)
@@ -1557,7 +1582,7 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
 
                 if (tun_not_capable(tun))
                         return -EPERM;
-                err = security_tun_dev_attach(tfile->socket.sk);
+                err = security_tun_dev_open(tun->security);
                 if (err < 0)
                         return err;
 
@@ -1572,6 +1597,8 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
         else {
                 char *name;
                 unsigned long flags = 0;
+                int queues = ifr->ifr_flags & IFF_MULTI_QUEUE ?
+                             MAX_TAP_QUEUES : 1;
 
                 if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
                         return -EPERM;
@@ -1595,8 +1622,8 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
                         name = ifr->ifr_name;
 
                 dev = alloc_netdev_mqs(sizeof(struct tun_struct), name,
-                                       tun_setup,
-                                       MAX_TAP_QUEUES, MAX_TAP_QUEUES);
+                                       tun_setup, queues, queues);
+
                 if (!dev)
                         return -ENOMEM;
 
@@ -1614,7 +1641,9 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
 
                 spin_lock_init(&tun->lock);
 
-                security_tun_dev_post_create(&tfile->sk);
+                err = security_tun_dev_alloc_security(&tun->security);
+                if (err < 0)
+                        goto err_free_dev;
 
                 tun_net_init(dev);
 
@@ -1639,10 +1668,10 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
                     device_create_file(&tun->dev->dev, &dev_attr_owner) ||
                     device_create_file(&tun->dev->dev, &dev_attr_group))
                         pr_err("Failed to create tun sysfs files\n");
-
-                netif_carrier_on(tun->dev);
         }
 
+        netif_carrier_on(tun->dev);
+
         tun_debug(KERN_INFO, tun, "tun_set_iff\n");
 
         if (ifr->ifr_flags & IFF_NO_PI)
@@ -1738,8 +1767,7 @@ static void tun_detach_filter(struct tun_struct *tun, int n)
         struct tun_file *tfile;
 
         for (i = 0; i < n; i++) {
-                tfile = rcu_dereference_protected(tun->tfiles[i],
-                                                  lockdep_rtnl_is_held());
+                tfile = rtnl_dereference(tun->tfiles[i]);
                 sk_detach_filter(tfile->socket.sk);
         }
 
@@ -1752,8 +1780,7 @@ static int tun_attach_filter(struct tun_struct *tun)
         struct tun_file *tfile;
 
         for (i = 0; i < tun->numqueues; i++) {
-                tfile = rcu_dereference_protected(tun->tfiles[i],
-                                                  lockdep_rtnl_is_held());
+                tfile = rtnl_dereference(tun->tfiles[i]);
                 ret = sk_attach_filter(&tun->fprog, tfile->socket.sk);
                 if (ret) {
                         tun_detach_filter(tun, i);
@@ -1771,8 +1798,7 @@ static void tun_set_sndbuf(struct tun_struct *tun)
         int i;
 
         for (i = 0; i < tun->numqueues; i++) {
-                tfile = rcu_dereference_protected(tun->tfiles[i],
-                                                lockdep_rtnl_is_held());
+                tfile = rtnl_dereference(tun->tfiles[i]);
                 tfile->socket.sk->sk_sndbuf = tun->sndbuf;
         }
 }
@@ -1787,22 +1813,24 @@ static int tun_set_queue(struct file *file, struct ifreq *ifr)
 
         if (ifr->ifr_flags & IFF_ATTACH_QUEUE) {
                 tun = tfile->detached;
-                if (!tun)
+                if (!tun) {
                         ret = -EINVAL;
-                else if (tun_not_capable(tun))
-                        ret = -EPERM;
-                else
-                        ret = tun_attach(tun, file);
+                        goto unlock;
+                }
+                ret = security_tun_dev_attach_queue(tun->security);
+                if (ret < 0)
+                        goto unlock;
+                ret = tun_attach(tun, file);
         } else if (ifr->ifr_flags & IFF_DETACH_QUEUE) {
-                tun = rcu_dereference_protected(tfile->tun,
-                                                lockdep_rtnl_is_held());
-                if (!tun || !(tun->flags & TUN_TAP_MQ))
+                tun = rtnl_dereference(tfile->tun);
+                if (!tun || !(tun->flags & TUN_TAP_MQ) || tfile->detached)
                         ret = -EINVAL;
                 else
                         __tun_detach(tfile, false);
         } else
                 ret = -EINVAL;
 
+unlock:
         rtnl_unlock();
         return ret;
 }
@@ -1880,10 +1908,11 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
                 /* Disable/Enable persist mode. Keep an extra reference to the
                  * module to prevent the module being unprobed.
                  */
-                if (arg) {
+                if (arg && !(tun->flags & TUN_PERSIST)) {
                         tun->flags |= TUN_PERSIST;
                         __module_get(THIS_MODULE);
-                } else {
+                }
+                if (!arg && (tun->flags & TUN_PERSIST)) {
                         tun->flags &= ~TUN_PERSIST;
                         module_put(THIS_MODULE);
                 }
diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
index 42f51c71ec1f..248d2dc765a5 100644
--- a/drivers/net/usb/cdc_mbim.c
+++ b/drivers/net/usb/cdc_mbim.c
@@ -374,6 +374,21 @@ static const struct driver_info cdc_mbim_info = {
         .tx_fixup = cdc_mbim_tx_fixup,
 };
 
+/* MBIM and NCM devices should not need a ZLP after NTBs with
+ * dwNtbOutMaxSize length. This driver_info is for the exceptional
+ * devices requiring it anyway, allowing them to be supported without
+ * forcing the performance penalty on all the sane devices.
+ */
+static const struct driver_info cdc_mbim_info_zlp = {
+        .description = "CDC MBIM",
+        .flags = FLAG_NO_SETINT | FLAG_MULTI_PACKET | FLAG_WWAN | FLAG_SEND_ZLP,
+        .bind = cdc_mbim_bind,
+        .unbind = cdc_mbim_unbind,
+        .manage_power = cdc_mbim_manage_power,
+        .rx_fixup = cdc_mbim_rx_fixup,
+        .tx_fixup = cdc_mbim_tx_fixup,
+};
+
 static const struct usb_device_id mbim_devs[] = {
         /* This duplicate NCM entry is intentional. MBIM devices can
          * be disguised as NCM by default, and this is necessary to
@@ -385,6 +400,10 @@ static const struct usb_device_id mbim_devs[] = {
         { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_NCM, USB_CDC_PROTO_NONE),
           .driver_info = (unsigned long)&cdc_mbim_info,
         },
+        /* Sierra Wireless MC7710 need ZLPs */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x68a2, USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
+          .driver_info = (unsigned long)&cdc_mbim_info_zlp,
+        },
         { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MBIM, USB_CDC_PROTO_NONE),
           .driver_info = (unsigned long)&cdc_mbim_info,
         },
diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
index 71b6e92b8e9b..00d3b2d37828 100644
--- a/drivers/net/usb/cdc_ncm.c
+++ b/drivers/net/usb/cdc_ncm.c
@@ -435,6 +435,13 @@ advance:
                 len -= temp;
         }
 
+        /* some buggy devices have an IAD but no CDC Union */
+        if (!ctx->union_desc && intf->intf_assoc && intf->intf_assoc->bInterfaceCount == 2) {
+                ctx->control = intf;
+                ctx->data = usb_ifnum_to_if(dev->udev, intf->cur_altsetting->desc.bInterfaceNumber + 1);
+                dev_dbg(&intf->dev, "CDC Union missing - got slave from IAD\n");
+        }
+
         /* check if we got everything */
         if ((ctx->control == NULL) || (ctx->data == NULL) ||
             ((!ctx->mbim_desc) && ((ctx->ether_desc == NULL) || (ctx->control != intf))))
@@ -497,7 +504,8 @@ advance:
 error2:
         usb_set_intfdata(ctx->control, NULL);
         usb_set_intfdata(ctx->data, NULL);
-        usb_driver_release_interface(driver, ctx->data);
+        if (ctx->data != ctx->control)
+                usb_driver_release_interface(driver, ctx->data);
 error:
         cdc_ncm_free((struct cdc_ncm_ctx *)dev->data[0]);
         dev->data[0] = 0;
@@ -1155,6 +1163,20 @@ static const struct driver_info wwan_info = {
         .tx_fixup = cdc_ncm_tx_fixup,
 };
 
+/* Same as wwan_info, but with FLAG_NOARP  */
+static const struct driver_info wwan_noarp_info = {
+        .description = "Mobile Broadband Network Device (NO ARP)",
+        .flags = FLAG_POINTTOPOINT | FLAG_NO_SETINT | FLAG_MULTI_PACKET
+                        | FLAG_WWAN | FLAG_NOARP,
+        .bind = cdc_ncm_bind,
+        .unbind = cdc_ncm_unbind,
+        .check_connect = cdc_ncm_check_connect,
+        .manage_power = usbnet_manage_power,
+        .status = cdc_ncm_status,
+        .rx_fixup = cdc_ncm_rx_fixup,
+        .tx_fixup = cdc_ncm_tx_fixup,
+};
+
 static const struct usb_device_id cdc_devs[] = {
         /* Ericsson MBM devices like F5521gw */
         { .match_flags = USB_DEVICE_ID_MATCH_INT_INFO
@@ -1193,6 +1215,16 @@ static const struct usb_device_id cdc_devs[] = {
         { USB_VENDOR_AND_INTERFACE_INFO(0x12d1, 0xff, 0x02, 0x46),
           .driver_info = (unsigned long)&wwan_info,
         },
+        { USB_VENDOR_AND_INTERFACE_INFO(0x12d1, 0xff, 0x02, 0x76),
+          .driver_info = (unsigned long)&wwan_info,
+        },
+
+        /* Infineon(now Intel) HSPA Modem platform */
+        { USB_DEVICE_AND_INTERFACE_INFO(0x1519, 0x0443,
+                USB_CLASS_COMM,
+                USB_CDC_SUBCLASS_NCM, USB_CDC_PROTO_NONE),
+          .driver_info = (unsigned long)&wwan_noarp_info,
+        },
 
         /* Generic CDC-NCM devices */
         { USB_INTERFACE_INFO(USB_CLASS_COMM,
diff --git a/drivers/net/usb/dm9601.c b/drivers/net/usb/dm9601.c
index 3f554c1149f3..d7e99445518e 100644
--- a/drivers/net/usb/dm9601.c
+++ b/drivers/net/usb/dm9601.c
@@ -45,6 +45,12 @@
 #define DM_MCAST_ADDR   0x16    /* 8 bytes */
 #define DM_GPR_CTRL     0x1e
 #define DM_GPR_DATA     0x1f
+#define DM_CHIP_ID      0x2c
+#define DM_MODE_CTRL    0x91    /* only on dm9620 */
+
+/* chip id values */
+#define ID_DM9601       0
+#define ID_DM9620       1
 
 #define DM_MAX_MCAST    64
 #define DM_MCAST_SIZE   8
@@ -53,7 +59,6 @@
 #define DM_RX_OVERHEAD  7       /* 3 byte header + 4 byte crc tail */
 #define DM_TIMEOUT      1000
 
-
 static int dm_read(struct usbnet *dev, u8 reg, u16 length, void *data)
 {
         int err;
@@ -84,32 +89,23 @@ static int dm_write(struct usbnet *dev, u8 reg, u16 length, void *data)
 
 static int dm_write_reg(struct usbnet *dev, u8 reg, u8 value)
 {
-        return usbnet_write_cmd(dev, DM_WRITE_REGS,
+        return usbnet_write_cmd(dev, DM_WRITE_REG,
                                 USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
                                 value, reg, NULL, 0);
 }
 
-static void dm_write_async_helper(struct usbnet *dev, u8 reg, u8 value,
-                                  u16 length, void *data)
+static void dm_write_async(struct usbnet *dev, u8 reg, u16 length, void *data)
 {
         usbnet_write_cmd_async(dev, DM_WRITE_REGS,
                                USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
-                               value, reg, data, length);
-}
-
-static void dm_write_async(struct usbnet *dev, u8 reg, u16 length, void *data)
-{
-        netdev_dbg(dev->net, "dm_write_async() reg=0x%02x length=%d\n", reg, length);
-
-        dm_write_async_helper(dev, reg, 0, length, data);
+                               0, reg, data, length);
 }
 
 static void dm_write_reg_async(struct usbnet *dev, u8 reg, u8 value)
 {
-        netdev_dbg(dev->net, "dm_write_reg_async() reg=0x%02x value=0x%02x\n",
-                   reg, value);
-
-        dm_write_async_helper(dev, reg, value, 0, NULL);
+        usbnet_write_cmd_async(dev, DM_WRITE_REG,
+                               USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
+                               value, reg, NULL, 0);
 }
 
 static int dm_read_shared_word(struct usbnet *dev, int phy, u8 reg, __le16 *value)
@@ -358,7 +354,7 @@ static const struct net_device_ops dm9601_netdev_ops = {
 static int dm9601_bind(struct usbnet *dev, struct usb_interface *intf)
 {
         int ret;
-        u8 mac[ETH_ALEN];
+        u8 mac[ETH_ALEN], id;
 
         ret = usbnet_get_endpoints(dev, intf);
         if (ret)
@@ -399,6 +395,24 @@ static int dm9601_bind(struct usbnet *dev, struct usb_interface *intf)
                 __dm9601_set_mac_address(dev);
         }
 
+        if (dm_read_reg(dev, DM_CHIP_ID, &id) < 0) {
+                netdev_err(dev->net, "Error reading chip ID\n");
+                ret = -ENODEV;
+                goto out;
+        }
+
+        /* put dm9620 devices in dm9601 mode */
+        if (id == ID_DM9620) {
+                u8 mode;
+
+                if (dm_read_reg(dev, DM_MODE_CTRL, &mode) < 0) {
+                        netdev_err(dev->net, "Error reading MODE_CTRL\n");
+                        ret = -ENODEV;
+                        goto out;
+                }
+                dm_write_reg(dev, DM_MODE_CTRL, mode & 0x7f);
+        }
+
         /* power up phy */
         dm_write_reg(dev, DM_GPR_CTRL, 1);
         dm_write_reg(dev, DM_GPR_DATA, 0);
@@ -581,6 +595,10 @@ static const struct usb_device_id products[] = {
          USB_DEVICE(0x0a46, 0x9000),    /* DM9000E */
          .driver_info = (unsigned long)&dm9601_info,
          },
+        {
+         USB_DEVICE(0x0a46, 0x9620),    /* DM9620 USB to Fast Ethernet Adapter */
+         .driver_info = (unsigned long)&dm9601_info,
+         },
         {},                     // END
 };
 
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 6a1ca500e612..19d903598b0d 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -351,6 +351,10 @@ static const struct usb_device_id products[] = {
                 USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 1, 57),
                 .driver_info        = (unsigned long)&qmi_wwan_info,
         },
+        {       /* HUAWEI_INTERFACE_NDIS_CONTROL_QUALCOMM */
+                USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 0x01, 0x69),
+                .driver_info        = (unsigned long)&qmi_wwan_info,
+        },
 
         /* 2. Combined interface devices matching on class+protocol */
         {       /* Huawei E367 and possibly others in "Windows mode" */
@@ -361,6 +365,14 @@ static const struct usb_device_id products[] = {
                 USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 1, 17),
                 .driver_info        = (unsigned long)&qmi_wwan_info,
         },
+        {       /* HUAWEI_NDIS_SINGLE_INTERFACE_VDF */
+                USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 0x01, 0x37),
+                .driver_info        = (unsigned long)&qmi_wwan_info,
+        },
+        {       /* HUAWEI_INTERFACE_NDIS_HW_QUALCOMM */
+                USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 0x01, 0x67),
+                .driver_info        = (unsigned long)&qmi_wwan_info,
+        },
         {       /* Pantech UML290, P4200 and more */
                 USB_VENDOR_AND_INTERFACE_INFO(0x106c, USB_CLASS_VENDOR_SPEC, 0xf0, 0xff),
                 .driver_info        = (unsigned long)&qmi_wwan_info,
@@ -399,6 +411,7 @@ static const struct usb_device_id products[] = {
         },
 
         /* 3. Combined interface devices matching on interface number */
+        {QMI_FIXED_INTF(0x0408, 0xea42, 4)},    /* Yota / Megafon M100-1 */
         {QMI_FIXED_INTF(0x12d1, 0x140c, 1)},    /* Huawei E173 */
         {QMI_FIXED_INTF(0x19d2, 0x0002, 1)},
         {QMI_FIXED_INTF(0x19d2, 0x0012, 1)},
@@ -433,6 +446,7 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x19d2, 0x0199, 1)},    /* ZTE MF820S */
         {QMI_FIXED_INTF(0x19d2, 0x0200, 1)},
         {QMI_FIXED_INTF(0x19d2, 0x0257, 3)},    /* ZTE MF821 */
+        {QMI_FIXED_INTF(0x19d2, 0x0265, 4)},    /* ONDA MT8205 4G LTE */
         {QMI_FIXED_INTF(0x19d2, 0x0284, 4)},    /* ZTE MF880 */
         {QMI_FIXED_INTF(0x19d2, 0x0326, 4)},    /* ZTE MF821D */
         {QMI_FIXED_INTF(0x19d2, 0x1008, 4)},    /* ZTE (Vodafone) K3570-Z */
@@ -459,6 +473,8 @@ static const struct usb_device_id products[] = {
         {QMI_FIXED_INTF(0x1199, 0x68a2, 19)},   /* Sierra Wireless MC7710 in QMI mode */
         {QMI_FIXED_INTF(0x1199, 0x901c, 8)},    /* Sierra Wireless EM7700 */
         {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)},    /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
+        {QMI_FIXED_INTF(0x2357, 0x0201, 4)},    /* TP-LINK HSUPA Modem MA180 */
+        {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},    /* Telit LE920 */
 
         /* 4. Gobi 1000 devices */
         {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},    /* Acer Gobi Modem Device */
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 3d4bf01641b4..5e33606c1366 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -380,6 +380,12 @@ static int rx_submit (struct usbnet *dev, struct urb *urb, gfp_t flags)
         unsigned long           lockflags;
         size_t                  size = dev->rx_urb_size;
 
+        /* prevent rx skb allocation when error ratio is high */
+        if (test_bit(EVENT_RX_KILL, &dev->flags)) {
+                usb_free_urb(urb);
+                return -ENOLINK;
+        }
+
         skb = __netdev_alloc_skb_ip_align(dev->net, size, flags);
         if (!skb) {
                 netif_dbg(dev, rx_err, dev->net, "no rx skb\n");
@@ -539,6 +545,17 @@ block:
                 break;
         }
 
+        /* stop rx if packet error rate is high */
+        if (++dev->pkt_cnt > 30) {
+                dev->pkt_cnt = 0;
+                dev->pkt_err = 0;
+        } else {
+                if (state == rx_cleanup)
+                        dev->pkt_err++;
+                if (dev->pkt_err > 20)
+                        set_bit(EVENT_RX_KILL, &dev->flags);
+        }
+
         state = defer_bh(dev, skb, &dev->rxq, state);
 
         if (urb) {
@@ -791,6 +808,11 @@ int usbnet_open (struct net_device *net)
                    (dev->driver_info->flags & FLAG_FRAMING_AX) ? "ASIX" :
                    "simple");
 
+        /* reset rx error state */
+        dev->pkt_cnt = 0;
+        dev->pkt_err = 0;
+        clear_bit(EVENT_RX_KILL, &dev->flags);
+
         // delay posting reads until we're fully open
         tasklet_schedule (&dev->bh);
         if (info->manage_power) {
@@ -1103,13 +1125,11 @@ netdev_tx_t usbnet_start_xmit (struct sk_buff *skb,
         if (info->tx_fixup) {
                 skb = info->tx_fixup (dev, skb, GFP_ATOMIC);
                 if (!skb) {
-                        if (netif_msg_tx_err(dev)) {
-                                netif_dbg(dev, tx_err, dev->net, "can't tx_fixup skb\n");
-                                goto drop;
-                        } else {
-                                /* cdc_ncm collected packet; waits for more */
+                        /* packet collected; minidriver waiting for more */
+                        if (info->flags & FLAG_MULTI_PACKET)
                                 goto not_drop;
-                        }
+                        netif_dbg(dev, tx_err, dev->net, "can't tx_fixup skb\n");
+                        goto drop;
                 }
         }
         length = skb->len;
@@ -1254,6 +1274,9 @@ static void usbnet_bh (unsigned long param)
                 }
         }
 
+        /* restart RX again after disabling due to high error rate */
+        clear_bit(EVENT_RX_KILL, &dev->flags);
+
         // waiting for all pending urbs to complete?
         if (dev->wait) {
                 if ((dev->txq.qlen + dev->rxq.qlen + dev->done.qlen) == 0) {
@@ -1448,6 +1471,10 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
                 if ((dev->driver_info->flags & FLAG_WWAN) != 0)
                         strcpy(net->name, "wwan%d");
 
+                /* devices that cannot do ARP */
+                if ((dev->driver_info->flags & FLAG_NOARP) != 0)
+                        net->flags |= IFF_NOARP;
+
                 /* maybe the remote can't receive an Ethernet MTU */
                 if (net->mtu > (dev->hard_mtu - net->hard_header_len))
                         net->mtu = dev->hard_mtu - net->hard_header_len;
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index a6fcf15adc4f..35c00c5ea02a 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -26,6 +26,7 @@
 #include <linux/scatterlist.h>
 #include <linux/if_vlan.h>
 #include <linux/slab.h>
+#include <linux/cpu.h>
 
 static int napi_weight = 128;
 module_param(napi_weight, int, 0444);
@@ -123,6 +124,12 @@ struct virtnet_info {
 
         /* Does the affinity hint is set for virtqueues? */
         bool affinity_hint_set;
+
+        /* Per-cpu variable to show the mapping from CPU to virtqueue */
+        int __percpu *vq_index;
+
+        /* CPU hot plug notifier */
+        struct notifier_block nb;
 };
 
 struct skb_vnet_hdr {
@@ -1013,32 +1020,75 @@ static int virtnet_vlan_rx_kill_vid(struct net_device *dev, u16 vid)
         return 0;
 }
 
-static void virtnet_set_affinity(struct virtnet_info *vi, bool set)
+static void virtnet_clean_affinity(struct virtnet_info *vi, long hcpu)
 {
         int i;
+        int cpu;
+
+        if (vi->affinity_hint_set) {
+                for (i = 0; i < vi->max_queue_pairs; i++) {
+                        virtqueue_set_affinity(vi->rq[i].vq, -1);
+                        virtqueue_set_affinity(vi->sq[i].vq, -1);
+                }
+
+                vi->affinity_hint_set = false;
+        }
+
+        i = 0;
+        for_each_online_cpu(cpu) {
+                if (cpu == hcpu) {
+                        *per_cpu_ptr(vi->vq_index, cpu) = -1;
+                } else {
+                        *per_cpu_ptr(vi->vq_index, cpu) =
+                                ++i % vi->curr_queue_pairs;
+                }
+        }
+}
+
+static void virtnet_set_affinity(struct virtnet_info *vi)
+{
+        int i;
+        int cpu;
 
         /* In multiqueue mode, when the number of cpu is equal to the number of
          * queue pairs, we let the queue pairs to be private to one cpu by
          * setting the affinity hint to eliminate the contention.
          */
-        if ((vi->curr_queue_pairs == 1 ||
-             vi->max_queue_pairs != num_online_cpus()) && set) {
-                if (vi->affinity_hint_set)
-                        set = false;
-                else
-                        return;
+        if (vi->curr_queue_pairs == 1 ||
+            vi->max_queue_pairs != num_online_cpus()) {
+                virtnet_clean_affinity(vi, -1);
+                return;
         }
 
-        for (i = 0; i < vi->max_queue_pairs; i++) {
-                int cpu = set ? i : -1;
+        i = 0;
+        for_each_online_cpu(cpu) {
                 virtqueue_set_affinity(vi->rq[i].vq, cpu);
                 virtqueue_set_affinity(vi->sq[i].vq, cpu);
+                *per_cpu_ptr(vi->vq_index, cpu) = i;
+                i++;
         }
 
-        if (set)
-                vi->affinity_hint_set = true;
-        else
-                vi->affinity_hint_set = false;
+        vi->affinity_hint_set = true;
+}
+
+static int virtnet_cpu_callback(struct notifier_block *nfb,
+                                unsigned long action, void *hcpu)
+{
+        struct virtnet_info *vi = container_of(nfb, struct virtnet_info, nb);
+
+        switch(action & ~CPU_TASKS_FROZEN) {
+        case CPU_ONLINE:
+        case CPU_DOWN_FAILED:
+        case CPU_DEAD:
+                virtnet_set_affinity(vi);
+                break;
+        case CPU_DOWN_PREPARE:
+                virtnet_clean_affinity(vi, (long)hcpu);
+                break;
+        default:
+                break;
+        }
+        return NOTIFY_OK;
 }
 
 static void virtnet_get_ringparam(struct net_device *dev,
@@ -1082,13 +1132,15 @@ static int virtnet_set_channels(struct net_device *dev,
         if (queue_pairs > vi->max_queue_pairs)
                 return -EINVAL;
 
+        get_online_cpus();
         err = virtnet_set_queues(vi, queue_pairs);
         if (!err) {
                 netif_set_real_num_tx_queues(dev, queue_pairs);
                 netif_set_real_num_rx_queues(dev, queue_pairs);
 
-                virtnet_set_affinity(vi, true);
+                virtnet_set_affinity(vi);
         }
+        put_online_cpus();
 
         return err;
 }
@@ -1127,12 +1179,19 @@ static int virtnet_change_mtu(struct net_device *dev, int new_mtu)
 
 /* To avoid contending a lock hold by a vcpu who would exit to host, select the
  * txq based on the processor id.
- * TODO: handle cpu hotplug.
  */
 static u16 virtnet_select_queue(struct net_device *dev, struct sk_buff *skb)
 {
-        int txq = skb_rx_queue_recorded(skb) ? skb_get_rx_queue(skb) :
-                  smp_processor_id();
+        int txq;
+        struct virtnet_info *vi = netdev_priv(dev);
+
+        if (skb_rx_queue_recorded(skb)) {
+                txq = skb_get_rx_queue(skb);
+        } else {
+                txq = *__this_cpu_ptr(vi->vq_index);
+                if (txq == -1)
+                        txq = 0;
+        }
 
         while (unlikely(txq >= dev->real_num_tx_queues))
                 txq -= dev->real_num_tx_queues;
@@ -1248,7 +1307,7 @@ static void virtnet_del_vqs(struct virtnet_info *vi)
 {
         struct virtio_device *vdev = vi->vdev;
 
-        virtnet_set_affinity(vi, false);
+        virtnet_clean_affinity(vi, -1);
 
         vdev->config->del_vqs(vdev);
 
@@ -1371,7 +1430,10 @@ static int init_vqs(struct virtnet_info *vi)
         if (ret)
                 goto err_free;
 
-        virtnet_set_affinity(vi, true);
+        get_online_cpus();
+        virtnet_set_affinity(vi);
+        put_online_cpus();
+
         return 0;
 
 err_free:
@@ -1453,6 +1515,10 @@ static int virtnet_probe(struct virtio_device *vdev)
         if (vi->stats == NULL)
                 goto free;
 
+        vi->vq_index = alloc_percpu(int);
+        if (vi->vq_index == NULL)
+                goto free_stats;
+
         mutex_init(&vi->config_lock);
         vi->config_enable = true;
         INIT_WORK(&vi->config_work, virtnet_config_changed_work);
@@ -1476,7 +1542,7 @@ static int virtnet_probe(struct virtio_device *vdev)
         /* Allocate/initialize the rx/tx queues, and invoke find_vqs */
         err = init_vqs(vi);
         if (err)
-                goto free_stats;
+                goto free_index;
 
         netif_set_real_num_tx_queues(dev, 1);
         netif_set_real_num_rx_queues(dev, 1);
@@ -1499,6 +1565,13 @@ static int virtnet_probe(struct virtio_device *vdev)
                 }
         }
 
+        vi->nb.notifier_call = &virtnet_cpu_callback;
+        err = register_hotcpu_notifier(&vi->nb);
+        if (err) {
+                pr_debug("virtio_net: registering cpu notifier failed\n");
+                goto free_recv_bufs;
+        }
+
         /* Assume link up if device can't report link status,
            otherwise get link status from config. */
         if (virtio_has_feature(vi->vdev, VIRTIO_NET_F_STATUS)) {
@@ -1520,6 +1593,8 @@ free_recv_bufs:
 free_vqs:
         cancel_delayed_work_sync(&vi->refill);
         virtnet_del_vqs(vi);
+free_index:
+        free_percpu(vi->vq_index);
 free_stats:
         free_percpu(vi->stats);
 free:
@@ -1543,6 +1618,8 @@ static void virtnet_remove(struct virtio_device *vdev)
 {
         struct virtnet_info *vi = vdev->priv;
 
+        unregister_hotcpu_notifier(&vi->nb);
+
         /* Prevent config work handler from accessing the device. */
         mutex_lock(&vi->config_lock);
         vi->config_enable = false;
@@ -1554,6 +1631,7 @@ static void virtnet_remove(struct virtio_device *vdev)
 
         flush_work(&vi->config_work);
 
+        free_percpu(vi->vq_index);
         free_percpu(vi->stats);
         free_netdev(vi->dev);
 }
diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
index dc8913c6238c..12c6440d1649 100644
--- a/drivers/net/vmxnet3/vmxnet3_drv.c
+++ b/drivers/net/vmxnet3/vmxnet3_drv.c
@@ -154,8 +154,7 @@ vmxnet3_check_link(struct vmxnet3_adapter *adapter, bool affectTxQueue)
         if (ret & 1) { /* Link is up. */
                 printk(KERN_INFO "%s: NIC Link is Up %d Mbps\n",
                        adapter->netdev->name, adapter->link_speed);
-                if (!netif_carrier_ok(adapter->netdev))
-                        netif_carrier_on(adapter->netdev);
+                netif_carrier_on(adapter->netdev);
 
                 if (affectTxQueue) {
                         for (i = 0; i < adapter->num_tx_queues; i++)
@@ -165,8 +164,7 @@ vmxnet3_check_link(struct vmxnet3_adapter *adapter, bool affectTxQueue)
         } else {
                 printk(KERN_INFO "%s: NIC Link is Down\n",
                        adapter->netdev->name);
-                if (netif_carrier_ok(adapter->netdev))
-                        netif_carrier_off(adapter->netdev);
+                netif_carrier_off(adapter->netdev);
 
                 if (affectTxQueue) {
                         for (i = 0; i < adapter->num_tx_queues; i++)
@@ -3061,6 +3059,7 @@ vmxnet3_probe_device(struct pci_dev *pdev,
         netif_set_real_num_tx_queues(adapter->netdev, adapter->num_tx_queues);
         netif_set_real_num_rx_queues(adapter->netdev, adapter->num_rx_queues);
 
+        netif_carrier_off(netdev);
         err = register_netdev(netdev);
 
         if (err) {
diff --git a/drivers/net/wimax/i2400m/netdev.c b/drivers/net/wimax/i2400m/netdev.c
index 1d76ae855f07..530581ca0191 100644
--- a/drivers/net/wimax/i2400m/netdev.c
+++ b/drivers/net/wimax/i2400m/netdev.c
@@ -156,7 +156,7 @@ void i2400m_wake_tx_work(struct work_struct *ws)
         struct i2400m *i2400m = container_of(ws, struct i2400m, wake_tx_ws);
         struct net_device *net_dev = i2400m->wimax_dev.net_dev;
         struct device *dev = i2400m_dev(i2400m);
-        struct sk_buff *skb = i2400m->wake_tx_skb;
+        struct sk_buff *skb;
         unsigned long flags;
 
         spin_lock_irqsave(&i2400m->tx_lock, flags);
@@ -236,23 +236,26 @@ void i2400m_tx_prep_header(struct sk_buff *skb)
 void i2400m_net_wake_stop(struct i2400m *i2400m)
 {
         struct device *dev = i2400m_dev(i2400m);
+        struct sk_buff *wake_tx_skb;
+        unsigned long flags;
 
         d_fnstart(3, dev, "(i2400m %p)\n", i2400m);
-        /* See i2400m_hard_start_xmit(), references are taken there
-         * and here we release them if the work was still
-         * pending. Note we can't differentiate work not pending vs
-         * never scheduled, so the NULL check does that. */
-        if (cancel_work_sync(&i2400m->wake_tx_ws) == 0
-            && i2400m->wake_tx_skb != NULL) {
-                unsigned long flags;
-                struct sk_buff *wake_tx_skb;
-                spin_lock_irqsave(&i2400m->tx_lock, flags);
-                wake_tx_skb = i2400m->wake_tx_skb;      /* compat help */
-                i2400m->wake_tx_skb = NULL;     /* compat help */
-                spin_unlock_irqrestore(&i2400m->tx_lock, flags);
+        /*
+         * See i2400m_hard_start_xmit(), references are taken there and
+         * here we release them if the packet was still pending.
+         */
+        cancel_work_sync(&i2400m->wake_tx_ws);
+
+        spin_lock_irqsave(&i2400m->tx_lock, flags);
+        wake_tx_skb = i2400m->wake_tx_skb;
+        i2400m->wake_tx_skb = NULL;
+        spin_unlock_irqrestore(&i2400m->tx_lock, flags);
+
+        if (wake_tx_skb) {
                 i2400m_put(i2400m);
                 kfree_skb(wake_tx_skb);
         }
+
         d_fnend(3, dev, "(i2400m %p) = void\n", i2400m);
 }
 
@@ -288,7 +291,7 @@ int i2400m_net_wake_tx(struct i2400m *i2400m, struct net_device *net_dev,
          * and if pending, release those resources. */
         result = 0;
         spin_lock_irqsave(&i2400m->tx_lock, flags);
-        if (!work_pending(&i2400m->wake_tx_ws)) {
+        if (!i2400m->wake_tx_skb) {
                 netif_stop_queue(net_dev);
                 i2400m_get(i2400m);
                 i2400m->wake_tx_skb = skb_get(skb);     /* transfer ref count */
diff --git a/drivers/net/wireless/ath/Kconfig b/drivers/net/wireless/ath/Kconfig
index 1a67a4f829fe..2c02b4e84094 100644
--- a/drivers/net/wireless/ath/Kconfig
+++ b/drivers/net/wireless/ath/Kconfig
@@ -30,5 +30,6 @@ source "drivers/net/wireless/ath/ath9k/Kconfig"
 source "drivers/net/wireless/ath/carl9170/Kconfig"
 source "drivers/net/wireless/ath/ath6kl/Kconfig"
 source "drivers/net/wireless/ath/ar5523/Kconfig"
+source "drivers/net/wireless/ath/wil6210/Kconfig"
 
 endif
diff --git a/drivers/net/wireless/ath/Makefile b/drivers/net/wireless/ath/Makefile
index 1e18621326dc..97b964ded2be 100644
--- a/drivers/net/wireless/ath/Makefile
+++ b/drivers/net/wireless/ath/Makefile
@@ -3,6 +3,7 @@ obj-$(CONFIG_ATH9K_HW)		+= ath9k/
 obj-$(CONFIG_CARL9170)          += carl9170/
 obj-$(CONFIG_ATH6KL)            += ath6kl/
 obj-$(CONFIG_AR5523)            += ar5523/
+obj-$(CONFIG_WIL6210)           += wil6210/
 
 obj-$(CONFIG_ATH_COMMON)        += ath.o
 
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_calib.c b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
index 8b0d8dcd7625..56317b0fb6b6 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_calib.c
@@ -976,6 +976,8 @@ static bool ar9003_hw_init_cal(struct ath_hw *ah,
                                           AR_PHY_CL_TAB_1,
                                           AR_PHY_CL_TAB_2 };
 
+        ar9003_hw_set_chain_masks(ah, ah->caps.rx_chainmask, ah->caps.tx_chainmask);
+
         if (rtt) {
                 if (!ar9003_hw_rtt_restore(ah, chan))
                         run_rtt_cal = true;
diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
index ce19c09fa8e8..3afc24bde6d6 100644
--- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
@@ -586,32 +586,19 @@ static void ar9003_hw_init_bb(struct ath_hw *ah,
         ath9k_hw_synth_delay(ah, chan, synthDelay);
 }
 
-static void ar9003_hw_set_chain_masks(struct ath_hw *ah, u8 rx, u8 tx)
+void ar9003_hw_set_chain_masks(struct ath_hw *ah, u8 rx, u8 tx)
 {
-        switch (rx) {
-        case 0x5:
+        if (ah->caps.tx_chainmask == 5 || ah->caps.rx_chainmask == 5)
                 REG_SET_BIT(ah, AR_PHY_ANALOG_SWAP,
                             AR_PHY_SWAP_ALT_CHAIN);
-        case 0x3:
-        case 0x1:
-        case 0x2:
-        case 0x7:
-                REG_WRITE(ah, AR_PHY_RX_CHAINMASK, rx);
-                REG_WRITE(ah, AR_PHY_CAL_CHAINMASK, rx);
-                break;
-        default:
-                break;
-        }
+
+        REG_WRITE(ah, AR_PHY_RX_CHAINMASK, rx);
+        REG_WRITE(ah, AR_PHY_CAL_CHAINMASK, rx);
 
         if ((ah->caps.hw_caps & ATH9K_HW_CAP_APM) && (tx == 0x7))
-                REG_WRITE(ah, AR_SELFGEN_MASK, 0x3);
-        else
-                REG_WRITE(ah, AR_SELFGEN_MASK, tx);
+                tx = 3;
 
-        if (tx == 0x5) {
-                REG_SET_BIT(ah, AR_PHY_ANALOG_SWAP,
-                            AR_PHY_SWAP_ALT_CHAIN);
-        }
+        REG_WRITE(ah, AR_SELFGEN_MASK, tx);
 }
 
 /*
diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
index 86e26a19efda..42794c546a40 100644
--- a/drivers/net/wireless/ath/ath9k/ath9k.h
+++ b/drivers/net/wireless/ath/ath9k/ath9k.h
@@ -317,7 +317,6 @@ struct ath_rx {
         u32 *rxlink;
         u32 num_pkts;
         unsigned int rxfilter;
-        spinlock_t rxbuflock;
         struct list_head rxbuf;
         struct ath_descdma rxdma;
         struct ath_buf *rx_bufptr;
@@ -328,7 +327,6 @@ struct ath_rx {
 
 int ath_startrecv(struct ath_softc *sc);
 bool ath_stoprecv(struct ath_softc *sc);
-void ath_flushrecv(struct ath_softc *sc);
 u32 ath_calcrxfilter(struct ath_softc *sc);
 int ath_rx_init(struct ath_softc *sc, int nbufs);
 void ath_rx_cleanup(struct ath_softc *sc);
@@ -646,7 +644,6 @@ void ath_ant_comb_update(struct ath_softc *sc);
 enum sc_op_flags {
         SC_OP_INVALID,
         SC_OP_BEACONS,
-        SC_OP_RXFLUSH,
         SC_OP_ANI_RUN,
         SC_OP_PRIM_STA_VIF,
         SC_OP_HW_RESET,
diff --git a/drivers/net/wireless/ath/ath9k/beacon.c b/drivers/net/wireless/ath/ath9k/beacon.c
index 531fffd801a3..2ca355e94da6 100644
--- a/drivers/net/wireless/ath/ath9k/beacon.c
+++ b/drivers/net/wireless/ath/ath9k/beacon.c
@@ -147,6 +147,7 @@ static struct ath_buf *ath9k_beacon_generate(struct ieee80211_hw *hw,
                                  skb->len, DMA_TO_DEVICE);
                 dev_kfree_skb_any(skb);
                 bf->bf_buf_addr = 0;
+                bf->bf_mpdu = NULL;
         }
 
         skb = ieee80211_beacon_get(hw, vif);
@@ -359,7 +360,6 @@ void ath9k_beacon_tasklet(unsigned long data)
                 return;
 
         bf = ath9k_beacon_generate(sc->hw, vif);
-        WARN_ON(!bf);
 
         if (sc->beacon.bmisscnt != 0) {
                 ath_dbg(common, BSTUCK, "resume beacon xmit after %u misses\n",
diff --git a/drivers/net/wireless/ath/ath9k/debug.c b/drivers/net/wireless/ath/ath9k/debug.c
index 13ff9edc2401..e585fc827c50 100644
--- a/drivers/net/wireless/ath/ath9k/debug.c
+++ b/drivers/net/wireless/ath/ath9k/debug.c
@@ -861,7 +861,6 @@ static ssize_t read_file_recv(struct file *file, char __user *user_buf,
         RXS_ERR("RX-LENGTH-ERR", rx_len_err);
         RXS_ERR("RX-OOM-ERR", rx_oom_err);
         RXS_ERR("RX-RATE-ERR", rx_rate_err);
-        RXS_ERR("RX-DROP-RXFLUSH", rx_drop_rxflush);
         RXS_ERR("RX-TOO-MANY-FRAGS", rx_too_many_frags_err);
 
         PHY_ERR("UNDERRUN ERR", ATH9K_PHYERR_UNDERRUN);
diff --git a/drivers/net/wireless/ath/ath9k/debug.h b/drivers/net/wireless/ath/ath9k/debug.h
index 375c3b46411e..6df2ab62dcb7 100644
--- a/drivers/net/wireless/ath/ath9k/debug.h
+++ b/drivers/net/wireless/ath/ath9k/debug.h
@@ -216,7 +216,6 @@ struct ath_tx_stats {
  * @rx_oom_err:  No. of frames dropped due to OOM issues.
  * @rx_rate_err:  No. of frames dropped due to rate errors.
  * @rx_too_many_frags_err:  Frames dropped due to too-many-frags received.
- * @rx_drop_rxflush: No. of frames dropped due to RX-FLUSH.
  * @rx_beacons:  No. of beacons received.
  * @rx_frags:  No. of rx-fragements received.
  */
@@ -235,7 +234,6 @@ struct ath_rx_stats {
         u32 rx_oom_err;
         u32 rx_rate_err;
         u32 rx_too_many_frags_err;
-        u32 rx_drop_rxflush;
         u32 rx_beacons;
         u32 rx_frags;
 };
diff --git a/drivers/net/wireless/ath/ath9k/htc_hst.c b/drivers/net/wireless/ath/ath9k/htc_hst.c
index 4a9570dfba72..aac4a406a513 100644
--- a/drivers/net/wireless/ath/ath9k/htc_hst.c
+++ b/drivers/net/wireless/ath/ath9k/htc_hst.c
@@ -344,6 +344,8 @@ void ath9k_htc_txcompletion_cb(struct htc_target *htc_handle,
                         endpoint->ep_callbacks.tx(endpoint->ep_callbacks.priv,
                                                   skb, htc_hdr->endpoint_id,
                                                   txok);
+                } else {
+                        kfree_skb(skb);
                 }
         }
 
diff --git a/drivers/net/wireless/ath/ath9k/hw.h b/drivers/net/wireless/ath/ath9k/hw.h
index 7f1a8e91c908..9d26fc56ca56 100644
--- a/drivers/net/wireless/ath/ath9k/hw.h
+++ b/drivers/net/wireless/ath/ath9k/hw.h
@@ -1066,6 +1066,7 @@ void ar9003_paprd_setup_gain_table(struct ath_hw *ah, int chain);
 int ar9003_paprd_init_table(struct ath_hw *ah);
 bool ar9003_paprd_is_done(struct ath_hw *ah);
 bool ar9003_is_paprd_enabled(struct ath_hw *ah);
+void ar9003_hw_set_chain_masks(struct ath_hw *ah, u8 rx, u8 tx);
 
 /* Hardware family op attach helpers */
 void ar5008_hw_attach_phy_ops(struct ath_hw *ah);
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index be30a9af1528..dd91f8fdc01c 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -182,7 +182,7 @@ static void ath_restart_work(struct ath_softc *sc)
         ath_start_ani(sc);
 }
 
-static bool ath_prepare_reset(struct ath_softc *sc, bool retry_tx, bool flush)
+static bool ath_prepare_reset(struct ath_softc *sc, bool retry_tx)
 {
         struct ath_hw *ah = sc->sc_ah;
         bool ret = true;
@@ -202,14 +202,6 @@ static bool ath_prepare_reset(struct ath_softc *sc, bool retry_tx, bool flush)
         if (!ath_drain_all_txq(sc, retry_tx))
                 ret = false;
 
-        if (!flush) {
-                if (ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
-                        ath_rx_tasklet(sc, 1, true);
-                ath_rx_tasklet(sc, 1, false);
-        } else {
-                ath_flushrecv(sc);
-        }
-
         return ret;
 }
 
@@ -262,11 +254,11 @@ static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan,
         struct ath_common *common = ath9k_hw_common(ah);
         struct ath9k_hw_cal_data *caldata = NULL;
         bool fastcc = true;
-        bool flush = false;
         int r;
 
         __ath_cancel_work(sc);
 
+        tasklet_disable(&sc->intr_tq);
         spin_lock_bh(&sc->sc_pcu_lock);
 
         if (!(sc->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL)) {
@@ -276,11 +268,10 @@ static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan,
 
         if (!hchan) {
                 fastcc = false;
-                flush = true;
                 hchan = ah->curchan;
         }
 
-        if (!ath_prepare_reset(sc, retry_tx, flush))
+        if (!ath_prepare_reset(sc, retry_tx))
                 fastcc = false;
 
         ath_dbg(common, CONFIG, "Reset to %u MHz, HT40: %d fastcc: %d\n",
@@ -302,6 +293,8 @@ static int ath_reset_internal(struct ath_softc *sc, struct ath9k_channel *hchan,
 
 out:
         spin_unlock_bh(&sc->sc_pcu_lock);
+        tasklet_enable(&sc->intr_tq);
+
         return r;
 }
 
@@ -804,7 +797,7 @@ static void ath9k_stop(struct ieee80211_hw *hw)
                 ath9k_hw_cfg_gpio_input(ah, ah->led_pin);
         }
 
-        ath_prepare_reset(sc, false, true);
+        ath_prepare_reset(sc, false);
 
         if (sc->rx.frag) {
                 dev_kfree_skb_any(sc->rx.frag);
@@ -1833,6 +1826,9 @@ static u32 fill_chainmask(u32 cap, u32 new)
 
 static bool validate_antenna_mask(struct ath_hw *ah, u32 val)
 {
+        if (AR_SREV_9300_20_OR_LATER(ah))
+                return true;
+
         switch (val & 0x7) {
         case 0x1:
         case 0x3:
diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index d4df98a938bf..90752f246970 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -254,8 +254,6 @@ rx_init_fail:
 
 static void ath_edma_start_recv(struct ath_softc *sc)
 {
-        spin_lock_bh(&sc->rx.rxbuflock);
-
         ath9k_hw_rxena(sc->sc_ah);
 
         ath_rx_addbuffer_edma(sc, ATH9K_RX_QUEUE_HP,
@@ -267,8 +265,6 @@ static void ath_edma_start_recv(struct ath_softc *sc)
         ath_opmode_init(sc);
 
         ath9k_hw_startpcureceive(sc->sc_ah, !!(sc->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL));
-
-        spin_unlock_bh(&sc->rx.rxbuflock);
 }
 
 static void ath_edma_stop_recv(struct ath_softc *sc)
@@ -285,8 +281,6 @@ int ath_rx_init(struct ath_softc *sc, int nbufs)
         int error = 0;
 
         spin_lock_init(&sc->sc_pcu_lock);
-        spin_lock_init(&sc->rx.rxbuflock);
-        clear_bit(SC_OP_RXFLUSH, &sc->sc_flags);
 
         common->rx_bufsize = IEEE80211_MAX_MPDU_LEN / 2 +
                              sc->sc_ah->caps.rx_status_len;
@@ -447,7 +441,6 @@ int ath_startrecv(struct ath_softc *sc)
                 return 0;
         }
 
-        spin_lock_bh(&sc->rx.rxbuflock);
         if (list_empty(&sc->rx.rxbuf))
                 goto start_recv;
 
@@ -468,26 +461,31 @@ start_recv:
         ath_opmode_init(sc);
         ath9k_hw_startpcureceive(ah, !!(sc->hw->conf.flags & IEEE80211_CONF_OFFCHANNEL));
 
-        spin_unlock_bh(&sc->rx.rxbuflock);
-
         return 0;
 }
 
+static void ath_flushrecv(struct ath_softc *sc)
+{
+        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
+                ath_rx_tasklet(sc, 1, true);
+        ath_rx_tasklet(sc, 1, false);
+}
+
 bool ath_stoprecv(struct ath_softc *sc)
 {
         struct ath_hw *ah = sc->sc_ah;
         bool stopped, reset = false;
 
-        spin_lock_bh(&sc->rx.rxbuflock);
         ath9k_hw_abortpcurecv(ah);
         ath9k_hw_setrxfilter(ah, 0);
         stopped = ath9k_hw_stopdmarecv(ah, &reset);
 
+        ath_flushrecv(sc);
+
         if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
                 ath_edma_stop_recv(sc);
         else
                 sc->rx.rxlink = NULL;
-        spin_unlock_bh(&sc->rx.rxbuflock);
 
         if (!(ah->ah_flags & AH_UNPLUGGED) &&
             unlikely(!stopped)) {
@@ -499,15 +497,6 @@ bool ath_stoprecv(struct ath_softc *sc)
         return stopped && !reset;
 }
 
-void ath_flushrecv(struct ath_softc *sc)
-{
-        set_bit(SC_OP_RXFLUSH, &sc->sc_flags);
-        if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA)
-                ath_rx_tasklet(sc, 1, true);
-        ath_rx_tasklet(sc, 1, false);
-        clear_bit(SC_OP_RXFLUSH, &sc->sc_flags);
-}
-
 static bool ath_beacon_dtim_pending_cab(struct sk_buff *skb)
 {
         /* Check whether the Beacon frame has DTIM indicating buffered bc/mc */
@@ -744,6 +733,7 @@ static struct ath_buf *ath_get_next_rx_buf(struct ath_softc *sc,
                         return NULL;
         }
 
+        list_del(&bf->list);
         if (!bf->bf_mpdu)
                 return bf;
 
@@ -1059,16 +1049,12 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
                 dma_type = DMA_FROM_DEVICE;
 
         qtype = hp ? ATH9K_RX_QUEUE_HP : ATH9K_RX_QUEUE_LP;
-        spin_lock_bh(&sc->rx.rxbuflock);
 
         tsf = ath9k_hw_gettsf64(ah);
         tsf_lower = tsf & 0xffffffff;
 
         do {
                 bool decrypt_error = false;
-                /* If handling rx interrupt and flush is in progress => exit */
-                if (test_bit(SC_OP_RXFLUSH, &sc->sc_flags) && (flush == 0))
-                        break;
 
                 memset(&rs, 0, sizeof(rs));
                 if (edma)
@@ -1111,15 +1097,6 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
 
                 ath_debug_stat_rx(sc, &rs);
 
-                /*
-                 * If we're asked to flush receive queue, directly
-                 * chain it back at the queue without processing it.
-                 */
-                if (test_bit(SC_OP_RXFLUSH, &sc->sc_flags)) {
-                        RX_STAT_INC(rx_drop_rxflush);
-                        goto requeue_drop_frag;
-                }
-
                 memset(rxs, 0, sizeof(struct ieee80211_rx_status));
 
                 rxs->mactime = (tsf & ~0xffffffffULL) | rs.rs_tstamp;
@@ -1254,19 +1231,18 @@ requeue_drop_frag:
                         sc->rx.frag = NULL;
                 }
 requeue:
+                list_add_tail(&bf->list, &sc->rx.rxbuf);
+                if (flush)
+                        continue;
+
                 if (edma) {
-                        list_add_tail(&bf->list, &sc->rx.rxbuf);
                         ath_rx_edma_buf_link(sc, qtype);
                 } else {
-                        list_move_tail(&bf->list, &sc->rx.rxbuf);
                         ath_rx_buf_link(sc, bf);
-                        if (!flush)
-                                ath9k_hw_rxena(ah);
+                        ath9k_hw_rxena(ah);
                 }
         } while (1);
 
-        spin_unlock_bh(&sc->rx.rxbuflock);
-
         if (!(ah->imask & ATH9K_INT_RXEOL)) {
                 ah->imask |= (ATH9K_INT_RXEOL | ATH9K_INT_RXORN);
                 ath9k_hw_set_interrupts(ah);
diff --git a/drivers/net/wireless/ath/wil6210/Kconfig b/drivers/net/wireless/ath/wil6210/Kconfig
new file mode 100644
index 000000000000..bac3d98a0cfb
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/Kconfig
@@ -0,0 +1,29 @@
+config WIL6210
+        tristate "Wilocity 60g WiFi card wil6210 support"
+        depends on CFG80211
+        depends on PCI
+        default n
+        ---help---
+          This module adds support for wireless adapter based on
+          wil6210 chip by Wilocity. It supports operation on the
+          60 GHz band, covered by the IEEE802.11ad standard.
+
+          http://wireless.kernel.org/en/users/Drivers/wil6210
+
+          If you choose to build it as a module, it will be called
+          wil6210
+
+config WIL6210_ISR_COR
+        bool "Use Clear-On-Read mode for ISR registers for wil6210"
+        depends on WIL6210
+        default y
+        ---help---
+          ISR registers on wil6210 chip may operate in either
+          COR (Clear-On-Read) or W1C (Write-1-to-Clear) mode.
+          For production code, use COR (say y); is default since
+          it saves extra target transaction;
+          For ISR debug, use W1C (say n); is allows to monitor ISR
+          registers with debugfs. If COR were used, ISR would
+          self-clear when accessed for debug purposes, it makes
+          such monitoring impossible.
+          Say y unless you debug interrupts
diff --git a/drivers/net/wireless/ath/wil6210/Makefile b/drivers/net/wireless/ath/wil6210/Makefile
new file mode 100644
index 000000000000..9396dc9fe3c5
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/Makefile
@@ -0,0 +1,13 @@
+obj-$(CONFIG_WIL6210) += wil6210.o
+
+wil6210-objs := main.o
+wil6210-objs += netdev.o
+wil6210-objs += cfg80211.o
+wil6210-objs += pcie_bus.o
+wil6210-objs += debugfs.o
+wil6210-objs += wmi.o
+wil6210-objs += interrupt.o
+wil6210-objs += txrx.o
+
+subdir-ccflags-y += -Werror
+subdir-ccflags-y += -D__CHECK_ENDIAN__
diff --git a/drivers/net/wireless/ath/wil6210/cfg80211.c b/drivers/net/wireless/ath/wil6210/cfg80211.c
new file mode 100644
index 000000000000..116f4e807ae1
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/cfg80211.c
@@ -0,0 +1,573 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+#include <linux/sched.h>
+#include <linux/etherdevice.h>
+#include <linux/wireless.h>
+#include <linux/ieee80211.h>
+#include <linux/slab.h>
+#include <linux/version.h>
+#include <net/cfg80211.h>
+
+#include "wil6210.h"
+#include "wmi.h"
+
+#define CHAN60G(_channel, _flags) {                             \
+        .band                   = IEEE80211_BAND_60GHZ,         \
+        .center_freq            = 56160 + (2160 * (_channel)),  \
+        .hw_value               = (_channel),                   \
+        .flags                  = (_flags),                     \
+        .max_antenna_gain       = 0,                            \
+        .max_power              = 40,                           \
+}
+
+static struct ieee80211_channel wil_60ghz_channels[] = {
+        CHAN60G(1, 0),
+        CHAN60G(2, 0),
+        CHAN60G(3, 0),
+/* channel 4 not supported yet */
+};
+
+static struct ieee80211_supported_band wil_band_60ghz = {
+        .channels = wil_60ghz_channels,
+        .n_channels = ARRAY_SIZE(wil_60ghz_channels),
+        .ht_cap = {
+                .ht_supported = true,
+                .cap = 0, /* TODO */
+                .ampdu_factor = IEEE80211_HT_MAX_AMPDU_64K, /* TODO */
+                .ampdu_density = IEEE80211_HT_MPDU_DENSITY_8, /* TODO */
+                .mcs = {
+                                /* MCS 1..12 - SC PHY */
+                        .rx_mask = {0xfe, 0x1f}, /* 1..12 */
+                        .tx_params = IEEE80211_HT_MCS_TX_DEFINED, /* TODO */
+                },
+        },
+};
+
+static const struct ieee80211_txrx_stypes
+wil_mgmt_stypes[NUM_NL80211_IFTYPES] = {
+        [NL80211_IFTYPE_STATION] = {
+                .tx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                BIT(IEEE80211_STYPE_PROBE_RESP >> 4),
+                .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
+        },
+        [NL80211_IFTYPE_AP] = {
+                .tx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                BIT(IEEE80211_STYPE_PROBE_RESP >> 4),
+                .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
+        },
+        [NL80211_IFTYPE_P2P_CLIENT] = {
+                .tx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                BIT(IEEE80211_STYPE_PROBE_RESP >> 4),
+                .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
+        },
+        [NL80211_IFTYPE_P2P_GO] = {
+                .tx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                BIT(IEEE80211_STYPE_PROBE_RESP >> 4),
+                .rx = BIT(IEEE80211_STYPE_ACTION >> 4) |
+                BIT(IEEE80211_STYPE_PROBE_REQ >> 4)
+        },
+};
+
+static const u32 wil_cipher_suites[] = {
+        WLAN_CIPHER_SUITE_GCMP,
+};
+
+int wil_iftype_nl2wmi(enum nl80211_iftype type)
+{
+        static const struct {
+                enum nl80211_iftype nl;
+                enum wmi_network_type wmi;
+        } __nl2wmi[] = {
+                {NL80211_IFTYPE_ADHOC,          WMI_NETTYPE_ADHOC},
+                {NL80211_IFTYPE_STATION,        WMI_NETTYPE_INFRA},
+                {NL80211_IFTYPE_AP,             WMI_NETTYPE_AP},
+                {NL80211_IFTYPE_P2P_CLIENT,     WMI_NETTYPE_P2P},
+                {NL80211_IFTYPE_P2P_GO,         WMI_NETTYPE_P2P},
+                {NL80211_IFTYPE_MONITOR,        WMI_NETTYPE_ADHOC}, /* FIXME */
+        };
+        uint i;
+
+        for (i = 0; i < ARRAY_SIZE(__nl2wmi); i++) {
+                if (__nl2wmi[i].nl == type)
+                        return __nl2wmi[i].wmi;
+        }
+
+        return -EOPNOTSUPP;
+}
+
+static int wil_cfg80211_get_station(struct wiphy *wiphy,
+                                    struct net_device *ndev,
+                                    u8 *mac, struct station_info *sinfo)
+{
+        struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+        int rc;
+        struct wmi_notify_req_cmd cmd = {
+                .cid = 0,
+                .interval_usec = 0,
+        };
+
+        if (memcmp(mac, wil->dst_addr[0], ETH_ALEN))
+                return -ENOENT;
+
+        /* WMI_NOTIFY_REQ_DONE_EVENTID handler fills wil->stats.bf_mcs */
+        rc = wmi_call(wil, WMI_NOTIFY_REQ_CMDID, &cmd, sizeof(cmd),
+                      WMI_NOTIFY_REQ_DONE_EVENTID, NULL, 0, 20);
+        if (rc)
+                return rc;
+
+        sinfo->generation = wil->sinfo_gen;
+
+        sinfo->filled |= STATION_INFO_TX_BITRATE;
+        sinfo->txrate.flags = RATE_INFO_FLAGS_MCS | RATE_INFO_FLAGS_60G;
+        sinfo->txrate.mcs = wil->stats.bf_mcs;
+        sinfo->filled |= STATION_INFO_RX_BITRATE;
+        sinfo->rxrate.flags = RATE_INFO_FLAGS_MCS | RATE_INFO_FLAGS_60G;
+        sinfo->rxrate.mcs = wil->stats.last_mcs_rx;
+
+        if (test_bit(wil_status_fwconnected, &wil->status)) {
+                sinfo->filled |= STATION_INFO_SIGNAL;
+                sinfo->signal = 12; /* TODO: provide real value */
+        }
+
+        return 0;
+}
+
+static int wil_cfg80211_change_iface(struct wiphy *wiphy,
+                                     struct net_device *ndev,
+                                     enum nl80211_iftype type, u32 *flags,
+                                     struct vif_params *params)
+{
+        struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+        struct wireless_dev *wdev = wil->wdev;
+
+        switch (type) {
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_P2P_CLIENT:
+        case NL80211_IFTYPE_P2P_GO:
+                break;
+        case NL80211_IFTYPE_MONITOR:
+                if (flags)
+                        wil->monitor_flags = *flags;
+                else
+                        wil->monitor_flags = 0;
+
+                break;
+        default:
+                return -EOPNOTSUPP;
+        }
+
+        wdev->iftype = type;
+
+        return 0;
+}
+
+static int wil_cfg80211_scan(struct wiphy *wiphy,
+                             struct cfg80211_scan_request *request)
+{
+        struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+        struct wireless_dev *wdev = wil->wdev;
+        struct {
+                struct wmi_start_scan_cmd cmd;
+                u16 chnl[4];
+        } __packed cmd;
+        uint i, n;
+
+        if (wil->scan_request) {
+                wil_err(wil, "Already scanning\n");
+                return -EAGAIN;
+        }
+
+        /* check we are client side */
+        switch (wdev->iftype) {
+        case NL80211_IFTYPE_STATION:
+        case NL80211_IFTYPE_P2P_CLIENT:
+                break;
+        default:
+                return -EOPNOTSUPP;
+
+        }
+
+        /* FW don't support scan after connection attempt */
+        if (test_bit(wil_status_dontscan, &wil->status)) {
+                wil_err(wil, "Scan after connect attempt not supported\n");
+                return -EBUSY;
+        }
+
+        wil->scan_request = request;
+
+        memset(&cmd, 0, sizeof(cmd));
+        cmd.cmd.num_channels = 0;
+        n = min(request->n_channels, 4U);
+        for (i = 0; i < n; i++) {
+                int ch = request->channels[i]->hw_value;
+                if (ch == 0) {
+                        wil_err(wil,
+                                "Scan requested for unknown frequency %dMhz\n",
+                                request->channels[i]->center_freq);
+                        continue;
+                }
+                /* 0-based channel indexes */
+                cmd.cmd.channel_list[cmd.cmd.num_channels++].channel = ch - 1;
+                wil_dbg(wil, "Scan for ch %d  : %d MHz\n", ch,
+                        request->channels[i]->center_freq);
+        }
+
+        return wmi_send(wil, WMI_START_SCAN_CMDID, &cmd, sizeof(cmd.cmd) +
+                        cmd.cmd.num_channels * sizeof(cmd.cmd.channel_list[0]));
+}
+
+static int wil_cfg80211_connect(struct wiphy *wiphy,
+                                struct net_device *ndev,
+                                struct cfg80211_connect_params *sme)
+{
+        struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+        struct cfg80211_bss *bss;
+        struct wmi_connect_cmd conn;
+        const u8 *ssid_eid;
+        const u8 *rsn_eid;
+        int ch;
+        int rc = 0;
+
+        bss = cfg80211_get_bss(wiphy, sme->channel, sme->bssid,
+                               sme->ssid, sme->ssid_len,
+                               WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
+        if (!bss) {
+                wil_err(wil, "Unable to find BSS\n");
+                return -ENOENT;
+        }
+
+        ssid_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SSID);
+        if (!ssid_eid) {
+                wil_err(wil, "No SSID\n");
+                rc = -ENOENT;
+                goto out;
+        }
+
+        rsn_eid = sme->ie ?
+                        cfg80211_find_ie(WLAN_EID_RSN, sme->ie, sme->ie_len) :
+                        NULL;
+        if (rsn_eid) {
+                if (sme->ie_len > WMI_MAX_IE_LEN) {
+                        rc = -ERANGE;
+                        wil_err(wil, "IE too large (%td bytes)\n",
+                                sme->ie_len);
+                        goto out;
+                }
+                /*
+                 * For secure assoc, send:
+                 * (1) WMI_DELETE_CIPHER_KEY_CMD
+                 * (2) WMI_SET_APPIE_CMD
+                 */
+                rc = wmi_del_cipher_key(wil, 0, bss->bssid);
+                if (rc) {
+                        wil_err(wil, "WMI_DELETE_CIPHER_KEY_CMD failed\n");
+                        goto out;
+                }
+                /* WMI_SET_APPIE_CMD */
+                rc = wmi_set_ie(wil, WMI_FRAME_ASSOC_REQ, sme->ie_len, sme->ie);
+                if (rc) {
+                        wil_err(wil, "WMI_SET_APPIE_CMD failed\n");
+                        goto out;
+                }
+        }
+
+        /* WMI_CONNECT_CMD */
+        memset(&conn, 0, sizeof(conn));
+        switch (bss->capability & 0x03) {
+        case WLAN_CAPABILITY_DMG_TYPE_AP:
+                conn.network_type = WMI_NETTYPE_INFRA;
+                break;
+        case WLAN_CAPABILITY_DMG_TYPE_PBSS:
+                conn.network_type = WMI_NETTYPE_P2P;
+                break;
+        default:
+                wil_err(wil, "Unsupported BSS type, capability= 0x%04x\n",
+                        bss->capability);
+                goto out;
+        }
+        if (rsn_eid) {
+                conn.dot11_auth_mode = WMI_AUTH11_SHARED;
+                conn.auth_mode = WMI_AUTH_WPA2_PSK;
+                conn.pairwise_crypto_type = WMI_CRYPT_AES_GCMP;
+                conn.pairwise_crypto_len = 16;
+        } else {
+                conn.dot11_auth_mode = WMI_AUTH11_OPEN;
+                conn.auth_mode = WMI_AUTH_NONE;
+        }
+
+        conn.ssid_len = min_t(u8, ssid_eid[1], 32);
+        memcpy(conn.ssid, ssid_eid+2, conn.ssid_len);
+
+        ch = bss->channel->hw_value;
+        if (ch == 0) {
+                wil_err(wil, "BSS at unknown frequency %dMhz\n",
+                        bss->channel->center_freq);
+                rc = -EOPNOTSUPP;
+                goto out;
+        }
+        conn.channel = ch - 1;
+
+        memcpy(conn.bssid, bss->bssid, 6);
+        memcpy(conn.dst_mac, bss->bssid, 6);
+        /*
+         * FW don't support scan after connection attempt
+         */
+        set_bit(wil_status_dontscan, &wil->status);
+
+        rc = wmi_send(wil, WMI_CONNECT_CMDID, &conn, sizeof(conn));
+        if (rc == 0) {
+                /* Connect can take lots of time */
+                mod_timer(&wil->connect_timer,
+                          jiffies + msecs_to_jiffies(2000));
+        }
+
+ out:
+        cfg80211_put_bss(bss);
+
+        return rc;
+}
+
+static int wil_cfg80211_disconnect(struct wiphy *wiphy,
+                                   struct net_device *ndev,
+                                   u16 reason_code)
+{
+        int rc;
+        struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+
+        rc = wmi_send(wil, WMI_DISCONNECT_CMDID, NULL, 0);
+
+        return rc;
+}
+
+static int wil_cfg80211_set_channel(struct wiphy *wiphy,
+                                    struct cfg80211_chan_def *chandef)
+{
+        struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+        struct wireless_dev *wdev = wil->wdev;
+
+        wdev->preset_chandef = *chandef;
+
+        return 0;
+}
+
+static int wil_cfg80211_add_key(struct wiphy *wiphy,
+                                struct net_device *ndev,
+                                u8 key_index, bool pairwise,
+                                const u8 *mac_addr,
+                                struct key_params *params)
+{
+        struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+
+        /* group key is not used */
+        if (!pairwise)
+                return 0;
+
+        return wmi_add_cipher_key(wil, key_index, mac_addr,
+                                  params->key_len, params->key);
+}
+
+static int wil_cfg80211_del_key(struct wiphy *wiphy,
+                                struct net_device *ndev,
+                                u8 key_index, bool pairwise,
+                                const u8 *mac_addr)
+{
+        struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+
+        /* group key is not used */
+        if (!pairwise)
+                return 0;
+
+        return wmi_del_cipher_key(wil, key_index, mac_addr);
+}
+
+/* Need to be present or wiphy_new() will WARN */
+static int wil_cfg80211_set_default_key(struct wiphy *wiphy,
+                                        struct net_device *ndev,
+                                        u8 key_index, bool unicast,
+                                        bool multicast)
+{
+        return 0;
+}
+
+static int wil_cfg80211_start_ap(struct wiphy *wiphy,
+                                 struct net_device *ndev,
+                                 struct cfg80211_ap_settings *info)
+{
+        int rc = 0;
+        struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+        struct wireless_dev *wdev = ndev->ieee80211_ptr;
+        struct ieee80211_channel *channel = info->chandef.chan;
+        struct cfg80211_beacon_data *bcon = &info->beacon;
+        u8 wmi_nettype = wil_iftype_nl2wmi(wdev->iftype);
+
+        if (!channel) {
+                wil_err(wil, "AP: No channel???\n");
+                return -EINVAL;
+        }
+
+        wil_dbg(wil, "AP on Channel %d %d MHz, %s\n", channel->hw_value,
+                channel->center_freq, info->privacy ? "secure" : "open");
+        print_hex_dump_bytes("SSID ", DUMP_PREFIX_OFFSET,
+                             info->ssid, info->ssid_len);
+
+        rc = wil_reset(wil);
+        if (rc)
+                return rc;
+
+        rc = wmi_set_ssid(wil, info->ssid_len, info->ssid);
+        if (rc)
+                return rc;
+
+        rc = wmi_set_channel(wil, channel->hw_value);
+        if (rc)
+                return rc;
+
+        /* MAC address - pre-requisite for other commands */
+        wmi_set_mac_address(wil, ndev->dev_addr);
+
+        /* IE's */
+        /* bcon 'head IE's are not relevant for 60g band */
+        wmi_set_ie(wil, WMI_FRAME_BEACON, bcon->beacon_ies_len,
+                   bcon->beacon_ies);
+        wmi_set_ie(wil, WMI_FRAME_PROBE_RESP, bcon->proberesp_ies_len,
+                   bcon->proberesp_ies);
+        wmi_set_ie(wil, WMI_FRAME_ASSOC_RESP, bcon->assocresp_ies_len,
+                   bcon->assocresp_ies);
+
+        wil->secure_pcp = info->privacy;
+
+        rc = wmi_set_bcon(wil, info->beacon_interval, wmi_nettype);
+        if (rc)
+                return rc;
+
+        /* Rx VRING. After MAC and beacon */
+        rc = wil_rx_init(wil);
+
+        netif_carrier_on(ndev);
+
+        return rc;
+}
+
+static int wil_cfg80211_stop_ap(struct wiphy *wiphy,
+                                struct net_device *ndev)
+{
+        int rc = 0;
+        struct wil6210_priv *wil = wiphy_to_wil(wiphy);
+        struct wireless_dev *wdev = ndev->ieee80211_ptr;
+        u8 wmi_nettype = wil_iftype_nl2wmi(wdev->iftype);
+
+        /* To stop beaconing, set BI to 0 */
+        rc = wmi_set_bcon(wil, 0, wmi_nettype);
+
+        return rc;
+}
+
+static struct cfg80211_ops wil_cfg80211_ops = {
+        .scan = wil_cfg80211_scan,
+        .connect = wil_cfg80211_connect,
+        .disconnect = wil_cfg80211_disconnect,
+        .change_virtual_intf = wil_cfg80211_change_iface,
+        .get_station = wil_cfg80211_get_station,
+        .set_monitor_channel = wil_cfg80211_set_channel,
+        .add_key = wil_cfg80211_add_key,
+        .del_key = wil_cfg80211_del_key,
+        .set_default_key = wil_cfg80211_set_default_key,
+        /* AP mode */
+        .start_ap = wil_cfg80211_start_ap,
+        .stop_ap = wil_cfg80211_stop_ap,
+};
+
+static void wil_wiphy_init(struct wiphy *wiphy)
+{
+        /* TODO: set real value */
+        wiphy->max_scan_ssids = 10;
+        wiphy->max_num_pmkids = 0 /* TODO: */;
+        wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION) |
+                                 BIT(NL80211_IFTYPE_AP) |
+                                 BIT(NL80211_IFTYPE_MONITOR);
+        /* TODO: enable P2P when integrated with supplicant:
+         * BIT(NL80211_IFTYPE_P2P_CLIENT) | BIT(NL80211_IFTYPE_P2P_GO)
+         */
+        wiphy->flags |= WIPHY_FLAG_HAVE_AP_SME |
+                        WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD;
+        dev_warn(wiphy_dev(wiphy), "%s : flags = 0x%08x\n",
+                 __func__, wiphy->flags);
+        wiphy->probe_resp_offload =
+                NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS |
+                NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS2 |
+                NL80211_PROBE_RESP_OFFLOAD_SUPPORT_P2P;
+
+        wiphy->bands[IEEE80211_BAND_60GHZ] = &wil_band_60ghz;
+
+        /* TODO: figure this out */
+        wiphy->signal_type = CFG80211_SIGNAL_TYPE_MBM;
+
+        wiphy->cipher_suites = wil_cipher_suites;
+        wiphy->n_cipher_suites = ARRAY_SIZE(wil_cipher_suites);
+        wiphy->mgmt_stypes = wil_mgmt_stypes;
+}
+
+struct wireless_dev *wil_cfg80211_init(struct device *dev)
+{
+        int rc = 0;
+        struct wireless_dev *wdev;
+
+        wdev = kzalloc(sizeof(struct wireless_dev), GFP_KERNEL);
+        if (!wdev)
+                return ERR_PTR(-ENOMEM);
+
+        wdev->wiphy = wiphy_new(&wil_cfg80211_ops,
+                                sizeof(struct wil6210_priv));
+        if (!wdev->wiphy) {
+                rc = -ENOMEM;
+                goto out;
+        }
+
+        set_wiphy_dev(wdev->wiphy, dev);
+        wil_wiphy_init(wdev->wiphy);
+
+        rc = wiphy_register(wdev->wiphy);
+        if (rc < 0)
+                goto out_failed_reg;
+
+        return wdev;
+
+out_failed_reg:
+        wiphy_free(wdev->wiphy);
+out:
+        kfree(wdev);
+
+        return ERR_PTR(rc);
+}
+
+void wil_wdev_free(struct wil6210_priv *wil)
+{
+        struct wireless_dev *wdev = wil_to_wdev(wil);
+
+        if (!wdev)
+                return;
+
+        wiphy_unregister(wdev->wiphy);
+        wiphy_free(wdev->wiphy);
+        kfree(wdev);
+}
diff --git a/drivers/net/wireless/ath/wil6210/dbg_hexdump.h b/drivers/net/wireless/ath/wil6210/dbg_hexdump.h
new file mode 100644
index 000000000000..6a315ba5aa7d
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/dbg_hexdump.h
@@ -0,0 +1,30 @@
+#ifndef WIL_DBG_HEXDUMP_H_
+#define WIL_DBG_HEXDUMP_H_
+
+#if defined(CONFIG_DYNAMIC_DEBUG)
+#define wil_dynamic_hex_dump(prefix_str, prefix_type, rowsize,  \
+                             groupsize, buf, len, ascii)        \
+do {                                                            \
+        DEFINE_DYNAMIC_DEBUG_METADATA(descriptor,               \
+                __builtin_constant_p(prefix_str) ? prefix_str : "hexdump");\
+        if (unlikely(descriptor.flags & _DPRINTK_FLAGS_PRINT))  \
+                print_hex_dump(KERN_DEBUG, prefix_str,          \
+                               prefix_type, rowsize, groupsize, \
+                               buf, len, ascii);                \
+} while (0)
+
+#define wil_print_hex_dump_debug(prefix_str, prefix_type, rowsize,      \
+                                 groupsize, buf, len, ascii)            \
+        wil_dynamic_hex_dump(prefix_str, prefix_type, rowsize,          \
+                             groupsize, buf, len, ascii)
+
+#define print_hex_dump_bytes(prefix_str, prefix_type, buf, len) \
+        wil_dynamic_hex_dump(prefix_str, prefix_type, 16, 1, buf, len, true)
+#else /* defined(CONFIG_DYNAMIC_DEBUG) */
+#define wil_print_hex_dump_debug(prefix_str, prefix_type, rowsize,      \
+                                 groupsize, buf, len, ascii)            \
+        print_hex_dump(KERN_DEBUG, prefix_str, prefix_type, rowsize,    \
+                       groupsize, buf, len, ascii)
+#endif /* defined(CONFIG_DYNAMIC_DEBUG) */
+
+#endif /* WIL_DBG_HEXDUMP_H_ */
diff --git a/drivers/net/wireless/ath/wil6210/debugfs.c b/drivers/net/wireless/ath/wil6210/debugfs.c
new file mode 100644
index 000000000000..65fc9683bfd8
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/debugfs.c
@@ -0,0 +1,603 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/module.h>
+#include <linux/debugfs.h>
+#include <linux/seq_file.h>
+#include <linux/pci.h>
+#include <linux/rtnetlink.h>
+
+#include "wil6210.h"
+#include "txrx.h"
+
+/* Nasty hack. Better have per device instances */
+static u32 mem_addr;
+static u32 dbg_txdesc_index;
+
+static void wil_print_vring(struct seq_file *s, struct wil6210_priv *wil,
+                            const char *name, struct vring *vring)
+{
+        void __iomem *x = wmi_addr(wil, vring->hwtail);
+
+        seq_printf(s, "VRING %s = {\n", name);
+        seq_printf(s, "  pa     = 0x%016llx\n", (unsigned long long)vring->pa);
+        seq_printf(s, "  va     = 0x%p\n", vring->va);
+        seq_printf(s, "  size   = %d\n", vring->size);
+        seq_printf(s, "  swtail = %d\n", vring->swtail);
+        seq_printf(s, "  swhead = %d\n", vring->swhead);
+        seq_printf(s, "  hwtail = [0x%08x] -> ", vring->hwtail);
+        if (x)
+                seq_printf(s, "0x%08x\n", ioread32(x));
+        else
+                seq_printf(s, "???\n");
+
+        if (vring->va && (vring->size < 1025)) {
+                uint i;
+                for (i = 0; i < vring->size; i++) {
+                        volatile struct vring_tx_desc *d = &vring->va[i].tx;
+                        if ((i % 64) == 0 && (i != 0))
+                                seq_printf(s, "\n");
+                        seq_printf(s, "%s", (d->dma.status & BIT(0)) ?
+                                        "S" : (vring->ctx[i] ? "H" : "h"));
+                }
+                seq_printf(s, "\n");
+        }
+        seq_printf(s, "}\n");
+}
+
+static int wil_vring_debugfs_show(struct seq_file *s, void *data)
+{
+        uint i;
+        struct wil6210_priv *wil = s->private;
+
+        wil_print_vring(s, wil, "rx", &wil->vring_rx);
+
+        for (i = 0; i < ARRAY_SIZE(wil->vring_tx); i++) {
+                struct vring *vring = &(wil->vring_tx[i]);
+                if (vring->va) {
+                        char name[10];
+                        snprintf(name, sizeof(name), "tx_%2d", i);
+                        wil_print_vring(s, wil, name, vring);
+                }
+        }
+
+        return 0;
+}
+
+static int wil_vring_seq_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, wil_vring_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations fops_vring = {
+        .open           = wil_vring_seq_open,
+        .release        = single_release,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+};
+
+static void wil_print_ring(struct seq_file *s, const char *prefix,
+                           void __iomem *off)
+{
+        struct wil6210_priv *wil = s->private;
+        struct wil6210_mbox_ring r;
+        int rsize;
+        uint i;
+
+        wil_memcpy_fromio_32(&r, off, sizeof(r));
+        wil_mbox_ring_le2cpus(&r);
+        /*
+         * we just read memory block from NIC. This memory may be
+         * garbage. Check validity before using it.
+         */
+        rsize = r.size / sizeof(struct wil6210_mbox_ring_desc);
+
+        seq_printf(s, "ring %s = {\n", prefix);
+        seq_printf(s, "  base = 0x%08x\n", r.base);
+        seq_printf(s, "  size = 0x%04x bytes -> %d entries\n", r.size, rsize);
+        seq_printf(s, "  tail = 0x%08x\n", r.tail);
+        seq_printf(s, "  head = 0x%08x\n", r.head);
+        seq_printf(s, "  entry size = %d\n", r.entry_size);
+
+        if (r.size % sizeof(struct wil6210_mbox_ring_desc)) {
+                seq_printf(s, "  ??? size is not multiple of %zd, garbage?\n",
+                           sizeof(struct wil6210_mbox_ring_desc));
+                goto out;
+        }
+
+        if (!wmi_addr(wil, r.base) ||
+            !wmi_addr(wil, r.tail) ||
+            !wmi_addr(wil, r.head)) {
+                seq_printf(s, "  ??? pointers are garbage?\n");
+                goto out;
+        }
+
+        for (i = 0; i < rsize; i++) {
+                struct wil6210_mbox_ring_desc d;
+                struct wil6210_mbox_hdr hdr;
+                size_t delta = i * sizeof(d);
+                void __iomem *x = wil->csr + HOSTADDR(r.base) + delta;
+
+                wil_memcpy_fromio_32(&d, x, sizeof(d));
+
+                seq_printf(s, "  [%2x] %s %s%s 0x%08x", i,
+                           d.sync ? "F" : "E",
+                           (r.tail - r.base == delta) ? "t" : " ",
+                           (r.head - r.base == delta) ? "h" : " ",
+                           le32_to_cpu(d.addr));
+                if (0 == wmi_read_hdr(wil, d.addr, &hdr)) {
+                        u16 len = le16_to_cpu(hdr.len);
+                        seq_printf(s, " -> %04x %04x %04x %02x\n",
+                                   le16_to_cpu(hdr.seq), len,
+                                   le16_to_cpu(hdr.type), hdr.flags);
+                        if (len <= MAX_MBOXITEM_SIZE) {
+                                int n = 0;
+                                unsigned char printbuf[16 * 3 + 2];
+                                unsigned char databuf[MAX_MBOXITEM_SIZE];
+                                void __iomem *src = wmi_buffer(wil, d.addr) +
+                                        sizeof(struct wil6210_mbox_hdr);
+                                /*
+                                 * No need to check @src for validity -
+                                 * we already validated @d.addr while
+                                 * reading header
+                                 */
+                                wil_memcpy_fromio_32(databuf, src, len);
+                                while (n < len) {
+                                        int l = min(len - n, 16);
+                                        hex_dump_to_buffer(databuf + n, l,
+                                                           16, 1, printbuf,
+                                                           sizeof(printbuf),
+                                                           false);
+                                        seq_printf(s, "      : %s\n", printbuf);
+                                        n += l;
+                                }
+                        }
+                } else {
+                        seq_printf(s, "\n");
+                }
+        }
+ out:
+        seq_printf(s, "}\n");
+}
+
+static int wil_mbox_debugfs_show(struct seq_file *s, void *data)
+{
+        struct wil6210_priv *wil = s->private;
+
+        wil_print_ring(s, "tx", wil->csr + HOST_MBOX +
+                       offsetof(struct wil6210_mbox_ctl, tx));
+        wil_print_ring(s, "rx", wil->csr + HOST_MBOX +
+                       offsetof(struct wil6210_mbox_ctl, rx));
+
+        return 0;
+}
+
+static int wil_mbox_seq_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, wil_mbox_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations fops_mbox = {
+        .open           = wil_mbox_seq_open,
+        .release        = single_release,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+};
+
+static int wil_debugfs_iomem_x32_set(void *data, u64 val)
+{
+        iowrite32(val, (void __iomem *)data);
+        wmb(); /* make sure write propagated to HW */
+
+        return 0;
+}
+
+static int wil_debugfs_iomem_x32_get(void *data, u64 *val)
+{
+        *val = ioread32((void __iomem *)data);
+
+        return 0;
+}
+
+DEFINE_SIMPLE_ATTRIBUTE(fops_iomem_x32, wil_debugfs_iomem_x32_get,
+                        wil_debugfs_iomem_x32_set, "0x%08llx\n");
+
+static struct dentry *wil_debugfs_create_iomem_x32(const char *name,
+                                                   mode_t mode,
+                                                   struct dentry *parent,
+                                                   void __iomem *value)
+{
+        return debugfs_create_file(name, mode, parent, (void * __force)value,
+                                   &fops_iomem_x32);
+}
+
+static int wil6210_debugfs_create_ISR(struct wil6210_priv *wil,
+                                      const char *name,
+                                      struct dentry *parent, u32 off)
+{
+        struct dentry *d = debugfs_create_dir(name, parent);
+
+        if (IS_ERR_OR_NULL(d))
+                return -ENODEV;
+
+        wil_debugfs_create_iomem_x32("ICC", S_IRUGO | S_IWUSR, d,
+                                     wil->csr + off);
+        wil_debugfs_create_iomem_x32("ICR", S_IRUGO | S_IWUSR, d,
+                                     wil->csr + off + 4);
+        wil_debugfs_create_iomem_x32("ICM", S_IRUGO | S_IWUSR, d,
+                                     wil->csr + off + 8);
+        wil_debugfs_create_iomem_x32("ICS", S_IWUSR, d,
+                                     wil->csr + off + 12);
+        wil_debugfs_create_iomem_x32("IMV", S_IRUGO | S_IWUSR, d,
+                                     wil->csr + off + 16);
+        wil_debugfs_create_iomem_x32("IMS", S_IWUSR, d,
+                                     wil->csr + off + 20);
+        wil_debugfs_create_iomem_x32("IMC", S_IWUSR, d,
+                                     wil->csr + off + 24);
+
+        return 0;
+}
+
+static int wil6210_debugfs_create_pseudo_ISR(struct wil6210_priv *wil,
+                                             struct dentry *parent)
+{
+        struct dentry *d = debugfs_create_dir("PSEUDO_ISR", parent);
+
+        if (IS_ERR_OR_NULL(d))
+                return -ENODEV;
+
+        wil_debugfs_create_iomem_x32("CAUSE", S_IRUGO, d, wil->csr +
+                                     HOSTADDR(RGF_DMA_PSEUDO_CAUSE));
+        wil_debugfs_create_iomem_x32("MASK_SW", S_IRUGO, d, wil->csr +
+                                     HOSTADDR(RGF_DMA_PSEUDO_CAUSE_MASK_SW));
+        wil_debugfs_create_iomem_x32("MASK_FW", S_IRUGO, d, wil->csr +
+                                     HOSTADDR(RGF_DMA_PSEUDO_CAUSE_MASK_FW));
+
+        return 0;
+}
+
+static int wil6210_debugfs_create_ITR_CNT(struct wil6210_priv *wil,
+                                          struct dentry *parent)
+{
+        struct dentry *d = debugfs_create_dir("ITR_CNT", parent);
+
+        if (IS_ERR_OR_NULL(d))
+                return -ENODEV;
+
+        wil_debugfs_create_iomem_x32("TRSH", S_IRUGO, d, wil->csr +
+                                     HOSTADDR(RGF_DMA_ITR_CNT_TRSH));
+        wil_debugfs_create_iomem_x32("DATA", S_IRUGO, d, wil->csr +
+                                     HOSTADDR(RGF_DMA_ITR_CNT_DATA));
+        wil_debugfs_create_iomem_x32("CTL", S_IRUGO, d, wil->csr +
+                                     HOSTADDR(RGF_DMA_ITR_CNT_CRL));
+
+        return 0;
+}
+
+static int wil_memread_debugfs_show(struct seq_file *s, void *data)
+{
+        struct wil6210_priv *wil = s->private;
+        void __iomem *a = wmi_buffer(wil, cpu_to_le32(mem_addr));
+
+        if (a)
+                seq_printf(s, "[0x%08x] = 0x%08x\n", mem_addr, ioread32(a));
+        else
+                seq_printf(s, "[0x%08x] = INVALID\n", mem_addr);
+
+        return 0;
+}
+
+static int wil_memread_seq_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, wil_memread_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations fops_memread = {
+        .open           = wil_memread_seq_open,
+        .release        = single_release,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+};
+
+static int wil_default_open(struct inode *inode, struct file *file)
+{
+        if (inode->i_private)
+                file->private_data = inode->i_private;
+
+        return 0;
+}
+
+static ssize_t wil_read_file_ioblob(struct file *file, char __user *user_buf,
+                                size_t count, loff_t *ppos)
+{
+        enum { max_count = 4096 };
+        struct debugfs_blob_wrapper *blob = file->private_data;
+        loff_t pos = *ppos;
+        size_t available = blob->size;
+        void *buf;
+        size_t ret;
+
+        if (pos < 0)
+                return -EINVAL;
+
+        if (pos >= available || !count)
+                return 0;
+
+        if (count > available - pos)
+                count = available - pos;
+        if (count > max_count)
+                count = max_count;
+
+        buf = kmalloc(count, GFP_KERNEL);
+        if (!buf)
+                return -ENOMEM;
+
+        wil_memcpy_fromio_32(buf, (const volatile void __iomem *)blob->data +
+                             pos, count);
+
+        ret = copy_to_user(user_buf, buf, count);
+        kfree(buf);
+        if (ret == count)
+                return -EFAULT;
+
+        count -= ret;
+        *ppos = pos + count;
+
+        return count;
+}
+
+static const struct file_operations fops_ioblob = {
+        .read =         wil_read_file_ioblob,
+        .open =         wil_default_open,
+        .llseek =       default_llseek,
+};
+
+static
+struct dentry *wil_debugfs_create_ioblob(const char *name,
+                                         mode_t mode,
+                                         struct dentry *parent,
+                                         struct debugfs_blob_wrapper *blob)
+{
+        return debugfs_create_file(name, mode, parent, blob, &fops_ioblob);
+}
+/*---reset---*/
+static ssize_t wil_write_file_reset(struct file *file, const char __user *buf,
+                                    size_t len, loff_t *ppos)
+{
+        struct wil6210_priv *wil = file->private_data;
+        struct net_device *ndev = wil_to_ndev(wil);
+
+        /**
+         * BUG:
+         * this code does NOT sync device state with the rest of system
+         * use with care, debug only!!!
+         */
+        rtnl_lock();
+        dev_close(ndev);
+        ndev->flags &= ~IFF_UP;
+        rtnl_unlock();
+        wil_reset(wil);
+
+        return len;
+}
+
+static const struct file_operations fops_reset = {
+        .write = wil_write_file_reset,
+        .open  = wil_default_open,
+};
+/*---------Tx descriptor------------*/
+
+static int wil_txdesc_debugfs_show(struct seq_file *s, void *data)
+{
+        struct wil6210_priv *wil = s->private;
+        struct vring *vring = &(wil->vring_tx[0]);
+
+        if (!vring->va) {
+                seq_printf(s, "No Tx VRING\n");
+                return 0;
+        }
+
+        if (dbg_txdesc_index < vring->size) {
+                volatile struct vring_tx_desc *d =
+                                &(vring->va[dbg_txdesc_index].tx);
+                volatile u32 *u = (volatile u32 *)d;
+                struct sk_buff *skb = vring->ctx[dbg_txdesc_index];
+
+                seq_printf(s, "Tx[%3d] = {\n", dbg_txdesc_index);
+                seq_printf(s, "  MAC = 0x%08x 0x%08x 0x%08x 0x%08x\n",
+                           u[0], u[1], u[2], u[3]);
+                seq_printf(s, "  DMA = 0x%08x 0x%08x 0x%08x 0x%08x\n",
+                           u[4], u[5], u[6], u[7]);
+                seq_printf(s, "  SKB = %p\n", skb);
+
+                if (skb) {
+                        unsigned char printbuf[16 * 3 + 2];
+                        int i = 0;
+                        int len = skb_headlen(skb);
+                        void *p = skb->data;
+
+                        seq_printf(s, "    len = %d\n", len);
+
+                        while (i < len) {
+                                int l = min(len - i, 16);
+                                hex_dump_to_buffer(p + i, l, 16, 1, printbuf,
+                                                   sizeof(printbuf), false);
+                                seq_printf(s, "      : %s\n", printbuf);
+                                i += l;
+                        }
+                }
+                seq_printf(s, "}\n");
+        } else {
+                seq_printf(s, "TxDesc index (%d) >= size (%d)\n",
+                           dbg_txdesc_index, vring->size);
+        }
+
+        return 0;
+}
+
+static int wil_txdesc_seq_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, wil_txdesc_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations fops_txdesc = {
+        .open           = wil_txdesc_seq_open,
+        .release        = single_release,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+};
+
+/*---------beamforming------------*/
+static int wil_bf_debugfs_show(struct seq_file *s, void *data)
+{
+        struct wil6210_priv *wil = s->private;
+        seq_printf(s,
+                   "TSF : 0x%016llx\n"
+                   "TxMCS : %d\n"
+                   "Sectors(rx:tx) my %2d:%2d peer %2d:%2d\n",
+                   wil->stats.tsf, wil->stats.bf_mcs,
+                   wil->stats.my_rx_sector, wil->stats.my_tx_sector,
+                   wil->stats.peer_rx_sector, wil->stats.peer_tx_sector);
+        return 0;
+}
+
+static int wil_bf_seq_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, wil_bf_debugfs_show, inode->i_private);
+}
+
+static const struct file_operations fops_bf = {
+        .open           = wil_bf_seq_open,
+        .release        = single_release,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+};
+/*---------SSID------------*/
+static ssize_t wil_read_file_ssid(struct file *file, char __user *user_buf,
+                                  size_t count, loff_t *ppos)
+{
+        struct wil6210_priv *wil = file->private_data;
+        struct wireless_dev *wdev = wil_to_wdev(wil);
+
+        return simple_read_from_buffer(user_buf, count, ppos,
+                                       wdev->ssid, wdev->ssid_len);
+}
+
+static ssize_t wil_write_file_ssid(struct file *file, const char __user *buf,
+                                   size_t count, loff_t *ppos)
+{
+        struct wil6210_priv *wil = file->private_data;
+        struct wireless_dev *wdev = wil_to_wdev(wil);
+        struct net_device *ndev = wil_to_ndev(wil);
+
+        if (*ppos != 0) {
+                wil_err(wil, "Unable to set SSID substring from [%d]\n",
+                        (int)*ppos);
+                return -EINVAL;
+        }
+
+        if (count > sizeof(wdev->ssid)) {
+                wil_err(wil, "SSID too long, len = %d\n", (int)count);
+                return -EINVAL;
+        }
+        if (netif_running(ndev)) {
+                wil_err(wil, "Unable to change SSID on running interface\n");
+                return -EINVAL;
+        }
+
+        wdev->ssid_len = count;
+        return simple_write_to_buffer(wdev->ssid, wdev->ssid_len, ppos,
+                                      buf, count);
+}
+
+static const struct file_operations fops_ssid = {
+        .read = wil_read_file_ssid,
+        .write = wil_write_file_ssid,
+        .open  = wil_default_open,
+};
+
+/*----------------*/
+int wil6210_debugfs_init(struct wil6210_priv *wil)
+{
+        struct dentry *dbg = wil->debug = debugfs_create_dir(WIL_NAME,
+                        wil_to_wiphy(wil)->debugfsdir);
+
+        if (IS_ERR_OR_NULL(dbg))
+                return -ENODEV;
+
+        debugfs_create_file("mbox", S_IRUGO, dbg, wil, &fops_mbox);
+        debugfs_create_file("vrings", S_IRUGO, dbg, wil, &fops_vring);
+        debugfs_create_file("txdesc", S_IRUGO, dbg, wil, &fops_txdesc);
+        debugfs_create_u32("txdesc_index", S_IRUGO | S_IWUSR, dbg,
+                           &dbg_txdesc_index);
+        debugfs_create_file("bf", S_IRUGO, dbg, wil, &fops_bf);
+        debugfs_create_file("ssid", S_IRUGO | S_IWUSR, dbg, wil, &fops_ssid);
+        debugfs_create_u32("secure_pcp", S_IRUGO | S_IWUSR, dbg,
+                           &wil->secure_pcp);
+
+        wil6210_debugfs_create_ISR(wil, "USER_ICR", dbg,
+                                   HOSTADDR(RGF_USER_USER_ICR));
+        wil6210_debugfs_create_ISR(wil, "DMA_EP_TX_ICR", dbg,
+                                   HOSTADDR(RGF_DMA_EP_TX_ICR));
+        wil6210_debugfs_create_ISR(wil, "DMA_EP_RX_ICR", dbg,
+                                   HOSTADDR(RGF_DMA_EP_RX_ICR));
+        wil6210_debugfs_create_ISR(wil, "DMA_EP_MISC_ICR", dbg,
+                                   HOSTADDR(RGF_DMA_EP_MISC_ICR));
+        wil6210_debugfs_create_pseudo_ISR(wil, dbg);
+        wil6210_debugfs_create_ITR_CNT(wil, dbg);
+
+        debugfs_create_u32("mem_addr", S_IRUGO | S_IWUSR, dbg, &mem_addr);
+        debugfs_create_file("mem_val", S_IRUGO, dbg, wil, &fops_memread);
+
+        debugfs_create_file("reset", S_IWUSR, dbg, wil, &fops_reset);
+
+        wil->rgf_blob.data = (void * __force)wil->csr + 0;
+        wil->rgf_blob.size = 0xa000;
+        wil_debugfs_create_ioblob("blob_rgf", S_IRUGO, dbg, &wil->rgf_blob);
+
+        wil->fw_code_blob.data = (void * __force)wil->csr + 0x40000;
+        wil->fw_code_blob.size = 0x40000;
+        wil_debugfs_create_ioblob("blob_fw_code", S_IRUGO, dbg,
+                                  &wil->fw_code_blob);
+
+        wil->fw_data_blob.data = (void * __force)wil->csr + 0x80000;
+        wil->fw_data_blob.size = 0x8000;
+        wil_debugfs_create_ioblob("blob_fw_data", S_IRUGO, dbg,
+                                  &wil->fw_data_blob);
+
+        wil->fw_peri_blob.data = (void * __force)wil->csr + 0x88000;
+        wil->fw_peri_blob.size = 0x18000;
+        wil_debugfs_create_ioblob("blob_fw_peri", S_IRUGO, dbg,
+                                  &wil->fw_peri_blob);
+
+        wil->uc_code_blob.data = (void * __force)wil->csr + 0xa0000;
+        wil->uc_code_blob.size = 0x10000;
+        wil_debugfs_create_ioblob("blob_uc_code", S_IRUGO, dbg,
+                                  &wil->uc_code_blob);
+
+        wil->uc_data_blob.data = (void * __force)wil->csr + 0xb0000;
+        wil->uc_data_blob.size = 0x4000;
+        wil_debugfs_create_ioblob("blob_uc_data", S_IRUGO, dbg,
+                                  &wil->uc_data_blob);
+
+        return 0;
+}
+
+void wil6210_debugfs_remove(struct wil6210_priv *wil)
+{
+        debugfs_remove_recursive(wil->debug);
+        wil->debug = NULL;
+}
diff --git a/drivers/net/wireless/ath/wil6210/interrupt.c b/drivers/net/wireless/ath/wil6210/interrupt.c
new file mode 100644
index 000000000000..38049da71049
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/interrupt.c
@@ -0,0 +1,471 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/interrupt.h>
+
+#include "wil6210.h"
+
+/**
+ * Theory of operation:
+ *
+ * There is ISR pseudo-cause register,
+ * dma_rgf->DMA_RGF.PSEUDO_CAUSE.PSEUDO_CAUSE
+ * Its bits represents OR'ed bits from 3 real ISR registers:
+ * TX, RX, and MISC.
+ *
+ * Registers may be configured to either "write 1 to clear" or
+ * "clear on read" mode
+ *
+ * When handling interrupt, one have to mask/unmask interrupts for the
+ * real ISR registers, or hardware may malfunction.
+ *
+ */
+
+#define WIL6210_IRQ_DISABLE     (0xFFFFFFFFUL)
+#define WIL6210_IMC_RX          BIT_DMA_EP_RX_ICR_RX_DONE
+#define WIL6210_IMC_TX          (BIT_DMA_EP_TX_ICR_TX_DONE | \
+                                BIT_DMA_EP_TX_ICR_TX_DONE_N(0))
+#define WIL6210_IMC_MISC        (ISR_MISC_FW_READY | ISR_MISC_MBOX_EVT)
+
+#define WIL6210_IRQ_PSEUDO_MASK (u32)(~(BIT_DMA_PSEUDO_CAUSE_RX | \
+                                        BIT_DMA_PSEUDO_CAUSE_TX | \
+                                        BIT_DMA_PSEUDO_CAUSE_MISC))
+
+#if defined(CONFIG_WIL6210_ISR_COR)
+/* configure to Clear-On-Read mode */
+#define WIL_ICR_ICC_VALUE       (0xFFFFFFFFUL)
+
+static inline void wil_icr_clear(u32 x, void __iomem *addr)
+{
+
+}
+#else /* defined(CONFIG_WIL6210_ISR_COR) */
+/* configure to Write-1-to-Clear mode */
+#define WIL_ICR_ICC_VALUE       (0UL)
+
+static inline void wil_icr_clear(u32 x, void __iomem *addr)
+{
+        iowrite32(x, addr);
+}
+#endif /* defined(CONFIG_WIL6210_ISR_COR) */
+
+static inline u32 wil_ioread32_and_clear(void __iomem *addr)
+{
+        u32 x = ioread32(addr);
+
+        wil_icr_clear(x, addr);
+
+        return x;
+}
+
+static void wil6210_mask_irq_tx(struct wil6210_priv *wil)
+{
+        iowrite32(WIL6210_IRQ_DISABLE, wil->csr +
+                  HOSTADDR(RGF_DMA_EP_TX_ICR) +
+                  offsetof(struct RGF_ICR, IMS));
+}
+
+static void wil6210_mask_irq_rx(struct wil6210_priv *wil)
+{
+        iowrite32(WIL6210_IRQ_DISABLE, wil->csr +
+                  HOSTADDR(RGF_DMA_EP_RX_ICR) +
+                  offsetof(struct RGF_ICR, IMS));
+}
+
+static void wil6210_mask_irq_misc(struct wil6210_priv *wil)
+{
+        iowrite32(WIL6210_IRQ_DISABLE, wil->csr +
+                  HOSTADDR(RGF_DMA_EP_MISC_ICR) +
+                  offsetof(struct RGF_ICR, IMS));
+}
+
+static void wil6210_mask_irq_pseudo(struct wil6210_priv *wil)
+{
+        wil_dbg_IRQ(wil, "%s()\n", __func__);
+
+        iowrite32(WIL6210_IRQ_DISABLE, wil->csr +
+                  HOSTADDR(RGF_DMA_PSEUDO_CAUSE_MASK_SW));
+
+        clear_bit(wil_status_irqen, &wil->status);
+}
+
+static void wil6210_unmask_irq_tx(struct wil6210_priv *wil)
+{
+        iowrite32(WIL6210_IMC_TX, wil->csr +
+                  HOSTADDR(RGF_DMA_EP_TX_ICR) +
+                  offsetof(struct RGF_ICR, IMC));
+}
+
+static void wil6210_unmask_irq_rx(struct wil6210_priv *wil)
+{
+        iowrite32(WIL6210_IMC_RX, wil->csr +
+                  HOSTADDR(RGF_DMA_EP_RX_ICR) +
+                  offsetof(struct RGF_ICR, IMC));
+}
+
+static void wil6210_unmask_irq_misc(struct wil6210_priv *wil)
+{
+        iowrite32(WIL6210_IMC_MISC, wil->csr +
+                  HOSTADDR(RGF_DMA_EP_MISC_ICR) +
+                  offsetof(struct RGF_ICR, IMC));
+}
+
+static void wil6210_unmask_irq_pseudo(struct wil6210_priv *wil)
+{
+        wil_dbg_IRQ(wil, "%s()\n", __func__);
+
+        set_bit(wil_status_irqen, &wil->status);
+
+        iowrite32(WIL6210_IRQ_PSEUDO_MASK, wil->csr +
+                  HOSTADDR(RGF_DMA_PSEUDO_CAUSE_MASK_SW));
+}
+
+void wil6210_disable_irq(struct wil6210_priv *wil)
+{
+        wil_dbg_IRQ(wil, "%s()\n", __func__);
+
+        wil6210_mask_irq_tx(wil);
+        wil6210_mask_irq_rx(wil);
+        wil6210_mask_irq_misc(wil);
+        wil6210_mask_irq_pseudo(wil);
+}
+
+void wil6210_enable_irq(struct wil6210_priv *wil)
+{
+        wil_dbg_IRQ(wil, "%s()\n", __func__);
+
+        iowrite32(WIL_ICR_ICC_VALUE, wil->csr + HOSTADDR(RGF_DMA_EP_RX_ICR) +
+                  offsetof(struct RGF_ICR, ICC));
+        iowrite32(WIL_ICR_ICC_VALUE, wil->csr + HOSTADDR(RGF_DMA_EP_TX_ICR) +
+                  offsetof(struct RGF_ICR, ICC));
+        iowrite32(WIL_ICR_ICC_VALUE, wil->csr + HOSTADDR(RGF_DMA_EP_MISC_ICR) +
+                  offsetof(struct RGF_ICR, ICC));
+
+        wil6210_unmask_irq_pseudo(wil);
+        wil6210_unmask_irq_tx(wil);
+        wil6210_unmask_irq_rx(wil);
+        wil6210_unmask_irq_misc(wil);
+}
+
+static irqreturn_t wil6210_irq_rx(int irq, void *cookie)
+{
+        struct wil6210_priv *wil = cookie;
+        u32 isr = wil_ioread32_and_clear(wil->csr +
+                                         HOSTADDR(RGF_DMA_EP_RX_ICR) +
+                                         offsetof(struct RGF_ICR, ICR));
+
+        wil_dbg_IRQ(wil, "ISR RX 0x%08x\n", isr);
+
+        if (!isr) {
+                wil_err(wil, "spurious IRQ: RX\n");
+                return IRQ_NONE;
+        }
+
+        wil6210_mask_irq_rx(wil);
+
+        if (isr & BIT_DMA_EP_RX_ICR_RX_DONE) {
+                wil_dbg_IRQ(wil, "RX done\n");
+                isr &= ~BIT_DMA_EP_RX_ICR_RX_DONE;
+                wil_rx_handle(wil);
+        }
+
+        if (isr)
+                wil_err(wil, "un-handled RX ISR bits 0x%08x\n", isr);
+
+        wil6210_unmask_irq_rx(wil);
+
+        return IRQ_HANDLED;
+}
+
+static irqreturn_t wil6210_irq_tx(int irq, void *cookie)
+{
+        struct wil6210_priv *wil = cookie;
+        u32 isr = wil_ioread32_and_clear(wil->csr +
+                                         HOSTADDR(RGF_DMA_EP_TX_ICR) +
+                                         offsetof(struct RGF_ICR, ICR));
+
+        wil_dbg_IRQ(wil, "ISR TX 0x%08x\n", isr);
+
+        if (!isr) {
+                wil_err(wil, "spurious IRQ: TX\n");
+                return IRQ_NONE;
+        }
+
+        wil6210_mask_irq_tx(wil);
+
+        if (isr & BIT_DMA_EP_TX_ICR_TX_DONE) {
+                uint i;
+                wil_dbg_IRQ(wil, "TX done\n");
+                isr &= ~BIT_DMA_EP_TX_ICR_TX_DONE;
+                for (i = 0; i < 24; i++) {
+                        u32 mask = BIT_DMA_EP_TX_ICR_TX_DONE_N(i);
+                        if (isr & mask) {
+                                isr &= ~mask;
+                                wil_dbg_IRQ(wil, "TX done(%i)\n", i);
+                                wil_tx_complete(wil, i);
+                        }
+                }
+        }
+
+        if (isr)
+                wil_err(wil, "un-handled TX ISR bits 0x%08x\n", isr);
+
+        wil6210_unmask_irq_tx(wil);
+
+        return IRQ_HANDLED;
+}
+
+static irqreturn_t wil6210_irq_misc(int irq, void *cookie)
+{
+        struct wil6210_priv *wil = cookie;
+        u32 isr = wil_ioread32_and_clear(wil->csr +
+                                         HOSTADDR(RGF_DMA_EP_MISC_ICR) +
+                                         offsetof(struct RGF_ICR, ICR));
+
+        wil_dbg_IRQ(wil, "ISR MISC 0x%08x\n", isr);
+
+        if (!isr) {
+                wil_err(wil, "spurious IRQ: MISC\n");
+                return IRQ_NONE;
+        }
+
+        wil6210_mask_irq_misc(wil);
+
+        if (isr & ISR_MISC_FW_READY) {
+                wil_dbg_IRQ(wil, "IRQ: FW ready\n");
+                /**
+                 * Actual FW ready indicated by the
+                 * WMI_FW_READY_EVENTID
+                 */
+                isr &= ~ISR_MISC_FW_READY;
+        }
+
+        wil->isr_misc = isr;
+
+        if (isr) {
+                return IRQ_WAKE_THREAD;
+        } else {
+                wil6210_unmask_irq_misc(wil);
+                return IRQ_HANDLED;
+        }
+}
+
+static irqreturn_t wil6210_irq_misc_thread(int irq, void *cookie)
+{
+        struct wil6210_priv *wil = cookie;
+        u32 isr = wil->isr_misc;
+
+        wil_dbg_IRQ(wil, "Thread ISR MISC 0x%08x\n", isr);
+
+        if (isr & ISR_MISC_MBOX_EVT) {
+                wil_dbg_IRQ(wil, "MBOX event\n");
+                wmi_recv_cmd(wil);
+                isr &= ~ISR_MISC_MBOX_EVT;
+        }
+
+        if (isr)
+                wil_err(wil, "un-handled MISC ISR bits 0x%08x\n", isr);
+
+        wil->isr_misc = 0;
+
+        wil6210_unmask_irq_misc(wil);
+
+        return IRQ_HANDLED;
+}
+
+/**
+ * thread IRQ handler
+ */
+static irqreturn_t wil6210_thread_irq(int irq, void *cookie)
+{
+        struct wil6210_priv *wil = cookie;
+
+        wil_dbg_IRQ(wil, "Thread IRQ\n");
+        /* Discover real IRQ cause */
+        if (wil->isr_misc)
+                wil6210_irq_misc_thread(irq, cookie);
+
+        wil6210_unmask_irq_pseudo(wil);
+
+        return IRQ_HANDLED;
+}
+
+/* DEBUG
+ * There is subtle bug in hardware that causes IRQ to raise when it should be
+ * masked. It is quite rare and hard to debug.
+ *
+ * Catch irq issue if it happens and print all I can.
+ */
+static int wil6210_debug_irq_mask(struct wil6210_priv *wil, u32 pseudo_cause)
+{
+        if (!test_bit(wil_status_irqen, &wil->status)) {
+                u32 icm_rx = wil_ioread32_and_clear(wil->csr +
+                                HOSTADDR(RGF_DMA_EP_RX_ICR) +
+                                offsetof(struct RGF_ICR, ICM));
+                u32 icr_rx = wil_ioread32_and_clear(wil->csr +
+                                HOSTADDR(RGF_DMA_EP_RX_ICR) +
+                                offsetof(struct RGF_ICR, ICR));
+                u32 imv_rx = ioread32(wil->csr +
+                                HOSTADDR(RGF_DMA_EP_RX_ICR) +
+                                offsetof(struct RGF_ICR, IMV));
+                u32 icm_tx = wil_ioread32_and_clear(wil->csr +
+                                HOSTADDR(RGF_DMA_EP_TX_ICR) +
+                                offsetof(struct RGF_ICR, ICM));
+                u32 icr_tx = wil_ioread32_and_clear(wil->csr +
+                                HOSTADDR(RGF_DMA_EP_TX_ICR) +
+                                offsetof(struct RGF_ICR, ICR));
+                u32 imv_tx = ioread32(wil->csr +
+                                HOSTADDR(RGF_DMA_EP_TX_ICR) +
+                                offsetof(struct RGF_ICR, IMV));
+                u32 icm_misc = wil_ioread32_and_clear(wil->csr +
+                                HOSTADDR(RGF_DMA_EP_MISC_ICR) +
+                                offsetof(struct RGF_ICR, ICM));
+                u32 icr_misc = wil_ioread32_and_clear(wil->csr +
+                                HOSTADDR(RGF_DMA_EP_MISC_ICR) +
+                                offsetof(struct RGF_ICR, ICR));
+                u32 imv_misc = ioread32(wil->csr +
+                                HOSTADDR(RGF_DMA_EP_MISC_ICR) +
+                                offsetof(struct RGF_ICR, IMV));
+                wil_err(wil, "IRQ when it should be masked: pseudo 0x%08x\n"
+                                "Rx   icm:icr:imv 0x%08x 0x%08x 0x%08x\n"
+                                "Tx   icm:icr:imv 0x%08x 0x%08x 0x%08x\n"
+                                "Misc icm:icr:imv 0x%08x 0x%08x 0x%08x\n",
+                                pseudo_cause,
+                                icm_rx, icr_rx, imv_rx,
+                                icm_tx, icr_tx, imv_tx,
+                                icm_misc, icr_misc, imv_misc);
+
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
+static irqreturn_t wil6210_hardirq(int irq, void *cookie)
+{
+        irqreturn_t rc = IRQ_HANDLED;
+        struct wil6210_priv *wil = cookie;
+        u32 pseudo_cause = ioread32(wil->csr + HOSTADDR(RGF_DMA_PSEUDO_CAUSE));
+
+        /**
+         * pseudo_cause is Clear-On-Read, no need to ACK
+         */
+        if ((pseudo_cause == 0) || ((pseudo_cause & 0xff) == 0xff))
+                return IRQ_NONE;
+
+        /* FIXME: IRQ mask debug */
+        if (wil6210_debug_irq_mask(wil, pseudo_cause))
+                return IRQ_NONE;
+
+        wil6210_mask_irq_pseudo(wil);
+
+        /* Discover real IRQ cause
+         * There are 2 possible phases for every IRQ:
+         * - hard IRQ handler called right here
+         * - threaded handler called later
+         *
+         * Hard IRQ handler reads and clears ISR.
+         *
+         * If threaded handler requested, hard IRQ handler
+         * returns IRQ_WAKE_THREAD and saves ISR register value
+         * for the threaded handler use.
+         *
+         * voting for wake thread - need at least 1 vote
+         */
+        if ((pseudo_cause & BIT_DMA_PSEUDO_CAUSE_RX) &&
+            (wil6210_irq_rx(irq, cookie) == IRQ_WAKE_THREAD))
+                rc = IRQ_WAKE_THREAD;
+
+        if ((pseudo_cause & BIT_DMA_PSEUDO_CAUSE_TX) &&
+            (wil6210_irq_tx(irq, cookie) == IRQ_WAKE_THREAD))
+                rc = IRQ_WAKE_THREAD;
+
+        if ((pseudo_cause & BIT_DMA_PSEUDO_CAUSE_MISC) &&
+            (wil6210_irq_misc(irq, cookie) == IRQ_WAKE_THREAD))
+                rc = IRQ_WAKE_THREAD;
+
+        /* if thread is requested, it will unmask IRQ */
+        if (rc != IRQ_WAKE_THREAD)
+                wil6210_unmask_irq_pseudo(wil);
+
+        wil_dbg_IRQ(wil, "Hard IRQ 0x%08x\n", pseudo_cause);
+
+        return rc;
+}
+
+static int wil6210_request_3msi(struct wil6210_priv *wil, int irq)
+{
+        int rc;
+        /*
+         * IRQ's are in the following order:
+         * - Tx
+         * - Rx
+         * - Misc
+         */
+
+        rc = request_irq(irq, wil6210_irq_tx, IRQF_SHARED,
+                         WIL_NAME"_tx", wil);
+        if (rc)
+                return rc;
+
+        rc = request_irq(irq + 1, wil6210_irq_rx, IRQF_SHARED,
+                         WIL_NAME"_rx", wil);
+        if (rc)
+                goto free0;
+
+        rc = request_threaded_irq(irq + 2, wil6210_irq_misc,
+                                  wil6210_irq_misc_thread,
+                                  IRQF_SHARED, WIL_NAME"_misc", wil);
+        if (rc)
+                goto free1;
+
+        return 0;
+        /* error branch */
+free1:
+        free_irq(irq + 1, wil);
+free0:
+        free_irq(irq, wil);
+
+        return rc;
+}
+
+int wil6210_init_irq(struct wil6210_priv *wil, int irq)
+{
+        int rc;
+        if (wil->n_msi == 3)
+                rc = wil6210_request_3msi(wil, irq);
+        else
+                rc = request_threaded_irq(irq, wil6210_hardirq,
+                                          wil6210_thread_irq,
+                                          wil->n_msi ? 0 : IRQF_SHARED,
+                                          WIL_NAME, wil);
+        if (rc)
+                return rc;
+
+        wil6210_enable_irq(wil);
+
+        return 0;
+}
+
+void wil6210_fini_irq(struct wil6210_priv *wil, int irq)
+{
+        wil6210_disable_irq(wil);
+        free_irq(irq, wil);
+        if (wil->n_msi == 3) {
+                free_irq(irq + 1, wil);
+                free_irq(irq + 2, wil);
+        }
+}
diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c
new file mode 100644
index 000000000000..95fcd361322b
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/main.c
@@ -0,0 +1,407 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+#include <linux/sched.h>
+#include <linux/ieee80211.h>
+#include <linux/wireless.h>
+#include <linux/slab.h>
+#include <linux/moduleparam.h>
+#include <linux/if_arp.h>
+
+#include "wil6210.h"
+
+/*
+ * Due to a hardware issue,
+ * one has to read/write to/from NIC in 32-bit chunks;
+ * regular memcpy_fromio and siblings will
+ * not work on 64-bit platform - it uses 64-bit transactions
+ *
+ * Force 32-bit transactions to enable NIC on 64-bit platforms
+ *
+ * To avoid byte swap on big endian host, __raw_{read|write}l
+ * should be used - {read|write}l would swap bytes to provide
+ * little endian on PCI value in host endianness.
+ */
+void wil_memcpy_fromio_32(void *dst, const volatile void __iomem *src,
+                          size_t count)
+{
+        u32 *d = dst;
+        const volatile u32 __iomem *s = src;
+
+        /* size_t is unsigned, if (count%4 != 0) it will wrap */
+        for (count += 4; count > 4; count -= 4)
+                *d++ = __raw_readl(s++);
+}
+
+void wil_memcpy_toio_32(volatile void __iomem *dst, const void *src,
+                        size_t count)
+{
+        volatile u32 __iomem *d = dst;
+        const u32 *s = src;
+
+        for (count += 4; count > 4; count -= 4)
+                __raw_writel(*s++, d++);
+}
+
+static void _wil6210_disconnect(struct wil6210_priv *wil, void *bssid)
+{
+        uint i;
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct wireless_dev *wdev = wil->wdev;
+
+        wil_dbg(wil, "%s()\n", __func__);
+
+        wil_link_off(wil);
+        clear_bit(wil_status_fwconnected, &wil->status);
+
+        switch (wdev->sme_state) {
+        case CFG80211_SME_CONNECTED:
+                cfg80211_disconnected(ndev, WLAN_STATUS_UNSPECIFIED_FAILURE,
+                                      NULL, 0, GFP_KERNEL);
+                break;
+        case CFG80211_SME_CONNECTING:
+                cfg80211_connect_result(ndev, bssid, NULL, 0, NULL, 0,
+                                        WLAN_STATUS_UNSPECIFIED_FAILURE,
+                                        GFP_KERNEL);
+                break;
+        default:
+                ;
+        }
+
+        for (i = 0; i < ARRAY_SIZE(wil->vring_tx); i++)
+                wil_vring_fini_tx(wil, i);
+}
+
+static void wil_disconnect_worker(struct work_struct *work)
+{
+        struct wil6210_priv *wil = container_of(work,
+                        struct wil6210_priv, disconnect_worker);
+
+        _wil6210_disconnect(wil, NULL);
+}
+
+static void wil_connect_timer_fn(ulong x)
+{
+        struct wil6210_priv *wil = (void *)x;
+
+        wil_dbg(wil, "Connect timeout\n");
+
+        /* reschedule to thread context - disconnect won't
+         * run from atomic context
+         */
+        schedule_work(&wil->disconnect_worker);
+}
+
+int wil_priv_init(struct wil6210_priv *wil)
+{
+        wil_dbg(wil, "%s()\n", __func__);
+
+        mutex_init(&wil->mutex);
+        mutex_init(&wil->wmi_mutex);
+
+        init_completion(&wil->wmi_ready);
+
+        wil->pending_connect_cid = -1;
+        setup_timer(&wil->connect_timer, wil_connect_timer_fn, (ulong)wil);
+
+        INIT_WORK(&wil->wmi_connect_worker, wmi_connect_worker);
+        INIT_WORK(&wil->disconnect_worker, wil_disconnect_worker);
+        INIT_WORK(&wil->wmi_event_worker, wmi_event_worker);
+
+        INIT_LIST_HEAD(&wil->pending_wmi_ev);
+        spin_lock_init(&wil->wmi_ev_lock);
+
+        wil->wmi_wq = create_singlethread_workqueue(WIL_NAME"_wmi");
+        if (!wil->wmi_wq)
+                return -EAGAIN;
+
+        wil->wmi_wq_conn = create_singlethread_workqueue(WIL_NAME"_connect");
+        if (!wil->wmi_wq_conn) {
+                destroy_workqueue(wil->wmi_wq);
+                return -EAGAIN;
+        }
+
+        /* make shadow copy of registers that should not change on run time */
+        wil_memcpy_fromio_32(&wil->mbox_ctl, wil->csr + HOST_MBOX,
+                             sizeof(struct wil6210_mbox_ctl));
+        wil_mbox_ring_le2cpus(&wil->mbox_ctl.rx);
+        wil_mbox_ring_le2cpus(&wil->mbox_ctl.tx);
+
+        return 0;
+}
+
+void wil6210_disconnect(struct wil6210_priv *wil, void *bssid)
+{
+        del_timer_sync(&wil->connect_timer);
+        _wil6210_disconnect(wil, bssid);
+}
+
+void wil_priv_deinit(struct wil6210_priv *wil)
+{
+        cancel_work_sync(&wil->disconnect_worker);
+        wil6210_disconnect(wil, NULL);
+        wmi_event_flush(wil);
+        destroy_workqueue(wil->wmi_wq_conn);
+        destroy_workqueue(wil->wmi_wq);
+}
+
+static void wil_target_reset(struct wil6210_priv *wil)
+{
+        wil_dbg(wil, "Resetting...\n");
+
+        /* register write */
+#define W(a, v) iowrite32(v, wil->csr + HOSTADDR(a))
+        /* register set = read, OR, write */
+#define S(a, v) iowrite32(ioread32(wil->csr + HOSTADDR(a)) | v, \
+                wil->csr + HOSTADDR(a))
+
+        /* hpal_perst_from_pad_src_n_mask */
+        S(RGF_USER_CLKS_CTL_SW_RST_MASK_0, BIT(6));
+        /* car_perst_rst_src_n_mask */
+        S(RGF_USER_CLKS_CTL_SW_RST_MASK_0, BIT(7));
+
+        W(RGF_USER_MAC_CPU_0,  BIT(1)); /* mac_cpu_man_rst */
+        W(RGF_USER_USER_CPU_0, BIT(1)); /* user_cpu_man_rst */
+
+        msleep(100);
+
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0xFE000000);
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_1, 0x0000003F);
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, 0x00000170);
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_0, 0xFFE7FC00);
+
+        msleep(100);
+
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, 0);
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0);
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_1, 0);
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_0, 0);
+
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_3, 0x00000001);
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_2, 0x00000080);
+        W(RGF_USER_CLKS_CTL_SW_RST_VEC_0, 0);
+
+        msleep(2000);
+
+        W(RGF_USER_USER_CPU_0, BIT(0)); /* user_cpu_man_de_rst */
+
+        msleep(2000);
+
+        wil_dbg(wil, "Reset completed\n");
+
+#undef W
+#undef S
+}
+
+void wil_mbox_ring_le2cpus(struct wil6210_mbox_ring *r)
+{
+        le32_to_cpus(&r->base);
+        le16_to_cpus(&r->entry_size);
+        le16_to_cpus(&r->size);
+        le32_to_cpus(&r->tail);
+        le32_to_cpus(&r->head);
+}
+
+static int wil_wait_for_fw_ready(struct wil6210_priv *wil)
+{
+        ulong to = msecs_to_jiffies(1000);
+        ulong left = wait_for_completion_timeout(&wil->wmi_ready, to);
+        if (0 == left) {
+                wil_err(wil, "Firmware not ready\n");
+                return -ETIME;
+        } else {
+                wil_dbg(wil, "FW ready after %d ms\n",
+                        jiffies_to_msecs(to-left));
+        }
+        return 0;
+}
+
+/*
+ * We reset all the structures, and we reset the UMAC.
+ * After calling this routine, you're expected to reload
+ * the firmware.
+ */
+int wil_reset(struct wil6210_priv *wil)
+{
+        int rc;
+
+        cancel_work_sync(&wil->disconnect_worker);
+        wil6210_disconnect(wil, NULL);
+
+        wmi_event_flush(wil);
+
+        flush_workqueue(wil->wmi_wq);
+        flush_workqueue(wil->wmi_wq_conn);
+
+        wil6210_disable_irq(wil);
+        wil->status = 0;
+
+        /* TODO: put MAC in reset */
+        wil_target_reset(wil);
+
+        /* init after reset */
+        wil->pending_connect_cid = -1;
+        INIT_COMPLETION(wil->wmi_ready);
+
+        /* make shadow copy of registers that should not change on run time */
+        wil_memcpy_fromio_32(&wil->mbox_ctl, wil->csr + HOST_MBOX,
+                             sizeof(struct wil6210_mbox_ctl));
+        wil_mbox_ring_le2cpus(&wil->mbox_ctl.rx);
+        wil_mbox_ring_le2cpus(&wil->mbox_ctl.tx);
+
+        /* TODO: release MAC reset */
+        wil6210_enable_irq(wil);
+
+        /* we just started MAC, wait for FW ready */
+        rc = wil_wait_for_fw_ready(wil);
+
+        return rc;
+}
+
+
+void wil_link_on(struct wil6210_priv *wil)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+
+        wil_dbg(wil, "%s()\n", __func__);
+
+        netif_carrier_on(ndev);
+        netif_tx_wake_all_queues(ndev);
+}
+
+void wil_link_off(struct wil6210_priv *wil)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+
+        wil_dbg(wil, "%s()\n", __func__);
+
+        netif_tx_stop_all_queues(ndev);
+        netif_carrier_off(ndev);
+}
+
+static int __wil_up(struct wil6210_priv *wil)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct wireless_dev *wdev = wil->wdev;
+        struct ieee80211_channel *channel = wdev->preset_chandef.chan;
+        int rc;
+        int bi;
+        u16 wmi_nettype = wil_iftype_nl2wmi(wdev->iftype);
+
+        rc = wil_reset(wil);
+        if (rc)
+                return rc;
+
+        /* FIXME Firmware works now in PBSS mode(ToDS=0, FromDS=0) */
+        wmi_nettype = wil_iftype_nl2wmi(NL80211_IFTYPE_ADHOC);
+        switch (wdev->iftype) {
+        case NL80211_IFTYPE_STATION:
+                wil_dbg(wil, "type: STATION\n");
+                bi = 0;
+                ndev->type = ARPHRD_ETHER;
+                break;
+        case NL80211_IFTYPE_AP:
+                wil_dbg(wil, "type: AP\n");
+                bi = 100;
+                ndev->type = ARPHRD_ETHER;
+                break;
+        case NL80211_IFTYPE_P2P_CLIENT:
+                wil_dbg(wil, "type: P2P_CLIENT\n");
+                bi = 0;
+                ndev->type = ARPHRD_ETHER;
+                break;
+        case NL80211_IFTYPE_P2P_GO:
+                wil_dbg(wil, "type: P2P_GO\n");
+                bi = 100;
+                ndev->type = ARPHRD_ETHER;
+                break;
+        case NL80211_IFTYPE_MONITOR:
+                wil_dbg(wil, "type: Monitor\n");
+                bi = 0;
+                ndev->type = ARPHRD_IEEE80211_RADIOTAP;
+                /* ARPHRD_IEEE80211 or ARPHRD_IEEE80211_RADIOTAP ? */
+                break;
+        default:
+                return -EOPNOTSUPP;
+        }
+
+        /* Apply profile in the following order: */
+        /* SSID and channel for the AP */
+        switch (wdev->iftype) {
+        case NL80211_IFTYPE_AP:
+        case NL80211_IFTYPE_P2P_GO:
+                if (wdev->ssid_len == 0) {
+                        wil_err(wil, "SSID not set\n");
+                        return -EINVAL;
+                }
+                wmi_set_ssid(wil, wdev->ssid_len, wdev->ssid);
+                if (channel)
+                        wmi_set_channel(wil, channel->hw_value);
+                break;
+        default:
+                ;
+        }
+
+        /* MAC address - pre-requisite for other commands */
+        wmi_set_mac_address(wil, ndev->dev_addr);
+
+        /* Set up beaconing if required. */
+        rc = wmi_set_bcon(wil, bi, wmi_nettype);
+        if (rc)
+                return rc;
+
+        /* Rx VRING. After MAC and beacon */
+        wil_rx_init(wil);
+
+        return 0;
+}
+
+int wil_up(struct wil6210_priv *wil)
+{
+        int rc;
+
+        mutex_lock(&wil->mutex);
+        rc = __wil_up(wil);
+        mutex_unlock(&wil->mutex);
+
+        return rc;
+}
+
+static int __wil_down(struct wil6210_priv *wil)
+{
+        if (wil->scan_request) {
+                cfg80211_scan_done(wil->scan_request, true);
+                wil->scan_request = NULL;
+        }
+
+        wil6210_disconnect(wil, NULL);
+        wil_rx_fini(wil);
+
+        return 0;
+}
+
+int wil_down(struct wil6210_priv *wil)
+{
+        int rc;
+
+        mutex_lock(&wil->mutex);
+        rc = __wil_down(wil);
+        mutex_unlock(&wil->mutex);
+
+        return rc;
+}
diff --git a/drivers/net/wireless/ath/wil6210/netdev.c b/drivers/net/wireless/ath/wil6210/netdev.c
new file mode 100644
index 000000000000..3068b5cb53a7
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/netdev.c
@@ -0,0 +1,157 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/module.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/slab.h>
+
+#include "wil6210.h"
+
+static int wil_open(struct net_device *ndev)
+{
+        struct wil6210_priv *wil = ndev_to_wil(ndev);
+
+        return wil_up(wil);
+}
+
+static int wil_stop(struct net_device *ndev)
+{
+        struct wil6210_priv *wil = ndev_to_wil(ndev);
+
+        return wil_down(wil);
+}
+
+/*
+ * AC to queue mapping
+ *
+ * AC_VO -> queue 3
+ * AC_VI -> queue 2
+ * AC_BE -> queue 1
+ * AC_BK -> queue 0
+ */
+static u16 wil_select_queue(struct net_device *ndev, struct sk_buff *skb)
+{
+        static const u16 wil_1d_to_queue[8] = { 1, 0, 0, 1, 2, 2, 3, 3 };
+        struct wil6210_priv *wil = ndev_to_wil(ndev);
+        u16 rc;
+
+        skb->priority = cfg80211_classify8021d(skb);
+
+        rc = wil_1d_to_queue[skb->priority];
+
+        wil_dbg_TXRX(wil, "%s() %d -> %d\n", __func__, (int)skb->priority,
+                     (int)rc);
+
+        return rc;
+}
+
+static const struct net_device_ops wil_netdev_ops = {
+        .ndo_open               = wil_open,
+        .ndo_stop               = wil_stop,
+        .ndo_start_xmit         = wil_start_xmit,
+        .ndo_select_queue       = wil_select_queue,
+        .ndo_set_mac_address    = eth_mac_addr,
+        .ndo_validate_addr      = eth_validate_addr,
+};
+
+void *wil_if_alloc(struct device *dev, void __iomem *csr)
+{
+        struct net_device *ndev;
+        struct wireless_dev *wdev;
+        struct wil6210_priv *wil;
+        struct ieee80211_channel *ch;
+        int rc = 0;
+
+        wdev = wil_cfg80211_init(dev);
+        if (IS_ERR(wdev)) {
+                dev_err(dev, "wil_cfg80211_init failed\n");
+                return wdev;
+        }
+
+        wil = wdev_to_wil(wdev);
+        wil->csr = csr;
+        wil->wdev = wdev;
+
+        rc = wil_priv_init(wil);
+        if (rc) {
+                dev_err(dev, "wil_priv_init failed\n");
+                goto out_wdev;
+        }
+
+        wdev->iftype = NL80211_IFTYPE_STATION; /* TODO */
+        /* default monitor channel */
+        ch = wdev->wiphy->bands[IEEE80211_BAND_60GHZ]->channels;
+        cfg80211_chandef_create(&wdev->preset_chandef, ch, NL80211_CHAN_NO_HT);
+
+        ndev = alloc_netdev_mqs(0, "wlan%d", ether_setup, WIL6210_TX_QUEUES, 1);
+        if (!ndev) {
+                dev_err(dev, "alloc_netdev_mqs failed\n");
+                rc = -ENOMEM;
+                goto out_priv;
+        }
+
+        ndev->netdev_ops = &wil_netdev_ops;
+        ndev->ieee80211_ptr = wdev;
+        SET_NETDEV_DEV(ndev, wiphy_dev(wdev->wiphy));
+        wdev->netdev = ndev;
+
+        wil_link_off(wil);
+
+        return wil;
+
+ out_priv:
+        wil_priv_deinit(wil);
+
+ out_wdev:
+        wil_wdev_free(wil);
+
+        return ERR_PTR(rc);
+}
+
+void wil_if_free(struct wil6210_priv *wil)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        if (!ndev)
+                return;
+
+        free_netdev(ndev);
+        wil_priv_deinit(wil);
+        wil_wdev_free(wil);
+}
+
+int wil_if_add(struct wil6210_priv *wil)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        int rc;
+
+        rc = register_netdev(ndev);
+        if (rc < 0) {
+                dev_err(&ndev->dev, "Failed to register netdev: %d\n", rc);
+                return rc;
+        }
+
+        wil_link_off(wil);
+
+        return 0;
+}
+
+void wil_if_remove(struct wil6210_priv *wil)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+
+        unregister_netdev(ndev);
+}
diff --git a/drivers/net/wireless/ath/wil6210/pcie_bus.c b/drivers/net/wireless/ath/wil6210/pcie_bus.c
new file mode 100644
index 000000000000..0fc83edd6bad
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/pcie_bus.c
@@ -0,0 +1,223 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/netdevice.h>
+#include <linux/debugfs.h>
+#include <linux/pci.h>
+#include <linux/moduleparam.h>
+
+#include "wil6210.h"
+
+static int use_msi = 1;
+module_param(use_msi, int, S_IRUGO);
+MODULE_PARM_DESC(use_msi,
+                 " Use MSI interrupt: "
+                 "0 - don't, 1 - (default) - single, or 3");
+
+/* Bus ops */
+static int wil_if_pcie_enable(struct wil6210_priv *wil)
+{
+        struct pci_dev *pdev = wil->pdev;
+        int rc;
+
+        pci_set_master(pdev);
+
+        /*
+         * how many MSI interrupts to request?
+         */
+        switch (use_msi) {
+        case 3:
+        case 1:
+        case 0:
+                break;
+        default:
+                wil_err(wil, "Invalid use_msi=%d, default to 1\n",
+                        use_msi);
+                use_msi = 1;
+        }
+        wil->n_msi = use_msi;
+        if (wil->n_msi) {
+                wil_dbg(wil, "Setup %d MSI interrupts\n", use_msi);
+                rc = pci_enable_msi_block(pdev, wil->n_msi);
+                if (rc && (wil->n_msi == 3)) {
+                        wil_err(wil, "3 MSI mode failed, try 1 MSI\n");
+                        wil->n_msi = 1;
+                        rc = pci_enable_msi_block(pdev, wil->n_msi);
+                }
+                if (rc) {
+                        wil_err(wil, "pci_enable_msi failed, use INTx\n");
+                        wil->n_msi = 0;
+                }
+        } else {
+                wil_dbg(wil, "MSI interrupts disabled, use INTx\n");
+        }
+
+        rc = wil6210_init_irq(wil, pdev->irq);
+        if (rc)
+                goto stop_master;
+
+        /* need reset here to obtain MAC */
+        rc = wil_reset(wil);
+        if (rc)
+                goto release_irq;
+
+        return 0;
+
+ release_irq:
+        wil6210_fini_irq(wil, pdev->irq);
+        /* safe to call if no MSI */
+        pci_disable_msi(pdev);
+ stop_master:
+        pci_clear_master(pdev);
+        return rc;
+}
+
+static int wil_if_pcie_disable(struct wil6210_priv *wil)
+{
+        struct pci_dev *pdev = wil->pdev;
+
+        pci_clear_master(pdev);
+        /* disable and release IRQ */
+        wil6210_fini_irq(wil, pdev->irq);
+        /* safe to call if no MSI */
+        pci_disable_msi(pdev);
+        /* TODO: disable HW */
+
+        return 0;
+}
+
+static int wil_pcie_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+{
+        struct wil6210_priv *wil;
+        struct device *dev = &pdev->dev;
+        void __iomem *csr;
+        int rc;
+
+        /* check HW */
+        dev_info(&pdev->dev, WIL_NAME " device found [%04x:%04x] (rev %x)\n",
+                 (int)pdev->vendor, (int)pdev->device, (int)pdev->revision);
+
+        if (pci_resource_len(pdev, 0) != WIL6210_MEM_SIZE) {
+                dev_err(&pdev->dev, "Not " WIL_NAME "? "
+                        "BAR0 size is %lu while expecting %lu\n",
+                        (ulong)pci_resource_len(pdev, 0), WIL6210_MEM_SIZE);
+                return -ENODEV;
+        }
+
+        rc = pci_enable_device(pdev);
+        if (rc) {
+                dev_err(&pdev->dev, "pci_enable_device failed\n");
+                return -ENODEV;
+        }
+        /* rollback to err_disable_pdev */
+
+        rc = pci_request_region(pdev, 0, WIL_NAME);
+        if (rc) {
+                dev_err(&pdev->dev, "pci_request_region failed\n");
+                goto err_disable_pdev;
+        }
+        /* rollback to err_release_reg */
+
+        csr = pci_ioremap_bar(pdev, 0);
+        if (!csr) {
+                dev_err(&pdev->dev, "pci_ioremap_bar failed\n");
+                rc = -ENODEV;
+                goto err_release_reg;
+        }
+        /* rollback to err_iounmap */
+        dev_info(&pdev->dev, "CSR at %pR -> %p\n", &pdev->resource[0], csr);
+
+        wil = wil_if_alloc(dev, csr);
+        if (IS_ERR(wil)) {
+                rc = (int)PTR_ERR(wil);
+                dev_err(dev, "wil_if_alloc failed: %d\n", rc);
+                goto err_iounmap;
+        }
+        /* rollback to if_free */
+
+        pci_set_drvdata(pdev, wil);
+        wil->pdev = pdev;
+
+        /* FW should raise IRQ when ready */
+        rc = wil_if_pcie_enable(wil);
+        if (rc) {
+                wil_err(wil, "Enable device failed\n");
+                goto if_free;
+        }
+        /* rollback to bus_disable */
+
+        rc = wil_if_add(wil);
+        if (rc) {
+                wil_err(wil, "wil_if_add failed: %d\n", rc);
+                goto bus_disable;
+        }
+
+        wil6210_debugfs_init(wil);
+
+        /* check FW is alive */
+        wmi_echo(wil);
+
+        return 0;
+
+ bus_disable:
+        wil_if_pcie_disable(wil);
+ if_free:
+        wil_if_free(wil);
+ err_iounmap:
+        pci_iounmap(pdev, csr);
+ err_release_reg:
+        pci_release_region(pdev, 0);
+ err_disable_pdev:
+        pci_disable_device(pdev);
+
+        return rc;
+}
+
+static void wil_pcie_remove(struct pci_dev *pdev)
+{
+        struct wil6210_priv *wil = pci_get_drvdata(pdev);
+
+        wil6210_debugfs_remove(wil);
+        wil_if_pcie_disable(wil);
+        wil_if_remove(wil);
+        wil_if_free(wil);
+        pci_iounmap(pdev, wil->csr);
+        pci_release_region(pdev, 0);
+        pci_disable_device(pdev);
+        pci_set_drvdata(pdev, NULL);
+}
+
+static DEFINE_PCI_DEVICE_TABLE(wil6210_pcie_ids) = {
+        { PCI_DEVICE(0x1ae9, 0x0301) },
+        { /* end: all zeroes */ },
+};
+MODULE_DEVICE_TABLE(pci, wil6210_pcie_ids);
+
+static struct pci_driver wil6210_driver = {
+        .probe          = wil_pcie_probe,
+        .remove         = wil_pcie_remove,
+        .id_table       = wil6210_pcie_ids,
+        .name           = WIL_NAME,
+};
+
+module_pci_driver(wil6210_driver);
+
+MODULE_LICENSE("Dual BSD/GPL");
+MODULE_AUTHOR("Qualcomm Atheros <wil6210@qca.qualcomm.com>");
+MODULE_DESCRIPTION("Driver for 60g WiFi WIL6210 card");
diff --git a/drivers/net/wireless/ath/wil6210/txrx.c b/drivers/net/wireless/ath/wil6210/txrx.c
new file mode 100644
index 000000000000..f29c294413cf
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/txrx.c
@@ -0,0 +1,871 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/kernel.h>
+#include <linux/netdevice.h>
+#include <linux/etherdevice.h>
+#include <linux/hardirq.h>
+#include <net/ieee80211_radiotap.h>
+#include <linux/if_arp.h>
+#include <linux/moduleparam.h>
+
+#include "wil6210.h"
+#include "wmi.h"
+#include "txrx.h"
+
+static bool rtap_include_phy_info;
+module_param(rtap_include_phy_info, bool, S_IRUGO);
+MODULE_PARM_DESC(rtap_include_phy_info,
+                 " Include PHY info in the radiotap header, default - no");
+
+static inline int wil_vring_is_empty(struct vring *vring)
+{
+        return vring->swhead == vring->swtail;
+}
+
+static inline u32 wil_vring_next_tail(struct vring *vring)
+{
+        return (vring->swtail + 1) % vring->size;
+}
+
+static inline void wil_vring_advance_head(struct vring *vring, int n)
+{
+        vring->swhead = (vring->swhead + n) % vring->size;
+}
+
+static inline int wil_vring_is_full(struct vring *vring)
+{
+        return wil_vring_next_tail(vring) == vring->swhead;
+}
+/*
+ * Available space in Tx Vring
+ */
+static inline int wil_vring_avail_tx(struct vring *vring)
+{
+        u32 swhead = vring->swhead;
+        u32 swtail = vring->swtail;
+        int used = (vring->size + swhead - swtail) % vring->size;
+
+        return vring->size - used - 1;
+}
+
+static int wil_vring_alloc(struct wil6210_priv *wil, struct vring *vring)
+{
+        struct device *dev = wil_to_dev(wil);
+        size_t sz = vring->size * sizeof(vring->va[0]);
+        uint i;
+
+        BUILD_BUG_ON(sizeof(vring->va[0]) != 32);
+
+        vring->swhead = 0;
+        vring->swtail = 0;
+        vring->ctx = kzalloc(vring->size * sizeof(vring->ctx[0]), GFP_KERNEL);
+        if (!vring->ctx) {
+                wil_err(wil, "vring_alloc [%d] failed to alloc ctx mem\n",
+                        vring->size);
+                vring->va = NULL;
+                return -ENOMEM;
+        }
+        /*
+         * vring->va should be aligned on its size rounded up to power of 2
+         * This is granted by the dma_alloc_coherent
+         */
+        vring->va = dma_alloc_coherent(dev, sz, &vring->pa, GFP_KERNEL);
+        if (!vring->va) {
+                wil_err(wil, "vring_alloc [%d] failed to alloc DMA mem\n",
+                        vring->size);
+                kfree(vring->ctx);
+                vring->ctx = NULL;
+                return -ENOMEM;
+        }
+        /* initially, all descriptors are SW owned
+         * For Tx and Rx, ownership bit is at the same location, thus
+         * we can use any
+         */
+        for (i = 0; i < vring->size; i++) {
+                volatile struct vring_tx_desc *d = &(vring->va[i].tx);
+                d->dma.status = TX_DMA_STATUS_DU;
+        }
+
+        wil_dbg(wil, "vring[%d] 0x%p:0x%016llx 0x%p\n", vring->size,
+                vring->va, (unsigned long long)vring->pa, vring->ctx);
+
+        return 0;
+}
+
+static void wil_vring_free(struct wil6210_priv *wil, struct vring *vring,
+                           int tx)
+{
+        struct device *dev = wil_to_dev(wil);
+        size_t sz = vring->size * sizeof(vring->va[0]);
+
+        while (!wil_vring_is_empty(vring)) {
+                if (tx) {
+                        volatile struct vring_tx_desc *d =
+                                        &vring->va[vring->swtail].tx;
+                        dma_addr_t pa = d->dma.addr_low |
+                                        ((u64)d->dma.addr_high << 32);
+                        struct sk_buff *skb = vring->ctx[vring->swtail];
+                        if (skb) {
+                                dma_unmap_single(dev, pa, d->dma.length,
+                                                 DMA_TO_DEVICE);
+                                dev_kfree_skb_any(skb);
+                                vring->ctx[vring->swtail] = NULL;
+                        } else {
+                                dma_unmap_page(dev, pa, d->dma.length,
+                                               DMA_TO_DEVICE);
+                        }
+                        vring->swtail = wil_vring_next_tail(vring);
+                } else { /* rx */
+                        volatile struct vring_rx_desc *d =
+                                        &vring->va[vring->swtail].rx;
+                        dma_addr_t pa = d->dma.addr_low |
+                                        ((u64)d->dma.addr_high << 32);
+                        struct sk_buff *skb = vring->ctx[vring->swhead];
+                        dma_unmap_single(dev, pa, d->dma.length,
+                                         DMA_FROM_DEVICE);
+                        kfree_skb(skb);
+                        wil_vring_advance_head(vring, 1);
+                }
+        }
+        dma_free_coherent(dev, sz, (void *)vring->va, vring->pa);
+        kfree(vring->ctx);
+        vring->pa = 0;
+        vring->va = NULL;
+        vring->ctx = NULL;
+}
+
+/**
+ * Allocate one skb for Rx VRING
+ *
+ * Safe to call from IRQ
+ */
+static int wil_vring_alloc_skb(struct wil6210_priv *wil, struct vring *vring,
+                               u32 i, int headroom)
+{
+        struct device *dev = wil_to_dev(wil);
+        unsigned int sz = RX_BUF_LEN;
+        volatile struct vring_rx_desc *d = &(vring->va[i].rx);
+        dma_addr_t pa;
+
+        /* TODO align */
+        struct sk_buff *skb = dev_alloc_skb(sz + headroom);
+        if (unlikely(!skb))
+                return -ENOMEM;
+
+        skb_reserve(skb, headroom);
+        skb_put(skb, sz);
+
+        pa = dma_map_single(dev, skb->data, skb->len, DMA_FROM_DEVICE);
+        if (unlikely(dma_mapping_error(dev, pa))) {
+                kfree_skb(skb);
+                return -ENOMEM;
+        }
+
+        d->dma.d0 = BIT(9) | RX_DMA_D0_CMD_DMA_IT;
+        d->dma.addr_low = lower_32_bits(pa);
+        d->dma.addr_high = (u16)upper_32_bits(pa);
+        /* ip_length don't care */
+        /* b11 don't care */
+        /* error don't care */
+        d->dma.status = 0; /* BIT(0) should be 0 for HW_OWNED */
+        d->dma.length = sz;
+        vring->ctx[i] = skb;
+
+        return 0;
+}
+
+/**
+ * Adds radiotap header
+ *
+ * Any error indicated as "Bad FCS"
+ *
+ * Vendor data for 04:ce:14-1 (Wilocity-1) consists of:
+ *  - Rx descriptor: 32 bytes
+ *  - Phy info
+ */
+static void wil_rx_add_radiotap_header(struct wil6210_priv *wil,
+                                       struct sk_buff *skb,
+                                       volatile struct vring_rx_desc *d)
+{
+        struct wireless_dev *wdev = wil->wdev;
+        struct wil6210_rtap {
+                struct ieee80211_radiotap_header rthdr;
+                /* fields should be in the order of bits in rthdr.it_present */
+                /* flags */
+                u8 flags;
+                /* channel */
+                __le16 chnl_freq __aligned(2);
+                __le16 chnl_flags;
+                /* MCS */
+                u8 mcs_present;
+                u8 mcs_flags;
+                u8 mcs_index;
+        } __packed;
+        struct wil6210_rtap_vendor {
+                struct wil6210_rtap rtap;
+                /* vendor */
+                u8 vendor_oui[3] __aligned(2);
+                u8 vendor_ns;
+                __le16 vendor_skip;
+                u8 vendor_data[0];
+        } __packed;
+        struct wil6210_rtap_vendor *rtap_vendor;
+        int rtap_len = sizeof(struct wil6210_rtap);
+        int phy_length = 0; /* phy info header size, bytes */
+        static char phy_data[128];
+        struct ieee80211_channel *ch = wdev->preset_chandef.chan;
+
+        if (rtap_include_phy_info) {
+                rtap_len = sizeof(*rtap_vendor) + sizeof(*d);
+                /* calculate additional length */
+                if (d->dma.status & RX_DMA_STATUS_PHY_INFO) {
+                        /**
+                         * PHY info starts from 8-byte boundary
+                         * there are 8-byte lines, last line may be partially
+                         * written (HW bug), thus FW configures for last line
+                         * to be excessive. Driver skips this last line.
+                         */
+                        int len = min_t(int, 8 + sizeof(phy_data),
+                                        wil_rxdesc_phy_length(d));
+                        if (len > 8) {
+                                void *p = skb_tail_pointer(skb);
+                                void *pa = PTR_ALIGN(p, 8);
+                                if (skb_tailroom(skb) >= len + (pa - p)) {
+                                        phy_length = len - 8;
+                                        memcpy(phy_data, pa, phy_length);
+                                }
+                        }
+                }
+                rtap_len += phy_length;
+        }
+
+        if (skb_headroom(skb) < rtap_len &&
+            pskb_expand_head(skb, rtap_len, 0, GFP_ATOMIC)) {
+                wil_err(wil, "Unable to expand headrom to %d\n", rtap_len);
+                return;
+        }
+
+        rtap_vendor = (void *)skb_push(skb, rtap_len);
+        memset(rtap_vendor, 0, rtap_len);
+
+        rtap_vendor->rtap.rthdr.it_version = PKTHDR_RADIOTAP_VERSION;
+        rtap_vendor->rtap.rthdr.it_len = cpu_to_le16(rtap_len);
+        rtap_vendor->rtap.rthdr.it_present = cpu_to_le32(
+                        (1 << IEEE80211_RADIOTAP_FLAGS) |
+                        (1 << IEEE80211_RADIOTAP_CHANNEL) |
+                        (1 << IEEE80211_RADIOTAP_MCS));
+        if (d->dma.status & RX_DMA_STATUS_ERROR)
+                rtap_vendor->rtap.flags |= IEEE80211_RADIOTAP_F_BADFCS;
+
+        rtap_vendor->rtap.chnl_freq = cpu_to_le16(ch ? ch->center_freq : 58320);
+        rtap_vendor->rtap.chnl_flags = cpu_to_le16(0);
+
+        rtap_vendor->rtap.mcs_present = IEEE80211_RADIOTAP_MCS_HAVE_MCS;
+        rtap_vendor->rtap.mcs_flags = 0;
+        rtap_vendor->rtap.mcs_index = wil_rxdesc_mcs(d);
+
+        if (rtap_include_phy_info) {
+                rtap_vendor->rtap.rthdr.it_present |= cpu_to_le32(1 <<
+                                IEEE80211_RADIOTAP_VENDOR_NAMESPACE);
+                /* OUI for Wilocity 04:ce:14 */
+                rtap_vendor->vendor_oui[0] = 0x04;
+                rtap_vendor->vendor_oui[1] = 0xce;
+                rtap_vendor->vendor_oui[2] = 0x14;
+                rtap_vendor->vendor_ns = 1;
+                /* Rx descriptor + PHY data  */
+                rtap_vendor->vendor_skip = cpu_to_le16(sizeof(*d) +
+                                                       phy_length);
+                memcpy(rtap_vendor->vendor_data, (void *)d, sizeof(*d));
+                memcpy(rtap_vendor->vendor_data + sizeof(*d), phy_data,
+                       phy_length);
+        }
+}
+
+/*
+ * Fast swap in place between 2 registers
+ */
+static void wil_swap_u16(u16 *a, u16 *b)
+{
+        *a ^= *b;
+        *b ^= *a;
+        *a ^= *b;
+}
+
+static void wil_swap_ethaddr(void *data)
+{
+        struct ethhdr *eth = data;
+        u16 *s = (u16 *)eth->h_source;
+        u16 *d = (u16 *)eth->h_dest;
+
+        wil_swap_u16(s++, d++);
+        wil_swap_u16(s++, d++);
+        wil_swap_u16(s, d);
+}
+
+/**
+ * reap 1 frame from @swhead
+ *
+ * Safe to call from IRQ
+ */
+static struct sk_buff *wil_vring_reap_rx(struct wil6210_priv *wil,
+                                         struct vring *vring)
+{
+        struct device *dev = wil_to_dev(wil);
+        struct net_device *ndev = wil_to_ndev(wil);
+        volatile struct vring_rx_desc *d;
+        struct sk_buff *skb;
+        dma_addr_t pa;
+        unsigned int sz = RX_BUF_LEN;
+        u8 ftype;
+        u8 ds_bits;
+
+        if (wil_vring_is_empty(vring))
+                return NULL;
+
+        d = &(vring->va[vring->swhead].rx);
+        if (!(d->dma.status & RX_DMA_STATUS_DU)) {
+                /* it is not error, we just reached end of Rx done area */
+                return NULL;
+        }
+
+        pa = d->dma.addr_low | ((u64)d->dma.addr_high << 32);
+        skb = vring->ctx[vring->swhead];
+        dma_unmap_single(dev, pa, sz, DMA_FROM_DEVICE);
+        skb_trim(skb, d->dma.length);
+
+        wil->stats.last_mcs_rx = wil_rxdesc_mcs(d);
+
+        /* use radiotap header only if required */
+        if (ndev->type == ARPHRD_IEEE80211_RADIOTAP)
+                wil_rx_add_radiotap_header(wil, skb, d);
+
+        wil_dbg_TXRX(wil, "Rx[%3d] : %d bytes\n", vring->swhead, d->dma.length);
+        wil_hex_dump_TXRX("Rx ", DUMP_PREFIX_NONE, 32, 4,
+                          (const void *)d, sizeof(*d), false);
+
+        wil_vring_advance_head(vring, 1);
+
+        /* no extra checks if in sniffer mode */
+        if (ndev->type != ARPHRD_ETHER)
+                return skb;
+        /*
+         * Non-data frames may be delivered through Rx DMA channel (ex: BAR)
+         * Driver should recognize it by frame type, that is found
+         * in Rx descriptor. If type is not data, it is 802.11 frame as is
+         */
+        ftype = wil_rxdesc_ftype(d) << 2;
+        if (ftype != IEEE80211_FTYPE_DATA) {
+                wil_dbg_TXRX(wil, "Non-data frame ftype 0x%08x\n", ftype);
+                /* TODO: process it */
+                kfree_skb(skb);
+                return NULL;
+        }
+
+        if (skb->len < ETH_HLEN) {
+                wil_err(wil, "Short frame, len = %d\n", skb->len);
+                /* TODO: process it (i.e. BAR) */
+                kfree_skb(skb);
+                return NULL;
+        }
+
+        ds_bits = wil_rxdesc_ds_bits(d);
+        if (ds_bits == 1) {
+                /*
+                 * HW bug - in ToDS mode, i.e. Rx on AP side,
+                 * addresses get swapped
+                 */
+                wil_swap_ethaddr(skb->data);
+        }
+
+        return skb;
+}
+
+/**
+ * allocate and fill up to @count buffers in rx ring
+ * buffers posted at @swtail
+ */
+static int wil_rx_refill(struct wil6210_priv *wil, int count)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct vring *v = &wil->vring_rx;
+        u32 next_tail;
+        int rc = 0;
+        int headroom = ndev->type == ARPHRD_IEEE80211_RADIOTAP ?
+                        WIL6210_RTAP_SIZE : 0;
+
+        for (; next_tail = wil_vring_next_tail(v),
+                        (next_tail != v->swhead) && (count-- > 0);
+                        v->swtail = next_tail) {
+                rc = wil_vring_alloc_skb(wil, v, v->swtail, headroom);
+                if (rc) {
+                        wil_err(wil, "Error %d in wil_rx_refill[%d]\n",
+                                rc, v->swtail);
+                        break;
+                }
+        }
+        iowrite32(v->swtail, wil->csr + HOSTADDR(v->hwtail));
+
+        return rc;
+}
+
+/*
+ * Pass Rx packet to the netif. Update statistics.
+ */
+static void wil_netif_rx_any(struct sk_buff *skb, struct net_device *ndev)
+{
+        int rc;
+        unsigned int len = skb->len;
+
+        if (in_interrupt())
+                rc = netif_rx(skb);
+        else
+                rc = netif_rx_ni(skb);
+
+        if (likely(rc == NET_RX_SUCCESS)) {
+                ndev->stats.rx_packets++;
+                ndev->stats.rx_bytes += len;
+
+        } else {
+                ndev->stats.rx_dropped++;
+        }
+}
+
+/**
+ * Proceed all completed skb's from Rx VRING
+ *
+ * Safe to call from IRQ
+ */
+void wil_rx_handle(struct wil6210_priv *wil)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct vring *v = &wil->vring_rx;
+        struct sk_buff *skb;
+
+        if (!v->va) {
+                wil_err(wil, "Rx IRQ while Rx not yet initialized\n");
+                return;
+        }
+        wil_dbg_TXRX(wil, "%s()\n", __func__);
+        while (NULL != (skb = wil_vring_reap_rx(wil, v))) {
+                wil_hex_dump_TXRX("Rx ", DUMP_PREFIX_OFFSET, 16, 1,
+                                  skb->data, skb_headlen(skb), false);
+
+                skb_orphan(skb);
+
+                if (wil->wdev->iftype == NL80211_IFTYPE_MONITOR) {
+                        skb->dev = ndev;
+                        skb_reset_mac_header(skb);
+                        skb->ip_summed = CHECKSUM_UNNECESSARY;
+                        skb->pkt_type = PACKET_OTHERHOST;
+                        skb->protocol = htons(ETH_P_802_2);
+
+                } else {
+                        skb->protocol = eth_type_trans(skb, ndev);
+                }
+
+                wil_netif_rx_any(skb, ndev);
+        }
+        wil_rx_refill(wil, v->size);
+}
+
+int wil_rx_init(struct wil6210_priv *wil)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct wireless_dev *wdev = wil->wdev;
+        struct vring *vring = &wil->vring_rx;
+        int rc;
+        struct wmi_cfg_rx_chain_cmd cmd = {
+                .action = WMI_RX_CHAIN_ADD,
+                .rx_sw_ring = {
+                        .max_mpdu_size = cpu_to_le16(RX_BUF_LEN),
+                },
+                .mid = 0, /* TODO - what is it? */
+                .decap_trans_type = WMI_DECAP_TYPE_802_3,
+        };
+        struct {
+                struct wil6210_mbox_hdr_wmi wmi;
+                struct wmi_cfg_rx_chain_done_event evt;
+        } __packed evt;
+
+        vring->size = WIL6210_RX_RING_SIZE;
+        rc = wil_vring_alloc(wil, vring);
+        if (rc)
+                return rc;
+
+        cmd.rx_sw_ring.ring_mem_base = cpu_to_le64(vring->pa);
+        cmd.rx_sw_ring.ring_size = cpu_to_le16(vring->size);
+        if (wdev->iftype == NL80211_IFTYPE_MONITOR) {
+                struct ieee80211_channel *ch = wdev->preset_chandef.chan;
+
+                cmd.sniffer_cfg.mode = cpu_to_le32(WMI_SNIFFER_ON);
+                if (ch)
+                        cmd.sniffer_cfg.channel = ch->hw_value - 1;
+                cmd.sniffer_cfg.phy_info_mode =
+                        cpu_to_le32(ndev->type == ARPHRD_IEEE80211_RADIOTAP);
+                cmd.sniffer_cfg.phy_support =
+                        cpu_to_le32((wil->monitor_flags & MONITOR_FLAG_CONTROL)
+                                    ? WMI_SNIFFER_CP : WMI_SNIFFER_DP);
+        }
+        /* typical time for secure PCP is 840ms */
+        rc = wmi_call(wil, WMI_CFG_RX_CHAIN_CMDID, &cmd, sizeof(cmd),
+                      WMI_CFG_RX_CHAIN_DONE_EVENTID, &evt, sizeof(evt), 2000);
+        if (rc)
+                goto err_free;
+
+        vring->hwtail = le32_to_cpu(evt.evt.rx_ring_tail_ptr);
+
+        wil_dbg(wil, "Rx init: status %d tail 0x%08x\n",
+                le32_to_cpu(evt.evt.status), vring->hwtail);
+
+        rc = wil_rx_refill(wil, vring->size);
+        if (rc)
+                goto err_free;
+
+        return 0;
+ err_free:
+        wil_vring_free(wil, vring, 0);
+
+        return rc;
+}
+
+void wil_rx_fini(struct wil6210_priv *wil)
+{
+        struct vring *vring = &wil->vring_rx;
+
+        if (vring->va) {
+                int rc;
+                struct wmi_cfg_rx_chain_cmd cmd = {
+                        .action = cpu_to_le32(WMI_RX_CHAIN_DEL),
+                        .rx_sw_ring = {
+                                .max_mpdu_size = cpu_to_le16(RX_BUF_LEN),
+                        },
+                };
+                struct {
+                        struct wil6210_mbox_hdr_wmi wmi;
+                        struct wmi_cfg_rx_chain_done_event cfg;
+                } __packed wmi_rx_cfg_reply;
+
+                rc = wmi_call(wil, WMI_CFG_RX_CHAIN_CMDID, &cmd, sizeof(cmd),
+                              WMI_CFG_RX_CHAIN_DONE_EVENTID,
+                              &wmi_rx_cfg_reply, sizeof(wmi_rx_cfg_reply),
+                              100);
+                wil_vring_free(wil, vring, 0);
+        }
+}
+
+int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
+                      int cid, int tid)
+{
+        int rc;
+        struct wmi_vring_cfg_cmd cmd = {
+                .action = cpu_to_le32(WMI_VRING_CMD_ADD),
+                .vring_cfg = {
+                        .tx_sw_ring = {
+                                .max_mpdu_size = cpu_to_le16(TX_BUF_LEN),
+                        },
+                        .ringid = id,
+                        .cidxtid = (cid & 0xf) | ((tid & 0xf) << 4),
+                        .encap_trans_type = WMI_VRING_ENC_TYPE_802_3,
+                        .mac_ctrl = 0,
+                        .to_resolution = 0,
+                        .agg_max_wsize = 16,
+                        .schd_params = {
+                                .priority = cpu_to_le16(0),
+                                .timeslot_us = cpu_to_le16(0xfff),
+                        },
+                },
+        };
+        struct {
+                struct wil6210_mbox_hdr_wmi wmi;
+                struct wmi_vring_cfg_done_event cmd;
+        } __packed reply;
+        struct vring *vring = &wil->vring_tx[id];
+
+        if (vring->va) {
+                wil_err(wil, "Tx ring [%d] already allocated\n", id);
+                rc = -EINVAL;
+                goto out;
+        }
+
+        vring->size = size;
+        rc = wil_vring_alloc(wil, vring);
+        if (rc)
+                goto out;
+
+        cmd.vring_cfg.tx_sw_ring.ring_mem_base = cpu_to_le64(vring->pa);
+        cmd.vring_cfg.tx_sw_ring.ring_size = cpu_to_le16(vring->size);
+
+        rc = wmi_call(wil, WMI_VRING_CFG_CMDID, &cmd, sizeof(cmd),
+                      WMI_VRING_CFG_DONE_EVENTID, &reply, sizeof(reply), 100);
+        if (rc)
+                goto out_free;
+
+        if (reply.cmd.status != WMI_VRING_CFG_SUCCESS) {
+                wil_err(wil, "Tx config failed, status 0x%02x\n",
+                        reply.cmd.status);
+                goto out_free;
+        }
+        vring->hwtail = le32_to_cpu(reply.cmd.tx_vring_tail_ptr);
+
+        return 0;
+ out_free:
+        wil_vring_free(wil, vring, 1);
+ out:
+
+        return rc;
+}
+
+void wil_vring_fini_tx(struct wil6210_priv *wil, int id)
+{
+        struct vring *vring = &wil->vring_tx[id];
+
+        if (!vring->va)
+                return;
+
+        wil_vring_free(wil, vring, 1);
+}
+
+static struct vring *wil_find_tx_vring(struct wil6210_priv *wil,
+                                       struct sk_buff *skb)
+{
+        struct vring *v = &wil->vring_tx[0];
+
+        if (v->va)
+                return v;
+
+        return NULL;
+}
+
+static int wil_tx_desc_map(volatile struct vring_tx_desc *d,
+                           dma_addr_t pa, u32 len)
+{
+        d->dma.addr_low = lower_32_bits(pa);
+        d->dma.addr_high = (u16)upper_32_bits(pa);
+        d->dma.ip_length = 0;
+        /* 0..6: mac_length; 7:ip_version 0-IP6 1-IP4*/
+        d->dma.b11 = 0/*14 | BIT(7)*/;
+        d->dma.error = 0;
+        d->dma.status = 0; /* BIT(0) should be 0 for HW_OWNED */
+        d->dma.length = len;
+        d->dma.d0 = 0;
+        d->mac.d[0] = 0;
+        d->mac.d[1] = 0;
+        d->mac.d[2] = 0;
+        d->mac.ucode_cmd = 0;
+        /* use dst index 0 */
+        d->mac.d[1] |= BIT(MAC_CFG_DESC_TX_1_DST_INDEX_EN_POS) |
+                       (0 << MAC_CFG_DESC_TX_1_DST_INDEX_POS);
+        /* translation type:  0 - bypass; 1 - 802.3; 2 - native wifi */
+        d->mac.d[2] = BIT(MAC_CFG_DESC_TX_2_SNAP_HDR_INSERTION_EN_POS) |
+                      (1 << MAC_CFG_DESC_TX_2_L2_TRANSLATION_TYPE_POS);
+
+        return 0;
+}
+
+static int wil_tx_vring(struct wil6210_priv *wil, struct vring *vring,
+                        struct sk_buff *skb)
+{
+        struct device *dev = wil_to_dev(wil);
+        volatile struct vring_tx_desc *d;
+        u32 swhead = vring->swhead;
+        int avail = wil_vring_avail_tx(vring);
+        int nr_frags = skb_shinfo(skb)->nr_frags;
+        uint f;
+        int vring_index = vring - wil->vring_tx;
+        uint i = swhead;
+        dma_addr_t pa;
+
+        wil_dbg_TXRX(wil, "%s()\n", __func__);
+
+        if (avail < vring->size/8)
+                netif_tx_stop_all_queues(wil_to_ndev(wil));
+        if (avail < 1 + nr_frags) {
+                wil_err(wil, "Tx ring full. No space for %d fragments\n",
+                        1 + nr_frags);
+                return -ENOMEM;
+        }
+        d = &(vring->va[i].tx);
+
+        /* FIXME FW can accept only unicast frames for the peer */
+        memcpy(skb->data, wil->dst_addr[vring_index], ETH_ALEN);
+
+        pa = dma_map_single(dev, skb->data,
+                        skb_headlen(skb), DMA_TO_DEVICE);
+
+        wil_dbg_TXRX(wil, "Tx skb %d bytes %p -> %#08llx\n", skb_headlen(skb),
+                     skb->data, (unsigned long long)pa);
+        wil_hex_dump_TXRX("Tx ", DUMP_PREFIX_OFFSET, 16, 1,
+                          skb->data, skb_headlen(skb), false);
+
+        if (unlikely(dma_mapping_error(dev, pa)))
+                return -EINVAL;
+        /* 1-st segment */
+        wil_tx_desc_map(d, pa, skb_headlen(skb));
+        d->mac.d[2] |= ((nr_frags + 1) <<
+                       MAC_CFG_DESC_TX_2_NUM_OF_DESCRIPTORS_POS);
+        /* middle segments */
+        for (f = 0; f < nr_frags; f++) {
+                const struct skb_frag_struct *frag =
+                                &skb_shinfo(skb)->frags[f];
+                int len = skb_frag_size(frag);
+                i = (swhead + f + 1) % vring->size;
+                d = &(vring->va[i].tx);
+                pa = skb_frag_dma_map(dev, frag, 0, skb_frag_size(frag),
+                                DMA_TO_DEVICE);
+                if (unlikely(dma_mapping_error(dev, pa)))
+                        goto dma_error;
+                wil_tx_desc_map(d, pa, len);
+                vring->ctx[i] = NULL;
+        }
+        /* for the last seg only */
+        d->dma.d0 |= BIT(DMA_CFG_DESC_TX_0_CMD_EOP_POS);
+        d->dma.d0 |= BIT(9); /* BUG: undocumented bit */
+        d->dma.d0 |= BIT(DMA_CFG_DESC_TX_0_CMD_DMA_IT_POS);
+        d->dma.d0 |= (vring_index << DMA_CFG_DESC_TX_0_QID_POS);
+
+        wil_hex_dump_TXRX("Tx ", DUMP_PREFIX_NONE, 32, 4,
+                          (const void *)d, sizeof(*d), false);
+
+        /* advance swhead */
+        wil_vring_advance_head(vring, nr_frags + 1);
+        wil_dbg_TXRX(wil, "Tx swhead %d -> %d\n", swhead, vring->swhead);
+        iowrite32(vring->swhead, wil->csr + HOSTADDR(vring->hwtail));
+        /* hold reference to skb
+         * to prevent skb release before accounting
+         * in case of immediate "tx done"
+         */
+        vring->ctx[i] = skb_get(skb);
+
+        return 0;
+ dma_error:
+        /* unmap what we have mapped */
+        /* Note: increment @f to operate with positive index */
+        for (f++; f > 0; f--) {
+                i = (swhead + f) % vring->size;
+                d = &(vring->va[i].tx);
+                d->dma.status = TX_DMA_STATUS_DU;
+                pa = d->dma.addr_low | ((u64)d->dma.addr_high << 32);
+                if (vring->ctx[i])
+                        dma_unmap_single(dev, pa, d->dma.length, DMA_TO_DEVICE);
+                else
+                        dma_unmap_page(dev, pa, d->dma.length, DMA_TO_DEVICE);
+        }
+
+        return -EINVAL;
+}
+
+
+netdev_tx_t wil_start_xmit(struct sk_buff *skb, struct net_device *ndev)
+{
+        struct wil6210_priv *wil = ndev_to_wil(ndev);
+        struct vring *vring;
+        int rc;
+
+        wil_dbg_TXRX(wil, "%s()\n", __func__);
+        if (!test_bit(wil_status_fwready, &wil->status)) {
+                wil_err(wil, "FW not ready\n");
+                goto drop;
+        }
+        if (!test_bit(wil_status_fwconnected, &wil->status)) {
+                wil_err(wil, "FW not connected\n");
+                goto drop;
+        }
+        if (wil->wdev->iftype == NL80211_IFTYPE_MONITOR) {
+                wil_err(wil, "Xmit in monitor mode not supported\n");
+                goto drop;
+        }
+        if (skb->protocol == cpu_to_be16(ETH_P_PAE)) {
+                rc = wmi_tx_eapol(wil, skb);
+        } else {
+                /* find vring */
+                vring = wil_find_tx_vring(wil, skb);
+                if (!vring) {
+                        wil_err(wil, "No Tx VRING available\n");
+                        goto drop;
+                }
+                /* set up vring entry */
+                rc = wil_tx_vring(wil, vring, skb);
+        }
+        switch (rc) {
+        case 0:
+                ndev->stats.tx_packets++;
+                ndev->stats.tx_bytes += skb->len;
+                dev_kfree_skb_any(skb);
+                return NETDEV_TX_OK;
+        case -ENOMEM:
+                return NETDEV_TX_BUSY;
+        default:
+                ; /* goto drop; */
+                break;
+        }
+ drop:
+        netif_tx_stop_all_queues(ndev);
+        ndev->stats.tx_dropped++;
+        dev_kfree_skb_any(skb);
+
+        return NET_XMIT_DROP;
+}
+
+/**
+ * Clean up transmitted skb's from the Tx VRING
+ *
+ * Safe to call from IRQ
+ */
+void wil_tx_complete(struct wil6210_priv *wil, int ringid)
+{
+        struct device *dev = wil_to_dev(wil);
+        struct vring *vring = &wil->vring_tx[ringid];
+
+        if (!vring->va) {
+                wil_err(wil, "Tx irq[%d]: vring not initialized\n", ringid);
+                return;
+        }
+
+        wil_dbg_TXRX(wil, "%s(%d)\n", __func__, ringid);
+
+        while (!wil_vring_is_empty(vring)) {
+                volatile struct vring_tx_desc *d = &vring->va[vring->swtail].tx;
+                dma_addr_t pa;
+                struct sk_buff *skb;
+                if (!(d->dma.status & TX_DMA_STATUS_DU))
+                        break;
+
+                wil_dbg_TXRX(wil,
+                             "Tx[%3d] : %d bytes, status 0x%02x err 0x%02x\n",
+                             vring->swtail, d->dma.length, d->dma.status,
+                             d->dma.error);
+                wil_hex_dump_TXRX("TxC ", DUMP_PREFIX_NONE, 32, 4,
+                                  (const void *)d, sizeof(*d), false);
+
+                pa = d->dma.addr_low | ((u64)d->dma.addr_high << 32);
+                skb = vring->ctx[vring->swtail];
+                if (skb) {
+                        dma_unmap_single(dev, pa, d->dma.length, DMA_TO_DEVICE);
+                        dev_kfree_skb_any(skb);
+                        vring->ctx[vring->swtail] = NULL;
+                } else {
+                        dma_unmap_page(dev, pa, d->dma.length, DMA_TO_DEVICE);
+                }
+                d->dma.addr_low = 0;
+                d->dma.addr_high = 0;
+                d->dma.length = 0;
+                d->dma.status = TX_DMA_STATUS_DU;
+                vring->swtail = wil_vring_next_tail(vring);
+        }
+        if (wil_vring_avail_tx(vring) > vring->size/4)
+                netif_tx_wake_all_queues(wil_to_ndev(wil));
+}
diff --git a/drivers/net/wireless/ath/wil6210/txrx.h b/drivers/net/wireless/ath/wil6210/txrx.h
new file mode 100644
index 000000000000..45a61f597c5c
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/txrx.h
@@ -0,0 +1,362 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef WIL6210_TXRX_H
+#define WIL6210_TXRX_H
+
+#define BUF_SW_OWNED    (1)
+#define BUF_HW_OWNED    (0)
+
+/* size of max. Rx packet */
+#define RX_BUF_LEN      (2048)
+#define TX_BUF_LEN      (2048)
+/* how many bytes to reserve for rtap header? */
+#define WIL6210_RTAP_SIZE (128)
+
+/* Tx/Rx path */
+/*
+ * Tx descriptor - MAC part
+ * [dword 0]
+ * bit  0.. 9 : lifetime_expiry_value:10
+ * bit     10 : interrup_en:1
+ * bit     11 : status_en:1
+ * bit 12..13 : txss_override:2
+ * bit     14 : timestamp_insertion:1
+ * bit     15 : duration_preserve:1
+ * bit 16..21 : reserved0:6
+ * bit 22..26 : mcs_index:5
+ * bit     27 : mcs_en:1
+ * bit 28..29 : reserved1:2
+ * bit     30 : reserved2:1
+ * bit     31 : sn_preserved:1
+ * [dword 1]
+ * bit  0.. 3 : pkt_mode:4
+ * bit      4 : pkt_mode_en:1
+ * bit  5.. 7 : reserved0:3
+ * bit  8..13 : reserved1:6
+ * bit     14 : reserved2:1
+ * bit     15 : ack_policy_en:1
+ * bit 16..19 : dst_index:4
+ * bit     20 : dst_index_en:1
+ * bit 21..22 : ack_policy:2
+ * bit     23 : lifetime_en:1
+ * bit 24..30 : max_retry:7
+ * bit     31 : max_retry_en:1
+ * [dword 2]
+ * bit  0.. 7 : num_of_descriptors:8
+ * bit  8..17 : reserved:10
+ * bit 18..19 : l2_translation_type:2
+ * bit     20 : snap_hdr_insertion_en:1
+ * bit     21 : vlan_removal_en:1
+ * bit 22..31 : reserved0:10
+ * [dword 3]
+ * bit  0.. 31: ucode_cmd:32
+ */
+struct vring_tx_mac {
+        u32 d[3];
+        u32 ucode_cmd;
+} __packed;
+
+/* TX MAC Dword 0 */
+#define MAC_CFG_DESC_TX_0_LIFETIME_EXPIRY_VALUE_POS 0
+#define MAC_CFG_DESC_TX_0_LIFETIME_EXPIRY_VALUE_LEN 10
+#define MAC_CFG_DESC_TX_0_LIFETIME_EXPIRY_VALUE_MSK 0x3FF
+
+#define MAC_CFG_DESC_TX_0_INTERRUP_EN_POS 10
+#define MAC_CFG_DESC_TX_0_INTERRUP_EN_LEN 1
+#define MAC_CFG_DESC_TX_0_INTERRUP_EN_MSK 0x400
+
+#define MAC_CFG_DESC_TX_0_STATUS_EN_POS 11
+#define MAC_CFG_DESC_TX_0_STATUS_EN_LEN 1
+#define MAC_CFG_DESC_TX_0_STATUS_EN_MSK 0x800
+
+#define MAC_CFG_DESC_TX_0_TXSS_OVERRIDE_POS 12
+#define MAC_CFG_DESC_TX_0_TXSS_OVERRIDE_LEN 2
+#define MAC_CFG_DESC_TX_0_TXSS_OVERRIDE_MSK 0x3000
+
+#define MAC_CFG_DESC_TX_0_TIMESTAMP_INSERTION_POS 14
+#define MAC_CFG_DESC_TX_0_TIMESTAMP_INSERTION_LEN 1
+#define MAC_CFG_DESC_TX_0_TIMESTAMP_INSERTION_MSK 0x4000
+
+#define MAC_CFG_DESC_TX_0_DURATION_PRESERVE_POS 15
+#define MAC_CFG_DESC_TX_0_DURATION_PRESERVE_LEN 1
+#define MAC_CFG_DESC_TX_0_DURATION_PRESERVE_MSK 0x8000
+
+#define MAC_CFG_DESC_TX_0_MCS_INDEX_POS 22
+#define MAC_CFG_DESC_TX_0_MCS_INDEX_LEN 5
+#define MAC_CFG_DESC_TX_0_MCS_INDEX_MSK 0x7C00000
+
+#define MAC_CFG_DESC_TX_0_MCS_EN_POS 27
+#define MAC_CFG_DESC_TX_0_MCS_EN_LEN 1
+#define MAC_CFG_DESC_TX_0_MCS_EN_MSK 0x8000000
+
+#define MAC_CFG_DESC_TX_0_SN_PRESERVED_POS 31
+#define MAC_CFG_DESC_TX_0_SN_PRESERVED_LEN 1
+#define MAC_CFG_DESC_TX_0_SN_PRESERVED_MSK 0x80000000
+
+/* TX MAC Dword 1 */
+#define MAC_CFG_DESC_TX_1_PKT_MODE_POS 0
+#define MAC_CFG_DESC_TX_1_PKT_MODE_LEN 4
+#define MAC_CFG_DESC_TX_1_PKT_MODE_MSK 0xF
+
+#define MAC_CFG_DESC_TX_1_PKT_MODE_EN_POS 4
+#define MAC_CFG_DESC_TX_1_PKT_MODE_EN_LEN 1
+#define MAC_CFG_DESC_TX_1_PKT_MODE_EN_MSK 0x10
+
+#define MAC_CFG_DESC_TX_1_ACK_POLICY_EN_POS 15
+#define MAC_CFG_DESC_TX_1_ACK_POLICY_EN_LEN 1
+#define MAC_CFG_DESC_TX_1_ACK_POLICY_EN_MSK 0x8000
+
+#define MAC_CFG_DESC_TX_1_DST_INDEX_POS 16
+#define MAC_CFG_DESC_TX_1_DST_INDEX_LEN 4
+#define MAC_CFG_DESC_TX_1_DST_INDEX_MSK 0xF0000
+
+#define MAC_CFG_DESC_TX_1_DST_INDEX_EN_POS 20
+#define MAC_CFG_DESC_TX_1_DST_INDEX_EN_LEN 1
+#define MAC_CFG_DESC_TX_1_DST_INDEX_EN_MSK 0x100000
+
+#define MAC_CFG_DESC_TX_1_ACK_POLICY_POS 21
+#define MAC_CFG_DESC_TX_1_ACK_POLICY_LEN 2
+#define MAC_CFG_DESC_TX_1_ACK_POLICY_MSK 0x600000
+
+#define MAC_CFG_DESC_TX_1_LIFETIME_EN_POS 23
+#define MAC_CFG_DESC_TX_1_LIFETIME_EN_LEN 1
+#define MAC_CFG_DESC_TX_1_LIFETIME_EN_MSK 0x800000
+
+#define MAC_CFG_DESC_TX_1_MAX_RETRY_POS 24
+#define MAC_CFG_DESC_TX_1_MAX_RETRY_LEN 7
+#define MAC_CFG_DESC_TX_1_MAX_RETRY_MSK 0x7F000000
+
+#define MAC_CFG_DESC_TX_1_MAX_RETRY_EN_POS 31
+#define MAC_CFG_DESC_TX_1_MAX_RETRY_EN_LEN 1
+#define MAC_CFG_DESC_TX_1_MAX_RETRY_EN_MSK 0x80000000
+
+/* TX MAC Dword 2 */
+#define MAC_CFG_DESC_TX_2_NUM_OF_DESCRIPTORS_POS 0
+#define MAC_CFG_DESC_TX_2_NUM_OF_DESCRIPTORS_LEN 8
+#define MAC_CFG_DESC_TX_2_NUM_OF_DESCRIPTORS_MSK 0xFF
+
+#define MAC_CFG_DESC_TX_2_RESERVED_POS 8
+#define MAC_CFG_DESC_TX_2_RESERVED_LEN 10
+#define MAC_CFG_DESC_TX_2_RESERVED_MSK 0x3FF00
+
+#define MAC_CFG_DESC_TX_2_L2_TRANSLATION_TYPE_POS 18
+#define MAC_CFG_DESC_TX_2_L2_TRANSLATION_TYPE_LEN 2
+#define MAC_CFG_DESC_TX_2_L2_TRANSLATION_TYPE_MSK 0xC0000
+
+#define MAC_CFG_DESC_TX_2_SNAP_HDR_INSERTION_EN_POS 20
+#define MAC_CFG_DESC_TX_2_SNAP_HDR_INSERTION_EN_LEN 1
+#define MAC_CFG_DESC_TX_2_SNAP_HDR_INSERTION_EN_MSK 0x100000
+
+#define MAC_CFG_DESC_TX_2_VLAN_REMOVAL_EN_POS 21
+#define MAC_CFG_DESC_TX_2_VLAN_REMOVAL_EN_LEN 1
+#define MAC_CFG_DESC_TX_2_VLAN_REMOVAL_EN_MSK 0x200000
+
+/* TX MAC Dword 3 */
+#define MAC_CFG_DESC_TX_3_UCODE_CMD_POS 0
+#define MAC_CFG_DESC_TX_3_UCODE_CMD_LEN 32
+#define MAC_CFG_DESC_TX_3_UCODE_CMD_MSK 0xFFFFFFFF
+
+/* TX DMA Dword 0 */
+#define DMA_CFG_DESC_TX_0_L4_LENGTH_POS 0
+#define DMA_CFG_DESC_TX_0_L4_LENGTH_LEN 8
+#define DMA_CFG_DESC_TX_0_L4_LENGTH_MSK 0xFF
+
+#define DMA_CFG_DESC_TX_0_CMD_EOP_POS 8
+#define DMA_CFG_DESC_TX_0_CMD_EOP_LEN 1
+#define DMA_CFG_DESC_TX_0_CMD_EOP_MSK 0x100
+
+#define DMA_CFG_DESC_TX_0_CMD_DMA_IT_POS 10
+#define DMA_CFG_DESC_TX_0_CMD_DMA_IT_LEN 1
+#define DMA_CFG_DESC_TX_0_CMD_DMA_IT_MSK 0x400
+
+#define DMA_CFG_DESC_TX_0_SEGMENT_BUF_DETAILS_POS 11
+#define DMA_CFG_DESC_TX_0_SEGMENT_BUF_DETAILS_LEN 2
+#define DMA_CFG_DESC_TX_0_SEGMENT_BUF_DETAILS_MSK 0x1800
+
+#define DMA_CFG_DESC_TX_0_TCP_SEG_EN_POS 13
+#define DMA_CFG_DESC_TX_0_TCP_SEG_EN_LEN 1
+#define DMA_CFG_DESC_TX_0_TCP_SEG_EN_MSK 0x2000
+
+#define DMA_CFG_DESC_TX_0_IPV4_CHECKSUM_EN_POS 14
+#define DMA_CFG_DESC_TX_0_IPV4_CHECKSUM_EN_LEN 1
+#define DMA_CFG_DESC_TX_0_IPV4_CHECKSUM_EN_MSK 0x4000
+
+#define DMA_CFG_DESC_TX_0_TCP_UDP_CHECKSUM_EN_POS 15
+#define DMA_CFG_DESC_TX_0_TCP_UDP_CHECKSUM_EN_LEN 1
+#define DMA_CFG_DESC_TX_0_TCP_UDP_CHECKSUM_EN_MSK 0x8000
+
+#define DMA_CFG_DESC_TX_0_QID_POS 16
+#define DMA_CFG_DESC_TX_0_QID_LEN 5
+#define DMA_CFG_DESC_TX_0_QID_MSK 0x1F0000
+
+#define DMA_CFG_DESC_TX_0_PSEUDO_HEADER_CALC_EN_POS 21
+#define DMA_CFG_DESC_TX_0_PSEUDO_HEADER_CALC_EN_LEN 1
+#define DMA_CFG_DESC_TX_0_PSEUDO_HEADER_CALC_EN_MSK 0x200000
+
+#define DMA_CFG_DESC_TX_0_L4_TYPE_POS 30
+#define DMA_CFG_DESC_TX_0_L4_TYPE_LEN 2
+#define DMA_CFG_DESC_TX_0_L4_TYPE_MSK 0xC0000000
+
+
+#define TX_DMA_STATUS_DU         BIT(0)
+
+struct vring_tx_dma {
+        u32 d0;
+        u32 addr_low;
+        u16 addr_high;
+        u8  ip_length;
+        u8  b11;       /* 0..6: mac_length; 7:ip_version */
+        u8  error;     /* 0..2: err; 3..7: reserved; */
+        u8  status;    /* 0: used; 1..7; reserved */
+        u16 length;
+} __packed;
+
+/*
+ * Rx descriptor - MAC part
+ * [dword 0]
+ * bit  0.. 3 : tid:4 The QoS (b3-0) TID Field
+ * bit  4.. 6 : connection_id:3 :The Source index that  was found during
+ *  Parsing the TA.  This field is used to  define the source of the packet
+ * bit      7 : reserved:1
+ * bit  8.. 9 : mac_id:2 : The MAC virtual  Ring number (always zero)
+ * bit 10..11 : frame_type:2 : The FC Control  (b3-2) -  MPDU Type
+ *              (management, data, control  and extension)
+ * bit 12..15 : frame_subtype:4 : The FC Control  (b7-4) -  Frame Subtype
+ * bit 16..27 : seq_number:12 The received Sequence number field
+ * bit 28..31 : extended:4 extended subtype
+ * [dword 1]
+ * bit  0.. 3 : reserved
+ * bit  4.. 5 : key_id:2
+ * bit      6 : decrypt_bypass:1
+ * bit      7 : security:1
+ * bit  8.. 9 : ds_bits:2
+ * bit     10 : a_msdu_present:1  from qos header
+ * bit     11 : a_msdu_type:1  from qos header
+ * bit     12 : a_mpdu:1  part of AMPDU aggregation
+ * bit     13 : broadcast:1
+ * bit     14 : mutlicast:1
+ * bit     15 : reserved:1
+ * bit 16..20 : rx_mac_qid:5   The Queue Identifier that the packet
+ *                             is received from
+ * bit 21..24 : mcs:4
+ * bit 25..28 : mic_icr:4
+ * bit 29..31 : reserved:3
+ * [dword 2]
+ * bit  0.. 2 : time_slot:3 The timeslot that the MPDU is received
+ * bit      3 : fc_protocol_ver:1 The FC Control  (b0) - Protocol  Version
+ * bit      4 : fc_order:1 The FC Control (b15) -Order
+ * bit  5.. 7 : qos_ack_policy:3  The QoS (b6-5) ack policy Field
+ * bit      8 : esop:1 The QoS (b4) ESOP field
+ * bit      9 : qos_rdg_more_ppdu:1 The QoS (b9) RDG  field
+ * bit 10..14 : qos_reserved:5 The QoS (b14-10) Reserved  field
+ * bit     15 : qos_ac_constraint:1
+ * bit 16..31 : pn_15_0:16 low 2 bytes of PN
+ * [dword 3]
+ * bit  0..31 : pn_47_16:32 high 4 bytes of PN
+ */
+struct vring_rx_mac {
+        u32 d0;
+        u32 d1;
+        u16 w4;
+        u16 pn_15_0;
+        u32 pn_47_16;
+} __packed;
+
+/*
+ * Rx descriptor - DMA part
+ * [dword 0]
+ * bit  0.. 7 : l4_length:8 layer 4 length
+ * bit  8.. 9 : reserved:2
+ * bit     10 : cmd_dma_it:1
+ * bit 11..15 : reserved:5
+ * bit 16..29 : phy_info_length:14
+ * bit 30..31 : l4_type:2 valid if the L4I bit is set in the status field
+ * [dword 1]
+ * bit  0..31 : addr_low:32 The payload buffer low address
+ * [dword 2]
+ * bit  0..15 : addr_high:16 The payload buffer high address
+ * bit 16..23 : ip_length:8
+ * bit 24..30 : mac_length:7
+ * bit     31 : ip_version:1
+ * [dword 3]
+ *  [byte 12] error
+ *  [byte 13] status
+ * bit      0 : du:1
+ * bit      1 : eop:1
+ * bit      2 : error:1
+ * bit      3 : mi:1
+ * bit      4 : l3_identified:1
+ * bit      5 : l4_identified:1
+ * bit      6 : phy_info_included:1
+ * bit      7 : reserved:1
+ *  [word 7] length
+ *
+ */
+
+#define RX_DMA_D0_CMD_DMA_IT     BIT(10)
+
+#define RX_DMA_STATUS_DU         BIT(0)
+#define RX_DMA_STATUS_ERROR      BIT(2)
+#define RX_DMA_STATUS_PHY_INFO   BIT(6)
+
+struct vring_rx_dma {
+        u32 d0;
+        u32 addr_low;
+        u16 addr_high;
+        u8  ip_length;
+        u8  b11;
+        u8  error;
+        u8  status;
+        u16 length;
+} __packed;
+
+struct vring_tx_desc {
+        struct vring_tx_mac mac;
+        struct vring_tx_dma dma;
+} __packed;
+
+struct vring_rx_desc {
+        struct vring_rx_mac mac;
+        struct vring_rx_dma dma;
+} __packed;
+
+union vring_desc {
+        struct vring_tx_desc tx;
+        struct vring_rx_desc rx;
+} __packed;
+
+static inline int wil_rxdesc_phy_length(volatile struct vring_rx_desc *d)
+{
+        return WIL_GET_BITS(d->dma.d0, 16, 29);
+}
+
+static inline int wil_rxdesc_mcs(volatile struct vring_rx_desc *d)
+{
+        return WIL_GET_BITS(d->mac.d1, 21, 24);
+}
+
+static inline int wil_rxdesc_ds_bits(volatile struct vring_rx_desc *d)
+{
+        return WIL_GET_BITS(d->mac.d1, 8, 9);
+}
+
+static inline int wil_rxdesc_ftype(volatile struct vring_rx_desc *d)
+{
+        return WIL_GET_BITS(d->mac.d0, 10, 11);
+}
+
+#endif /* WIL6210_TXRX_H */
diff --git a/drivers/net/wireless/ath/wil6210/wil6210.h b/drivers/net/wireless/ath/wil6210/wil6210.h
new file mode 100644
index 000000000000..9bcfffa4006c
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/wil6210.h
@@ -0,0 +1,363 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#ifndef __WIL6210_H__
+#define __WIL6210_H__
+
+#include <linux/netdevice.h>
+#include <linux/wireless.h>
+#include <net/cfg80211.h>
+
+#include "dbg_hexdump.h"
+
+#define WIL_NAME "wil6210"
+
+/**
+ * extract bits [@b0:@b1] (inclusive) from the value @x
+ * it should be @b0 <= @b1, or result is incorrect
+ */
+static inline u32 WIL_GET_BITS(u32 x, int b0, int b1)
+{
+        return (x >> b0) & ((1 << (b1 - b0 + 1)) - 1);
+}
+
+#define WIL6210_MEM_SIZE (2*1024*1024UL)
+
+#define WIL6210_TX_QUEUES (4)
+
+#define WIL6210_RX_RING_SIZE (128)
+#define WIL6210_TX_RING_SIZE (128)
+#define WIL6210_MAX_TX_RINGS (24)
+
+/* Hardware definitions begin */
+
+/*
+ * Mapping
+ * RGF File      | Host addr    |  FW addr
+ *               |              |
+ * user_rgf      | 0x000000     | 0x880000
+ *  dma_rgf      | 0x001000     | 0x881000
+ * pcie_rgf      | 0x002000     | 0x882000
+ *               |              |
+ */
+
+/* Where various structures placed in host address space */
+#define WIL6210_FW_HOST_OFF      (0x880000UL)
+
+#define HOSTADDR(fwaddr)        (fwaddr - WIL6210_FW_HOST_OFF)
+
+/*
+ * Interrupt control registers block
+ *
+ * each interrupt controlled by the same bit in all registers
+ */
+struct RGF_ICR {
+        u32 ICC; /* Cause Control, RW: 0 - W1C, 1 - COR */
+        u32 ICR; /* Cause, W1C/COR depending on ICC */
+        u32 ICM; /* Cause masked (ICR & ~IMV), W1C/COR depending on ICC */
+        u32 ICS; /* Cause Set, WO */
+        u32 IMV; /* Mask, RW+S/C */
+        u32 IMS; /* Mask Set, write 1 to set */
+        u32 IMC; /* Mask Clear, write 1 to clear */
+} __packed;
+
+/* registers - FW addresses */
+#define RGF_USER_USER_SCRATCH_PAD       (0x8802bc)
+#define RGF_USER_USER_ICR               (0x880b4c) /* struct RGF_ICR */
+        #define BIT_USER_USER_ICR_SW_INT_2      BIT(18)
+#define RGF_USER_CLKS_CTL_SW_RST_MASK_0 (0x880b14)
+#define RGF_USER_MAC_CPU_0              (0x8801fc)
+#define RGF_USER_USER_CPU_0             (0x8801e0)
+#define RGF_USER_CLKS_CTL_SW_RST_VEC_0  (0x880b04)
+#define RGF_USER_CLKS_CTL_SW_RST_VEC_1  (0x880b08)
+#define RGF_USER_CLKS_CTL_SW_RST_VEC_2  (0x880b0c)
+#define RGF_USER_CLKS_CTL_SW_RST_VEC_3  (0x880b10)
+
+#define RGF_DMA_PSEUDO_CAUSE            (0x881c68)
+#define RGF_DMA_PSEUDO_CAUSE_MASK_SW    (0x881c6c)
+#define RGF_DMA_PSEUDO_CAUSE_MASK_FW    (0x881c70)
+        #define BIT_DMA_PSEUDO_CAUSE_RX         BIT(0)
+        #define BIT_DMA_PSEUDO_CAUSE_TX         BIT(1)
+        #define BIT_DMA_PSEUDO_CAUSE_MISC       BIT(2)
+
+#define RGF_DMA_EP_TX_ICR               (0x881bb4) /* struct RGF_ICR */
+        #define BIT_DMA_EP_TX_ICR_TX_DONE       BIT(0)
+        #define BIT_DMA_EP_TX_ICR_TX_DONE_N(n)  BIT(n+1) /* n = [0..23] */
+#define RGF_DMA_EP_RX_ICR               (0x881bd0) /* struct RGF_ICR */
+        #define BIT_DMA_EP_RX_ICR_RX_DONE       BIT(0)
+#define RGF_DMA_EP_MISC_ICR             (0x881bec) /* struct RGF_ICR */
+        #define BIT_DMA_EP_MISC_ICR_RX_HTRSH    BIT(0)
+        #define BIT_DMA_EP_MISC_ICR_TX_NO_ACT   BIT(1)
+        #define BIT_DMA_EP_MISC_ICR_FW_INT0     BIT(28)
+        #define BIT_DMA_EP_MISC_ICR_FW_INT1     BIT(29)
+
+/* Interrupt moderation control */
+#define RGF_DMA_ITR_CNT_TRSH            (0x881c5c)
+#define RGF_DMA_ITR_CNT_DATA            (0x881c60)
+#define RGF_DMA_ITR_CNT_CRL             (0x881C64)
+        #define BIT_DMA_ITR_CNT_CRL_EN          BIT(0)
+        #define BIT_DMA_ITR_CNT_CRL_EXT_TICK    BIT(1)
+        #define BIT_DMA_ITR_CNT_CRL_FOREVER     BIT(2)
+        #define BIT_DMA_ITR_CNT_CRL_CLR         BIT(3)
+        #define BIT_DMA_ITR_CNT_CRL_REACH_TRSH  BIT(4)
+
+/* popular locations */
+#define HOST_MBOX   HOSTADDR(RGF_USER_USER_SCRATCH_PAD)
+#define HOST_SW_INT (HOSTADDR(RGF_USER_USER_ICR) + \
+        offsetof(struct RGF_ICR, ICS))
+#define SW_INT_MBOX BIT_USER_USER_ICR_SW_INT_2
+
+/* ISR register bits */
+#define ISR_MISC_FW_READY BIT_DMA_EP_MISC_ICR_FW_INT0
+#define ISR_MISC_MBOX_EVT BIT_DMA_EP_MISC_ICR_FW_INT1
+
+/* Hardware definitions end */
+
+struct wil6210_mbox_ring {
+        u32 base;
+        u16 entry_size; /* max. size of mbox entry, incl. all headers */
+        u16 size;
+        u32 tail;
+        u32 head;
+} __packed;
+
+struct wil6210_mbox_ring_desc {
+        __le32 sync;
+        __le32 addr;
+} __packed;
+
+/* at HOST_OFF_WIL6210_MBOX_CTL */
+struct wil6210_mbox_ctl {
+        struct wil6210_mbox_ring tx;
+        struct wil6210_mbox_ring rx;
+} __packed;
+
+struct wil6210_mbox_hdr {
+        __le16 seq;
+        __le16 len; /* payload, bytes after this header */
+        __le16 type;
+        u8 flags;
+        u8 reserved;
+} __packed;
+
+#define WIL_MBOX_HDR_TYPE_WMI (0)
+
+/* max. value for wil6210_mbox_hdr.len */
+#define MAX_MBOXITEM_SIZE   (240)
+
+struct wil6210_mbox_hdr_wmi {
+        u8 reserved0[2];
+        __le16 id;
+        __le16 info1; /* bits [0..3] - device_id, rest - unused */
+        u8 reserved1[2];
+} __packed;
+
+struct pending_wmi_event {
+        struct list_head list;
+        struct {
+                struct wil6210_mbox_hdr hdr;
+                struct wil6210_mbox_hdr_wmi wmi;
+                u8 data[0];
+        } __packed event;
+};
+
+union vring_desc;
+
+struct vring {
+        dma_addr_t pa;
+        volatile union vring_desc *va; /* vring_desc[size], WriteBack by DMA */
+        u16 size; /* number of vring_desc elements */
+        u32 swtail;
+        u32 swhead;
+        u32 hwtail; /* write here to inform hw */
+        void **ctx; /* void *ctx[size] - software context */
+};
+
+enum { /* for wil6210_priv.status */
+        wil_status_fwready = 0,
+        wil_status_fwconnected,
+        wil_status_dontscan,
+        wil_status_irqen, /* FIXME: interrupts enabled - for debug */
+};
+
+struct pci_dev;
+
+struct wil6210_stats {
+        u64 tsf;
+        u32 snr;
+        u16 last_mcs_rx;
+        u16 bf_mcs; /* last BF, used for Tx */
+        u16 my_rx_sector;
+        u16 my_tx_sector;
+        u16 peer_rx_sector;
+        u16 peer_tx_sector;
+};
+
+struct wil6210_priv {
+        struct pci_dev *pdev;
+        int n_msi;
+        struct wireless_dev *wdev;
+        void __iomem *csr;
+        ulong status;
+        /* profile */
+        u32 monitor_flags;
+        u32 secure_pcp; /* create secure PCP? */
+        int sinfo_gen;
+        /* cached ISR registers */
+        u32 isr_misc;
+        /* mailbox related */
+        struct mutex wmi_mutex;
+        struct wil6210_mbox_ctl mbox_ctl;
+        struct completion wmi_ready;
+        u16 wmi_seq;
+        u16 reply_id; /**< wait for this WMI event */
+        void *reply_buf;
+        u16 reply_size;
+        struct workqueue_struct *wmi_wq; /* for deferred calls */
+        struct work_struct wmi_event_worker;
+        struct workqueue_struct *wmi_wq_conn; /* for connect worker */
+        struct work_struct wmi_connect_worker;
+        struct work_struct disconnect_worker;
+        struct timer_list connect_timer;
+        int pending_connect_cid;
+        struct list_head pending_wmi_ev;
+        /*
+         * protect pending_wmi_ev
+         * - fill in IRQ from wil6210_irq_misc,
+         * - consumed in thread by wmi_event_worker
+         */
+        spinlock_t wmi_ev_lock;
+        /* DMA related */
+        struct vring vring_rx;
+        struct vring vring_tx[WIL6210_MAX_TX_RINGS];
+        u8 dst_addr[WIL6210_MAX_TX_RINGS][ETH_ALEN];
+        /* scan */
+        struct cfg80211_scan_request *scan_request;
+
+        struct mutex mutex; /* for wil6210_priv access in wil_{up|down} */
+        /* statistics */
+        struct wil6210_stats stats;
+        /* debugfs */
+        struct dentry *debug;
+        struct debugfs_blob_wrapper fw_code_blob;
+        struct debugfs_blob_wrapper fw_data_blob;
+        struct debugfs_blob_wrapper fw_peri_blob;
+        struct debugfs_blob_wrapper uc_code_blob;
+        struct debugfs_blob_wrapper uc_data_blob;
+        struct debugfs_blob_wrapper rgf_blob;
+};
+
+#define wil_to_wiphy(i) (i->wdev->wiphy)
+#define wil_to_dev(i) (wiphy_dev(wil_to_wiphy(i)))
+#define wiphy_to_wil(w) (struct wil6210_priv *)(wiphy_priv(w))
+#define wil_to_wdev(i) (i->wdev)
+#define wdev_to_wil(w) (struct wil6210_priv *)(wdev_priv(w))
+#define wil_to_ndev(i) (wil_to_wdev(i)->netdev)
+#define ndev_to_wil(n) (wdev_to_wil(n->ieee80211_ptr))
+
+#define wil_dbg(wil, fmt, arg...) netdev_dbg(wil_to_ndev(wil), fmt, ##arg)
+#define wil_info(wil, fmt, arg...) netdev_info(wil_to_ndev(wil), fmt, ##arg)
+#define wil_err(wil, fmt, arg...) netdev_err(wil_to_ndev(wil), fmt, ##arg)
+
+#define wil_dbg_IRQ(wil, fmt, arg...) wil_dbg(wil, "DBG[ IRQ]" fmt, ##arg)
+#define wil_dbg_TXRX(wil, fmt, arg...) wil_dbg(wil, "DBG[TXRX]" fmt, ##arg)
+#define wil_dbg_WMI(wil, fmt, arg...) wil_dbg(wil, "DBG[ WMI]" fmt, ##arg)
+
+#define wil_hex_dump_TXRX(prefix_str, prefix_type, rowsize,     \
+                          groupsize, buf, len, ascii)           \
+                          wil_print_hex_dump_debug("DBG[TXRX]" prefix_str,\
+                                         prefix_type, rowsize,  \
+                                         groupsize, buf, len, ascii)
+
+#define wil_hex_dump_WMI(prefix_str, prefix_type, rowsize,      \
+                         groupsize, buf, len, ascii)            \
+                         wil_print_hex_dump_debug("DBG[ WMI]" prefix_str,\
+                                        prefix_type, rowsize,   \
+                                        groupsize, buf, len, ascii)
+
+void wil_memcpy_fromio_32(void *dst, const volatile void __iomem *src,
+                          size_t count);
+void wil_memcpy_toio_32(volatile void __iomem *dst, const void *src,
+                        size_t count);
+
+void *wil_if_alloc(struct device *dev, void __iomem *csr);
+void wil_if_free(struct wil6210_priv *wil);
+int wil_if_add(struct wil6210_priv *wil);
+void wil_if_remove(struct wil6210_priv *wil);
+int wil_priv_init(struct wil6210_priv *wil);
+void wil_priv_deinit(struct wil6210_priv *wil);
+int wil_reset(struct wil6210_priv *wil);
+void wil_link_on(struct wil6210_priv *wil);
+void wil_link_off(struct wil6210_priv *wil);
+int wil_up(struct wil6210_priv *wil);
+int wil_down(struct wil6210_priv *wil);
+void wil_mbox_ring_le2cpus(struct wil6210_mbox_ring *r);
+
+void __iomem *wmi_buffer(struct wil6210_priv *wil, __le32 ptr);
+void __iomem *wmi_addr(struct wil6210_priv *wil, u32 ptr);
+int wmi_read_hdr(struct wil6210_priv *wil, __le32 ptr,
+                 struct wil6210_mbox_hdr *hdr);
+int wmi_send(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len);
+void wmi_recv_cmd(struct wil6210_priv *wil);
+int wmi_call(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len,
+             u16 reply_id, void *reply, u8 reply_size, int to_msec);
+void wmi_connect_worker(struct work_struct *work);
+void wmi_event_worker(struct work_struct *work);
+void wmi_event_flush(struct wil6210_priv *wil);
+int wmi_set_ssid(struct wil6210_priv *wil, u8 ssid_len, const void *ssid);
+int wmi_get_ssid(struct wil6210_priv *wil, u8 *ssid_len, void *ssid);
+int wmi_set_channel(struct wil6210_priv *wil, int channel);
+int wmi_get_channel(struct wil6210_priv *wil, int *channel);
+int wmi_tx_eapol(struct wil6210_priv *wil, struct sk_buff *skb);
+int wmi_del_cipher_key(struct wil6210_priv *wil, u8 key_index,
+                       const void *mac_addr);
+int wmi_add_cipher_key(struct wil6210_priv *wil, u8 key_index,
+                       const void *mac_addr, int key_len, const void *key);
+int wmi_echo(struct wil6210_priv *wil);
+int wmi_set_ie(struct wil6210_priv *wil, u8 type, u16 ie_len, const void *ie);
+
+int wil6210_init_irq(struct wil6210_priv *wil, int irq);
+void wil6210_fini_irq(struct wil6210_priv *wil, int irq);
+void wil6210_disable_irq(struct wil6210_priv *wil);
+void wil6210_enable_irq(struct wil6210_priv *wil);
+
+int wil6210_debugfs_init(struct wil6210_priv *wil);
+void wil6210_debugfs_remove(struct wil6210_priv *wil);
+
+struct wireless_dev *wil_cfg80211_init(struct device *dev);
+void wil_wdev_free(struct wil6210_priv *wil);
+
+int wmi_set_mac_address(struct wil6210_priv *wil, void *addr);
+int wmi_set_bcon(struct wil6210_priv *wil, int bi, u8 wmi_nettype);
+void wil6210_disconnect(struct wil6210_priv *wil, void *bssid);
+
+int wil_rx_init(struct wil6210_priv *wil);
+void wil_rx_fini(struct wil6210_priv *wil);
+
+/* TX API */
+int wil_vring_init_tx(struct wil6210_priv *wil, int id, int size,
+                      int cid, int tid);
+void wil_vring_fini_tx(struct wil6210_priv *wil, int id);
+
+netdev_tx_t wil_start_xmit(struct sk_buff *skb, struct net_device *ndev);
+void wil_tx_complete(struct wil6210_priv *wil, int ringid);
+
+/* RX API */
+void wil_rx_handle(struct wil6210_priv *wil);
+
+int wil_iftype_nl2wmi(enum nl80211_iftype type);
+
+#endif /* __WIL6210_H__ */
diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c
new file mode 100644
index 000000000000..12915f6e7617
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/wmi.c
@@ -0,0 +1,975 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <linux/pci.h>
+#include <linux/io.h>
+#include <linux/list.h>
+#include <linux/etherdevice.h>
+
+#include "wil6210.h"
+#include "wmi.h"
+
+/**
+ * WMI event receiving - theory of operations
+ *
+ * When firmware about to report WMI event, it fills memory area
+ * in the mailbox and raises misc. IRQ. Thread interrupt handler invoked for
+ * the misc IRQ, function @wmi_recv_cmd called by thread IRQ handler.
+ *
+ * @wmi_recv_cmd reads event, allocates memory chunk  and attaches it to the
+ * event list @wil->pending_wmi_ev. Then, work queue @wil->wmi_wq wakes up
+ * and handles events within the @wmi_event_worker. Every event get detached
+ * from list, processed and deleted.
+ *
+ * Purpose for this mechanism is to release IRQ thread; otherwise,
+ * if WMI event handling involves another WMI command flow, this 2-nd flow
+ * won't be completed because of blocked IRQ thread.
+ */
+
+/**
+ * Addressing - theory of operations
+ *
+ * There are several buses present on the WIL6210 card.
+ * Same memory areas are visible at different address on
+ * the different busses. There are 3 main bus masters:
+ *  - MAC CPU (ucode)
+ *  - User CPU (firmware)
+ *  - AHB (host)
+ *
+ * On the PCI bus, there is one BAR (BAR0) of 2Mb size, exposing
+ * AHB addresses starting from 0x880000
+ *
+ * Internally, firmware uses addresses that allows faster access but
+ * are invisible from the host. To read from these addresses, alternative
+ * AHB address must be used.
+ *
+ * Memory mapping
+ * Linker address         PCI/Host address
+ *                        0x880000 .. 0xa80000  2Mb BAR0
+ * 0x800000 .. 0x807000   0x900000 .. 0x907000  28k DCCM
+ * 0x840000 .. 0x857000   0x908000 .. 0x91f000  92k PERIPH
+ */
+
+/**
+ * @fw_mapping provides memory remapping table
+ */
+static const struct {
+        u32 from; /* linker address - from, inclusive */
+        u32 to;   /* linker address - to, exclusive */
+        u32 host; /* PCI/Host address - BAR0 + 0x880000 */
+} fw_mapping[] = {
+        {0x000000, 0x040000, 0x8c0000}, /* FW code RAM 256k */
+        {0x800000, 0x808000, 0x900000}, /* FW data RAM 32k */
+        {0x840000, 0x860000, 0x908000}, /* peripheral data RAM 128k/96k used */
+        {0x880000, 0x88a000, 0x880000}, /* various RGF */
+        {0x8c0000, 0x932000, 0x8c0000}, /* trivial mapping for upper area */
+        /*
+         * 920000..930000 ucode code RAM
+         * 930000..932000 ucode data RAM
+         */
+};
+
+/**
+ * return AHB address for given firmware/ucode internal (linker) address
+ * @x - internal address
+ * If address have no valid AHB mapping, return 0
+ */
+static u32 wmi_addr_remap(u32 x)
+{
+        uint i;
+
+        for (i = 0; i < ARRAY_SIZE(fw_mapping); i++) {
+                if ((x >= fw_mapping[i].from) && (x < fw_mapping[i].to))
+                        return x + fw_mapping[i].host - fw_mapping[i].from;
+        }
+
+        return 0;
+}
+
+/**
+ * Check address validity for WMI buffer; remap if needed
+ * @ptr - internal (linker) fw/ucode address
+ *
+ * Valid buffer should be DWORD aligned
+ *
+ * return address for accessing buffer from the host;
+ * if buffer is not valid, return NULL.
+ */
+void __iomem *wmi_buffer(struct wil6210_priv *wil, __le32 ptr_)
+{
+        u32 off;
+        u32 ptr = le32_to_cpu(ptr_);
+
+        if (ptr % 4)
+                return NULL;
+
+        ptr = wmi_addr_remap(ptr);
+        if (ptr < WIL6210_FW_HOST_OFF)
+                return NULL;
+
+        off = HOSTADDR(ptr);
+        if (off > WIL6210_MEM_SIZE - 4)
+                return NULL;
+
+        return wil->csr + off;
+}
+
+/**
+ * Check address validity
+ */
+void __iomem *wmi_addr(struct wil6210_priv *wil, u32 ptr)
+{
+        u32 off;
+
+        if (ptr % 4)
+                return NULL;
+
+        if (ptr < WIL6210_FW_HOST_OFF)
+                return NULL;
+
+        off = HOSTADDR(ptr);
+        if (off > WIL6210_MEM_SIZE - 4)
+                return NULL;
+
+        return wil->csr + off;
+}
+
+int wmi_read_hdr(struct wil6210_priv *wil, __le32 ptr,
+                 struct wil6210_mbox_hdr *hdr)
+{
+        void __iomem *src = wmi_buffer(wil, ptr);
+        if (!src)
+                return -EINVAL;
+
+        wil_memcpy_fromio_32(hdr, src, sizeof(*hdr));
+
+        return 0;
+}
+
+static int __wmi_send(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len)
+{
+        struct {
+                struct wil6210_mbox_hdr hdr;
+                struct wil6210_mbox_hdr_wmi wmi;
+        } __packed cmd = {
+                .hdr = {
+                        .type = WIL_MBOX_HDR_TYPE_WMI,
+                        .flags = 0,
+                        .len = cpu_to_le16(sizeof(cmd.wmi) + len),
+                },
+                .wmi = {
+                        .id = cpu_to_le16(cmdid),
+                        .info1 = 0,
+                },
+        };
+        struct wil6210_mbox_ring *r = &wil->mbox_ctl.tx;
+        struct wil6210_mbox_ring_desc d_head;
+        u32 next_head;
+        void __iomem *dst;
+        void __iomem *head = wmi_addr(wil, r->head);
+        uint retry;
+
+        if (sizeof(cmd) + len > r->entry_size) {
+                wil_err(wil, "WMI size too large: %d bytes, max is %d\n",
+                        (int)(sizeof(cmd) + len), r->entry_size);
+                return -ERANGE;
+
+        }
+
+        might_sleep();
+
+        if (!test_bit(wil_status_fwready, &wil->status)) {
+                wil_err(wil, "FW not ready\n");
+                return -EAGAIN;
+        }
+
+        if (!head) {
+                wil_err(wil, "WMI head is garbage: 0x%08x\n", r->head);
+                return -EINVAL;
+        }
+        /* read Tx head till it is not busy */
+        for (retry = 5; retry > 0; retry--) {
+                wil_memcpy_fromio_32(&d_head, head, sizeof(d_head));
+                if (d_head.sync == 0)
+                        break;
+                msleep(20);
+        }
+        if (d_head.sync != 0) {
+                wil_err(wil, "WMI head busy\n");
+                return -EBUSY;
+        }
+        /* next head */
+        next_head = r->base + ((r->head - r->base + sizeof(d_head)) % r->size);
+        wil_dbg_WMI(wil, "Head 0x%08x -> 0x%08x\n", r->head, next_head);
+        /* wait till FW finish with previous command */
+        for (retry = 5; retry > 0; retry--) {
+                r->tail = ioread32(wil->csr + HOST_MBOX +
+                                   offsetof(struct wil6210_mbox_ctl, tx.tail));
+                if (next_head != r->tail)
+                        break;
+                msleep(20);
+        }
+        if (next_head == r->tail) {
+                wil_err(wil, "WMI ring full\n");
+                return -EBUSY;
+        }
+        dst = wmi_buffer(wil, d_head.addr);
+        if (!dst) {
+                wil_err(wil, "invalid WMI buffer: 0x%08x\n",
+                        le32_to_cpu(d_head.addr));
+                return -EINVAL;
+        }
+        cmd.hdr.seq = cpu_to_le16(++wil->wmi_seq);
+        /* set command */
+        wil_dbg_WMI(wil, "WMI command 0x%04x [%d]\n", cmdid, len);
+        wil_hex_dump_WMI("Cmd ", DUMP_PREFIX_OFFSET, 16, 1, &cmd,
+                         sizeof(cmd), true);
+        wil_hex_dump_WMI("cmd ", DUMP_PREFIX_OFFSET, 16, 1, buf,
+                         len, true);
+        wil_memcpy_toio_32(dst, &cmd, sizeof(cmd));
+        wil_memcpy_toio_32(dst + sizeof(cmd), buf, len);
+        /* mark entry as full */
+        iowrite32(1, wil->csr + HOSTADDR(r->head) +
+                  offsetof(struct wil6210_mbox_ring_desc, sync));
+        /* advance next ptr */
+        iowrite32(r->head = next_head, wil->csr + HOST_MBOX +
+                  offsetof(struct wil6210_mbox_ctl, tx.head));
+
+        /* interrupt to FW */
+        iowrite32(SW_INT_MBOX, wil->csr + HOST_SW_INT);
+
+        return 0;
+}
+
+int wmi_send(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len)
+{
+        int rc;
+
+        mutex_lock(&wil->wmi_mutex);
+        rc = __wmi_send(wil, cmdid, buf, len);
+        mutex_unlock(&wil->wmi_mutex);
+
+        return rc;
+}
+
+/*=== Event handlers ===*/
+static void wmi_evt_ready(struct wil6210_priv *wil, int id, void *d, int len)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct wireless_dev *wdev = wil->wdev;
+        struct wmi_ready_event *evt = d;
+        u32 ver = le32_to_cpu(evt->sw_version);
+
+        wil_dbg_WMI(wil, "FW ver. %d; MAC %pM\n", ver, evt->mac);
+
+        if (!is_valid_ether_addr(ndev->dev_addr)) {
+                memcpy(ndev->dev_addr, evt->mac, ETH_ALEN);
+                memcpy(ndev->perm_addr, evt->mac, ETH_ALEN);
+        }
+        snprintf(wdev->wiphy->fw_version, sizeof(wdev->wiphy->fw_version),
+                 "%d", ver);
+}
+
+static void wmi_evt_fw_ready(struct wil6210_priv *wil, int id, void *d,
+                             int len)
+{
+        wil_dbg_WMI(wil, "WMI: FW ready\n");
+
+        set_bit(wil_status_fwready, &wil->status);
+        /* reuse wmi_ready for the firmware ready indication */
+        complete(&wil->wmi_ready);
+}
+
+static void wmi_evt_rx_mgmt(struct wil6210_priv *wil, int id, void *d, int len)
+{
+        struct wmi_rx_mgmt_packet_event *data = d;
+        struct wiphy *wiphy = wil_to_wiphy(wil);
+        struct ieee80211_mgmt *rx_mgmt_frame =
+                        (struct ieee80211_mgmt *)data->payload;
+        int ch_no = data->info.channel+1;
+        u32 freq = ieee80211_channel_to_frequency(ch_no,
+                        IEEE80211_BAND_60GHZ);
+        struct ieee80211_channel *channel = ieee80211_get_channel(wiphy, freq);
+        /* TODO convert LE to CPU */
+        s32 signal = 0; /* TODO */
+        __le16 fc = rx_mgmt_frame->frame_control;
+        u32 d_len = le32_to_cpu(data->info.len);
+        u16 d_status = le16_to_cpu(data->info.status);
+
+        wil_dbg_WMI(wil, "MGMT: channel %d MCS %d SNR %d\n",
+                    data->info.channel, data->info.mcs, data->info.snr);
+        wil_dbg_WMI(wil, "status 0x%04x len %d stype %04x\n", d_status, d_len,
+                    le16_to_cpu(data->info.stype));
+        wil_dbg_WMI(wil, "qid %d mid %d cid %d\n",
+                    data->info.qid, data->info.mid, data->info.cid);
+
+        if (!channel) {
+                wil_err(wil, "Frame on unsupported channel\n");
+                return;
+        }
+
+        if (ieee80211_is_beacon(fc) || ieee80211_is_probe_resp(fc)) {
+                struct cfg80211_bss *bss;
+                u64 tsf = le64_to_cpu(rx_mgmt_frame->u.beacon.timestamp);
+                u16 cap = le16_to_cpu(rx_mgmt_frame->u.beacon.capab_info);
+                u16 bi = le16_to_cpu(rx_mgmt_frame->u.beacon.beacon_int);
+                const u8 *ie_buf = rx_mgmt_frame->u.beacon.variable;
+                size_t ie_len = d_len - offsetof(struct ieee80211_mgmt,
+                                                 u.beacon.variable);
+                wil_dbg_WMI(wil, "Capability info : 0x%04x\n", cap);
+
+                bss = cfg80211_inform_bss(wiphy, channel, rx_mgmt_frame->bssid,
+                                          tsf, cap, bi, ie_buf, ie_len,
+                                          signal, GFP_KERNEL);
+                if (bss) {
+                        wil_dbg_WMI(wil, "Added BSS %pM\n",
+                                    rx_mgmt_frame->bssid);
+                        cfg80211_put_bss(bss);
+                } else {
+                        wil_err(wil, "cfg80211_inform_bss() failed\n");
+                }
+        }
+}
+
+static void wmi_evt_scan_complete(struct wil6210_priv *wil, int id,
+                                  void *d, int len)
+{
+        if (wil->scan_request) {
+                struct wmi_scan_complete_event *data = d;
+                bool aborted = (data->status != 0);
+
+                wil_dbg_WMI(wil, "SCAN_COMPLETE(0x%08x)\n", data->status);
+                cfg80211_scan_done(wil->scan_request, aborted);
+                wil->scan_request = NULL;
+        } else {
+                wil_err(wil, "SCAN_COMPLETE while not scanning\n");
+        }
+}
+
+static void wmi_evt_connect(struct wil6210_priv *wil, int id, void *d, int len)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct wireless_dev *wdev = wil->wdev;
+        struct wmi_connect_event *evt = d;
+        int ch; /* channel number */
+        struct station_info sinfo;
+        u8 *assoc_req_ie, *assoc_resp_ie;
+        size_t assoc_req_ielen, assoc_resp_ielen;
+        /* capinfo(u16) + listen_interval(u16) + IEs */
+        const size_t assoc_req_ie_offset = sizeof(u16) * 2;
+        /* capinfo(u16) + status_code(u16) + associd(u16) + IEs */
+        const size_t assoc_resp_ie_offset = sizeof(u16) * 3;
+
+        if (len < sizeof(*evt)) {
+                wil_err(wil, "Connect event too short : %d bytes\n", len);
+                return;
+        }
+        if (len != sizeof(*evt) + evt->beacon_ie_len + evt->assoc_req_len +
+                   evt->assoc_resp_len) {
+                wil_err(wil,
+                        "Connect event corrupted : %d != %d + %d + %d + %d\n",
+                        len, (int)sizeof(*evt), evt->beacon_ie_len,
+                        evt->assoc_req_len, evt->assoc_resp_len);
+                return;
+        }
+        ch = evt->channel + 1;
+        wil_dbg_WMI(wil, "Connect %pM channel [%d] cid %d\n",
+                    evt->bssid, ch, evt->cid);
+        wil_hex_dump_WMI("connect AI : ", DUMP_PREFIX_OFFSET, 16, 1,
+                         evt->assoc_info, len - sizeof(*evt), true);
+
+        /* figure out IE's */
+        assoc_req_ie = &evt->assoc_info[evt->beacon_ie_len +
+                                        assoc_req_ie_offset];
+        assoc_req_ielen = evt->assoc_req_len - assoc_req_ie_offset;
+        if (evt->assoc_req_len <= assoc_req_ie_offset) {
+                assoc_req_ie = NULL;
+                assoc_req_ielen = 0;
+        }
+
+        assoc_resp_ie = &evt->assoc_info[evt->beacon_ie_len +
+                                         evt->assoc_req_len +
+                                         assoc_resp_ie_offset];
+        assoc_resp_ielen = evt->assoc_resp_len - assoc_resp_ie_offset;
+        if (evt->assoc_resp_len <= assoc_resp_ie_offset) {
+                assoc_resp_ie = NULL;
+                assoc_resp_ielen = 0;
+        }
+
+        if ((wdev->iftype == NL80211_IFTYPE_STATION) ||
+            (wdev->iftype == NL80211_IFTYPE_P2P_CLIENT)) {
+                if (wdev->sme_state != CFG80211_SME_CONNECTING) {
+                        wil_err(wil, "Not in connecting state\n");
+                        return;
+                }
+                del_timer_sync(&wil->connect_timer);
+                cfg80211_connect_result(ndev, evt->bssid,
+                                        assoc_req_ie, assoc_req_ielen,
+                                        assoc_resp_ie, assoc_resp_ielen,
+                                        WLAN_STATUS_SUCCESS, GFP_KERNEL);
+
+        } else if ((wdev->iftype == NL80211_IFTYPE_AP) ||
+                   (wdev->iftype == NL80211_IFTYPE_P2P_GO)) {
+                memset(&sinfo, 0, sizeof(sinfo));
+
+                sinfo.generation = wil->sinfo_gen++;
+
+                if (assoc_req_ie) {
+                        sinfo.assoc_req_ies = assoc_req_ie;
+                        sinfo.assoc_req_ies_len = assoc_req_ielen;
+                        sinfo.filled |= STATION_INFO_ASSOC_REQ_IES;
+                }
+
+                cfg80211_new_sta(ndev, evt->bssid, &sinfo, GFP_KERNEL);
+        }
+        set_bit(wil_status_fwconnected, &wil->status);
+
+        /* FIXME FW can transmit only ucast frames to peer */
+        /* FIXME real ring_id instead of hard coded 0 */
+        memcpy(wil->dst_addr[0], evt->bssid, ETH_ALEN);
+
+        wil->pending_connect_cid = evt->cid;
+        queue_work(wil->wmi_wq_conn, &wil->wmi_connect_worker);
+}
+
+static void wmi_evt_disconnect(struct wil6210_priv *wil, int id,
+                               void *d, int len)
+{
+        struct wmi_disconnect_event *evt = d;
+
+        wil_dbg_WMI(wil, "Disconnect %pM reason %d proto %d wmi\n",
+                    evt->bssid,
+                    evt->protocol_reason_status, evt->disconnect_reason);
+
+        wil->sinfo_gen++;
+
+        wil6210_disconnect(wil, evt->bssid);
+        clear_bit(wil_status_dontscan, &wil->status);
+}
+
+static void wmi_evt_notify(struct wil6210_priv *wil, int id, void *d, int len)
+{
+        struct wmi_notify_req_done_event *evt = d;
+
+        if (len < sizeof(*evt)) {
+                wil_err(wil, "Short NOTIFY event\n");
+                return;
+        }
+
+        wil->stats.tsf = le64_to_cpu(evt->tsf);
+        wil->stats.snr = le32_to_cpu(evt->snr_val);
+        wil->stats.bf_mcs = le16_to_cpu(evt->bf_mcs);
+        wil->stats.my_rx_sector = le16_to_cpu(evt->my_rx_sector);
+        wil->stats.my_tx_sector = le16_to_cpu(evt->my_tx_sector);
+        wil->stats.peer_rx_sector = le16_to_cpu(evt->other_rx_sector);
+        wil->stats.peer_tx_sector = le16_to_cpu(evt->other_tx_sector);
+        wil_dbg_WMI(wil, "Link status, MCS %d TSF 0x%016llx\n"
+                    "BF status 0x%08x SNR 0x%08x\n"
+                    "Tx Tpt %d goodput %d Rx goodput %d\n"
+                    "Sectors(rx:tx) my %d:%d peer %d:%d\n",
+                    wil->stats.bf_mcs, wil->stats.tsf, evt->status,
+                    wil->stats.snr, le32_to_cpu(evt->tx_tpt),
+                    le32_to_cpu(evt->tx_goodput), le32_to_cpu(evt->rx_goodput),
+                    wil->stats.my_rx_sector, wil->stats.my_tx_sector,
+                    wil->stats.peer_rx_sector, wil->stats.peer_tx_sector);
+}
+
+/*
+ * Firmware reports EAPOL frame using WME event.
+ * Reconstruct Ethernet frame and deliver it via normal Rx
+ */
+static void wmi_evt_eapol_rx(struct wil6210_priv *wil, int id,
+                             void *d, int len)
+{
+        struct net_device *ndev = wil_to_ndev(wil);
+        struct wmi_eapol_rx_event *evt = d;
+        u16 eapol_len = le16_to_cpu(evt->eapol_len);
+        int sz = eapol_len + ETH_HLEN;
+        struct sk_buff *skb;
+        struct ethhdr *eth;
+
+        wil_dbg_WMI(wil, "EAPOL len %d from %pM\n", eapol_len,
+                    evt->src_mac);
+
+        if (eapol_len > 196) { /* TODO: revisit size limit */
+                wil_err(wil, "EAPOL too large\n");
+                return;
+        }
+
+        skb = alloc_skb(sz, GFP_KERNEL);
+        if (!skb) {
+                wil_err(wil, "Failed to allocate skb\n");
+                return;
+        }
+        eth = (struct ethhdr *)skb_put(skb, ETH_HLEN);
+        memcpy(eth->h_dest, ndev->dev_addr, ETH_ALEN);
+        memcpy(eth->h_source, evt->src_mac, ETH_ALEN);
+        eth->h_proto = cpu_to_be16(ETH_P_PAE);
+        memcpy(skb_put(skb, eapol_len), evt->eapol, eapol_len);
+        skb->protocol = eth_type_trans(skb, ndev);
+        if (likely(netif_rx_ni(skb) == NET_RX_SUCCESS)) {
+                ndev->stats.rx_packets++;
+                ndev->stats.rx_bytes += skb->len;
+        } else {
+                ndev->stats.rx_dropped++;
+        }
+}
+
+static const struct {
+        int eventid;
+        void (*handler)(struct wil6210_priv *wil, int eventid,
+                        void *data, int data_len);
+} wmi_evt_handlers[] = {
+        {WMI_READY_EVENTID,             wmi_evt_ready},
+        {WMI_FW_READY_EVENTID,          wmi_evt_fw_ready},
+        {WMI_RX_MGMT_PACKET_EVENTID,    wmi_evt_rx_mgmt},
+        {WMI_SCAN_COMPLETE_EVENTID,     wmi_evt_scan_complete},
+        {WMI_CONNECT_EVENTID,           wmi_evt_connect},
+        {WMI_DISCONNECT_EVENTID,        wmi_evt_disconnect},
+        {WMI_NOTIFY_REQ_DONE_EVENTID,   wmi_evt_notify},
+        {WMI_EAPOL_RX_EVENTID,          wmi_evt_eapol_rx},
+};
+
+/*
+ * Run in IRQ context
+ * Extract WMI command from mailbox. Queue it to the @wil->pending_wmi_ev
+ * that will be eventually handled by the @wmi_event_worker in the thread
+ * context of thread "wil6210_wmi"
+ */
+void wmi_recv_cmd(struct wil6210_priv *wil)
+{
+        struct wil6210_mbox_ring_desc d_tail;
+        struct wil6210_mbox_hdr hdr;
+        struct wil6210_mbox_ring *r = &wil->mbox_ctl.rx;
+        struct pending_wmi_event *evt;
+        u8 *cmd;
+        void __iomem *src;
+        ulong flags;
+
+        for (;;) {
+                u16 len;
+
+                r->head = ioread32(wil->csr + HOST_MBOX +
+                                   offsetof(struct wil6210_mbox_ctl, rx.head));
+                if (r->tail == r->head)
+                        return;
+
+                /* read cmd from tail */
+                wil_memcpy_fromio_32(&d_tail, wil->csr + HOSTADDR(r->tail),
+                                     sizeof(struct wil6210_mbox_ring_desc));
+                if (d_tail.sync == 0) {
+                        wil_err(wil, "Mbox evt not owned by FW?\n");
+                        return;
+                }
+
+                if (0 != wmi_read_hdr(wil, d_tail.addr, &hdr)) {
+                        wil_err(wil, "Mbox evt at 0x%08x?\n",
+                                le32_to_cpu(d_tail.addr));
+                        return;
+                }
+
+                len = le16_to_cpu(hdr.len);
+                src = wmi_buffer(wil, d_tail.addr) +
+                      sizeof(struct wil6210_mbox_hdr);
+                evt = kmalloc(ALIGN(offsetof(struct pending_wmi_event,
+                                             event.wmi) + len, 4),
+                              GFP_KERNEL);
+                if (!evt) {
+                        wil_err(wil, "kmalloc for WMI event (%d) failed\n",
+                                len);
+                        return;
+                }
+                evt->event.hdr = hdr;
+                cmd = (void *)&evt->event.wmi;
+                wil_memcpy_fromio_32(cmd, src, len);
+                /* mark entry as empty */
+                iowrite32(0, wil->csr + HOSTADDR(r->tail) +
+                          offsetof(struct wil6210_mbox_ring_desc, sync));
+                /* indicate */
+                wil_dbg_WMI(wil, "Mbox evt %04x %04x %04x %02x\n",
+                            le16_to_cpu(hdr.seq), len, le16_to_cpu(hdr.type),
+                            hdr.flags);
+                if ((hdr.type == WIL_MBOX_HDR_TYPE_WMI) &&
+                    (len >= sizeof(struct wil6210_mbox_hdr_wmi))) {
+                        wil_dbg_WMI(wil, "WMI event 0x%04x\n",
+                                    evt->event.wmi.id);
+                }
+                wil_hex_dump_WMI("evt ", DUMP_PREFIX_OFFSET, 16, 1,
+                                 &evt->event.hdr, sizeof(hdr) + len, true);
+
+                /* advance tail */
+                r->tail = r->base + ((r->tail - r->base +
+                          sizeof(struct wil6210_mbox_ring_desc)) % r->size);
+                iowrite32(r->tail, wil->csr + HOST_MBOX +
+                          offsetof(struct wil6210_mbox_ctl, rx.tail));
+
+                /* add to the pending list */
+                spin_lock_irqsave(&wil->wmi_ev_lock, flags);
+                list_add_tail(&evt->list, &wil->pending_wmi_ev);
+                spin_unlock_irqrestore(&wil->wmi_ev_lock, flags);
+                {
+                        int q = queue_work(wil->wmi_wq,
+                                           &wil->wmi_event_worker);
+                        wil_dbg_WMI(wil, "queue_work -> %d\n", q);
+                }
+        }
+}
+
+int wmi_call(struct wil6210_priv *wil, u16 cmdid, void *buf, u16 len,
+             u16 reply_id, void *reply, u8 reply_size, int to_msec)
+{
+        int rc;
+        int remain;
+
+        mutex_lock(&wil->wmi_mutex);
+
+        rc = __wmi_send(wil, cmdid, buf, len);
+        if (rc)
+                goto out;
+
+        wil->reply_id = reply_id;
+        wil->reply_buf = reply;
+        wil->reply_size = reply_size;
+        remain = wait_for_completion_timeout(&wil->wmi_ready,
+                        msecs_to_jiffies(to_msec));
+        if (0 == remain) {
+                wil_err(wil, "wmi_call(0x%04x->0x%04x) timeout %d msec\n",
+                        cmdid, reply_id, to_msec);
+                rc = -ETIME;
+        } else {
+                wil_dbg_WMI(wil,
+                            "wmi_call(0x%04x->0x%04x) completed in %d msec\n",
+                            cmdid, reply_id,
+                            to_msec - jiffies_to_msecs(remain));
+        }
+        wil->reply_id = 0;
+        wil->reply_buf = NULL;
+        wil->reply_size = 0;
+ out:
+        mutex_unlock(&wil->wmi_mutex);
+
+        return rc;
+}
+
+int wmi_echo(struct wil6210_priv *wil)
+{
+        struct wmi_echo_cmd cmd = {
+                .value = cpu_to_le32(0x12345678),
+        };
+
+        return wmi_call(wil, WMI_ECHO_CMDID, &cmd, sizeof(cmd),
+                         WMI_ECHO_RSP_EVENTID, NULL, 0, 20);
+}
+
+int wmi_set_mac_address(struct wil6210_priv *wil, void *addr)
+{
+        struct wmi_set_mac_address_cmd cmd;
+
+        memcpy(cmd.mac, addr, ETH_ALEN);
+
+        wil_dbg_WMI(wil, "Set MAC %pM\n", addr);
+
+        return wmi_send(wil, WMI_SET_MAC_ADDRESS_CMDID, &cmd, sizeof(cmd));
+}
+
+int wmi_set_bcon(struct wil6210_priv *wil, int bi, u8 wmi_nettype)
+{
+        struct wmi_bcon_ctrl_cmd cmd = {
+                .bcon_interval = cpu_to_le16(bi),
+                .network_type = wmi_nettype,
+                .disable_sec_offload = 1,
+        };
+
+        if (!wil->secure_pcp)
+                cmd.disable_sec = 1;
+
+        return wmi_send(wil, WMI_BCON_CTRL_CMDID, &cmd, sizeof(cmd));
+}
+
+int wmi_set_ssid(struct wil6210_priv *wil, u8 ssid_len, const void *ssid)
+{
+        struct wmi_set_ssid_cmd cmd = {
+                .ssid_len = cpu_to_le32(ssid_len),
+        };
+
+        if (ssid_len > sizeof(cmd.ssid))
+                return -EINVAL;
+
+        memcpy(cmd.ssid, ssid, ssid_len);
+
+        return wmi_send(wil, WMI_SET_SSID_CMDID, &cmd, sizeof(cmd));
+}
+
+int wmi_get_ssid(struct wil6210_priv *wil, u8 *ssid_len, void *ssid)
+{
+        int rc;
+        struct {
+                struct wil6210_mbox_hdr_wmi wmi;
+                struct wmi_set_ssid_cmd cmd;
+        } __packed reply;
+        int len; /* reply.cmd.ssid_len in CPU order */
+
+        rc = wmi_call(wil, WMI_GET_SSID_CMDID, NULL, 0, WMI_GET_SSID_EVENTID,
+                      &reply, sizeof(reply), 20);
+        if (rc)
+                return rc;
+
+        len = le32_to_cpu(reply.cmd.ssid_len);
+        if (len > sizeof(reply.cmd.ssid))
+                return -EINVAL;
+
+        *ssid_len = len;
+        memcpy(ssid, reply.cmd.ssid, len);
+
+        return 0;
+}
+
+int wmi_set_channel(struct wil6210_priv *wil, int channel)
+{
+        struct wmi_set_pcp_channel_cmd cmd = {
+                .channel = channel - 1,
+        };
+
+        return wmi_send(wil, WMI_SET_PCP_CHANNEL_CMDID, &cmd, sizeof(cmd));
+}
+
+int wmi_get_channel(struct wil6210_priv *wil, int *channel)
+{
+        int rc;
+        struct {
+                struct wil6210_mbox_hdr_wmi wmi;
+                struct wmi_set_pcp_channel_cmd cmd;
+        } __packed reply;
+
+        rc = wmi_call(wil, WMI_GET_PCP_CHANNEL_CMDID, NULL, 0,
+                      WMI_GET_PCP_CHANNEL_EVENTID, &reply, sizeof(reply), 20);
+        if (rc)
+                return rc;
+
+        if (reply.cmd.channel > 3)
+                return -EINVAL;
+
+        *channel = reply.cmd.channel + 1;
+
+        return 0;
+}
+
+int wmi_tx_eapol(struct wil6210_priv *wil, struct sk_buff *skb)
+{
+        struct wmi_eapol_tx_cmd *cmd;
+        struct ethhdr *eth;
+        u16 eapol_len = skb->len - ETH_HLEN;
+        void *eapol = skb->data + ETH_HLEN;
+        uint i;
+        int rc;
+
+        skb_set_mac_header(skb, 0);
+        eth = eth_hdr(skb);
+        wil_dbg_WMI(wil, "EAPOL %d bytes to %pM\n", eapol_len, eth->h_dest);
+        for (i = 0; i < ARRAY_SIZE(wil->vring_tx); i++) {
+                if (memcmp(wil->dst_addr[i], eth->h_dest, ETH_ALEN) == 0)
+                        goto found_dest;
+        }
+
+        return -EINVAL;
+
+ found_dest:
+        /* find out eapol data & len */
+        cmd = kzalloc(sizeof(*cmd) + eapol_len, GFP_KERNEL);
+        if (!cmd)
+                return -EINVAL;
+
+        memcpy(cmd->dst_mac, eth->h_dest, ETH_ALEN);
+        cmd->eapol_len = cpu_to_le16(eapol_len);
+        memcpy(cmd->eapol, eapol, eapol_len);
+        rc = wmi_send(wil, WMI_EAPOL_TX_CMDID, cmd, sizeof(*cmd) + eapol_len);
+        kfree(cmd);
+
+        return rc;
+}
+
+int wmi_del_cipher_key(struct wil6210_priv *wil, u8 key_index,
+                       const void *mac_addr)
+{
+        struct wmi_delete_cipher_key_cmd cmd = {
+                .key_index = key_index,
+        };
+
+        if (mac_addr)
+                memcpy(cmd.mac, mac_addr, WMI_MAC_LEN);
+
+        return wmi_send(wil, WMI_DELETE_CIPHER_KEY_CMDID, &cmd, sizeof(cmd));
+}
+
+int wmi_add_cipher_key(struct wil6210_priv *wil, u8 key_index,
+                       const void *mac_addr, int key_len, const void *key)
+{
+        struct wmi_add_cipher_key_cmd cmd = {
+                .key_index = key_index,
+                .key_usage = WMI_KEY_USE_PAIRWISE,
+                .key_len = key_len,
+        };
+
+        if (!key || (key_len > sizeof(cmd.key)))
+                return -EINVAL;
+
+        memcpy(cmd.key, key, key_len);
+        if (mac_addr)
+                memcpy(cmd.mac, mac_addr, WMI_MAC_LEN);
+
+        return wmi_send(wil, WMI_ADD_CIPHER_KEY_CMDID, &cmd, sizeof(cmd));
+}
+
+int wmi_set_ie(struct wil6210_priv *wil, u8 type, u16 ie_len, const void *ie)
+{
+        int rc;
+        u16 len = sizeof(struct wmi_set_appie_cmd) + ie_len;
+        struct wmi_set_appie_cmd *cmd = kzalloc(len, GFP_KERNEL);
+        if (!cmd) {
+                wil_err(wil, "kmalloc(%d) failed\n", len);
+                return -ENOMEM;
+        }
+
+        cmd->mgmt_frm_type = type;
+        /* BUG: FW API define ieLen as u8. Will fix FW */
+        cmd->ie_len = cpu_to_le16(ie_len);
+        memcpy(cmd->ie_info, ie, ie_len);
+        rc = wmi_send(wil, WMI_SET_APPIE_CMDID, &cmd, len);
+        kfree(cmd);
+
+        return rc;
+}
+
+void wmi_event_flush(struct wil6210_priv *wil)
+{
+        struct pending_wmi_event *evt, *t;
+
+        wil_dbg_WMI(wil, "%s()\n", __func__);
+
+        list_for_each_entry_safe(evt, t, &wil->pending_wmi_ev, list) {
+                list_del(&evt->list);
+                kfree(evt);
+        }
+}
+
+static bool wmi_evt_call_handler(struct wil6210_priv *wil, int id,
+                                 void *d, int len)
+{
+        uint i;
+
+        for (i = 0; i < ARRAY_SIZE(wmi_evt_handlers); i++) {
+                if (wmi_evt_handlers[i].eventid == id) {
+                        wmi_evt_handlers[i].handler(wil, id, d, len);
+                        return true;
+                }
+        }
+
+        return false;
+}
+
+static void wmi_event_handle(struct wil6210_priv *wil,
+                             struct wil6210_mbox_hdr *hdr)
+{
+        u16 len = le16_to_cpu(hdr->len);
+
+        if ((hdr->type == WIL_MBOX_HDR_TYPE_WMI) &&
+            (len >= sizeof(struct wil6210_mbox_hdr_wmi))) {
+                struct wil6210_mbox_hdr_wmi *wmi = (void *)(&hdr[1]);
+                void *evt_data = (void *)(&wmi[1]);
+                u16 id = le16_to_cpu(wmi->id);
+                /* check if someone waits for this event */
+                if (wil->reply_id && wil->reply_id == id) {
+                        if (wil->reply_buf) {
+                                memcpy(wil->reply_buf, wmi,
+                                       min(len, wil->reply_size));
+                        } else {
+                                wmi_evt_call_handler(wil, id, evt_data,
+                                                     len - sizeof(*wmi));
+                        }
+                        wil_dbg_WMI(wil, "Complete WMI 0x%04x\n", id);
+                        complete(&wil->wmi_ready);
+                        return;
+                }
+                /* unsolicited event */
+                /* search for handler */
+                if (!wmi_evt_call_handler(wil, id, evt_data,
+                                          len - sizeof(*wmi))) {
+                        wil_err(wil, "Unhandled event 0x%04x\n", id);
+                }
+        } else {
+                wil_err(wil, "Unknown event type\n");
+                print_hex_dump(KERN_ERR, "evt?? ", DUMP_PREFIX_OFFSET, 16, 1,
+                               hdr, sizeof(*hdr) + len, true);
+        }
+}
+
+/*
+ * Retrieve next WMI event from the pending list
+ */
+static struct list_head *next_wmi_ev(struct wil6210_priv *wil)
+{
+        ulong flags;
+        struct list_head *ret = NULL;
+
+        spin_lock_irqsave(&wil->wmi_ev_lock, flags);
+
+        if (!list_empty(&wil->pending_wmi_ev)) {
+                ret = wil->pending_wmi_ev.next;
+                list_del(ret);
+        }
+
+        spin_unlock_irqrestore(&wil->wmi_ev_lock, flags);
+
+        return ret;
+}
+
+/*
+ * Handler for the WMI events
+ */
+void wmi_event_worker(struct work_struct *work)
+{
+        struct wil6210_priv *wil = container_of(work, struct wil6210_priv,
+                                                 wmi_event_worker);
+        struct pending_wmi_event *evt;
+        struct list_head *lh;
+
+        while ((lh = next_wmi_ev(wil)) != NULL) {
+                evt = list_entry(lh, struct pending_wmi_event, list);
+                wmi_event_handle(wil, &evt->event.hdr);
+                kfree(evt);
+        }
+}
+
+void wmi_connect_worker(struct work_struct *work)
+{
+        int rc;
+        struct wil6210_priv *wil = container_of(work, struct wil6210_priv,
+                                                wmi_connect_worker);
+
+        if (wil->pending_connect_cid < 0) {
+                wil_err(wil, "No connection pending\n");
+                return;
+        }
+
+        wil_dbg_WMI(wil, "Configure for connection CID %d\n",
+                    wil->pending_connect_cid);
+
+        rc = wil_vring_init_tx(wil, 0, WIL6210_TX_RING_SIZE,
+                               wil->pending_connect_cid, 0);
+        wil->pending_connect_cid = -1;
+        if (rc == 0)
+                wil_link_on(wil);
+}
diff --git a/drivers/net/wireless/ath/wil6210/wmi.h b/drivers/net/wireless/ath/wil6210/wmi.h
new file mode 100644
index 000000000000..3bbf87572b07
--- /dev/null
+++ b/drivers/net/wireless/ath/wil6210/wmi.h
@@ -0,0 +1,1116 @@
+/*
+ * Copyright (c) 2012 Qualcomm Atheros, Inc.
+ * Copyright (c) 2006-2012 Wilocity .
+ *
+ * Permission to use, copy, modify, and/or distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/*
+ * This file contains the definitions of the WMI protocol specified in the
+ * Wireless Module Interface (WMI) for the Wilocity
+ * MARLON 60 Gigabit wireless solution.
+ * It includes definitions of all the commands and events.
+ * Commands are messages from the host to the WM.
+ * Events are messages from the WM to the host.
+ */
+
+#ifndef __WILOCITY_WMI_H__
+#define __WILOCITY_WMI_H__
+
+/* General */
+
+#define WMI_MAC_LEN             (6)
+#define WMI_PROX_RANGE_NUM      (3)
+
+/* List of Commands */
+enum wmi_command_id {
+        WMI_CONNECT_CMDID               = 0x0001,
+        WMI_DISCONNECT_CMDID            = 0x0003,
+        WMI_START_SCAN_CMDID            = 0x0007,
+        WMI_SET_BSS_FILTER_CMDID        = 0x0009,
+        WMI_SET_PROBED_SSID_CMDID       = 0x000a,
+        WMI_SET_LISTEN_INT_CMDID        = 0x000b,
+        WMI_BCON_CTRL_CMDID             = 0x000f,
+        WMI_ADD_CIPHER_KEY_CMDID        = 0x0016,
+        WMI_DELETE_CIPHER_KEY_CMDID     = 0x0017,
+        WMI_SET_APPIE_CMDID             = 0x003f,
+        WMI_GET_APPIE_CMDID             = 0x0040,
+        WMI_SET_WSC_STATUS_CMDID        = 0x0041,
+        WMI_PXMT_RANGE_CFG_CMDID        = 0x0042,
+        WMI_PXMT_SNR2_RANGE_CFG_CMDID   = 0x0043,
+        WMI_FAST_MEM_ACC_MODE_CMDID     = 0x0300,
+        WMI_MEM_READ_CMDID              = 0x0800,
+        WMI_MEM_WR_CMDID                = 0x0801,
+        WMI_ECHO_CMDID                  = 0x0803,
+        WMI_DEEP_ECHO_CMDID             = 0x0804,
+        WMI_CONFIG_MAC_CMDID            = 0x0805,
+        WMI_CONFIG_PHY_DEBUG_CMDID      = 0x0806,
+        WMI_ADD_STATION_CMDID           = 0x0807,
+        WMI_ADD_DEBUG_TX_PCKT_CMDID     = 0x0808,
+        WMI_PHY_GET_STATISTICS_CMDID    = 0x0809,
+        WMI_FS_TUNE_CMDID               = 0x080a,
+        WMI_CORR_MEASURE_CMDID          = 0x080b,
+        WMI_TEMP_SENSE_CMDID            = 0x080e,
+        WMI_DC_CALIB_CMDID              = 0x080f,
+        WMI_SEND_TONE_CMDID             = 0x0810,
+        WMI_IQ_TX_CALIB_CMDID           = 0x0811,
+        WMI_IQ_RX_CALIB_CMDID           = 0x0812,
+        WMI_SET_UCODE_IDLE_CMDID        = 0x0813,
+        WMI_SET_WORK_MODE_CMDID         = 0x0815,
+        WMI_LO_LEAKAGE_CALIB_CMDID      = 0x0816,
+        WMI_MARLON_R_ACTIVATE_CMDID     = 0x0817,
+        WMI_MARLON_R_READ_CMDID         = 0x0818,
+        WMI_MARLON_R_WRITE_CMDID        = 0x0819,
+        WMI_MARLON_R_TXRX_SEL_CMDID     = 0x081a,
+        MAC_IO_STATIC_PARAMS_CMDID      = 0x081b,
+        MAC_IO_DYNAMIC_PARAMS_CMDID     = 0x081c,
+        WMI_SILENT_RSSI_CALIB_CMDID     = 0x081d,
+        WMI_CFG_RX_CHAIN_CMDID          = 0x0820,
+        WMI_VRING_CFG_CMDID             = 0x0821,
+        WMI_RX_ON_CMDID                 = 0x0822,
+        WMI_VRING_BA_EN_CMDID           = 0x0823,
+        WMI_VRING_BA_DIS_CMDID          = 0x0824,
+        WMI_RCP_ADDBA_RESP_CMDID        = 0x0825,
+        WMI_RCP_DELBA_CMDID             = 0x0826,
+        WMI_SET_SSID_CMDID              = 0x0827,
+        WMI_GET_SSID_CMDID              = 0x0828,
+        WMI_SET_PCP_CHANNEL_CMDID       = 0x0829,
+        WMI_GET_PCP_CHANNEL_CMDID       = 0x082a,
+        WMI_SW_TX_REQ_CMDID             = 0x082b,
+        WMI_RX_OFF_CMDID                = 0x082c,
+        WMI_READ_MAC_RXQ_CMDID          = 0x0830,
+        WMI_READ_MAC_TXQ_CMDID          = 0x0831,
+        WMI_WRITE_MAC_RXQ_CMDID         = 0x0832,
+        WMI_WRITE_MAC_TXQ_CMDID         = 0x0833,
+        WMI_WRITE_MAC_XQ_FIELD_CMDID    = 0x0834,
+        WMI_MLME_PUSH_CMDID             = 0x0835,
+        WMI_BEAMFORMING_MGMT_CMDID      = 0x0836,
+        WMI_BF_TXSS_MGMT_CMDID          = 0x0837,
+        WMI_BF_SM_MGMT_CMDID            = 0x0838,
+        WMI_BF_RXSS_MGMT_CMDID          = 0x0839,
+        WMI_SET_SECTORS_CMDID           = 0x0849,
+        WMI_MAINTAIN_PAUSE_CMDID        = 0x0850,
+        WMI_MAINTAIN_RESUME_CMDID       = 0x0851,
+        WMI_RS_MGMT_CMDID               = 0x0852,
+        WMI_RF_MGMT_CMDID               = 0x0853,
+        /* Performance monitoring commands */
+        WMI_BF_CTRL_CMDID               = 0x0862,
+        WMI_NOTIFY_REQ_CMDID            = 0x0863,
+        WMI_GET_STATUS_CMDID            = 0x0864,
+        WMI_UNIT_TEST_CMDID             = 0x0900,
+        WMI_HICCUP_CMDID                = 0x0901,
+        WMI_FLASH_READ_CMDID            = 0x0902,
+        WMI_FLASH_WRITE_CMDID           = 0x0903,
+        WMI_SECURITY_UNIT_TEST_CMDID    = 0x0904,
+
+        WMI_SET_MAC_ADDRESS_CMDID       = 0xf003,
+        WMI_ABORT_SCAN_CMDID            = 0xf007,
+        WMI_SET_PMK_CMDID               = 0xf028,
+
+        WMI_SET_PROMISCUOUS_MODE_CMDID  = 0xf041,
+        WMI_GET_PMK_CMDID               = 0xf048,
+        WMI_SET_PASSPHRASE_CMDID        = 0xf049,
+        WMI_SEND_ASSOC_RES_CMDID        = 0xf04a,
+        WMI_SET_ASSOC_REQ_RELAY_CMDID   = 0xf04b,
+        WMI_EAPOL_TX_CMDID              = 0xf04c,
+        WMI_MAC_ADDR_REQ_CMDID          = 0xf04d,
+        WMI_FW_VER_CMDID                = 0xf04e,
+};
+
+/*
+ * Commands data structures
+ */
+
+/*
+ * Frame Types
+ */
+enum wmi_mgmt_frame_type {
+        WMI_FRAME_BEACON        = 0,
+        WMI_FRAME_PROBE_REQ     = 1,
+        WMI_FRAME_PROBE_RESP    = 2,
+        WMI_FRAME_ASSOC_REQ     = 3,
+        WMI_FRAME_ASSOC_RESP    = 4,
+        WMI_NUM_MGMT_FRAME,
+};
+
+/*
+ * WMI_CONNECT_CMDID
+ */
+enum wmi_network_type {
+        WMI_NETTYPE_INFRA               = 0x01,
+        WMI_NETTYPE_ADHOC               = 0x02,
+        WMI_NETTYPE_ADHOC_CREATOR       = 0x04,
+        WMI_NETTYPE_AP                  = 0x10,
+        WMI_NETTYPE_P2P                 = 0x20,
+        WMI_NETTYPE_WBE                 = 0x40, /* PCIE over 60g */
+};
+
+enum wmi_dot11_auth_mode {
+        WMI_AUTH11_OPEN                 = 0x01,
+        WMI_AUTH11_SHARED               = 0x02,
+        WMI_AUTH11_LEAP                 = 0x04,
+        WMI_AUTH11_WSC                  = 0x08,
+};
+
+enum wmi_auth_mode {
+        WMI_AUTH_NONE                   = 0x01,
+        WMI_AUTH_WPA                    = 0x02,
+        WMI_AUTH_WPA2                   = 0x04,
+        WMI_AUTH_WPA_PSK                = 0x08,
+        WMI_AUTH_WPA2_PSK               = 0x10,
+        WMI_AUTH_WPA_CCKM               = 0x20,
+        WMI_AUTH_WPA2_CCKM              = 0x40,
+};
+
+enum wmi_crypto_type {
+        WMI_CRYPT_NONE                  = 0x01,
+        WMI_CRYPT_WEP                   = 0x02,
+        WMI_CRYPT_TKIP                  = 0x04,
+        WMI_CRYPT_AES                   = 0x08,
+        WMI_CRYPT_AES_GCMP              = 0x20,
+};
+
+
+enum wmi_connect_ctrl_flag_bits {
+        WMI_CONNECT_ASSOC_POLICY_USER           = 0x0001,
+        WMI_CONNECT_SEND_REASSOC                = 0x0002,
+        WMI_CONNECT_IGNORE_WPAx_GROUP_CIPHER    = 0x0004,
+        WMI_CONNECT_PROFILE_MATCH_DONE          = 0x0008,
+        WMI_CONNECT_IGNORE_AAC_BEACON           = 0x0010,
+        WMI_CONNECT_CSA_FOLLOW_BSS              = 0x0020,
+        WMI_CONNECT_DO_WPA_OFFLOAD              = 0x0040,
+        WMI_CONNECT_DO_NOT_DEAUTH               = 0x0080,
+};
+
+#define WMI_MAX_SSID_LEN    (32)
+
+struct wmi_connect_cmd {
+        u8 network_type;
+        u8 dot11_auth_mode;
+        u8 auth_mode;
+        u8 pairwise_crypto_type;
+        u8 pairwise_crypto_len;
+        u8 group_crypto_type;
+        u8 group_crypto_len;
+        u8 ssid_len;
+        u8 ssid[WMI_MAX_SSID_LEN];
+        u8 channel;
+        u8 reserved0;
+        u8 bssid[WMI_MAC_LEN];
+        __le32 ctrl_flags;
+        u8 dst_mac[WMI_MAC_LEN];
+        u8 reserved1[2];
+} __packed;
+
+
+/*
+ * WMI_RECONNECT_CMDID
+ */
+struct wmi_reconnect_cmd {
+        u8 channel;                     /* hint */
+        u8 reserved;
+        u8 bssid[WMI_MAC_LEN];          /* mandatory if set */
+} __packed;
+
+
+/*
+ * WMI_SET_PMK_CMDID
+ */
+
+#define WMI_MIN_KEY_INDEX       (0)
+#define WMI_MAX_KEY_INDEX       (3)
+#define WMI_MAX_KEY_LEN         (32)
+#define WMI_PASSPHRASE_LEN      (64)
+#define WMI_PMK_LEN             (32)
+
+struct  wmi_set_pmk_cmd {
+        u8 pmk[WMI_PMK_LEN];
+} __packed;
+
+
+/*
+ * WMI_SET_PASSPHRASE_CMDID
+ */
+struct wmi_set_passphrase_cmd {
+        u8 ssid[WMI_MAX_SSID_LEN];
+        u8 passphrase[WMI_PASSPHRASE_LEN];
+        u8 ssid_len;
+        u8 passphrase_len;
+} __packed;
+
+/*
+ * WMI_ADD_CIPHER_KEY_CMDID
+ */
+enum wmi_key_usage {
+        WMI_KEY_USE_PAIRWISE    = 0,
+        WMI_KEY_USE_GROUP       = 1,
+        WMI_KEY_USE_TX          = 2,  /* default Tx Key - Static WEP only */
+};
+
+struct wmi_add_cipher_key_cmd {
+        u8 key_index;
+        u8 key_type;
+        u8 key_usage;           /* enum wmi_key_usage */
+        u8 key_len;
+        u8 key_rsc[8];          /* key replay sequence counter */
+        u8 key[WMI_MAX_KEY_LEN];
+        u8 key_op_ctrl;         /* Additional Key Control information */
+        u8 mac[WMI_MAC_LEN];
+} __packed;
+
+/*
+ * WMI_DELETE_CIPHER_KEY_CMDID
+ */
+struct wmi_delete_cipher_key_cmd {
+        u8 key_index;
+        u8 mac[WMI_MAC_LEN];
+} __packed;
+
+
+/*
+ * WMI_START_SCAN_CMDID
+ *
+ * Start L1 scan operation
+ *
+ * Returned events:
+ * - WMI_RX_MGMT_PACKET_EVENTID - for every probe resp.
+ * - WMI_SCAN_COMPLETE_EVENTID
+ */
+enum wmi_scan_type {
+        WMI_LONG_SCAN           = 0,
+        WMI_SHORT_SCAN          = 1,
+};
+
+struct wmi_start_scan_cmd {
+        u8 reserved[8];
+        __le32 home_dwell_time; /* Max duration in the home channel(ms) */
+        __le32 force_scan_interval;     /* Time interval between scans (ms)*/
+        u8 scan_type;           /* wmi_scan_type */
+        u8 num_channels;                /* how many channels follow */
+        struct {
+                u8 channel;
+                u8 reserved;
+        } channel_list[0];      /* channels ID's */
+                                /* 0 - 58320 MHz */
+                                /* 1 - 60480 MHz */
+                                /* 2 - 62640 MHz */
+} __packed;
+
+/*
+ * WMI_SET_PROBED_SSID_CMDID
+ */
+#define MAX_PROBED_SSID_INDEX   (15)
+
+enum wmi_ssid_flag {
+        WMI_SSID_FLAG_DISABLE   = 0,    /* disables entry */
+        WMI_SSID_FLAG_SPECIFIC  = 1,    /* probes specified ssid */
+        WMI_SSID_FLAG_ANY       = 2,    /* probes for any ssid */
+};
+
+struct wmi_probed_ssid_cmd {
+        u8 entry_index;                 /* 0 to MAX_PROBED_SSID_INDEX */
+        u8 flag;                        /* enum wmi_ssid_flag */
+        u8 ssid_len;
+        u8 ssid[WMI_MAX_SSID_LEN];
+} __packed;
+
+/*
+ * WMI_SET_APPIE_CMDID
+ * Add Application specified IE to a management frame
+ */
+struct wmi_set_appie_cmd {
+        u8 mgmt_frm_type;       /* enum wmi_mgmt_frame_type */
+        u8 reserved;
+        __le16 ie_len;  /* Length of the IE to be added to MGMT frame */
+        u8 ie_info[0];
+} __packed;
+
+#define WMI_MAX_IE_LEN (1024)
+
+struct wmi_pxmt_range_cfg_cmd {
+        u8 dst_mac[WMI_MAC_LEN];
+        __le16 range;
+} __packed;
+
+struct wmi_pxmt_snr2_range_cfg_cmd {
+        s8 snr2range_arr[WMI_PROX_RANGE_NUM-1];
+} __packed;
+
+/*
+ * WMI_RF_MGMT_CMDID
+ */
+enum wmi_rf_mgmt_type {
+        WMI_RF_MGMT_W_DISABLE   = 0,
+        WMI_RF_MGMT_W_ENABLE    = 1,
+        WMI_RF_MGMT_GET_STATUS  = 2,
+};
+
+struct wmi_rf_mgmt_cmd {
+        __le32 rf_mgmt_type;
+} __packed;
+
+/*
+ * WMI_SET_SSID_CMDID
+ */
+struct wmi_set_ssid_cmd {
+        __le32 ssid_len;
+        u8 ssid[WMI_MAX_SSID_LEN];
+} __packed;
+
+/*
+ * WMI_SET_PCP_CHANNEL_CMDID
+ */
+struct wmi_set_pcp_channel_cmd {
+        u8 channel;
+        u8 reserved[3];
+} __packed;
+
+/*
+ * WMI_BCON_CTRL_CMDID
+ */
+struct wmi_bcon_ctrl_cmd {
+        __le16 bcon_interval;
+        __le16 frag_num;
+        __le64 ss_mask;
+        u8 network_type;
+        u8 reserved;
+        u8 disable_sec_offload;
+        u8 disable_sec;
+} __packed;
+
+/*
+ * WMI_SW_TX_REQ_CMDID
+ */
+struct wmi_sw_tx_req_cmd {
+        u8 dst_mac[WMI_MAC_LEN];
+        __le16 len;
+        u8 payload[0];
+} __packed;
+
+/*
+ * WMI_VRING_CFG_CMDID
+ */
+
+struct wmi_sw_ring_cfg {
+        __le64 ring_mem_base;
+        __le16 ring_size;
+        __le16 max_mpdu_size;
+} __packed;
+
+struct wmi_vring_cfg_schd {
+        __le16 priority;
+        __le16 timeslot_us;
+} __packed;
+
+enum wmi_vring_cfg_encap_trans_type {
+        WMI_VRING_ENC_TYPE_802_3                = 0,
+        WMI_VRING_ENC_TYPE_NATIVE_WIFI          = 1,
+};
+
+enum wmi_vring_cfg_ds_cfg {
+        WMI_VRING_DS_PBSS                       = 0,
+        WMI_VRING_DS_STATION                    = 1,
+        WMI_VRING_DS_AP                         = 2,
+        WMI_VRING_DS_ADDR4                      = 3,
+};
+
+enum wmi_vring_cfg_nwifi_ds_trans_type {
+        WMI_NWIFI_TX_TRANS_MODE_NO              = 0,
+        WMI_NWIFI_TX_TRANS_MODE_AP2PBSS         = 1,
+        WMI_NWIFI_TX_TRANS_MODE_STA2PBSS        = 2,
+};
+
+enum wmi_vring_cfg_schd_params_priority {
+        WMI_SCH_PRIO_REGULAR                    = 0,
+        WMI_SCH_PRIO_HIGH                       = 1,
+};
+
+struct wmi_vring_cfg {
+        struct wmi_sw_ring_cfg tx_sw_ring;
+        u8 ringid;                              /* 0-23 vrings */
+
+        #define CIDXTID_CID_POS (0)
+        #define CIDXTID_CID_LEN (4)
+        #define CIDXTID_CID_MSK (0xF)
+        #define CIDXTID_TID_POS (4)
+        #define CIDXTID_TID_LEN (4)
+        #define CIDXTID_TID_MSK (0xF0)
+        u8 cidxtid;
+
+        u8 encap_trans_type;
+        u8 ds_cfg;                              /* 802.3 DS cfg */
+        u8 nwifi_ds_trans_type;
+
+        #define VRING_CFG_MAC_CTRL_LIFETIME_EN_POS (0)
+        #define VRING_CFG_MAC_CTRL_LIFETIME_EN_LEN (1)
+        #define VRING_CFG_MAC_CTRL_LIFETIME_EN_MSK (0x1)
+        #define VRING_CFG_MAC_CTRL_AGGR_EN_POS (1)
+        #define VRING_CFG_MAC_CTRL_AGGR_EN_LEN (1)
+        #define VRING_CFG_MAC_CTRL_AGGR_EN_MSK (0x2)
+        u8 mac_ctrl;
+
+        #define VRING_CFG_TO_RESOLUTION_VALUE_POS (0)
+        #define VRING_CFG_TO_RESOLUTION_VALUE_LEN (6)
+        #define VRING_CFG_TO_RESOLUTION_VALUE_MSK (0x3F)
+        u8 to_resolution;
+        u8 agg_max_wsize;
+        struct wmi_vring_cfg_schd schd_params;
+} __packed;
+
+enum wmi_vring_cfg_cmd_action {
+        WMI_VRING_CMD_ADD                       = 0,
+        WMI_VRING_CMD_MODIFY                    = 1,
+        WMI_VRING_CMD_DELETE                    = 2,
+};
+
+struct wmi_vring_cfg_cmd {
+        __le32 action;
+        struct wmi_vring_cfg vring_cfg;
+} __packed;
+
+/*
+ * WMI_VRING_BA_EN_CMDID
+ */
+struct wmi_vring_ba_en_cmd {
+        u8 ringid;
+        u8 agg_max_wsize;
+        __le16 ba_timeout;
+} __packed;
+
+/*
+ * WMI_VRING_BA_DIS_CMDID
+ */
+struct wmi_vring_ba_dis_cmd {
+        u8 ringid;
+        u8 reserved;
+        __le16 reason;
+} __packed;
+
+/*
+ * WMI_NOTIFY_REQ_CMDID
+ */
+struct wmi_notify_req_cmd {
+        u8 cid;
+        u8 reserved[3];
+        __le32 interval_usec;
+} __packed;
+
+/*
+ * WMI_CFG_RX_CHAIN_CMDID
+ */
+enum wmi_sniffer_cfg_mode {
+        WMI_SNIFFER_OFF                         = 0,
+        WMI_SNIFFER_ON                          = 1,
+};
+
+enum wmi_sniffer_cfg_phy_info_mode {
+        WMI_SNIFFER_PHY_INFO_DISABLED           = 0,
+        WMI_SNIFFER_PHY_INFO_ENABLED            = 1,
+};
+
+enum wmi_sniffer_cfg_phy_support {
+        WMI_SNIFFER_CP                          = 0,
+        WMI_SNIFFER_DP                          = 1,
+        WMI_SNIFFER_BOTH_PHYS                   = 2,
+};
+
+struct wmi_sniffer_cfg {
+        __le32 mode;            /* enum wmi_sniffer_cfg_mode */
+        __le32 phy_info_mode;   /* enum wmi_sniffer_cfg_phy_info_mode */
+        __le32 phy_support;     /* enum wmi_sniffer_cfg_phy_support */
+        u8 channel;
+        u8 reserved[3];
+} __packed;
+
+enum wmi_cfg_rx_chain_cmd_action {
+        WMI_RX_CHAIN_ADD                        = 0,
+        WMI_RX_CHAIN_DEL                        = 1,
+};
+
+enum wmi_cfg_rx_chain_cmd_decap_trans_type {
+        WMI_DECAP_TYPE_802_3                    = 0,
+        WMI_DECAP_TYPE_NATIVE_WIFI              = 1,
+};
+
+enum wmi_cfg_rx_chain_cmd_nwifi_ds_trans_type {
+        WMI_NWIFI_RX_TRANS_MODE_NO              = 0,
+        WMI_NWIFI_RX_TRANS_MODE_PBSS2AP         = 1,
+        WMI_NWIFI_RX_TRANS_MODE_PBSS2STA        = 2,
+};
+
+struct wmi_cfg_rx_chain_cmd {
+        __le32 action;
+        struct wmi_sw_ring_cfg rx_sw_ring;
+        u8 mid;
+        u8 decap_trans_type;
+
+        #define L2_802_3_OFFLOAD_CTRL_VLAN_TAG_INSERTION_POS (0)
+        #define L2_802_3_OFFLOAD_CTRL_VLAN_TAG_INSERTION_LEN (1)
+        #define L2_802_3_OFFLOAD_CTRL_VLAN_TAG_INSERTION_MSK (0x1)
+        u8 l2_802_3_offload_ctrl;
+
+        #define L2_NWIFI_OFFLOAD_CTRL_REMOVE_QOS_POS (0)
+        #define L2_NWIFI_OFFLOAD_CTRL_REMOVE_QOS_LEN (1)
+        #define L2_NWIFI_OFFLOAD_CTRL_REMOVE_QOS_MSK (0x1)
+        #define L2_NWIFI_OFFLOAD_CTRL_REMOVE_PN_POS (1)
+        #define L2_NWIFI_OFFLOAD_CTRL_REMOVE_PN_LEN (1)
+        #define L2_NWIFI_OFFLOAD_CTRL_REMOVE_PN_MSK (0x2)
+        u8 l2_nwifi_offload_ctrl;
+
+        u8 vlan_id;
+        u8 nwifi_ds_trans_type;
+
+        #define L3_L4_CTRL_IPV4_CHECKSUM_EN_POS (0)
+        #define L3_L4_CTRL_IPV4_CHECKSUM_EN_LEN (1)
+        #define L3_L4_CTRL_IPV4_CHECKSUM_EN_MSK (0x1)
+        #define L3_L4_CTRL_TCPIP_CHECKSUM_EN_POS (1)
+        #define L3_L4_CTRL_TCPIP_CHECKSUM_EN_LEN (1)
+        #define L3_L4_CTRL_TCPIP_CHECKSUM_EN_MSK (0x2)
+        u8 l3_l4_ctrl;
+
+        #define RING_CTRL_OVERRIDE_PREFETCH_THRSH_POS (0)
+        #define RING_CTRL_OVERRIDE_PREFETCH_THRSH_LEN (1)
+        #define RING_CTRL_OVERRIDE_PREFETCH_THRSH_MSK (0x1)
+        #define RING_CTRL_OVERRIDE_WB_THRSH_POS (1)
+        #define RING_CTRL_OVERRIDE_WB_THRSH_LEN (1)
+        #define RING_CTRL_OVERRIDE_WB_THRSH_MSK (0x2)
+        #define RING_CTRL_OVERRIDE_ITR_THRSH_POS (2)
+        #define RING_CTRL_OVERRIDE_ITR_THRSH_LEN (1)
+        #define RING_CTRL_OVERRIDE_ITR_THRSH_MSK (0x4)
+        #define RING_CTRL_OVERRIDE_HOST_THRSH_POS (3)
+        #define RING_CTRL_OVERRIDE_HOST_THRSH_LEN (1)
+        #define RING_CTRL_OVERRIDE_HOST_THRSH_MSK (0x8)
+        u8 ring_ctrl;
+
+        __le16 prefetch_thrsh;
+        __le16 wb_thrsh;
+        __le32 itr_value;
+        __le16 host_thrsh;
+        u8 reserved[2];
+        struct wmi_sniffer_cfg sniffer_cfg;
+} __packed;
+
+/*
+ * WMI_RCP_ADDBA_RESP_CMDID
+ */
+struct wmi_rcp_addba_resp_cmd {
+
+        #define CIDXTID_CID_POS (0)
+        #define CIDXTID_CID_LEN (4)
+        #define CIDXTID_CID_MSK (0xF)
+        #define CIDXTID_TID_POS (4)
+        #define CIDXTID_TID_LEN (4)
+        #define CIDXTID_TID_MSK (0xF0)
+        u8 cidxtid;
+
+        u8 dialog_token;
+        __le16 status_code;
+        __le16 ba_param_set;    /* ieee80211_ba_parameterset field to send */
+        __le16 ba_timeout;
+} __packed;
+
+/*
+ * WMI_RCP_DELBA_CMDID
+ */
+struct wmi_rcp_delba_cmd {
+
+        #define CIDXTID_CID_POS (0)
+        #define CIDXTID_CID_LEN (4)
+        #define CIDXTID_CID_MSK (0xF)
+        #define CIDXTID_TID_POS (4)
+        #define CIDXTID_TID_LEN (4)
+        #define CIDXTID_TID_MSK (0xF0)
+        u8 cidxtid;
+
+        u8 reserved;
+        __le16 reason;
+} __packed;
+
+/*
+ * WMI_RCP_ADDBA_REQ_CMDID
+ */
+struct wmi_rcp_addba_req_cmd {
+
+        #define CIDXTID_CID_POS (0)
+        #define CIDXTID_CID_LEN (4)
+        #define CIDXTID_CID_MSK (0xF)
+        #define CIDXTID_TID_POS (4)
+        #define CIDXTID_TID_LEN (4)
+        #define CIDXTID_TID_MSK (0xF0)
+        u8 cidxtid;
+
+        u8 dialog_token;
+        /* ieee80211_ba_parameterset field as it received */
+        __le16 ba_param_set;
+        __le16 ba_timeout;
+        /* ieee80211_ba_seqstrl field as it received */
+        __le16 ba_seq_ctrl;
+} __packed;
+
+/*
+ * WMI_SET_MAC_ADDRESS_CMDID
+ */
+struct wmi_set_mac_address_cmd {
+        u8 mac[WMI_MAC_LEN];
+        u8 reserved[2];
+} __packed;
+
+
+/*
+* WMI_EAPOL_TX_CMDID
+*/
+struct wmi_eapol_tx_cmd {
+        u8 dst_mac[WMI_MAC_LEN];
+        __le16 eapol_len;
+        u8 eapol[0];
+} __packed;
+
+/*
+ * WMI_ECHO_CMDID
+ *
+ * Check FW is alive
+ *
+ * WMI_DEEP_ECHO_CMDID
+ *
+ * Check FW and ucode are alive
+ *
+ * Returned event: WMI_ECHO_RSP_EVENTID
+ * same event for both commands
+ */
+struct wmi_echo_cmd {
+        __le32 value;
+} __packed;
+
+/*
+ * WMI Events
+ */
+
+/*
+ * List of Events (target to host)
+ */
+enum wmi_event_id {
+        WMI_IMM_RSP_EVENTID                     = 0x0000,
+        WMI_READY_EVENTID                       = 0x1001,
+        WMI_CONNECT_EVENTID                     = 0x1002,
+        WMI_DISCONNECT_EVENTID                  = 0x1003,
+        WMI_SCAN_COMPLETE_EVENTID               = 0x100a,
+        WMI_REPORT_STATISTICS_EVENTID           = 0x100b,
+        WMI_RD_MEM_RSP_EVENTID                  = 0x1800,
+        WMI_FW_READY_EVENTID                    = 0x1801,
+        WMI_EXIT_FAST_MEM_ACC_MODE_EVENTID      = 0x0200,
+        WMI_ECHO_RSP_EVENTID                    = 0x1803,
+        WMI_CONFIG_MAC_DONE_EVENTID             = 0x1805,
+        WMI_CONFIG_PHY_DEBUG_DONE_EVENTID       = 0x1806,
+        WMI_ADD_STATION_DONE_EVENTID            = 0x1807,
+        WMI_ADD_DEBUG_TX_PCKT_DONE_EVENTID      = 0x1808,
+        WMI_PHY_GET_STATISTICS_EVENTID          = 0x1809,
+        WMI_FS_TUNE_DONE_EVENTID                = 0x180a,
+        WMI_CORR_MEASURE_DONE_EVENTID           = 0x180b,
+        WMI_TEMP_SENSE_DONE_EVENTID             = 0x180e,
+        WMI_DC_CALIB_DONE_EVENTID               = 0x180f,
+        WMI_IQ_TX_CALIB_DONE_EVENTID            = 0x1811,
+        WMI_IQ_RX_CALIB_DONE_EVENTID            = 0x1812,
+        WMI_SET_WORK_MODE_DONE_EVENTID          = 0x1815,
+        WMI_LO_LEAKAGE_CALIB_DONE_EVENTID       = 0x1816,
+        WMI_MARLON_R_ACTIVATE_DONE_EVENTID      = 0x1817,
+        WMI_MARLON_R_READ_DONE_EVENTID          = 0x1818,
+        WMI_MARLON_R_WRITE_DONE_EVENTID         = 0x1819,
+        WMI_MARLON_R_TXRX_SEL_DONE_EVENTID      = 0x181a,
+        WMI_SILENT_RSSI_CALIB_DONE_EVENTID      = 0x181d,
+
+        WMI_CFG_RX_CHAIN_DONE_EVENTID           = 0x1820,
+        WMI_VRING_CFG_DONE_EVENTID              = 0x1821,
+        WMI_RX_ON_DONE_EVENTID                  = 0x1822,
+        WMI_BA_STATUS_EVENTID                   = 0x1823,
+        WMI_RCP_ADDBA_REQ_EVENTID               = 0x1824,
+        WMI_ADDBA_RESP_SENT_EVENTID             = 0x1825,
+        WMI_DELBA_EVENTID                       = 0x1826,
+        WMI_GET_SSID_EVENTID                    = 0x1828,
+        WMI_GET_PCP_CHANNEL_EVENTID             = 0x182a,
+        WMI_SW_TX_COMPLETE_EVENTID              = 0x182b,
+        WMI_RX_OFF_DONE_EVENTID                 = 0x182c,
+
+        WMI_READ_MAC_RXQ_EVENTID                = 0x1830,
+        WMI_READ_MAC_TXQ_EVENTID                = 0x1831,
+        WMI_WRITE_MAC_RXQ_EVENTID               = 0x1832,
+        WMI_WRITE_MAC_TXQ_EVENTID               = 0x1833,
+        WMI_WRITE_MAC_XQ_FIELD_EVENTID          = 0x1834,
+
+        WMI_BEAFORMING_MGMT_DONE_EVENTID        = 0x1836,
+        WMI_BF_TXSS_MGMT_DONE_EVENTID           = 0x1837,
+        WMI_BF_RXSS_MGMT_DONE_EVENTID           = 0x1839,
+        WMI_RS_MGMT_DONE_EVENTID                = 0x1852,
+        WMI_RF_MGMT_STATUS_EVENTID              = 0x1853,
+        WMI_BF_SM_MGMT_DONE_EVENTID             = 0x1838,
+        WMI_RX_MGMT_PACKET_EVENTID              = 0x1840,
+
+        /* Performance monitoring events */
+        WMI_DATA_PORT_OPEN_EVENTID              = 0x1860,
+        WMI_WBE_LINKDOWN_EVENTID                = 0x1861,
+
+        WMI_BF_CTRL_DONE_EVENTID                = 0x1862,
+        WMI_NOTIFY_REQ_DONE_EVENTID             = 0x1863,
+        WMI_GET_STATUS_DONE_EVENTID             = 0x1864,
+
+        WMI_UNIT_TEST_EVENTID                   = 0x1900,
+        WMI_FLASH_READ_DONE_EVENTID             = 0x1902,
+        WMI_FLASH_WRITE_DONE_EVENTID            = 0x1903,
+
+        WMI_SET_CHANNEL_EVENTID                 = 0x9000,
+        WMI_ASSOC_REQ_EVENTID                   = 0x9001,
+        WMI_EAPOL_RX_EVENTID                    = 0x9002,
+        WMI_MAC_ADDR_RESP_EVENTID               = 0x9003,
+        WMI_FW_VER_EVENTID                      = 0x9004,
+};
+
+/*
+ * Events data structures
+ */
+
+/*
+ * WMI_RF_MGMT_STATUS_EVENTID
+ */
+enum wmi_rf_status {
+        WMI_RF_ENABLED                  = 0,
+        WMI_RF_DISABLED_HW              = 1,
+        WMI_RF_DISABLED_SW              = 2,
+        WMI_RF_DISABLED_HW_SW           = 3,
+};
+
+struct wmi_rf_mgmt_status_event {
+        __le32 rf_status;
+} __packed;
+
+/*
+ * WMI_GET_STATUS_DONE_EVENTID
+ */
+struct wmi_get_status_done_event {
+        __le32 is_associated;
+        u8 cid;
+        u8 reserved0[3];
+        u8 bssid[WMI_MAC_LEN];
+        u8 channel;
+        u8 reserved1;
+        u8 network_type;
+        u8 reserved2[3];
+        __le32 ssid_len;
+        u8 ssid[WMI_MAX_SSID_LEN];
+        __le32 rf_status;
+        __le32 is_secured;
+} __packed;
+
+/*
+ * WMI_FW_VER_EVENTID
+ */
+struct wmi_fw_ver_event {
+        u8 major;
+        u8 minor;
+        __le16 subminor;
+        __le16 build;
+} __packed;
+
+/*
+* WMI_MAC_ADDR_RESP_EVENTID
+*/
+struct wmi_mac_addr_resp_event {
+        u8 mac[WMI_MAC_LEN];
+        u8 auth_mode;
+        u8 crypt_mode;
+        __le32 offload_mode;
+} __packed;
+
+/*
+* WMI_EAPOL_RX_EVENTID
+*/
+struct wmi_eapol_rx_event {
+        u8 src_mac[WMI_MAC_LEN];
+        __le16 eapol_len;
+        u8 eapol[0];
+} __packed;
+
+/*
+* WMI_READY_EVENTID
+*/
+enum wmi_phy_capability {
+        WMI_11A_CAPABILITY              = 1,
+        WMI_11G_CAPABILITY              = 2,
+        WMI_11AG_CAPABILITY             = 3,
+        WMI_11NA_CAPABILITY             = 4,
+        WMI_11NG_CAPABILITY             = 5,
+        WMI_11NAG_CAPABILITY            = 6,
+        WMI_11AD_CAPABILITY             = 7,
+        WMI_11N_CAPABILITY_OFFSET = WMI_11NA_CAPABILITY - WMI_11A_CAPABILITY,
+};
+
+struct wmi_ready_event {
+        __le32 sw_version;
+        __le32 abi_version;
+        u8 mac[WMI_MAC_LEN];
+        u8 phy_capability;              /* enum wmi_phy_capability */
+        u8 reserved;
+} __packed;
+
+/*
+ * WMI_NOTIFY_REQ_DONE_EVENTID
+ */
+struct wmi_notify_req_done_event {
+        __le32 status;
+        __le64 tsf;
+        __le32 snr_val;
+        __le32 tx_tpt;
+        __le32 tx_goodput;
+        __le32 rx_goodput;
+        __le16 bf_mcs;
+        __le16 my_rx_sector;
+        __le16 my_tx_sector;
+        __le16 other_rx_sector;
+        __le16 other_tx_sector;
+        __le16 range;
+} __packed;
+
+/*
+ * WMI_CONNECT_EVENTID
+ */
+struct wmi_connect_event {
+        u8 channel;
+        u8 reserved0;
+        u8 bssid[WMI_MAC_LEN];
+        __le16 listen_interval;
+        __le16 beacon_interval;
+        u8 network_type;
+        u8 reserved1[3];
+        u8 beacon_ie_len;
+        u8 assoc_req_len;
+        u8 assoc_resp_len;
+        u8 cid;
+        u8 reserved2[3];
+        u8 assoc_info[0];
+} __packed;
+
+/*
+ * WMI_DISCONNECT_EVENTID
+ */
+enum wmi_disconnect_reason {
+        WMI_DIS_REASON_NO_NETWORK_AVAIL         = 1,
+        WMI_DIS_REASON_LOST_LINK                = 2, /* bmiss */
+        WMI_DIS_REASON_DISCONNECT_CMD           = 3,
+        WMI_DIS_REASON_BSS_DISCONNECTED         = 4,
+        WMI_DIS_REASON_AUTH_FAILED              = 5,
+        WMI_DIS_REASON_ASSOC_FAILED             = 6,
+        WMI_DIS_REASON_NO_RESOURCES_AVAIL       = 7,
+        WMI_DIS_REASON_CSERV_DISCONNECT         = 8,
+        WMI_DIS_REASON_INVALID_PROFILE          = 10,
+        WMI_DIS_REASON_DOT11H_CHANNEL_SWITCH    = 11,
+        WMI_DIS_REASON_PROFILE_MISMATCH         = 12,
+        WMI_DIS_REASON_CONNECTION_EVICTED       = 13,
+        WMI_DIS_REASON_IBSS_MERGE               = 14,
+};
+
+struct wmi_disconnect_event {
+        __le16 protocol_reason_status;  /* reason code, see 802.11 spec. */
+        u8 bssid[WMI_MAC_LEN];          /* set if known */
+        u8 disconnect_reason;           /* see wmi_disconnect_reason_e */
+        u8 assoc_resp_len;
+        u8 assoc_info[0];
+} __packed;
+
+/*
+ * WMI_SCAN_COMPLETE_EVENTID
+ */
+struct wmi_scan_complete_event {
+        __le32 status;
+} __packed;
+
+/*
+ * WMI_BA_STATUS_EVENTID
+ */
+enum wmi_vring_ba_status {
+        WMI_BA_AGREED                   = 0,
+        WMI_BA_NON_AGREED               = 1,
+};
+
+struct wmi_vring_ba_status_event {
+        __le16 status;
+        u8 reserved[2];
+        u8 ringid;
+        u8 agg_wsize;
+        __le16 ba_timeout;
+} __packed;
+
+/*
+ * WMI_DELBA_EVENTID
+ */
+struct wmi_delba_event {
+
+        #define CIDXTID_CID_POS (0)
+        #define CIDXTID_CID_LEN (4)
+        #define CIDXTID_CID_MSK (0xF)
+        #define CIDXTID_TID_POS (4)
+        #define CIDXTID_TID_LEN (4)
+        #define CIDXTID_TID_MSK (0xF0)
+        u8 cidxtid;
+
+        u8 from_initiator;
+        __le16 reason;
+} __packed;
+
+/*
+ * WMI_VRING_CFG_DONE_EVENTID
+ */
+enum wmi_vring_cfg_done_event_status {
+        WMI_VRING_CFG_SUCCESS           = 0,
+        WMI_VRING_CFG_FAILURE           = 1,
+};
+
+struct wmi_vring_cfg_done_event {
+        u8 ringid;
+        u8 status;
+        u8 reserved[2];
+        __le32 tx_vring_tail_ptr;
+} __packed;
+
+/*
+ * WMI_ADDBA_RESP_SENT_EVENTID
+ */
+enum wmi_rcp_addba_resp_sent_event_status {
+        WMI_ADDBA_SUCCESS               = 0,
+        WMI_ADDBA_FAIL                  = 1,
+};
+
+struct wmi_rcp_addba_resp_sent_event {
+
+        #define CIDXTID_CID_POS (0)
+        #define CIDXTID_CID_LEN (4)
+        #define CIDXTID_CID_MSK (0xF)
+        #define CIDXTID_TID_POS (4)
+        #define CIDXTID_TID_LEN (4)
+        #define CIDXTID_TID_MSK (0xF0)
+        u8 cidxtid;
+
+        u8 reserved;
+        __le16 status;
+} __packed;
+
+/*
+ * WMI_RCP_ADDBA_REQ_EVENTID
+ */
+struct wmi_rcp_addba_req_event {
+
+        #define CIDXTID_CID_POS (0)
+        #define CIDXTID_CID_LEN (4)
+        #define CIDXTID_CID_MSK (0xF)
+        #define CIDXTID_TID_POS (4)
+        #define CIDXTID_TID_LEN (4)
+        #define CIDXTID_TID_MSK (0xF0)
+        u8 cidxtid;
+
+        u8 dialog_token;
+        __le16 ba_param_set;    /* ieee80211_ba_parameterset as it received */
+        __le16 ba_timeout;
+        __le16 ba_seq_ctrl;     /* ieee80211_ba_seqstrl field as it received */
+} __packed;
+
+/*
+ * WMI_CFG_RX_CHAIN_DONE_EVENTID
+ */
+enum wmi_cfg_rx_chain_done_event_status {
+        WMI_CFG_RX_CHAIN_SUCCESS        = 1,
+};
+
+struct wmi_cfg_rx_chain_done_event {
+        __le32 rx_ring_tail_ptr;        /* Rx V-Ring Tail pointer */
+        __le32 status;
+} __packed;
+
+/*
+ * WMI_WBE_LINKDOWN_EVENTID
+ */
+enum wmi_wbe_link_down_event_reason {
+        WMI_WBE_REASON_USER_REQUEST     = 0,
+        WMI_WBE_REASON_RX_DISASSOC      = 1,
+        WMI_WBE_REASON_BAD_PHY_LINK     = 2,
+};
+
+struct wmi_wbe_link_down_event {
+        u8 cid;
+        u8 reserved[3];
+        __le32 reason;
+} __packed;
+
+/*
+ * WMI_DATA_PORT_OPEN_EVENTID
+ */
+struct wmi_data_port_open_event {
+        u8 cid;
+        u8 reserved[3];
+} __packed;
+
+/*
+ * WMI_GET_PCP_CHANNEL_EVENTID
+ */
+struct wmi_get_pcp_channel_event {
+        u8 channel;
+        u8 reserved[3];
+} __packed;
+
+/*
+ * WMI_SW_TX_COMPLETE_EVENTID
+ */
+enum wmi_sw_tx_status {
+        WMI_TX_SW_STATUS_SUCCESS                = 0,
+        WMI_TX_SW_STATUS_FAILED_NO_RESOURCES    = 1,
+        WMI_TX_SW_STATUS_FAILED_TX              = 2,
+};
+
+struct wmi_sw_tx_complete_event {
+        u8 status;      /* enum wmi_sw_tx_status */
+        u8 reserved[3];
+} __packed;
+
+/*
+ * WMI_GET_SSID_EVENTID
+ */
+struct wmi_get_ssid_event {
+        __le32 ssid_len;
+        u8 ssid[WMI_MAX_SSID_LEN];
+} __packed;
+
+/*
+ * WMI_RX_MGMT_PACKET_EVENTID
+ */
+struct wmi_rx_mgmt_info {
+        u8 mcs;
+        s8 snr;
+        __le16 range;
+        __le16 stype;
+        __le16 status;
+        __le32 len;
+        u8 qid;
+        u8 mid;
+        u8 cid;
+        u8 channel;     /* From Radio MNGR */
+} __packed;
+
+struct wmi_rx_mgmt_packet_event {
+        struct wmi_rx_mgmt_info info;
+        u8 payload[0];
+} __packed;
+
+/*
+ * WMI_ECHO_RSP_EVENTID
+ */
+struct wmi_echo_event {
+        __le32 echoed_value;
+} __packed;
+
+#endif /* __WILOCITY_WMI_H__ */
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index b298e5d68be2..10e288d470e7 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -7,6 +7,7 @@
 #include <linux/hw_random.h>
 #include <linux/bcma/bcma.h>
 #include <linux/ssb/ssb.h>
+#include <linux/completion.h>
 #include <net/mac80211.h>
 
 #include "debugfs.h"
@@ -722,6 +723,10 @@ enum b43_firmware_file_type {
 struct b43_request_fw_context {
         /* The device we are requesting the fw for. */
         struct b43_wldev *dev;
+        /* a completion event structure needed if this call is asynchronous */
+        struct completion fw_load_complete;
+        /* a pointer to the firmware object */
+        const struct firmware *blob;
         /* The type of firmware to request. */
         enum b43_firmware_file_type req_type;
         /* Error messages for each firmware type. */
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 16ab280359bd..806e34c19281 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -2088,11 +2088,18 @@ static void b43_print_fw_helptext(struct b43_wl *wl, bool error)
                 b43warn(wl, text);
 }
 
+static void b43_fw_cb(const struct firmware *firmware, void *context)
+{
+        struct b43_request_fw_context *ctx = context;
+
+        ctx->blob = firmware;
+        complete(&ctx->fw_load_complete);
+}
+
 int b43_do_request_fw(struct b43_request_fw_context *ctx,
                       const char *name,
-                      struct b43_firmware_file *fw)
+                      struct b43_firmware_file *fw, bool async)
 {
-        const struct firmware *blob;
         struct b43_fw_header *hdr;
         u32 size;
         int err;
@@ -2131,11 +2138,31 @@ int b43_do_request_fw(struct b43_request_fw_context *ctx,
                 B43_WARN_ON(1);
                 return -ENOSYS;
         }
-        err = request_firmware(&blob, ctx->fwname, ctx->dev->dev->dev);
+        if (async) {
+                /* do this part asynchronously */
+                init_completion(&ctx->fw_load_complete);
+                err = request_firmware_nowait(THIS_MODULE, 1, ctx->fwname,
+                                              ctx->dev->dev->dev, GFP_KERNEL,
+                                              ctx, b43_fw_cb);
+                if (err < 0) {
+                        pr_err("Unable to load firmware\n");
+                        return err;
+                }
+                /* stall here until fw ready */
+                wait_for_completion(&ctx->fw_load_complete);
+                if (ctx->blob)
+                        goto fw_ready;
+        /* On some ARM systems, the async request will fail, but the next sync
+         * request works. For this reason, we dall through here
+         */
+        }
+        err = request_firmware(&ctx->blob, ctx->fwname,
+                               ctx->dev->dev->dev);
         if (err == -ENOENT) {
                 snprintf(ctx->errors[ctx->req_type],
                          sizeof(ctx->errors[ctx->req_type]),
-                         "Firmware file \"%s\" not found\n", ctx->fwname);
+                         "Firmware file \"%s\" not found\n",
+                         ctx->fwname);
                 return err;
         } else if (err) {
                 snprintf(ctx->errors[ctx->req_type],
@@ -2144,14 +2171,15 @@ int b43_do_request_fw(struct b43_request_fw_context *ctx,
                          ctx->fwname, err);
                 return err;
         }
-        if (blob->size < sizeof(struct b43_fw_header))
+fw_ready:
+        if (ctx->blob->size < sizeof(struct b43_fw_header))
                 goto err_format;
-        hdr = (struct b43_fw_header *)(blob->data);
+        hdr = (struct b43_fw_header *)(ctx->blob->data);
         switch (hdr->type) {
         case B43_FW_TYPE_UCODE:
         case B43_FW_TYPE_PCM:
                 size = be32_to_cpu(hdr->size);
-                if (size != blob->size - sizeof(struct b43_fw_header))
+                if (size != ctx->blob->size - sizeof(struct b43_fw_header))
                         goto err_format;
                 /* fallthrough */
         case B43_FW_TYPE_IV:
@@ -2162,7 +2190,7 @@ int b43_do_request_fw(struct b43_request_fw_context *ctx,
                 goto err_format;
         }
 
-        fw->data = blob;
+        fw->data = ctx->blob;
         fw->filename = name;
         fw->type = ctx->req_type;
 
@@ -2172,7 +2200,7 @@ err_format:
         snprintf(ctx->errors[ctx->req_type],
                  sizeof(ctx->errors[ctx->req_type]),
                  "Firmware file \"%s\" format error.\n", ctx->fwname);
-        release_firmware(blob);
+        release_firmware(ctx->blob);
 
         return -EPROTO;
 }
@@ -2223,7 +2251,7 @@ static int b43_try_request_fw(struct b43_request_fw_context *ctx)
                         goto err_no_ucode;
                 }
         }
-        err = b43_do_request_fw(ctx, filename, &fw->ucode);
+        err = b43_do_request_fw(ctx, filename, &fw->ucode, true);
         if (err)
                 goto err_load;
 
@@ -2235,7 +2263,7 @@ static int b43_try_request_fw(struct b43_request_fw_context *ctx)
         else
                 goto err_no_pcm;
         fw->pcm_request_failed = false;
-        err = b43_do_request_fw(ctx, filename, &fw->pcm);
+        err = b43_do_request_fw(ctx, filename, &fw->pcm, false);
         if (err == -ENOENT) {
                 /* We did not find a PCM file? Not fatal, but
                  * core rev <= 10 must do without hwcrypto then. */
@@ -2296,7 +2324,7 @@ static int b43_try_request_fw(struct b43_request_fw_context *ctx)
         default:
                 goto err_no_initvals;
         }
-        err = b43_do_request_fw(ctx, filename, &fw->initvals);
+        err = b43_do_request_fw(ctx, filename, &fw->initvals, false);
         if (err)
                 goto err_load;
 
@@ -2355,7 +2383,7 @@ static int b43_try_request_fw(struct b43_request_fw_context *ctx)
         default:
                 goto err_no_initvals;
         }
-        err = b43_do_request_fw(ctx, filename, &fw->initvals_band);
+        err = b43_do_request_fw(ctx, filename, &fw->initvals_band, false);
         if (err)
                 goto err_load;
 
diff --git a/drivers/net/wireless/b43/main.h b/drivers/net/wireless/b43/main.h
index 8c684cd33529..abac25ee958d 100644
--- a/drivers/net/wireless/b43/main.h
+++ b/drivers/net/wireless/b43/main.h
@@ -137,9 +137,8 @@ void b43_mac_phy_clock_set(struct b43_wldev *dev, bool on);
 
 
 struct b43_request_fw_context;
-int b43_do_request_fw(struct b43_request_fw_context *ctx,
-                      const char *name,
-                      struct b43_firmware_file *fw);
+int b43_do_request_fw(struct b43_request_fw_context *ctx, const char *name,
+                      struct b43_firmware_file *fw, bool async);
 void b43_do_release_fw(struct b43_firmware_file *fw);
 
 #endif /* B43_MAIN_H_ */
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
index 1fbd8ecbe2ea..e5fd20994bec 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c
@@ -36,6 +36,7 @@
 #include "debug.h"
 
 #define N_TX_QUEUES     4 /* #tx queues on mac80211<->driver interface */
+#define BRCMS_FLUSH_TIMEOUT     500 /* msec */
 
 /* Flags we support */
 #define MAC_FILTERS (FIF_PROMISC_IN_BSS | \
@@ -708,16 +709,29 @@ static void brcms_ops_rfkill_poll(struct ieee80211_hw *hw)
         wiphy_rfkill_set_hw_state(wl->pub->ieee_hw->wiphy, blocked);
 }
 
+static bool brcms_tx_flush_completed(struct brcms_info *wl)
+{
+        bool result;
+
+        spin_lock_bh(&wl->lock);
+        result = brcms_c_tx_flush_completed(wl->wlc);
+        spin_unlock_bh(&wl->lock);
+        return result;
+}
+
 static void brcms_ops_flush(struct ieee80211_hw *hw, bool drop)
 {
         struct brcms_info *wl = hw->priv;
+        int ret;
 
         no_printk("%s: drop = %s\n", __func__, drop ? "true" : "false");
 
-        /* wait for packet queue and dma fifos to run empty */
-        spin_lock_bh(&wl->lock);
-        brcms_c_wait_for_tx_completion(wl->wlc, drop);
-        spin_unlock_bh(&wl->lock);
+        ret = wait_event_timeout(wl->tx_flush_wq,
+                                 brcms_tx_flush_completed(wl),
+                                 msecs_to_jiffies(BRCMS_FLUSH_TIMEOUT));
+
+        brcms_dbg_mac80211(wl->wlc->hw->d11core,
+                           "ret=%d\n", jiffies_to_msecs(ret));
 }
 
 static const struct ieee80211_ops brcms_ops = {
@@ -772,6 +786,7 @@ void brcms_dpc(unsigned long data)
 
  done:
         spin_unlock_bh(&wl->lock);
+        wake_up(&wl->tx_flush_wq);
 }
 
 /*
@@ -1020,6 +1035,8 @@ static struct brcms_info *brcms_attach(struct bcma_device *pdev)
 
         atomic_set(&wl->callbacks, 0);
 
+        init_waitqueue_head(&wl->tx_flush_wq);
+
         /* setup the bottom half handler */
         tasklet_init(&wl->tasklet, brcms_dpc, (unsigned long) wl);
 
@@ -1407,9 +1424,10 @@ void brcms_add_timer(struct brcms_timer *t, uint ms, int periodic)
 #endif
         t->ms = ms;
         t->periodic = (bool) periodic;
-        t->set = true;
-
-        atomic_inc(&t->wl->callbacks);
+        if (!t->set) {
+                t->set = true;
+                atomic_inc(&t->wl->callbacks);
+        }
 
         ieee80211_queue_delayed_work(hw, &t->dly_wrk, msecs_to_jiffies(ms));
 }
@@ -1608,13 +1626,3 @@ bool brcms_rfkill_set_hw_state(struct brcms_info *wl)
         spin_lock_bh(&wl->lock);
         return blocked;
 }
-
-/*
- * precondition: perimeter lock has been acquired
- */
-void brcms_msleep(struct brcms_info *wl, uint ms)
-{
-        spin_unlock_bh(&wl->lock);
-        msleep(ms);
-        spin_lock_bh(&wl->lock);
-}
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h
index 9358bd5ebd35..947ccacf43e6 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.h
@@ -68,6 +68,8 @@ struct brcms_info {
         spinlock_t lock;        /* per-device perimeter lock */
         spinlock_t isr_lock;    /* per-device ISR synchronization lock */
 
+        /* tx flush */
+        wait_queue_head_t tx_flush_wq;
 
         /* timer related fields */
         atomic_t callbacks;     /* # outstanding callback functions */
@@ -100,7 +102,6 @@ extern struct brcms_timer *brcms_init_timer(struct brcms_info *wl,
 extern void brcms_free_timer(struct brcms_timer *timer);
 extern void brcms_add_timer(struct brcms_timer *timer, uint ms, int periodic);
 extern bool brcms_del_timer(struct brcms_timer *timer);
-extern void brcms_msleep(struct brcms_info *wl, uint ms);
 extern void brcms_dpc(unsigned long data);
 extern void brcms_timer(struct brcms_timer *t);
 extern void brcms_fatal_error(struct brcms_info *wl);
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/main.c b/drivers/net/wireless/brcm80211/brcmsmac/main.c
index 17594de4199e..8b5839008af3 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/main.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/main.c
@@ -1027,7 +1027,6 @@ brcms_c_dotxstatus(struct brcms_c_info *wlc, struct tx_status *txs)
 static bool
 brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)
 {
-        bool morepending = false;
         struct bcma_device *core;
         struct tx_status txstatus, *txs;
         u32 s1, s2;
@@ -1041,23 +1040,20 @@ brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)
         txs = &txstatus;
         core = wlc_hw->d11core;
         *fatal = false;
-        s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));
-        while (!(*fatal)
-               && (s1 & TXS_V)) {
-                /* !give others some time to run! */
-                if (n >= max_tx_num) {
-                        morepending = true;
-                        break;
-                }
 
+        while (n < max_tx_num) {
+                s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));
                 if (s1 == 0xffffffff) {
                         brcms_err(core, "wl%d: %s: dead chip\n", wlc_hw->unit,
                                   __func__);
                         *fatal = true;
                         return false;
                 }
-                s2 = bcma_read32(core, D11REGOFFS(frmtxstatus2));
+                /* only process when valid */
+                if (!(s1 & TXS_V))
+                        break;
 
+                s2 = bcma_read32(core, D11REGOFFS(frmtxstatus2));
                 txs->status = s1 & TXS_STATUS_MASK;
                 txs->frameid = (s1 & TXS_FID_MASK) >> TXS_FID_SHIFT;
                 txs->sequence = s2 & TXS_SEQ_MASK;
@@ -1065,15 +1061,12 @@ brcms_b_txstatus(struct brcms_hardware *wlc_hw, bool bound, bool *fatal)
                 txs->lasttxtime = 0;
 
                 *fatal = brcms_c_dotxstatus(wlc_hw->wlc, txs);
-
-                s1 = bcma_read32(core, D11REGOFFS(frmtxstatus));
+                if (*fatal == true)
+                        return false;
                 n++;
         }
 
-        if (*fatal)
-                return false;
-
-        return morepending;
+        return n >= max_tx_num;
 }
 
 static void brcms_c_tbtt(struct brcms_c_info *wlc)
@@ -7518,25 +7511,16 @@ int brcms_c_get_curband(struct brcms_c_info *wlc)
         return wlc->band->bandunit;
 }
 
-void brcms_c_wait_for_tx_completion(struct brcms_c_info *wlc, bool drop)
+bool brcms_c_tx_flush_completed(struct brcms_c_info *wlc)
 {
-        int timeout = 20;
         int i;
 
         /* Kick DMA to send any pending AMPDU */
         for (i = 0; i < ARRAY_SIZE(wlc->hw->di); i++)
                 if (wlc->hw->di[i])
-                        dma_txflush(wlc->hw->di[i]);
-
-        /* wait for queue and DMA fifos to run dry */
-        while (brcms_txpktpendtot(wlc) > 0) {
-                brcms_msleep(wlc->wl, 1);
-
-                if (--timeout == 0)
-                        break;
-        }
+                        dma_kick_tx(wlc->hw->di[i]);
 
-        WARN_ON_ONCE(timeout == 0);
+        return !brcms_txpktpendtot(wlc);
 }
 
 void brcms_c_set_beacon_listen_interval(struct brcms_c_info *wlc, u8 interval)
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/pub.h b/drivers/net/wireless/brcm80211/brcmsmac/pub.h
index 4fb2834f4e64..b0f14b7b8616 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/pub.h
+++ b/drivers/net/wireless/brcm80211/brcmsmac/pub.h
@@ -314,8 +314,6 @@ extern void brcms_c_associate_upd(struct brcms_c_info *wlc, bool state);
 extern void brcms_c_scan_start(struct brcms_c_info *wlc);
 extern void brcms_c_scan_stop(struct brcms_c_info *wlc);
 extern int brcms_c_get_curband(struct brcms_c_info *wlc);
-extern void brcms_c_wait_for_tx_completion(struct brcms_c_info *wlc,
-                                           bool drop);
 extern int brcms_c_set_channel(struct brcms_c_info *wlc, u16 channel);
 extern int brcms_c_set_rate_limit(struct brcms_c_info *wlc, u16 srl, u16 lrl);
 extern void brcms_c_get_current_rateset(struct brcms_c_info *wlc,
@@ -332,5 +330,6 @@ extern int brcms_c_set_tx_power(struct brcms_c_info *wlc, int txpwr);
 extern int brcms_c_get_tx_power(struct brcms_c_info *wlc);
 extern bool brcms_c_check_radio_disabled(struct brcms_c_info *wlc);
 extern void brcms_c_mute(struct brcms_c_info *wlc, bool on);
+extern bool brcms_c_tx_flush_completed(struct brcms_c_info *wlc);
 
 #endif                          /* _BRCM_PUB_H_ */
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.c b/drivers/net/wireless/ipw2x00/ipw2100.c
index d92b21a8e597..b3ab7b7becae 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.c
+++ b/drivers/net/wireless/ipw2x00/ipw2100.c
@@ -2181,9 +2181,10 @@ static void isr_indicate_rf_kill(struct ipw2100_priv *priv, u32 status)
         mod_delayed_work(system_wq, &priv->rf_kill, round_jiffies_relative(HZ));
 }
 
-static void send_scan_event(void *data)
+static void ipw2100_scan_event(struct work_struct *work)
 {
-        struct ipw2100_priv *priv = data;
+        struct ipw2100_priv *priv = container_of(work, struct ipw2100_priv,
+                                                 scan_event.work);
         union iwreq_data wrqu;
 
         wrqu.data.length = 0;
@@ -2191,18 +2192,6 @@ static void send_scan_event(void *data)
         wireless_send_event(priv->net_dev, SIOCGIWSCAN, &wrqu, NULL);
 }
 
-static void ipw2100_scan_event_later(struct work_struct *work)
-{
-        send_scan_event(container_of(work, struct ipw2100_priv,
-                                        scan_event_later.work));
-}
-
-static void ipw2100_scan_event_now(struct work_struct *work)
-{
-        send_scan_event(container_of(work, struct ipw2100_priv,
-                                        scan_event_now));
-}
-
 static void isr_scan_complete(struct ipw2100_priv *priv, u32 status)
 {
         IPW_DEBUG_SCAN("scan complete\n");
@@ -2212,13 +2201,11 @@ static void isr_scan_complete(struct ipw2100_priv *priv, u32 status)
 
         /* Only userspace-requested scan completion events go out immediately */
         if (!priv->user_requested_scan) {
-                if (!delayed_work_pending(&priv->scan_event_later))
-                        schedule_delayed_work(&priv->scan_event_later,
-                                              round_jiffies_relative(msecs_to_jiffies(4000)));
+                schedule_delayed_work(&priv->scan_event,
+                                      round_jiffies_relative(msecs_to_jiffies(4000)));
         } else {
                 priv->user_requested_scan = 0;
-                cancel_delayed_work(&priv->scan_event_later);
-                schedule_work(&priv->scan_event_now);
+                mod_delayed_work(system_wq, &priv->scan_event, 0);
         }
 }
 
@@ -4459,8 +4446,7 @@ static void ipw2100_kill_works(struct ipw2100_priv *priv)
         cancel_delayed_work_sync(&priv->wx_event_work);
         cancel_delayed_work_sync(&priv->hang_check);
         cancel_delayed_work_sync(&priv->rf_kill);
-        cancel_work_sync(&priv->scan_event_now);
-        cancel_delayed_work_sync(&priv->scan_event_later);
+        cancel_delayed_work_sync(&priv->scan_event);
 }
 
 static int ipw2100_tx_allocate(struct ipw2100_priv *priv)
@@ -6195,8 +6181,7 @@ static struct net_device *ipw2100_alloc_device(struct pci_dev *pci_dev,
         INIT_DELAYED_WORK(&priv->wx_event_work, ipw2100_wx_event_work);
         INIT_DELAYED_WORK(&priv->hang_check, ipw2100_hang_check);
         INIT_DELAYED_WORK(&priv->rf_kill, ipw2100_rf_kill);
-        INIT_WORK(&priv->scan_event_now, ipw2100_scan_event_now);
-        INIT_DELAYED_WORK(&priv->scan_event_later, ipw2100_scan_event_later);
+        INIT_DELAYED_WORK(&priv->scan_event, ipw2100_scan_event);
 
         tasklet_init(&priv->irq_tasklet, (void (*)(unsigned long))
                      ipw2100_irq_tasklet, (unsigned long)priv);
diff --git a/drivers/net/wireless/ipw2x00/ipw2100.h b/drivers/net/wireless/ipw2x00/ipw2100.h
index 5fe17cbab1f3..c6d78790cb0d 100644
--- a/drivers/net/wireless/ipw2x00/ipw2100.h
+++ b/drivers/net/wireless/ipw2x00/ipw2100.h
@@ -577,8 +577,7 @@ struct ipw2100_priv {
         struct delayed_work wx_event_work;
         struct delayed_work hang_check;
         struct delayed_work rf_kill;
-        struct work_struct scan_event_now;
-        struct delayed_work scan_event_later;
+        struct delayed_work scan_event;
 
         int user_requested_scan;
 
diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c
index 844f201b7b70..2c2d6db0536c 100644
--- a/drivers/net/wireless/ipw2x00/ipw2200.c
+++ b/drivers/net/wireless/ipw2x00/ipw2200.c
@@ -4480,18 +4480,11 @@ static void handle_scan_event(struct ipw_priv *priv)
 {
         /* Only userspace-requested scan completion events go out immediately */
         if (!priv->user_requested_scan) {
-                if (!delayed_work_pending(&priv->scan_event))
-                        schedule_delayed_work(&priv->scan_event,
-                                              round_jiffies_relative(msecs_to_jiffies(4000)));
+                schedule_delayed_work(&priv->scan_event,
+                                      round_jiffies_relative(msecs_to_jiffies(4000)));
         } else {
-                union iwreq_data wrqu;
-
                 priv->user_requested_scan = 0;
-                cancel_delayed_work(&priv->scan_event);
-
-                wrqu.data.length = 0;
-                wrqu.data.flags = 0;
-                wireless_send_event(priv->net_dev, SIOCGIWSCAN, &wrqu, NULL);
+                mod_delayed_work(system_wq, &priv->scan_event, 0);
         }
 }
 
diff --git a/drivers/net/wireless/iwlegacy/3945-mac.c b/drivers/net/wireless/iwlegacy/3945-mac.c
index d604b4036a76..3726cd6fcd75 100644
--- a/drivers/net/wireless/iwlegacy/3945-mac.c
+++ b/drivers/net/wireless/iwlegacy/3945-mac.c
@@ -3273,7 +3273,7 @@ il3945_store_measurement(struct device *d, struct device_attribute *attr,
 
         if (count) {
                 char *p = buffer;
-                strncpy(buffer, buf, min(sizeof(buffer), count));
+                strlcpy(buffer, buf, sizeof(buffer));
                 channel = simple_strtoul(p, NULL, 0);
                 if (channel)
                         params.channel = channel;
diff --git a/drivers/net/wireless/iwlegacy/common.c b/drivers/net/wireless/iwlegacy/common.c
index 7e16d10a7f14..90b8970eadf0 100644
--- a/drivers/net/wireless/iwlegacy/common.c
+++ b/drivers/net/wireless/iwlegacy/common.c
@@ -3958,17 +3958,21 @@ il_connection_init_rx_config(struct il_priv *il)
 
         memset(&il->staging, 0, sizeof(il->staging));
 
-        if (!il->vif) {
+        switch (il->iw_mode) {
+        case NL80211_IFTYPE_UNSPECIFIED:
                 il->staging.dev_type = RXON_DEV_TYPE_ESS;
-        } else if (il->vif->type == NL80211_IFTYPE_STATION) {
+                break;
+        case NL80211_IFTYPE_STATION:
                 il->staging.dev_type = RXON_DEV_TYPE_ESS;
                 il->staging.filter_flags = RXON_FILTER_ACCEPT_GRP_MSK;
-        } else if (il->vif->type == NL80211_IFTYPE_ADHOC) {
+                break;
+        case NL80211_IFTYPE_ADHOC:
                 il->staging.dev_type = RXON_DEV_TYPE_IBSS;
                 il->staging.flags = RXON_FLG_SHORT_PREAMBLE_MSK;
                 il->staging.filter_flags =
                     RXON_FILTER_BCON_AWARE_MSK | RXON_FILTER_ACCEPT_GRP_MSK;
-        } else {
+                break;
+        default:
                 IL_ERR("Unsupported interface type %d\n", il->vif->type);
                 return;
         }
@@ -4550,8 +4554,7 @@ out:
 EXPORT_SYMBOL(il_mac_add_interface);
 
 static void
-il_teardown_interface(struct il_priv *il, struct ieee80211_vif *vif,
-                      bool mode_change)
+il_teardown_interface(struct il_priv *il, struct ieee80211_vif *vif)
 {
         lockdep_assert_held(&il->mutex);
 
@@ -4560,9 +4563,7 @@ il_teardown_interface(struct il_priv *il, struct ieee80211_vif *vif,
                 il_force_scan_end(il);
         }
 
-        if (!mode_change)
-                il_set_mode(il);
-
+        il_set_mode(il);
 }
 
 void
@@ -4575,8 +4576,8 @@ il_mac_remove_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
 
         WARN_ON(il->vif != vif);
         il->vif = NULL;
-
-        il_teardown_interface(il, vif, false);
+        il->iw_mode = NL80211_IFTYPE_UNSPECIFIED;
+        il_teardown_interface(il, vif);
         memset(il->bssid, 0, ETH_ALEN);
 
         D_MAC80211("leave\n");
@@ -4685,18 +4686,10 @@ il_mac_change_interface(struct ieee80211_hw *hw, struct ieee80211_vif *vif,
         }
 
         /* success */
-        il_teardown_interface(il, vif, true);
         vif->type = newtype;
         vif->p2p = false;
-        err = il_set_mode(il);
-        WARN_ON(err);
-        /*
-         * We've switched internally, but submitting to the
-         * device may have failed for some reason. Mask this
-         * error, because otherwise mac80211 will not switch
-         * (and set the interface type back) and we'll be
-         * out of sync with it.
-         */
+        il->iw_mode = newtype;
+        il_teardown_interface(il, vif);
         err = 0;
 
 out:
diff --git a/drivers/net/wireless/iwlwifi/dvm/tx.c b/drivers/net/wireless/iwlwifi/dvm/tx.c
index da21328ca8ed..279796419ea0 100644
--- a/drivers/net/wireless/iwlwifi/dvm/tx.c
+++ b/drivers/net/wireless/iwlwifi/dvm/tx.c
@@ -1079,6 +1079,8 @@ static void iwlagn_set_tx_status(struct iwl_priv *priv,
 {
         u16 status = le16_to_cpu(tx_resp->status.status);
 
+        info->flags &= ~IEEE80211_TX_CTL_AMPDU;
+
         info->status.rates[0].count = tx_resp->failure_frame + 1;
         info->flags |= iwl_tx_status_to_mac80211(status);
         iwlagn_hwrate_to_tx_control(priv, le32_to_cpu(tx_resp->rate_n_flags),
diff --git a/drivers/net/wireless/iwlwifi/pcie/rx.c b/drivers/net/wireless/iwlwifi/pcie/rx.c
index dad4c4aad91f..8389cd38338b 100644
--- a/drivers/net/wireless/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/iwlwifi/pcie/rx.c
@@ -1166,6 +1166,7 @@ static irqreturn_t iwl_pcie_isr(int irq, void *data)
         else if (test_bit(STATUS_INT_ENABLED, &trans_pcie->status) &&
                  !trans_pcie->inta)
                 iwl_enable_interrupts(trans);
+        return IRQ_HANDLED;
 
 none:
         /* re-enable interrupts here since we don't have anything to service. */
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index a875499f8945..cdb11b3964e2 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -1459,7 +1459,7 @@ mwifiex_cfg80211_assoc(struct mwifiex_private *priv, size_t ssid_len, u8 *ssid,
         struct cfg80211_ssid req_ssid;
         int ret, auth_type = 0;
         struct cfg80211_bss *bss = NULL;
-        u8 is_scanning_required = 0, config_bands = 0;
+        u8 is_scanning_required = 0;
 
         memset(&req_ssid, 0, sizeof(struct cfg80211_ssid));
 
@@ -1478,19 +1478,6 @@ mwifiex_cfg80211_assoc(struct mwifiex_private *priv, size_t ssid_len, u8 *ssid,
         /* disconnect before try to associate */
         mwifiex_deauthenticate(priv, NULL);
 
-        if (channel) {
-                if (mode == NL80211_IFTYPE_STATION) {
-                        if (channel->band == IEEE80211_BAND_2GHZ)
-                                config_bands = BAND_B | BAND_G | BAND_GN;
-                        else
-                                config_bands = BAND_A | BAND_AN;
-
-                        if (!((config_bands | priv->adapter->fw_bands) &
-                              ~priv->adapter->fw_bands))
-                                priv->adapter->config_bands = config_bands;
-                }
-        }
-
         /* As this is new association, clear locally stored
          * keys and security related flags */
         priv->sec_info.wpa_enabled = false;
@@ -1707,9 +1694,9 @@ static int mwifiex_set_ibss_params(struct mwifiex_private *priv,
 
                 if (cfg80211_get_chandef_type(&params->chandef) !=
                                                 NL80211_CHAN_NO_HT)
-                        config_bands |= BAND_GN;
+                        config_bands |= BAND_G | BAND_GN;
         } else {
-                if (cfg80211_get_chandef_type(&params->chandef) !=
+                if (cfg80211_get_chandef_type(&params->chandef) ==
                                                 NL80211_CHAN_NO_HT)
                         config_bands = BAND_A;
                 else
diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c
index 13fbc4eb1595..b879e1338a54 100644
--- a/drivers/net/wireless/mwifiex/pcie.c
+++ b/drivers/net/wireless/mwifiex/pcie.c
@@ -161,7 +161,7 @@ static int mwifiex_pcie_suspend(struct pci_dev *pdev, pm_message_t state)
 
         if (pdev) {
                 card = (struct pcie_service_card *) pci_get_drvdata(pdev);
-                if (!card || card->adapter) {
+                if (!card || !card->adapter) {
                         pr_err("Card or adapter structure is not valid\n");
                         return 0;
                 }
diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c
index 9189a32b7844..973a9d90e9ea 100644
--- a/drivers/net/wireless/mwifiex/scan.c
+++ b/drivers/net/wireless/mwifiex/scan.c
@@ -1563,7 +1563,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                 dev_err(adapter->dev, "SCAN_RESP: too many AP returned (%d)\n",
                         scan_rsp->number_of_sets);
                 ret = -1;
-                goto done;
+                goto check_next_scan;
         }
 
         bytes_left = le16_to_cpu(scan_rsp->bss_descript_size);
@@ -1634,7 +1634,8 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                 if (!beacon_size || beacon_size > bytes_left) {
                         bss_info += bytes_left;
                         bytes_left = 0;
-                        return -1;
+                        ret = -1;
+                        goto check_next_scan;
                 }
 
                 /* Initialize the current working beacon pointer for this BSS
@@ -1690,7 +1691,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                                 dev_err(priv->adapter->dev,
                                         "%s: bytes left < IE length\n",
                                         __func__);
-                                goto done;
+                                goto check_next_scan;
                         }
                         if (element_id == WLAN_EID_DS_PARAMS) {
                                 channel = *(current_ptr + sizeof(struct ieee_types_header));
@@ -1753,6 +1754,7 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                 }
         }
 
+check_next_scan:
         spin_lock_irqsave(&adapter->scan_pending_q_lock, flags);
         if (list_empty(&adapter->scan_pending_q)) {
                 spin_unlock_irqrestore(&adapter->scan_pending_q_lock, flags);
@@ -1813,7 +1815,6 @@ int mwifiex_ret_802_11_scan(struct mwifiex_private *priv,
                 }
         }
 
-done:
         return ret;
 }
 
diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
index 5a1c1d0e5599..f2874c3392b4 100644
--- a/drivers/net/wireless/mwifiex/sdio.c
+++ b/drivers/net/wireless/mwifiex/sdio.c
@@ -1752,6 +1752,8 @@ mwifiex_update_mp_end_port(struct mwifiex_adapter *adapter, u16 port)
 static struct mmc_host *reset_host;
 static void sdio_card_reset_worker(struct work_struct *work)
 {
+        struct mmc_host *target = reset_host;
+
         /* The actual reset operation must be run outside of driver thread.
          * This is because mmc_remove_host() will cause the device to be
          * instantly destroyed, and the driver then needs to end its thread,
@@ -1761,10 +1763,10 @@ static void sdio_card_reset_worker(struct work_struct *work)
          */
 
         pr_err("Resetting card...\n");
-        mmc_remove_host(reset_host);
+        mmc_remove_host(target);
         /* 20ms delay is based on experiment with sdhci controller */
         mdelay(20);
-        mmc_add_host(reset_host);
+        mmc_add_host(target);
 }
 static DECLARE_WORK(card_reset_work, sdio_card_reset_worker);
 
@@ -1773,9 +1775,6 @@ static void mwifiex_sdio_card_reset(struct mwifiex_adapter *adapter)
 {
         struct sdio_mmc_card *card = adapter->card;
 
-        if (work_pending(&card_reset_work))
-                return;
-
         reset_host = card->func->card->host;
         schedule_work(&card_reset_work);
 }
diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
index cb682561c438..f542bb8ccbc8 100644
--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
@@ -56,7 +56,6 @@ int mwifiex_copy_mcast_addr(struct mwifiex_multicast_list *mlist,
  */
 int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter)
 {
-        bool cancel_flag = false;
         int status;
         struct cmd_ctrl_node *cmd_queued;
 
@@ -70,14 +69,11 @@ int mwifiex_wait_queue_complete(struct mwifiex_adapter *adapter)
         atomic_inc(&adapter->cmd_pending);
 
         /* Wait for completion */
-        wait_event_interruptible(adapter->cmd_wait_q.wait,
-                                 *(cmd_queued->condition));
-        if (!*(cmd_queued->condition))
-                cancel_flag = true;
-
-        if (cancel_flag) {
-                mwifiex_cancel_pending_ioctl(adapter);
-                dev_dbg(adapter->dev, "cmd cancel\n");
+        status = wait_event_interruptible(adapter->cmd_wait_q.wait,
+                                          *(cmd_queued->condition));
+        if (status) {
+                dev_err(adapter->dev, "cmd_wait_q terminated: %d\n", status);
+                return status;
         }
 
         status = adapter->cmd_wait_q.status;
@@ -287,6 +283,20 @@ int mwifiex_bss_start(struct mwifiex_private *priv, struct cfg80211_bss *bss,
                 if (ret)
                         goto done;
 
+                if (bss_desc) {
+                        u8 config_bands = 0;
+
+                        if (mwifiex_band_to_radio_type((u8) bss_desc->bss_band)
+                            == HostCmd_SCAN_RADIO_TYPE_BG)
+                                config_bands = BAND_B | BAND_G | BAND_GN;
+                        else
+                                config_bands = BAND_A | BAND_AN;
+
+                        if (!((config_bands | adapter->fw_bands) &
+                              ~adapter->fw_bands))
+                                adapter->config_bands = config_bands;
+                }
+
                 ret = mwifiex_check_network_compatibility(priv, bss_desc);
                 if (ret)
                         goto done;
@@ -496,8 +506,11 @@ int mwifiex_enable_hs(struct mwifiex_adapter *adapter)
                 return false;
         }
 
-        wait_event_interruptible(adapter->hs_activate_wait_q,
-                                 adapter->hs_activate_wait_q_woken);
+        if (wait_event_interruptible(adapter->hs_activate_wait_q,
+                                     adapter->hs_activate_wait_q_woken)) {
+                dev_err(adapter->dev, "hs_activate_wait_q terminated\n");
+                return false;
+        }
 
         return true;
 }
diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c
index f221b95b90b3..a00a03ea4ec9 100644
--- a/drivers/net/wireless/mwl8k.c
+++ b/drivers/net/wireless/mwl8k.c
@@ -318,20 +318,20 @@ struct mwl8k_sta {
 #define MWL8K_STA(_sta) ((struct mwl8k_sta *)&((_sta)->drv_priv))
 
 static const struct ieee80211_channel mwl8k_channels_24[] = {
-        { .center_freq = 2412, .hw_value = 1, },
-        { .center_freq = 2417, .hw_value = 2, },
-        { .center_freq = 2422, .hw_value = 3, },
-        { .center_freq = 2427, .hw_value = 4, },
-        { .center_freq = 2432, .hw_value = 5, },
-        { .center_freq = 2437, .hw_value = 6, },
-        { .center_freq = 2442, .hw_value = 7, },
-        { .center_freq = 2447, .hw_value = 8, },
-        { .center_freq = 2452, .hw_value = 9, },
-        { .center_freq = 2457, .hw_value = 10, },
-        { .center_freq = 2462, .hw_value = 11, },
-        { .center_freq = 2467, .hw_value = 12, },
-        { .center_freq = 2472, .hw_value = 13, },
-        { .center_freq = 2484, .hw_value = 14, },
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2412, .hw_value = 1, },
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2417, .hw_value = 2, },
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2422, .hw_value = 3, },
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2427, .hw_value = 4, },
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2432, .hw_value = 5, },
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2437, .hw_value = 6, },
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2442, .hw_value = 7, },
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2447, .hw_value = 8, },
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2452, .hw_value = 9, },
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2457, .hw_value = 10, },
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2462, .hw_value = 11, },
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2467, .hw_value = 12, },
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2472, .hw_value = 13, },
+        { .band = IEEE80211_BAND_2GHZ, .center_freq = 2484, .hw_value = 14, },
 };
 
 static const struct ieee80211_rate mwl8k_rates_24[] = {
@@ -352,10 +352,10 @@ static const struct ieee80211_rate mwl8k_rates_24[] = {
 };
 
 static const struct ieee80211_channel mwl8k_channels_50[] = {
-        { .center_freq = 5180, .hw_value = 36, },
-        { .center_freq = 5200, .hw_value = 40, },
-        { .center_freq = 5220, .hw_value = 44, },
-        { .center_freq = 5240, .hw_value = 48, },
+        { .band = IEEE80211_BAND_5GHZ, .center_freq = 5180, .hw_value = 36, },
+        { .band = IEEE80211_BAND_5GHZ, .center_freq = 5200, .hw_value = 40, },
+        { .band = IEEE80211_BAND_5GHZ, .center_freq = 5220, .hw_value = 44, },
+        { .band = IEEE80211_BAND_5GHZ, .center_freq = 5240, .hw_value = 48, },
 };
 
 static const struct ieee80211_rate mwl8k_rates_50[] = {
@@ -4250,9 +4250,11 @@ static int mwl8k_cmd_update_stadb_add(struct ieee80211_hw *hw,
         p->amsdu_enabled = 0;
 
         rc = mwl8k_post_cmd(hw, &cmd->header);
+        if (!rc)
+                rc = p->station_id;
         kfree(cmd);
 
-        return rc ? rc : p->station_id;
+        return rc;
 }
 
 static int mwl8k_cmd_update_stadb_del(struct ieee80211_hw *hw,
diff --git a/drivers/net/wireless/rtlwifi/Kconfig b/drivers/net/wireless/rtlwifi/Kconfig
index 21b1bbb93a7e..b80bc4612581 100644
--- a/drivers/net/wireless/rtlwifi/Kconfig
+++ b/drivers/net/wireless/rtlwifi/Kconfig
@@ -57,12 +57,12 @@ config RTL8192CU
 
 config RTLWIFI
         tristate
-        depends on RTL8192CE || RTL8192CU || RTL8192SE || RTL8192DE
+        depends on RTL8192CE || RTL8192CU || RTL8192SE || RTL8192DE || RTL8723AE
         default m
 
 config RTLWIFI_DEBUG
         bool "Additional debugging output"
-        depends on RTL8192CE || RTL8192CU || RTL8192SE || RTL8192DE
+        depends on RTL8192CE || RTL8192CU || RTL8192SE || RTL8192DE || RTL8723AE
         default y
 
 config RTL8192C_COMMON
diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c
index 4494d130b37c..0f8b05185eda 100644
--- a/drivers/net/wireless/rtlwifi/base.c
+++ b/drivers/net/wireless/rtlwifi/base.c
@@ -1004,7 +1004,8 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
                                          is_tx ? "Tx" : "Rx");
 
                                 if (is_tx) {
-                                        rtl_lps_leave(hw);
+                                        schedule_work(&rtlpriv->
+                                                      works.lps_leave_work);
                                         ppsc->last_delaylps_stamp_jiffies =
                                             jiffies;
                                 }
@@ -1014,7 +1015,7 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
                 }
         } else if (ETH_P_ARP == ether_type) {
                 if (is_tx) {
-                        rtl_lps_leave(hw);
+                        schedule_work(&rtlpriv->works.lps_leave_work);
                         ppsc->last_delaylps_stamp_jiffies = jiffies;
                 }
 
@@ -1024,7 +1025,7 @@ u8 rtl_is_special_data(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx)
                          "802.1X %s EAPOL pkt!!\n", is_tx ? "Tx" : "Rx");
 
                 if (is_tx) {
-                        rtl_lps_leave(hw);
+                        schedule_work(&rtlpriv->works.lps_leave_work);
                         ppsc->last_delaylps_stamp_jiffies = jiffies;
                 }
 
diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
index 1d5d3604e3e0..246e5352f2e1 100644
--- a/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
+++ b/drivers/net/wireless/rtlwifi/rtl8192c/phy_common.c
@@ -692,7 +692,7 @@ u8 rtl92c_phy_sw_chnl(struct ieee80211_hw *hw)
         if (!(is_hal_stop(rtlhal)) && !(RT_CANNOT_IO(hw))) {
                 rtl92c_phy_sw_chnl_callback(hw);
                 RT_TRACE(rtlpriv, COMP_CHAN, DBG_LOUD,
-                         "sw_chnl_inprogress false schdule workitem\n");
+                         "sw_chnl_inprogress false schedule workitem\n");
                 rtlphy->sw_chnl_inprogress = false;
         } else {
                 RT_TRACE(rtlpriv, COMP_CHAN, DBG_LOUD,
diff --git a/drivers/net/wireless/rtlwifi/rtl8723ae/phy.c b/drivers/net/wireless/rtlwifi/rtl8723ae/phy.c
index 39cc7938eedf..3d8536bb0d2b 100644
--- a/drivers/net/wireless/rtlwifi/rtl8723ae/phy.c
+++ b/drivers/net/wireless/rtlwifi/rtl8723ae/phy.c
@@ -1106,7 +1106,7 @@ u8 rtl8723ae_phy_sw_chnl(struct ieee80211_hw *hw)
         if (!(is_hal_stop(rtlhal)) && !(RT_CANNOT_IO(hw))) {
                 rtl8723ae_phy_sw_chnl_callback(hw);
                 RT_TRACE(rtlpriv, COMP_CHAN, DBG_LOUD,
-                         "sw_chnl_inprogress false schdule workitem\n");
+                         "sw_chnl_inprogress false schedule workitem\n");
                 rtlphy->sw_chnl_inprogress = false;
         } else {
                 RT_TRACE(rtlpriv, COMP_CHAN, DBG_LOUD,
diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c
index f2ecdeb3a90d..1535efda3d52 100644
--- a/drivers/net/wireless/rtlwifi/usb.c
+++ b/drivers/net/wireless/rtlwifi/usb.c
@@ -542,8 +542,8 @@ static void _rtl_rx_pre_process(struct ieee80211_hw *hw, struct sk_buff *skb)
         WARN_ON(skb_queue_empty(&rx_queue));
         while (!skb_queue_empty(&rx_queue)) {
                 _skb = skb_dequeue(&rx_queue);
-                _rtl_usb_rx_process_agg(hw, skb);
-                ieee80211_rx_irqsafe(hw, skb);
+                _rtl_usb_rx_process_agg(hw, _skb);
+                ieee80211_rx_irqsafe(hw, _skb);
         }
 }
 
diff --git a/drivers/net/wireless/ti/wl1251/ps.c b/drivers/net/wireless/ti/wl1251/ps.c
index db719f7d2692..b9e27b98bbc9 100644
--- a/drivers/net/wireless/ti/wl1251/ps.c
+++ b/drivers/net/wireless/ti/wl1251/ps.c
@@ -68,8 +68,7 @@ int wl1251_ps_elp_wakeup(struct wl1251 *wl)
         unsigned long timeout, start;
         u32 elp_reg;
 
-        if (delayed_work_pending(&wl->elp_work))
-                cancel_delayed_work(&wl->elp_work);
+        cancel_delayed_work(&wl->elp_work);
 
         if (!wl->elp)
                 return 0;
diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
index 94b79c3338c4..9d7f1723dd8f 100644
--- a/drivers/net/xen-netback/common.h
+++ b/drivers/net/xen-netback/common.h
@@ -151,6 +151,9 @@ void xen_netbk_queue_tx_skb(struct xenvif *vif, struct sk_buff *skb);
 /* Notify xenvif that ring now has space to send an skb to the frontend */
 void xenvif_notify_tx_completion(struct xenvif *vif);
 
+/* Prevent the device from generating any further traffic. */
+void xenvif_carrier_off(struct xenvif *vif);
+
 /* Returns number of ring slots required to send an skb to the frontend */
 unsigned int xen_netbk_count_skb_slots(struct xenvif *vif, struct sk_buff *skb);
 
diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
index b7d41f8c338a..b8c5193bd420 100644
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -343,17 +343,22 @@ err:
         return err;
 }
 
-void xenvif_disconnect(struct xenvif *vif)
+void xenvif_carrier_off(struct xenvif *vif)
 {
         struct net_device *dev = vif->dev;
-        if (netif_carrier_ok(dev)) {
-                rtnl_lock();
-                netif_carrier_off(dev); /* discard queued packets */
-                if (netif_running(dev))
-                        xenvif_down(vif);
-                rtnl_unlock();
-                xenvif_put(vif);
-        }
+
+        rtnl_lock();
+        netif_carrier_off(dev); /* discard queued packets */
+        if (netif_running(dev))
+                xenvif_down(vif);
+        rtnl_unlock();
+        xenvif_put(vif);
+}
+
+void xenvif_disconnect(struct xenvif *vif)
+{
+        if (netif_carrier_ok(vif->dev))
+                xenvif_carrier_off(vif);
 
         atomic_dec(&vif->refcnt);
         wait_event(vif->waiting_to_free, atomic_read(&vif->refcnt) == 0);
diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
index f2d6b78d901d..2b9520c46e97 100644
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -147,7 +147,8 @@ void xen_netbk_remove_xenvif(struct xenvif *vif)
         atomic_dec(&netbk->netfront_count);
 }
 
-static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx);
+static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx,
+                                  u8 status);
 static void make_tx_response(struct xenvif *vif,
                              struct xen_netif_tx_request *txp,
                              s8       st);
@@ -879,7 +880,7 @@ static void netbk_tx_err(struct xenvif *vif,
 
         do {
                 make_tx_response(vif, txp, XEN_NETIF_RSP_ERROR);
-                if (cons >= end)
+                if (cons == end)
                         break;
                 txp = RING_GET_REQUEST(&vif->tx, cons++);
         } while (1);
@@ -888,6 +889,13 @@ static void netbk_tx_err(struct xenvif *vif,
         xenvif_put(vif);
 }
 
+static void netbk_fatal_tx_err(struct xenvif *vif)
+{
+        netdev_err(vif->dev, "fatal error; disabling device\n");
+        xenvif_carrier_off(vif);
+        xenvif_put(vif);
+}
+
 static int netbk_count_requests(struct xenvif *vif,
                                 struct xen_netif_tx_request *first,
                                 struct xen_netif_tx_request *txp,
@@ -901,19 +909,22 @@ static int netbk_count_requests(struct xenvif *vif,
 
         do {
                 if (frags >= work_to_do) {
-                        netdev_dbg(vif->dev, "Need more frags\n");
+                        netdev_err(vif->dev, "Need more frags\n");
+                        netbk_fatal_tx_err(vif);
                         return -frags;
                 }
 
                 if (unlikely(frags >= MAX_SKB_FRAGS)) {
-                        netdev_dbg(vif->dev, "Too many frags\n");
+                        netdev_err(vif->dev, "Too many frags\n");
+                        netbk_fatal_tx_err(vif);
                         return -frags;
                 }
 
                 memcpy(txp, RING_GET_REQUEST(&vif->tx, cons + frags),
                        sizeof(*txp));
                 if (txp->size > first->size) {
-                        netdev_dbg(vif->dev, "Frags galore\n");
+                        netdev_err(vif->dev, "Frag is bigger than frame.\n");
+                        netbk_fatal_tx_err(vif);
                         return -frags;
                 }
 
@@ -921,8 +932,9 @@ static int netbk_count_requests(struct xenvif *vif,
                 frags++;
 
                 if (unlikely((txp->offset + txp->size) > PAGE_SIZE)) {
-                        netdev_dbg(vif->dev, "txp->offset: %x, size: %u\n",
+                        netdev_err(vif->dev, "txp->offset: %x, size: %u\n",
                                  txp->offset, txp->size);
+                        netbk_fatal_tx_err(vif);
                         return -frags;
                 }
         } while ((txp++)->flags & XEN_NETTXF_more_data);
@@ -966,7 +978,7 @@ static struct gnttab_copy *xen_netbk_get_requests(struct xen_netbk *netbk,
                 pending_idx = netbk->pending_ring[index];
                 page = xen_netbk_alloc_page(netbk, skb, pending_idx);
                 if (!page)
-                        return NULL;
+                        goto err;
 
                 gop->source.u.ref = txp->gref;
                 gop->source.domid = vif->domid;
@@ -988,6 +1000,17 @@ static struct gnttab_copy *xen_netbk_get_requests(struct xen_netbk *netbk,
         }
 
         return gop;
+err:
+        /* Unwind, freeing all pages and sending error responses. */
+        while (i-- > start) {
+                xen_netbk_idx_release(netbk, frag_get_pending_idx(&frags[i]),
+                                      XEN_NETIF_RSP_ERROR);
+        }
+        /* The head too, if necessary. */
+        if (start)
+                xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_ERROR);
+
+        return NULL;
 }
 
 static int xen_netbk_tx_check_gop(struct xen_netbk *netbk,
@@ -996,30 +1019,20 @@ static int xen_netbk_tx_check_gop(struct xen_netbk *netbk,
 {
         struct gnttab_copy *gop = *gopp;
         u16 pending_idx = *((u16 *)skb->data);
-        struct pending_tx_info *pending_tx_info = netbk->pending_tx_info;
-        struct xenvif *vif = pending_tx_info[pending_idx].vif;
-        struct xen_netif_tx_request *txp;
         struct skb_shared_info *shinfo = skb_shinfo(skb);
         int nr_frags = shinfo->nr_frags;
         int i, err, start;
 
         /* Check status of header. */
         err = gop->status;
-        if (unlikely(err)) {
-                pending_ring_idx_t index;
-                index = pending_index(netbk->pending_prod++);
-                txp = &pending_tx_info[pending_idx].req;
-                make_tx_response(vif, txp, XEN_NETIF_RSP_ERROR);
-                netbk->pending_ring[index] = pending_idx;
-                xenvif_put(vif);
-        }
+        if (unlikely(err))
+                xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_ERROR);
 
         /* Skip first skb fragment if it is on same page as header fragment. */
         start = (frag_get_pending_idx(&shinfo->frags[0]) == pending_idx);
 
         for (i = start; i < nr_frags; i++) {
                 int j, newerr;
-                pending_ring_idx_t index;
 
                 pending_idx = frag_get_pending_idx(&shinfo->frags[i]);
 
@@ -1028,16 +1041,12 @@ static int xen_netbk_tx_check_gop(struct xen_netbk *netbk,
                 if (likely(!newerr)) {
                         /* Had a previous error? Invalidate this fragment. */
                         if (unlikely(err))
-                                xen_netbk_idx_release(netbk, pending_idx);
+                                xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY);
                         continue;
                 }
 
                 /* Error on this fragment: respond to client with an error. */
-                txp = &netbk->pending_tx_info[pending_idx].req;
-                make_tx_response(vif, txp, XEN_NETIF_RSP_ERROR);
-                index = pending_index(netbk->pending_prod++);
-                netbk->pending_ring[index] = pending_idx;
-                xenvif_put(vif);
+                xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_ERROR);
 
                 /* Not the first error? Preceding frags already invalidated. */
                 if (err)
@@ -1045,10 +1054,10 @@ static int xen_netbk_tx_check_gop(struct xen_netbk *netbk,
 
                 /* First error: invalidate header and preceding fragments. */
                 pending_idx = *((u16 *)skb->data);
-                xen_netbk_idx_release(netbk, pending_idx);
+                xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY);
                 for (j = start; j < i; j++) {
                         pending_idx = frag_get_pending_idx(&shinfo->frags[j]);
-                        xen_netbk_idx_release(netbk, pending_idx);
+                        xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY);
                 }
 
                 /* Remember the error: invalidate all subsequent fragments. */
@@ -1082,7 +1091,7 @@ static void xen_netbk_fill_frags(struct xen_netbk *netbk, struct sk_buff *skb)
 
                 /* Take an extra reference to offset xen_netbk_idx_release */
                 get_page(netbk->mmap_pages[pending_idx]);
-                xen_netbk_idx_release(netbk, pending_idx);
+                xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY);
         }
 }
 
@@ -1095,7 +1104,8 @@ static int xen_netbk_get_extras(struct xenvif *vif,
 
         do {
                 if (unlikely(work_to_do-- <= 0)) {
-                        netdev_dbg(vif->dev, "Missing extra info\n");
+                        netdev_err(vif->dev, "Missing extra info\n");
+                        netbk_fatal_tx_err(vif);
                         return -EBADR;
                 }
 
@@ -1104,8 +1114,9 @@ static int xen_netbk_get_extras(struct xenvif *vif,
                 if (unlikely(!extra.type ||
                              extra.type >= XEN_NETIF_EXTRA_TYPE_MAX)) {
                         vif->tx.req_cons = ++cons;
-                        netdev_dbg(vif->dev,
+                        netdev_err(vif->dev,
                                    "Invalid extra type: %d\n", extra.type);
+                        netbk_fatal_tx_err(vif);
                         return -EINVAL;
                 }
 
@@ -1121,13 +1132,15 @@ static int netbk_set_skb_gso(struct xenvif *vif,
                              struct xen_netif_extra_info *gso)
 {
         if (!gso->u.gso.size) {
-                netdev_dbg(vif->dev, "GSO size must not be zero.\n");
+                netdev_err(vif->dev, "GSO size must not be zero.\n");
+                netbk_fatal_tx_err(vif);
                 return -EINVAL;
         }
 
         /* Currently only TCPv4 S.O. is supported. */
         if (gso->u.gso.type != XEN_NETIF_GSO_TYPE_TCPV4) {
-                netdev_dbg(vif->dev, "Bad GSO type %d.\n", gso->u.gso.type);
+                netdev_err(vif->dev, "Bad GSO type %d.\n", gso->u.gso.type);
+                netbk_fatal_tx_err(vif);
                 return -EINVAL;
         }
 
@@ -1264,9 +1277,25 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk)
 
                 /* Get a netif from the list with work to do. */
                 vif = poll_net_schedule_list(netbk);
+                /* This can sometimes happen because the test of
+                 * list_empty(net_schedule_list) at the top of the
+                 * loop is unlocked.  Just go back and have another
+                 * look.
+                 */
                 if (!vif)
                         continue;
 
+                if (vif->tx.sring->req_prod - vif->tx.req_cons >
+                    XEN_NETIF_TX_RING_SIZE) {
+                        netdev_err(vif->dev,
+                                   "Impossible number of requests. "
+                                   "req_prod %d, req_cons %d, size %ld\n",
+                                   vif->tx.sring->req_prod, vif->tx.req_cons,
+                                   XEN_NETIF_TX_RING_SIZE);
+                        netbk_fatal_tx_err(vif);
+                        continue;
+                }
+
                 RING_FINAL_CHECK_FOR_REQUESTS(&vif->tx, work_to_do);
                 if (!work_to_do) {
                         xenvif_put(vif);
@@ -1294,17 +1323,14 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk)
                         work_to_do = xen_netbk_get_extras(vif, extras,
                                                           work_to_do);
                         idx = vif->tx.req_cons;
-                        if (unlikely(work_to_do < 0)) {
-                                netbk_tx_err(vif, &txreq, idx);
+                        if (unlikely(work_to_do < 0))
                                 continue;
-                        }
                 }
 
                 ret = netbk_count_requests(vif, &txreq, txfrags, work_to_do);
-                if (unlikely(ret < 0)) {
-                        netbk_tx_err(vif, &txreq, idx - ret);
+                if (unlikely(ret < 0))
                         continue;
-                }
+
                 idx += ret;
 
                 if (unlikely(txreq.size < ETH_HLEN)) {
@@ -1316,11 +1342,11 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk)
 
                 /* No crossing a page as the payload mustn't fragment. */
                 if (unlikely((txreq.offset + txreq.size) > PAGE_SIZE)) {
-                        netdev_dbg(vif->dev,
+                        netdev_err(vif->dev,
                                    "txreq.offset: %x, size: %u, end: %lu\n",
                                    txreq.offset, txreq.size,
                                    (txreq.offset&~PAGE_MASK) + txreq.size);
-                        netbk_tx_err(vif, &txreq, idx);
+                        netbk_fatal_tx_err(vif);
                         continue;
                 }
 
@@ -1348,8 +1374,8 @@ static unsigned xen_netbk_tx_build_gops(struct xen_netbk *netbk)
                         gso = &extras[XEN_NETIF_EXTRA_TYPE_GSO - 1];
 
                         if (netbk_set_skb_gso(vif, skb, gso)) {
+                                /* Failure in netbk_set_skb_gso is fatal. */
                                 kfree_skb(skb);
-                                netbk_tx_err(vif, &txreq, idx);
                                 continue;
                         }
                 }
@@ -1448,7 +1474,7 @@ static void xen_netbk_tx_submit(struct xen_netbk *netbk)
                         txp->size -= data_len;
                 } else {
                         /* Schedule a response immediately. */
-                        xen_netbk_idx_release(netbk, pending_idx);
+                        xen_netbk_idx_release(netbk, pending_idx, XEN_NETIF_RSP_OKAY);
                 }
 
                 if (txp->flags & XEN_NETTXF_csum_blank)
@@ -1500,7 +1526,8 @@ static void xen_netbk_tx_action(struct xen_netbk *netbk)
         xen_netbk_tx_submit(netbk);
 }
 
-static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx)
+static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx,
+                                  u8 status)
 {
         struct xenvif *vif;
         struct pending_tx_info *pending_tx_info;
@@ -1514,7 +1541,7 @@ static void xen_netbk_idx_release(struct xen_netbk *netbk, u16 pending_idx)
 
         vif = pending_tx_info->vif;
 
-        make_tx_response(vif, &pending_tx_info->req, XEN_NETIF_RSP_OKAY);
+        make_tx_response(vif, &pending_tx_info->req, status);
 
         index = pending_index(netbk->pending_prod++);
         netbk->pending_ring[index] = pending_idx;
diff --git a/drivers/pci/hotplug/pciehp.h b/drivers/pci/hotplug/pciehp.h
index 26ffd3e3fb74..2c113de94323 100644
--- a/drivers/pci/hotplug/pciehp.h
+++ b/drivers/pci/hotplug/pciehp.h
@@ -44,7 +44,6 @@ extern bool pciehp_poll_mode;
 extern int pciehp_poll_time;
 extern bool pciehp_debug;
 extern bool pciehp_force;
-extern struct workqueue_struct *pciehp_wq;
 
 #define dbg(format, arg...)                                             \
 do {                                                                    \
@@ -78,6 +77,7 @@ struct slot {
         struct hotplug_slot *hotplug_slot;
         struct delayed_work work;       /* work for button event */
         struct mutex lock;
+        struct workqueue_struct *wq;
 };
 
 struct event_info {
diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c
index 916bf4f53aba..939bd1d4b5b1 100644
--- a/drivers/pci/hotplug/pciehp_core.c
+++ b/drivers/pci/hotplug/pciehp_core.c
@@ -42,7 +42,6 @@ bool pciehp_debug;
 bool pciehp_poll_mode;
 int pciehp_poll_time;
 bool pciehp_force;
-struct workqueue_struct *pciehp_wq;
 
 #define DRIVER_VERSION  "0.4"
 #define DRIVER_AUTHOR   "Dan Zink <dan.zink@compaq.com>, Greg Kroah-Hartman <greg@kroah.com>, Dely Sy <dely.l.sy@intel.com>"
@@ -340,18 +339,13 @@ static int __init pcied_init(void)
 {
         int retval = 0;
 
-        pciehp_wq = alloc_workqueue("pciehp", 0, 0);
-        if (!pciehp_wq)
-                return -ENOMEM;
-
         pciehp_firmware_init();
         retval = pcie_port_service_register(&hpdriver_portdrv);
         dbg("pcie_port_service_register = %d\n", retval);
         info(DRIVER_DESC " version: " DRIVER_VERSION "\n");
-        if (retval) {
-                destroy_workqueue(pciehp_wq);
+        if (retval)
                 dbg("Failure to register service\n");
-        }
+
         return retval;
 }
 
@@ -359,7 +353,6 @@ static void __exit pcied_cleanup(void)
 {
         dbg("unload_pciehpd()\n");
         pcie_port_service_unregister(&hpdriver_portdrv);
-        destroy_workqueue(pciehp_wq);
         info(DRIVER_DESC " version: " DRIVER_VERSION " unloaded\n");
 }
 
diff --git a/drivers/pci/hotplug/pciehp_ctrl.c b/drivers/pci/hotplug/pciehp_ctrl.c
index 27f44295a657..38f018679175 100644
--- a/drivers/pci/hotplug/pciehp_ctrl.c
+++ b/drivers/pci/hotplug/pciehp_ctrl.c
@@ -49,7 +49,7 @@ static int queue_interrupt_event(struct slot *p_slot, u32 event_type)
         info->p_slot = p_slot;
         INIT_WORK(&info->work, interrupt_event_handler);
 
-        queue_work(pciehp_wq, &info->work);
+        queue_work(p_slot->wq, &info->work);
 
         return 0;
 }
@@ -344,7 +344,7 @@ void pciehp_queue_pushbutton_work(struct work_struct *work)
                 kfree(info);
                 goto out;
         }
-        queue_work(pciehp_wq, &info->work);
+        queue_work(p_slot->wq, &info->work);
  out:
         mutex_unlock(&p_slot->lock);
 }
@@ -377,7 +377,7 @@ static void handle_button_press_event(struct slot *p_slot)
                 if (ATTN_LED(ctrl))
                         pciehp_set_attention_status(p_slot, 0);
 
-                queue_delayed_work(pciehp_wq, &p_slot->work, 5*HZ);
+                queue_delayed_work(p_slot->wq, &p_slot->work, 5*HZ);
                 break;
         case BLINKINGOFF_STATE:
         case BLINKINGON_STATE:
@@ -439,7 +439,7 @@ static void handle_surprise_event(struct slot *p_slot)
         else
                 p_slot->state = POWERON_STATE;
 
-        queue_work(pciehp_wq, &info->work);
+        queue_work(p_slot->wq, &info->work);
 }
 
 static void interrupt_event_handler(struct work_struct *work)
diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
index 13b2eaf7ba43..5127f3f41821 100644
--- a/drivers/pci/hotplug/pciehp_hpc.c
+++ b/drivers/pci/hotplug/pciehp_hpc.c
@@ -773,23 +773,32 @@ static void pcie_shutdown_notification(struct controller *ctrl)
 static int pcie_init_slot(struct controller *ctrl)
 {
         struct slot *slot;
+        char name[32];
 
         slot = kzalloc(sizeof(*slot), GFP_KERNEL);
         if (!slot)
                 return -ENOMEM;
 
+        snprintf(name, sizeof(name), "pciehp-%u", PSN(ctrl));
+        slot->wq = alloc_workqueue(name, 0, 0);
+        if (!slot->wq)
+                goto abort;
+
         slot->ctrl = ctrl;
         mutex_init(&slot->lock);
         INIT_DELAYED_WORK(&slot->work, pciehp_queue_pushbutton_work);
         ctrl->slot = slot;
         return 0;
+abort:
+        kfree(slot);
+        return -ENOMEM;
 }
 
 static void pcie_cleanup_slot(struct controller *ctrl)
 {
         struct slot *slot = ctrl->slot;
         cancel_delayed_work(&slot->work);
-        flush_workqueue(pciehp_wq);
+        destroy_workqueue(slot->wq);
         kfree(slot);
 }
 
diff --git a/drivers/pci/hotplug/shpchp.h b/drivers/pci/hotplug/shpchp.h
index ca64932e658b..b849f995075a 100644
--- a/drivers/pci/hotplug/shpchp.h
+++ b/drivers/pci/hotplug/shpchp.h
@@ -46,8 +46,6 @@
 extern bool shpchp_poll_mode;
 extern int shpchp_poll_time;
 extern bool shpchp_debug;
-extern struct workqueue_struct *shpchp_wq;
-extern struct workqueue_struct *shpchp_ordered_wq;
 
 #define dbg(format, arg...)                                             \
 do {                                                                    \
@@ -91,6 +89,7 @@ struct slot {
         struct list_head        slot_list;
         struct delayed_work work;       /* work for button event */
         struct mutex lock;
+        struct workqueue_struct *wq;
         u8 hp_slot;
 };
 
diff --git a/drivers/pci/hotplug/shpchp_core.c b/drivers/pci/hotplug/shpchp_core.c
index b6de307248e4..3100c52c837c 100644
--- a/drivers/pci/hotplug/shpchp_core.c
+++ b/drivers/pci/hotplug/shpchp_core.c
@@ -39,8 +39,6 @@
 bool shpchp_debug;
 bool shpchp_poll_mode;
 int shpchp_poll_time;
-struct workqueue_struct *shpchp_wq;
-struct workqueue_struct *shpchp_ordered_wq;
 
 #define DRIVER_VERSION  "0.4"
 #define DRIVER_AUTHOR   "Dan Zink <dan.zink@compaq.com>, Greg Kroah-Hartman <greg@kroah.com>, Dely Sy <dely.l.sy@intel.com>"
@@ -129,6 +127,14 @@ static int init_slots(struct controller *ctrl)
                 slot->device = ctrl->slot_device_offset + i;
                 slot->hpc_ops = ctrl->hpc_ops;
                 slot->number = ctrl->first_slot + (ctrl->slot_num_inc * i);
+
+                snprintf(name, sizeof(name), "shpchp-%d", slot->number);
+                slot->wq = alloc_workqueue(name, 0, 0);
+                if (!slot->wq) {
+                        retval = -ENOMEM;
+                        goto error_info;
+                }
+
                 mutex_init(&slot->lock);
                 INIT_DELAYED_WORK(&slot->work, shpchp_queue_pushbutton_work);
 
@@ -148,7 +154,7 @@ static int init_slots(struct controller *ctrl)
                 if (retval) {
                         ctrl_err(ctrl, "pci_hp_register failed with error %d\n",
                                  retval);
-                        goto error_info;
+                        goto error_slotwq;
                 }
 
                 get_power_status(hotplug_slot, &info->power_status);
@@ -160,6 +166,8 @@ static int init_slots(struct controller *ctrl)
         }
 
         return 0;
+error_slotwq:
+        destroy_workqueue(slot->wq);
 error_info:
         kfree(info);
 error_hpslot:
@@ -180,8 +188,7 @@ void cleanup_slots(struct controller *ctrl)
                 slot = list_entry(tmp, struct slot, slot_list);
                 list_del(&slot->slot_list);
                 cancel_delayed_work(&slot->work);
-                flush_workqueue(shpchp_wq);
-                flush_workqueue(shpchp_ordered_wq);
+                destroy_workqueue(slot->wq);
                 pci_hp_deregister(slot->hotplug_slot);
         }
 }
@@ -364,25 +371,12 @@ static struct pci_driver shpc_driver = {
 
 static int __init shpcd_init(void)
 {
-        int retval = 0;
-
-        shpchp_wq = alloc_ordered_workqueue("shpchp", 0);
-        if (!shpchp_wq)
-                return -ENOMEM;
-
-        shpchp_ordered_wq = alloc_ordered_workqueue("shpchp_ordered", 0);
-        if (!shpchp_ordered_wq) {
-                destroy_workqueue(shpchp_wq);
-                return -ENOMEM;
-        }
+        int retval;
 
         retval = pci_register_driver(&shpc_driver);
         dbg("%s: pci_register_driver = %d\n", __func__, retval);
         info(DRIVER_DESC " version: " DRIVER_VERSION "\n");
-        if (retval) {
-                destroy_workqueue(shpchp_ordered_wq);
-                destroy_workqueue(shpchp_wq);
-        }
+
         return retval;
 }
 
@@ -390,8 +384,6 @@ static void __exit shpcd_cleanup(void)
 {
         dbg("unload_shpchpd()\n");
         pci_unregister_driver(&shpc_driver);
-        destroy_workqueue(shpchp_ordered_wq);
-        destroy_workqueue(shpchp_wq);
         info(DRIVER_DESC " version: " DRIVER_VERSION " unloaded\n");
 }
 
diff --git a/drivers/pci/hotplug/shpchp_ctrl.c b/drivers/pci/hotplug/shpchp_ctrl.c
index f9b5a52e4115..58499277903a 100644
--- a/drivers/pci/hotplug/shpchp_ctrl.c
+++ b/drivers/pci/hotplug/shpchp_ctrl.c
@@ -51,7 +51,7 @@ static int queue_interrupt_event(struct slot *p_slot, u32 event_type)
         info->p_slot = p_slot;
         INIT_WORK(&info->work, interrupt_event_handler);
 
-        queue_work(shpchp_wq, &info->work);
+        queue_work(p_slot->wq, &info->work);
 
         return 0;
 }
@@ -453,7 +453,7 @@ void shpchp_queue_pushbutton_work(struct work_struct *work)
                 kfree(info);
                 goto out;
         }
-        queue_work(shpchp_ordered_wq, &info->work);
+        queue_work(p_slot->wq, &info->work);
  out:
         mutex_unlock(&p_slot->lock);
 }
@@ -501,7 +501,7 @@ static void handle_button_press_event(struct slot *p_slot)
                 p_slot->hpc_ops->green_led_blink(p_slot);
                 p_slot->hpc_ops->set_attention_status(p_slot, 0);
 
-                queue_delayed_work(shpchp_wq, &p_slot->work, 5*HZ);
+                queue_delayed_work(p_slot->wq, &p_slot->work, 5*HZ);
                 break;
         case BLINKINGOFF_STATE:
         case BLINKINGON_STATE:
diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c
index bafd2bbcaf65..c18e5bf444fa 100644
--- a/drivers/pci/iov.c
+++ b/drivers/pci/iov.c
@@ -739,7 +739,7 @@ EXPORT_SYMBOL_GPL(pci_num_vf);
 /**
  * pci_sriov_set_totalvfs -- reduce the TotalVFs available
  * @dev: the PCI PF device
- * numvfs: number that should be used for TotalVFs supported
+ * @numvfs: number that should be used for TotalVFs supported
  *
  * Should be called from PF driver's probe routine with
  * device's mutex held.
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 5099636a6e5f..00cc78c7aa04 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -845,6 +845,32 @@ int pci_enable_msi_block(struct pci_dev *dev, unsigned int nvec)
 }
 EXPORT_SYMBOL(pci_enable_msi_block);
 
+int pci_enable_msi_block_auto(struct pci_dev *dev, unsigned int *maxvec)
+{
+        int ret, pos, nvec;
+        u16 msgctl;
+
+        pos = pci_find_capability(dev, PCI_CAP_ID_MSI);
+        if (!pos)
+                return -EINVAL;
+
+        pci_read_config_word(dev, pos + PCI_MSI_FLAGS, &msgctl);
+        ret = 1 << ((msgctl & PCI_MSI_FLAGS_QMASK) >> 1);
+
+        if (maxvec)
+                *maxvec = ret;
+
+        do {
+                nvec = ret;
+                ret = pci_enable_msi_block(dev, nvec);
+        } while (ret > 0);
+
+        if (ret < 0)
+                return ret;
+        return nvec;
+}
+EXPORT_SYMBOL(pci_enable_msi_block_auto);
+
 void pci_msi_shutdown(struct pci_dev *dev)
 {
         struct msi_desc *desc;
diff --git a/drivers/pci/pcie/Kconfig b/drivers/pci/pcie/Kconfig
index 6c8bc5809787..fde4a32a0295 100644
--- a/drivers/pci/pcie/Kconfig
+++ b/drivers/pci/pcie/Kconfig
@@ -82,4 +82,4 @@ endchoice
 
 config PCIE_PME
         def_bool y
-        depends on PCIEPORTBUS && PM_RUNTIME && EXPERIMENTAL && ACPI
+        depends on PCIEPORTBUS && PM_RUNTIME && ACPI
diff --git a/drivers/pci/pcie/aer/aerdrv_core.c b/drivers/pci/pcie/aer/aerdrv_core.c
index 421bbc5fee32..564d97f94b6c 100644
--- a/drivers/pci/pcie/aer/aerdrv_core.c
+++ b/drivers/pci/pcie/aer/aerdrv_core.c
@@ -630,6 +630,7 @@ static void aer_recover_work_func(struct work_struct *work)
                         continue;
                 }
                 do_recovery(pdev, entry.severity);
+                pci_dev_put(pdev);
         }
 }
 #endif
diff --git a/drivers/pci/pcie/aer/aerdrv_errprint.c b/drivers/pci/pcie/aer/aerdrv_errprint.c
index 3ea51736f18d..5ab14251839d 100644
--- a/drivers/pci/pcie/aer/aerdrv_errprint.c
+++ b/drivers/pci/pcie/aer/aerdrv_errprint.c
@@ -23,6 +23,9 @@
 
 #include "aerdrv.h"
 
+#define CREATE_TRACE_POINTS
+#include <trace/events/ras.h>
+
 #define AER_AGENT_RECEIVER              0
 #define AER_AGENT_REQUESTER             1
 #define AER_AGENT_COMPLETER             2
@@ -121,12 +124,11 @@ static const char *aer_agent_string[] = {
         "Transmitter ID"
 };
 
-static void __aer_print_error(const char *prefix,
+static void __aer_print_error(struct pci_dev *dev,
                               struct aer_err_info *info)
 {
         int i, status;
         const char *errmsg = NULL;
-
         status = (info->status & ~info->mask);
 
         for (i = 0; i < 32; i++) {
@@ -141,26 +143,22 @@ static void __aer_print_error(const char *prefix,
                                 aer_uncorrectable_error_string[i] : NULL;
 
                 if (errmsg)
-                        printk("%s""   [%2d] %-22s%s\n", prefix, i, errmsg,
+                        dev_err(&dev->dev, "   [%2d] %-22s%s\n", i, errmsg,
                                 info->first_error == i ? " (First)" : "");
                 else
-                        printk("%s""   [%2d] Unknown Error Bit%s\n", prefix, i,
-                                info->first_error == i ? " (First)" : "");
+                        dev_err(&dev->dev, "   [%2d] Unknown Error Bit%s\n",
+                                i, info->first_error == i ? " (First)" : "");
         }
 }
 
 void aer_print_error(struct pci_dev *dev, struct aer_err_info *info)
 {
         int id = ((dev->bus->number << 8) | dev->devfn);
-        char prefix[44];
-
-        snprintf(prefix, sizeof(prefix), "%s%s %s: ",
-                 (info->severity == AER_CORRECTABLE) ? KERN_WARNING : KERN_ERR,
-                 dev_driver_string(&dev->dev), dev_name(&dev->dev));
 
         if (info->status == 0) {
-                printk("%s""PCIe Bus Error: severity=%s, type=Unaccessible, "
-                        "id=%04x(Unregistered Agent ID)\n", prefix,
+                dev_err(&dev->dev,
+                        "PCIe Bus Error: severity=%s, type=Unaccessible, "
+                        "id=%04x(Unregistered Agent ID)\n",
                         aer_error_severity_string[info->severity], id);
         } else {
                 int layer, agent;
@@ -168,22 +166,24 @@ void aer_print_error(struct pci_dev *dev, struct aer_err_info *info)
                 layer = AER_GET_LAYER_ERROR(info->severity, info->status);
                 agent = AER_GET_AGENT(info->severity, info->status);
 
-                printk("%s""PCIe Bus Error: severity=%s, type=%s, id=%04x(%s)\n",
-                        prefix, aer_error_severity_string[info->severity],
+                dev_err(&dev->dev,
+                        "PCIe Bus Error: severity=%s, type=%s, id=%04x(%s)\n",
+                        aer_error_severity_string[info->severity],
                         aer_error_layer[layer], id, aer_agent_string[agent]);
 
-                printk("%s""  device [%04x:%04x] error status/mask=%08x/%08x\n",
-                        prefix, dev->vendor, dev->device,
+                dev_err(&dev->dev,
+                        "  device [%04x:%04x] error status/mask=%08x/%08x\n",
+                        dev->vendor, dev->device,
                         info->status, info->mask);
 
-                __aer_print_error(prefix, info);
+                __aer_print_error(dev, info);
 
                 if (info->tlp_header_valid) {
                         unsigned char *tlp = (unsigned char *) &info->tlp;
-                        printk("%s""  TLP Header:"
+                        dev_err(&dev->dev, "  TLP Header:"
                                 " %02x%02x%02x%02x %02x%02x%02x%02x"
                                 " %02x%02x%02x%02x %02x%02x%02x%02x\n",
-                                prefix, *(tlp + 3), *(tlp + 2), *(tlp + 1), *tlp,
+                                *(tlp + 3), *(tlp + 2), *(tlp + 1), *tlp,
                                 *(tlp + 7), *(tlp + 6), *(tlp + 5), *(tlp + 4),
                                 *(tlp + 11), *(tlp + 10), *(tlp + 9),
                                 *(tlp + 8), *(tlp + 15), *(tlp + 14),
@@ -192,8 +192,11 @@ void aer_print_error(struct pci_dev *dev, struct aer_err_info *info)
         }
 
         if (info->id && info->error_dev_num > 1 && info->id == id)
-                printk("%s""  Error of this Agent(%04x) is reported first\n",
-                        prefix, id);
+                dev_err(&dev->dev,
+                           "  Error of this Agent(%04x) is reported first\n",
+                        id);
+        trace_aer_event(dev_name(&dev->dev), (info->status & ~info->mask),
+                        info->severity);
 }
 
 void aer_print_port_info(struct pci_dev *dev, struct aer_err_info *info)
@@ -217,7 +220,7 @@ int cper_severity_to_aer(int cper_severity)
 }
 EXPORT_SYMBOL_GPL(cper_severity_to_aer);
 
-void cper_print_aer(const char *prefix, int cper_severity,
+void cper_print_aer(const char *prefix, struct pci_dev *dev, int cper_severity,
                     struct aer_capability_regs *aer)
 {
         int aer_severity, layer, agent, status_strs_size, tlp_header_valid = 0;
@@ -239,25 +242,27 @@ void cper_print_aer(const char *prefix, int cper_severity,
         }
         layer = AER_GET_LAYER_ERROR(aer_severity, status);
         agent = AER_GET_AGENT(aer_severity, status);
-        printk("%s""aer_status: 0x%08x, aer_mask: 0x%08x\n",
-               prefix, status, mask);
+        dev_err(&dev->dev, "aer_status: 0x%08x, aer_mask: 0x%08x\n",
+               status, mask);
         cper_print_bits(prefix, status, status_strs, status_strs_size);
-        printk("%s""aer_layer=%s, aer_agent=%s\n", prefix,
+        dev_err(&dev->dev, "aer_layer=%s, aer_agent=%s\n",
                aer_error_layer[layer], aer_agent_string[agent]);
         if (aer_severity != AER_CORRECTABLE)
-                printk("%s""aer_uncor_severity: 0x%08x\n",
-                       prefix, aer->uncor_severity);
+                dev_err(&dev->dev, "aer_uncor_severity: 0x%08x\n",
+                       aer->uncor_severity);
         if (tlp_header_valid) {
                 const unsigned char *tlp;
                 tlp = (const unsigned char *)&aer->header_log;
-                printk("%s""aer_tlp_header:"
+                dev_err(&dev->dev, "aer_tlp_header:"
                         " %02x%02x%02x%02x %02x%02x%02x%02x"
                         " %02x%02x%02x%02x %02x%02x%02x%02x\n",
-                        prefix, *(tlp + 3), *(tlp + 2), *(tlp + 1), *tlp,
+                        *(tlp + 3), *(tlp + 2), *(tlp + 1), *tlp,
                         *(tlp + 7), *(tlp + 6), *(tlp + 5), *(tlp + 4),
                         *(tlp + 11), *(tlp + 10), *(tlp + 9),
                         *(tlp + 8), *(tlp + 15), *(tlp + 14),
                         *(tlp + 13), *(tlp + 12));
         }
+        trace_aer_event(dev_name(&dev->dev), (status & ~mask),
+                        aer_severity);
 }
 #endif
diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
index b52630b8eada..8474b6a4fc9b 100644
--- a/drivers/pci/pcie/aspm.c
+++ b/drivers/pci/pcie/aspm.c
@@ -771,6 +771,9 @@ void pcie_clear_aspm(struct pci_bus *bus)
 {
         struct pci_dev *child;
 
+        if (aspm_force)
+                return;
+
         /*
          * Clear any ASPM setup that the firmware has carried out on this bus
          */
diff --git a/drivers/pci/remove.c b/drivers/pci/remove.c
index 7c0fd9252e6f..84954a726a94 100644
--- a/drivers/pci/remove.c
+++ b/drivers/pci/remove.c
@@ -19,6 +19,8 @@ static void pci_free_resources(struct pci_dev *dev)
 
 static void pci_stop_dev(struct pci_dev *dev)
 {
+        pci_pme_active(dev, false);
+
         if (dev->is_added) {
                 pci_proc_detach_device(dev);
                 pci_remove_sysfs_dev_files(dev);
diff --git a/drivers/pinctrl/Kconfig b/drivers/pinctrl/Kconfig
index d186c5825133..393b0ecf4ca4 100644
--- a/drivers/pinctrl/Kconfig
+++ b/drivers/pinctrl/Kconfig
@@ -213,7 +213,6 @@ config PINCTRL_COH901
 
 config PINCTRL_SAMSUNG
         bool
-        depends on OF && GPIOLIB
         select PINMUX
         select PINCONF
 
diff --git a/drivers/pinctrl/mvebu/pinctrl-dove.c b/drivers/pinctrl/mvebu/pinctrl-dove.c
index 69aba3697287..428ea96a94d3 100644
--- a/drivers/pinctrl/mvebu/pinctrl-dove.c
+++ b/drivers/pinctrl/mvebu/pinctrl-dove.c
@@ -588,7 +588,7 @@ static int dove_pinctrl_probe(struct platform_device *pdev)
 {
         const struct of_device_id *match =
                 of_match_device(dove_pinctrl_of_match, &pdev->dev);
-        pdev->dev.platform_data = match->data;
+        pdev->dev.platform_data = (void *)match->data;
 
         /*
          * General MPP Configuration Register is part of pdma registers.
diff --git a/drivers/pinctrl/mvebu/pinctrl-kirkwood.c b/drivers/pinctrl/mvebu/pinctrl-kirkwood.c
index f12084e18057..cdd483df673e 100644
--- a/drivers/pinctrl/mvebu/pinctrl-kirkwood.c
+++ b/drivers/pinctrl/mvebu/pinctrl-kirkwood.c
@@ -66,9 +66,9 @@ static struct mvebu_mpp_mode mv88f6xxx_mpp_modes[] = {
                 MPP_VAR_FUNCTION(0x5, "sata0", "act",    V(0, 1, 1, 1, 1, 0)),
                 MPP_VAR_FUNCTION(0xb, "lcd", "vsync",    V(0, 0, 0, 0, 1, 0))),
         MPP_MODE(6,
-                MPP_VAR_FUNCTION(0x0, "sysrst", "out",   V(1, 1, 1, 1, 1, 1)),
-                MPP_VAR_FUNCTION(0x1, "spi", "mosi",     V(1, 1, 1, 1, 1, 1)),
-                MPP_VAR_FUNCTION(0x2, "ptp", "trig",     V(1, 1, 1, 1, 0, 0))),
+                MPP_VAR_FUNCTION(0x1, "sysrst", "out",   V(1, 1, 1, 1, 1, 1)),
+                MPP_VAR_FUNCTION(0x2, "spi", "mosi",     V(1, 1, 1, 1, 1, 1)),
+                MPP_VAR_FUNCTION(0x3, "ptp", "trig",     V(1, 1, 1, 1, 0, 0))),
         MPP_MODE(7,
                 MPP_VAR_FUNCTION(0x0, "gpo", NULL,       V(1, 1, 1, 1, 1, 1)),
                 MPP_VAR_FUNCTION(0x1, "pex", "rsto",     V(1, 1, 1, 1, 0, 1)),
@@ -458,7 +458,7 @@ static int kirkwood_pinctrl_probe(struct platform_device *pdev)
 {
         const struct of_device_id *match =
                 of_match_device(kirkwood_pinctrl_of_match, &pdev->dev);
-        pdev->dev.platform_data = match->data;
+        pdev->dev.platform_data = (void *)match->data;
         return mvebu_pinctrl_probe(pdev);
 }
 
diff --git a/drivers/pinctrl/pinctrl-mxs.c b/drivers/pinctrl/pinctrl-mxs.c
index dd227d21dcf2..23af9f1f9c35 100644
--- a/drivers/pinctrl/pinctrl-mxs.c
+++ b/drivers/pinctrl/pinctrl-mxs.c
@@ -146,7 +146,7 @@ free:
 static void mxs_dt_free_map(struct pinctrl_dev *pctldev,
                             struct pinctrl_map *map, unsigned num_maps)
 {
-        int i;
+        u32 i;
 
         for (i = 0; i < num_maps; i++) {
                 if (map[i].type == PIN_MAP_TYPE_MUX_GROUP)
@@ -203,7 +203,7 @@ static int mxs_pinctrl_enable(struct pinctrl_dev *pctldev, unsigned selector,
         void __iomem *reg;
         u8 bank, shift;
         u16 pin;
-        int i;
+        u32 i;
 
         for (i = 0; i < g->npins; i++) {
                 bank = PINID_TO_BANK(g->pins[i]);
@@ -256,7 +256,7 @@ static int mxs_pinconf_group_set(struct pinctrl_dev *pctldev,
         void __iomem *reg;
         u8 ma, vol, pull, bank, shift;
         u16 pin;
-        int i;
+        u32 i;
 
         ma = CONFIG_TO_MA(config);
         vol = CONFIG_TO_VOL(config);
@@ -345,8 +345,7 @@ static int mxs_pinctrl_parse_group(struct platform_device *pdev,
         const char *propname = "fsl,pinmux-ids";
         char *group;
         int length = strlen(np->name) + SUFFIX_LEN;
-        int i;
-        u32 val;
+        u32 val, i;
 
         group = devm_kzalloc(&pdev->dev, length, GFP_KERNEL);
         if (!group)
diff --git a/drivers/pinctrl/pinctrl-nomadik.c b/drivers/pinctrl/pinctrl-nomadik.c
index b885c0911e83..de9e8519b803 100644
--- a/drivers/pinctrl/pinctrl-nomadik.c
+++ b/drivers/pinctrl/pinctrl-nomadik.c
@@ -678,7 +678,7 @@ int nmk_gpio_set_mode(int gpio, int gpio_mode)
 }
 EXPORT_SYMBOL(nmk_gpio_set_mode);
 
-static int nmk_prcm_gpiocr_get_mode(struct pinctrl_dev *pctldev, int gpio)
+static int __maybe_unused nmk_prcm_gpiocr_get_mode(struct pinctrl_dev *pctldev, int gpio)
 {
         int i;
         u16 reg;
diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
index f6a360b86eb6..5c32e880bcb2 100644
--- a/drivers/pinctrl/pinctrl-single.c
+++ b/drivers/pinctrl/pinctrl-single.c
@@ -30,7 +30,6 @@
 #define PCS_MUX_BITS_NAME               "pinctrl-single,bits"
 #define PCS_REG_NAME_LEN                ((sizeof(unsigned long) * 2) + 1)
 #define PCS_OFF_DISABLED                ~0U
-#define PCS_MAX_GPIO_VALUES             2
 
 /**
  * struct pcs_pingroup - pingroups for a function
@@ -78,16 +77,6 @@ struct pcs_function {
 };
 
 /**
- * struct pcs_gpio_range - pinctrl gpio range
- * @range:      subrange of the GPIO number space
- * @gpio_func:  gpio function value in the pinmux register
- */
-struct pcs_gpio_range {
-        struct pinctrl_gpio_range range;
-        int gpio_func;
-};
-
-/**
  * struct pcs_data - wrapper for data needed by pinctrl framework
  * @pa:         pindesc array
  * @cur:        index to current element
@@ -414,26 +403,9 @@ static void pcs_disable(struct pinctrl_dev *pctldev, unsigned fselector,
 }
 
 static int pcs_request_gpio(struct pinctrl_dev *pctldev,
-                            struct pinctrl_gpio_range *range, unsigned pin)
+                        struct pinctrl_gpio_range *range, unsigned offset)
 {
-        struct pcs_device *pcs = pinctrl_dev_get_drvdata(pctldev);
-        struct pcs_gpio_range *gpio = NULL;
-        int end, mux_bytes;
-        unsigned data;
-
-        gpio = container_of(range, struct pcs_gpio_range, range);
-        end = range->pin_base + range->npins - 1;
-        if (pin < range->pin_base || pin > end) {
-                dev_err(pctldev->dev,
-                        "pin %d isn't in the range of %d to %d\n",
-                        pin, range->pin_base, end);
-                return -EINVAL;
-        }
-        mux_bytes = pcs->width / BITS_PER_BYTE;
-        data = pcs->read(pcs->base + pin * mux_bytes) & ~pcs->fmask;
-        data |= gpio->gpio_func;
-        pcs->write(data, pcs->base + pin * mux_bytes);
-        return 0;
+        return -ENOTSUPP;
 }
 
 static struct pinmux_ops pcs_pinmux_ops = {
@@ -907,49 +879,6 @@ static void pcs_free_resources(struct pcs_device *pcs)
 
 static struct of_device_id pcs_of_match[];
 
-static int pcs_add_gpio_range(struct device_node *node, struct pcs_device *pcs)
-{
-        struct pcs_gpio_range *gpio;
-        struct device_node *child;
-        struct resource r;
-        const char name[] = "pinctrl-single";
-        u32 gpiores[PCS_MAX_GPIO_VALUES];
-        int ret, i = 0, mux_bytes = 0;
-
-        for_each_child_of_node(node, child) {
-                ret = of_address_to_resource(child, 0, &r);
-                if (ret < 0)
-                        continue;
-                memset(gpiores, 0, sizeof(u32) * PCS_MAX_GPIO_VALUES);
-                ret = of_property_read_u32_array(child, "pinctrl-single,gpio",
-                                                 gpiores, PCS_MAX_GPIO_VALUES);
-                if (ret < 0)
-                        continue;
-                gpio = devm_kzalloc(pcs->dev, sizeof(*gpio), GFP_KERNEL);
-                if (!gpio) {
-                        dev_err(pcs->dev, "failed to allocate pcs gpio\n");
-                        return -ENOMEM;
-                }
-                gpio->range.name = devm_kzalloc(pcs->dev, sizeof(name),
-                                                GFP_KERNEL);
-                if (!gpio->range.name) {
-                        dev_err(pcs->dev, "failed to allocate range name\n");
-                        return -ENOMEM;
-                }
-                memcpy((char *)gpio->range.name, name, sizeof(name));
-
-                gpio->range.id = i++;
-                gpio->range.base = gpiores[0];
-                gpio->gpio_func = gpiores[1];
-                mux_bytes = pcs->width / BITS_PER_BYTE;
-                gpio->range.pin_base = (r.start - pcs->res->start) / mux_bytes;
-                gpio->range.npins = (r.end - r.start) / mux_bytes + 1;
-
-                pinctrl_add_gpio_range(pcs->pctl, &gpio->range);
-        }
-        return 0;
-}
-
 static int pcs_probe(struct platform_device *pdev)
 {
         struct device_node *np = pdev->dev.of_node;
@@ -1046,10 +975,6 @@ static int pcs_probe(struct platform_device *pdev)
                 goto free;
         }
 
-        ret = pcs_add_gpio_range(np, pcs);
-        if (ret < 0)
-                goto free;
-
         dev_info(pcs->dev, "%i pins at pa %p size %u\n",
                  pcs->desc.npins, pcs->base, pcs->size);
 
diff --git a/drivers/pinctrl/pinctrl-sirf.c b/drivers/pinctrl/pinctrl-sirf.c
index 498b2ba905de..d02498b30c6e 100644
--- a/drivers/pinctrl/pinctrl-sirf.c
+++ b/drivers/pinctrl/pinctrl-sirf.c
@@ -1246,6 +1246,22 @@ static void __iomem *sirfsoc_rsc_of_iomap(void)
         return of_iomap(np, 0);
 }
 
+static int sirfsoc_gpio_of_xlate(struct gpio_chip *gc,
+       const struct of_phandle_args *gpiospec,
+       u32 *flags)
+{
+       if (gpiospec->args[0] > SIRFSOC_GPIO_NO_OF_BANKS * SIRFSOC_GPIO_BANK_SIZE)
+               return -EINVAL;
+
+       if (gc != &sgpio_bank[gpiospec->args[0] / SIRFSOC_GPIO_BANK_SIZE].chip.gc)
+               return -EINVAL;
+
+       if (flags)
+               *flags = gpiospec->args[1];
+
+       return gpiospec->args[0] % SIRFSOC_GPIO_BANK_SIZE;
+}
+
 static int sirfsoc_pinmux_probe(struct platform_device *pdev)
 {
         int ret;
@@ -1736,6 +1752,8 @@ static int sirfsoc_gpio_probe(struct device_node *np)
                 bank->chip.gc.ngpio = SIRFSOC_GPIO_BANK_SIZE;
                 bank->chip.gc.label = kstrdup(np->full_name, GFP_KERNEL);
                 bank->chip.gc.of_node = np;
+                bank->chip.gc.of_xlate = sirfsoc_gpio_of_xlate;
+                bank->chip.gc.of_gpio_n_cells = 2;
                 bank->chip.regs = regs;
                 bank->id = i;
                 bank->is_marco = is_marco;
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index 06f4eb7ab87e..afed7018a2b5 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -125,8 +125,11 @@ static const struct key_entry acer_wmi_keymap[] = {
         {KE_IGNORE, 0x63, {KEY_BRIGHTNESSDOWN} },
         {KE_KEY, 0x64, {KEY_SWITCHVIDEOMODE} }, /* Display Switch */
         {KE_IGNORE, 0x81, {KEY_SLEEP} },
-        {KE_KEY, 0x82, {KEY_TOUCHPAD_TOGGLE} }, /* Touch Pad On/Off */
+        {KE_KEY, 0x82, {KEY_TOUCHPAD_TOGGLE} }, /* Touch Pad Toggle */
+        {KE_KEY, KEY_TOUCHPAD_ON, {KEY_TOUCHPAD_ON} },
+        {KE_KEY, KEY_TOUCHPAD_OFF, {KEY_TOUCHPAD_OFF} },
         {KE_IGNORE, 0x83, {KEY_TOUCHPAD_TOGGLE} },
+        {KE_KEY, 0x85, {KEY_TOUCHPAD_TOGGLE} },
         {KE_END, 0}
 };
 
@@ -147,6 +150,7 @@ struct event_return_value {
 #define ACER_WMID3_GDS_THREEG           (1<<6)  /* 3G */
 #define ACER_WMID3_GDS_WIMAX            (1<<7)  /* WiMAX */
 #define ACER_WMID3_GDS_BLUETOOTH        (1<<11) /* BT */
+#define ACER_WMID3_GDS_TOUCHPAD         (1<<1)  /* Touchpad */
 
 struct lm_input_params {
         u8 function_num;        /* Function Number */
@@ -875,7 +879,7 @@ WMI_execute_u32(u32 method_id, u32 in, u32 *out)
         struct acpi_buffer input = { (acpi_size) sizeof(u32), (void *)(&in) };
         struct acpi_buffer result = { ACPI_ALLOCATE_BUFFER, NULL };
         union acpi_object *obj;
-        u32 tmp;
+        u32 tmp = 0;
         acpi_status status;
 
         status = wmi_evaluate_method(WMID_GUID1, 1, method_id, &input, &result);
@@ -884,14 +888,14 @@ WMI_execute_u32(u32 method_id, u32 in, u32 *out)
                 return status;
 
         obj = (union acpi_object *) result.pointer;
-        if (obj && obj->type == ACPI_TYPE_BUFFER &&
-                (obj->buffer.length == sizeof(u32) ||
-                obj->buffer.length == sizeof(u64))) {
-                tmp = *((u32 *) obj->buffer.pointer);
-        } else if (obj->type == ACPI_TYPE_INTEGER) {
-                tmp = (u32) obj->integer.value;
-        } else {
-                tmp = 0;
+        if (obj) {
+                if (obj->type == ACPI_TYPE_BUFFER &&
+                        (obj->buffer.length == sizeof(u32) ||
+                        obj->buffer.length == sizeof(u64))) {
+                        tmp = *((u32 *) obj->buffer.pointer);
+                } else if (obj->type == ACPI_TYPE_INTEGER) {
+                        tmp = (u32) obj->integer.value;
+                }
         }
 
         if (out)
@@ -1193,12 +1197,14 @@ static acpi_status WMID_set_capabilities(void)
                 return status;
 
         obj = (union acpi_object *) out.pointer;
-        if (obj && obj->type == ACPI_TYPE_BUFFER &&
-                (obj->buffer.length == sizeof(u32) ||
-                obj->buffer.length == sizeof(u64))) {
-                devices = *((u32 *) obj->buffer.pointer);
-        } else if (obj->type == ACPI_TYPE_INTEGER) {
-                devices = (u32) obj->integer.value;
+        if (obj) {
+                if (obj->type == ACPI_TYPE_BUFFER &&
+                        (obj->buffer.length == sizeof(u32) ||
+                        obj->buffer.length == sizeof(u64))) {
+                        devices = *((u32 *) obj->buffer.pointer);
+                } else if (obj->type == ACPI_TYPE_INTEGER) {
+                        devices = (u32) obj->integer.value;
+                }
         } else {
                 kfree(out.pointer);
                 return AE_ERROR;
@@ -1676,6 +1682,7 @@ static void acer_wmi_notify(u32 value, void *context)
         acpi_status status;
         u16 device_state;
         const struct key_entry *key;
+        u32 scancode;
 
         status = wmi_get_event_data(value, &response);
         if (status != AE_OK) {
@@ -1712,6 +1719,7 @@ static void acer_wmi_notify(u32 value, void *context)
                         pr_warn("Unknown key number - 0x%x\n",
                                 return_value.key_num);
                 } else {
+                        scancode = return_value.key_num;
                         switch (key->keycode) {
                         case KEY_WLAN:
                         case KEY_BLUETOOTH:
@@ -1725,9 +1733,11 @@ static void acer_wmi_notify(u32 value, void *context)
                                         rfkill_set_sw_state(bluetooth_rfkill,
                                                 !(device_state & ACER_WMID3_GDS_BLUETOOTH));
                                 break;
+                        case KEY_TOUCHPAD_TOGGLE:
+                                scancode = (device_state & ACER_WMID3_GDS_TOUCHPAD) ?
+                                                KEY_TOUCHPAD_ON : KEY_TOUCHPAD_OFF;
                         }
-                        sparse_keymap_report_entry(acer_wmi_input_dev, key,
-                                                   1, true);
+                        sparse_keymap_report_event(acer_wmi_input_dev, scancode, 1, true);
                 }
                 break;
         case WMID_ACCEL_EVENT:
@@ -1946,12 +1956,14 @@ static u32 get_wmid_devices(void)
                 return 0;
 
         obj = (union acpi_object *) out.pointer;
-        if (obj && obj->type == ACPI_TYPE_BUFFER &&
-                (obj->buffer.length == sizeof(u32) ||
-                obj->buffer.length == sizeof(u64))) {
-                devices = *((u32 *) obj->buffer.pointer);
-        } else if (obj->type == ACPI_TYPE_INTEGER) {
-                devices = (u32) obj->integer.value;
+        if (obj) {
+                if (obj->type == ACPI_TYPE_BUFFER &&
+                        (obj->buffer.length == sizeof(u32) ||
+                        obj->buffer.length == sizeof(u64))) {
+                        devices = *((u32 *) obj->buffer.pointer);
+                } else if (obj->type == ACPI_TYPE_INTEGER) {
+                        devices = (u32) obj->integer.value;
+                }
         }
 
         kfree(out.pointer);
diff --git a/drivers/platform/x86/asus-laptop.c b/drivers/platform/x86/asus-laptop.c
index ec1d3bc2dbe2..fcde4e528819 100644
--- a/drivers/platform/x86/asus-laptop.c
+++ b/drivers/platform/x86/asus-laptop.c
@@ -860,8 +860,10 @@ static ssize_t show_infos(struct device *dev,
         /*
          * The HWRS method return informations about the hardware.
          * 0x80 bit is for WLAN, 0x100 for Bluetooth.
+         * 0x40 for WWAN, 0x10 for WIMAX.
          * The significance of others is yet to be found.
-         * If we don't find the method, we assume the device are present.
+         * We don't currently use this for device detection, and it
+         * takes several seconds to run on some systems.
          */
         rv = acpi_evaluate_integer(asus->handle, "HWRS", NULL, &temp);
         if (!ACPI_FAILURE(rv))
@@ -1682,7 +1684,7 @@ static int asus_laptop_get_info(struct asus_laptop *asus)
 {
         struct acpi_buffer buffer = { ACPI_ALLOCATE_BUFFER, NULL };
         union acpi_object *model = NULL;
-        unsigned long long bsts_result, hwrs_result;
+        unsigned long long bsts_result;
         char *string = NULL;
         acpi_status status;
 
@@ -1741,20 +1743,9 @@ static int asus_laptop_get_info(struct asus_laptop *asus)
                 return -ENOMEM;
         }
 
-        if (*string)
+        if (string)
                 pr_notice("  %s model detected\n", string);
 
-        /*
-         * The HWRS method return informations about the hardware.
-         * 0x80 bit is for WLAN, 0x100 for Bluetooth,
-         * 0x40 for WWAN, 0x10 for WIMAX.
-         * The significance of others is yet to be found.
-         */
-        status =
-            acpi_evaluate_integer(asus->handle, "HWRS", NULL, &hwrs_result);
-        if (!ACPI_FAILURE(status))
-                pr_notice("  HWRS returned %x", (int)hwrs_result);
-
         if (!acpi_check_handle(asus->handle, METHOD_WL_STATUS, NULL))
                 asus->have_rsts = true;
 
diff --git a/drivers/platform/x86/ibm_rtl.c b/drivers/platform/x86/ibm_rtl.c
index 7481146a5b47..97c2be195efc 100644
--- a/drivers/platform/x86/ibm_rtl.c
+++ b/drivers/platform/x86/ibm_rtl.c
@@ -244,7 +244,7 @@ static int __init ibm_rtl_init(void) {
         if (force)
                 pr_warn("module loaded by force\n");
         /* first ensure that we are running on IBM HW */
-        else if (efi_enabled || !dmi_check_system(ibm_rtl_dmi_table))
+        else if (efi_enabled(EFI_BOOT) || !dmi_check_system(ibm_rtl_dmi_table))
                 return -ENODEV;
 
         /* Get the address for the Extended BIOS Data Area */
diff --git a/drivers/platform/x86/samsung-laptop.c b/drivers/platform/x86/samsung-laptop.c
index dd90d15f5210..d1f030053176 100644
--- a/drivers/platform/x86/samsung-laptop.c
+++ b/drivers/platform/x86/samsung-laptop.c
@@ -26,6 +26,7 @@
 #include <linux/seq_file.h>
 #include <linux/debugfs.h>
 #include <linux/ctype.h>
+#include <linux/efi.h>
 #include <acpi/video.h>
 
 /*
@@ -1523,6 +1524,16 @@ static struct dmi_system_id __initdata samsung_dmi_table[] = {
                 },
          .driver_data = &samsung_broken_acpi_video,
         },
+        {
+         .callback = samsung_dmi_matched,
+         .ident = "N250P",
+         .matches = {
+                DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."),
+                DMI_MATCH(DMI_PRODUCT_NAME, "N250P"),
+                DMI_MATCH(DMI_BOARD_NAME, "N250P"),
+                },
+         .driver_data = &samsung_broken_acpi_video,
+        },
         { },
 };
 MODULE_DEVICE_TABLE(dmi, samsung_dmi_table);
@@ -1534,6 +1545,9 @@ static int __init samsung_init(void)
         struct samsung_laptop *samsung;
         int ret;
 
+        if (efi_enabled(EFI_BOOT))
+                return -ENODEV;
+
         quirks = &samsung_unknown;
         if (!force && !dmi_check_system(samsung_dmi_table))
                 return -ENODEV;
diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
index daaddec68def..b8ad71f7863f 100644
--- a/drivers/platform/x86/sony-laptop.c
+++ b/drivers/platform/x86/sony-laptop.c
@@ -786,28 +786,29 @@ static int sony_nc_int_call(acpi_handle handle, char *name, int *value,
 static int sony_nc_buffer_call(acpi_handle handle, char *name, u64 *value,
                 void *buffer, size_t buflen)
 {
+        int ret = 0;
         size_t len = len;
         union acpi_object *object = __call_snc_method(handle, name, value);
 
         if (!object)
                 return -EINVAL;
 
-        if (object->type == ACPI_TYPE_BUFFER)
+        if (object->type == ACPI_TYPE_BUFFER) {
                 len = MIN(buflen, object->buffer.length);
+                memcpy(buffer, object->buffer.pointer, len);
 
-        else if (object->type == ACPI_TYPE_INTEGER)
+        } else if (object->type == ACPI_TYPE_INTEGER) {
                 len = MIN(buflen, sizeof(object->integer.value));
+                memcpy(buffer, &object->integer.value, len);
 
-        else {
+        } else {
                 pr_warn("Invalid acpi_object: expected 0x%x got 0x%x\n",
                                 ACPI_TYPE_BUFFER, object->type);
-                kfree(object);
-                return -EINVAL;
+                ret = -EINVAL;
         }
 
-        memcpy(buffer, object->buffer.pointer, len);
         kfree(object);
-        return 0;
+        return ret;
 }
 
 struct sony_nc_handles {
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index f946ca7cb762..ebcb461bb2b0 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -4877,8 +4877,7 @@ static int __init light_init(struct ibm_init_struct *iibm)
 static void light_exit(void)
 {
         led_classdev_unregister(&tpacpi_led_thinklight.led_classdev);
-        if (work_pending(&tpacpi_led_thinklight.work))
-                flush_workqueue(tpacpi_wq);
+        flush_workqueue(tpacpi_wq);
 }
 
 static int light_read(struct seq_file *m)
diff --git a/drivers/regulator/88pm8607.c b/drivers/regulator/88pm8607.c
index 2b557119adad..c79ab843333e 100644
--- a/drivers/regulator/88pm8607.c
+++ b/drivers/regulator/88pm8607.c
@@ -30,8 +30,6 @@ struct pm8607_regulator_info {
         unsigned int    *vol_table;
         unsigned int    *vol_suspend;
 
-        int     update_reg;
-        int     update_bit;
         int     slope_double;
 };
 
@@ -222,29 +220,6 @@ static int pm8607_list_voltage(struct regulator_dev *rdev, unsigned index)
         return ret;
 }
 
-static int pm8607_set_voltage_sel(struct regulator_dev *rdev, unsigned selector)
-{
-        struct pm8607_regulator_info *info = rdev_get_drvdata(rdev);
-        uint8_t val;
-        int ret;
-
-        val = (uint8_t)(selector << (ffs(rdev->desc->vsel_mask) - 1));
-
-        ret = pm860x_set_bits(info->i2c, rdev->desc->vsel_reg,
-                              rdev->desc->vsel_mask, val);
-        if (ret)
-                return ret;
-        switch (info->desc.id) {
-        case PM8607_ID_BUCK1:
-        case PM8607_ID_BUCK3:
-                ret = pm860x_set_bits(info->i2c, info->update_reg,
-                                      1 << info->update_bit,
-                                      1 << info->update_bit);
-                break;
-        }
-        return ret;
-}
-
 static int pm8606_preg_enable(struct regulator_dev *rdev)
 {
         struct pm8607_regulator_info *info = rdev_get_drvdata(rdev);
@@ -276,7 +251,7 @@ static int pm8606_preg_is_enabled(struct regulator_dev *rdev)
 
 static struct regulator_ops pm8607_regulator_ops = {
         .list_voltage   = pm8607_list_voltage,
-        .set_voltage_sel = pm8607_set_voltage_sel,
+        .set_voltage_sel = regulator_set_voltage_sel_regmap,
         .get_voltage_sel = regulator_get_voltage_sel_regmap,
         .enable = regulator_enable_regmap,
         .disable = regulator_disable_regmap,
@@ -313,11 +288,11 @@ static struct regulator_ops pm8606_preg_ops = {
                 .n_voltages = ARRAY_SIZE(vreg##_table),                 \
                 .vsel_reg = PM8607_##vreg,                              \
                 .vsel_mask = ARRAY_SIZE(vreg##_table) - 1,              \
+                .apply_reg = PM8607_##ureg,                             \
+                .apply_bit = (ubit),                                    \
                 .enable_reg = PM8607_##ereg,                            \
                 .enable_mask = 1 << (ebit),                             \
         },                                                              \
-        .update_reg     = PM8607_##ureg,                                \
-        .update_bit     = (ubit),                                       \
         .slope_double   = (0),                                          \
         .vol_table      = (unsigned int *)&vreg##_table,                \
         .vol_suspend    = (unsigned int *)&vreg##_suspend_table,        \
@@ -343,9 +318,9 @@ static struct regulator_ops pm8606_preg_ops = {
 }
 
 static struct pm8607_regulator_info pm8607_regulator_info[] = {
-        PM8607_DVC(BUCK1, GO, 0, SUPPLIES_EN11, 0),
-        PM8607_DVC(BUCK2, GO, 1, SUPPLIES_EN11, 1),
-        PM8607_DVC(BUCK3, GO, 2, SUPPLIES_EN11, 2),
+        PM8607_DVC(BUCK1, GO, BIT(0), SUPPLIES_EN11, 0),
+        PM8607_DVC(BUCK2, GO, BIT(1), SUPPLIES_EN11, 1),
+        PM8607_DVC(BUCK3, GO, BIT(2), SUPPLIES_EN11, 2),
 
         PM8607_LDO(1,         LDO1, 0, SUPPLIES_EN11, 3),
         PM8607_LDO(2,         LDO2, 0, SUPPLIES_EN11, 4),
@@ -372,7 +347,7 @@ static int pm8607_regulator_dt_init(struct platform_device *pdev,
                                     struct regulator_config *config)
 {
         struct device_node *nproot, *np;
-        nproot = pdev->dev.parent->of_node;
+        nproot = of_node_get(pdev->dev.parent->of_node);
         if (!nproot)
                 return -ENODEV;
         nproot = of_find_node_by_name(nproot, "regulators");
@@ -388,6 +363,7 @@ static int pm8607_regulator_dt_init(struct platform_device *pdev,
                         break;
                 }
         }
+        of_node_put(nproot);
         return 0;
 }
 #else
diff --git a/drivers/regulator/Kconfig b/drivers/regulator/Kconfig
index 551a22b07538..a5d97eaee99e 100644
--- a/drivers/regulator/Kconfig
+++ b/drivers/regulator/Kconfig
@@ -91,6 +91,7 @@ config REGULATOR_AAT2870
 config REGULATOR_ARIZONA
         tristate "Wolfson Arizona class devices"
         depends on MFD_ARIZONA
+        depends on SND_SOC
         help
           Support for the regulators found on Wolfson Arizona class
           devices.
@@ -277,6 +278,15 @@ config REGULATOR_LP872X
         help
           This driver supports LP8720/LP8725 PMIC
 
+config REGULATOR_LP8755
+        tristate "TI LP8755 High Performance PMU driver"
+        depends on I2C
+        select REGMAP_I2C
+        help
+          This driver supports LP8755 High Performance PMU driver. This
+          chip contains six step-down DC/DC converters which can support
+          9 mode multiphase configuration.
+
 config REGULATOR_LP8788
         bool "TI LP8788 Power Regulators"
         depends on MFD_LP8788
diff --git a/drivers/regulator/Makefile b/drivers/regulator/Makefile
index b802b0c7fb02..6e8250382def 100644
--- a/drivers/regulator/Makefile
+++ b/drivers/regulator/Makefile
@@ -30,6 +30,7 @@ obj-$(CONFIG_REGULATOR_LP3972) += lp3972.o
 obj-$(CONFIG_REGULATOR_LP872X) += lp872x.o
 obj-$(CONFIG_REGULATOR_LP8788) += lp8788-buck.o
 obj-$(CONFIG_REGULATOR_LP8788) += lp8788-ldo.o
+obj-$(CONFIG_REGULATOR_LP8755) += lp8755.o
 obj-$(CONFIG_REGULATOR_MAX1586) += max1586.o
 obj-$(CONFIG_REGULATOR_MAX8649) += max8649.o
 obj-$(CONFIG_REGULATOR_MAX8660) += max8660.o
diff --git a/drivers/regulator/anatop-regulator.c b/drivers/regulator/anatop-regulator.c
index 8f39cac661d2..0d4a8ccbb536 100644
--- a/drivers/regulator/anatop-regulator.c
+++ b/drivers/regulator/anatop-regulator.c
@@ -31,12 +31,18 @@
 #include <linux/regulator/driver.h>
 #include <linux/regulator/of_regulator.h>
 
+#define LDO_RAMP_UP_UNIT_IN_CYCLES      64 /* 64 cycles per step */
+#define LDO_RAMP_UP_FREQ_IN_MHZ         24 /* cycle based on 24M OSC */
+
 struct anatop_regulator {
         const char *name;
         u32 control_reg;
         struct regmap *anatop;
         int vol_bit_shift;
         int vol_bit_width;
+        u32 delay_reg;
+        int delay_bit_shift;
+        int delay_bit_width;
         int min_bit_val;
         int min_voltage;
         int max_voltage;
@@ -55,6 +61,32 @@ static int anatop_regmap_set_voltage_sel(struct regulator_dev *reg,
         return regulator_set_voltage_sel_regmap(reg, selector);
 }
 
+static int anatop_regmap_set_voltage_time_sel(struct regulator_dev *reg,
+        unsigned int old_sel,
+        unsigned int new_sel)
+{
+        struct anatop_regulator *anatop_reg = rdev_get_drvdata(reg);
+        u32 val;
+        int ret = 0;
+
+        /* check whether need to care about LDO ramp up speed */
+        if (anatop_reg->delay_bit_width && new_sel > old_sel) {
+                /*
+                 * the delay for LDO ramp up time is
+                 * based on the register setting, we need
+                 * to calculate how many steps LDO need to
+                 * ramp up, and how much delay needed. (us)
+                 */
+                regmap_read(anatop_reg->anatop, anatop_reg->delay_reg, &val);
+                val = (val >> anatop_reg->delay_bit_shift) &
+                        ((1 << anatop_reg->delay_bit_width) - 1);
+                ret = (new_sel - old_sel) * (LDO_RAMP_UP_UNIT_IN_CYCLES <<
+                        val) / LDO_RAMP_UP_FREQ_IN_MHZ + 1;
+        }
+
+        return ret;
+}
+
 static int anatop_regmap_get_voltage_sel(struct regulator_dev *reg)
 {
         struct anatop_regulator *anatop_reg = rdev_get_drvdata(reg);
@@ -67,6 +99,7 @@ static int anatop_regmap_get_voltage_sel(struct regulator_dev *reg)
 
 static struct regulator_ops anatop_rops = {
         .set_voltage_sel = anatop_regmap_set_voltage_sel,
+        .set_voltage_time_sel = anatop_regmap_set_voltage_time_sel,
         .get_voltage_sel = anatop_regmap_get_voltage_sel,
         .list_voltage = regulator_list_voltage_linear,
         .map_voltage = regulator_map_voltage_linear,
@@ -143,6 +176,14 @@ static int anatop_regulator_probe(struct platform_device *pdev)
                 goto anatop_probe_end;
         }
 
+        /* read LDO ramp up setting, only for core reg */
+        of_property_read_u32(np, "anatop-delay-reg-offset",
+                             &sreg->delay_reg);
+        of_property_read_u32(np, "anatop-delay-bit-width",
+                             &sreg->delay_bit_width);
+        of_property_read_u32(np, "anatop-delay-bit-shift",
+                             &sreg->delay_bit_shift);
+
         rdesc->n_voltages = (sreg->max_voltage - sreg->min_voltage) / 25000 + 1
                             + sreg->min_bit_val;
         rdesc->min_uV = sreg->min_voltage;
diff --git a/drivers/regulator/arizona-micsupp.c b/drivers/regulator/arizona-micsupp.c
index a6d040cbf8ac..e87536bf0bed 100644
--- a/drivers/regulator/arizona-micsupp.c
+++ b/drivers/regulator/arizona-micsupp.c
@@ -21,6 +21,8 @@
 #include <linux/regulator/machine.h>
 #include <linux/gpio.h>
 #include <linux/slab.h>
+#include <linux/workqueue.h>
+#include <sound/soc.h>
 
 #include <linux/mfd/arizona/core.h>
 #include <linux/mfd/arizona/pdata.h>
@@ -34,6 +36,8 @@ struct arizona_micsupp {
 
         struct regulator_consumer_supply supply;
         struct regulator_init_data init_data;
+
+        struct work_struct check_cp_work;
 };
 
 static int arizona_micsupp_list_voltage(struct regulator_dev *rdev,
@@ -72,9 +76,73 @@ static int arizona_micsupp_map_voltage(struct regulator_dev *rdev,
         return selector;
 }
 
+static void arizona_micsupp_check_cp(struct work_struct *work)
+{
+        struct arizona_micsupp *micsupp =
+                container_of(work, struct arizona_micsupp, check_cp_work);
+        struct snd_soc_dapm_context *dapm = micsupp->arizona->dapm;
+        struct arizona *arizona = micsupp->arizona;
+        struct regmap *regmap = arizona->regmap;
+        unsigned int reg;
+        int ret;
+
+        ret = regmap_read(regmap, ARIZONA_MIC_CHARGE_PUMP_1, &reg);
+        if (ret != 0) {
+                dev_err(arizona->dev, "Failed to read CP state: %d\n", ret);
+                return;
+        }
+
+        if (dapm) {
+                if ((reg & (ARIZONA_CPMIC_ENA | ARIZONA_CPMIC_BYPASS)) ==
+                    ARIZONA_CPMIC_ENA)
+                        snd_soc_dapm_force_enable_pin(dapm, "MICSUPP");
+                else
+                        snd_soc_dapm_disable_pin(dapm, "MICSUPP");
+
+                snd_soc_dapm_sync(dapm);
+        }
+}
+
+static int arizona_micsupp_enable(struct regulator_dev *rdev)
+{
+        struct arizona_micsupp *micsupp = rdev_get_drvdata(rdev);
+        int ret;
+
+        ret = regulator_enable_regmap(rdev);
+
+        if (ret == 0)
+                schedule_work(&micsupp->check_cp_work);
+
+        return ret;
+}
+
+static int arizona_micsupp_disable(struct regulator_dev *rdev)
+{
+        struct arizona_micsupp *micsupp = rdev_get_drvdata(rdev);
+        int ret;
+
+        ret = regulator_disable_regmap(rdev);
+        if (ret == 0)
+                schedule_work(&micsupp->check_cp_work);
+
+        return ret;
+}
+
+static int arizona_micsupp_set_bypass(struct regulator_dev *rdev, bool ena)
+{
+        struct arizona_micsupp *micsupp = rdev_get_drvdata(rdev);
+        int ret;
+
+        ret = regulator_set_bypass_regmap(rdev, ena);
+        if (ret == 0)
+                schedule_work(&micsupp->check_cp_work);
+
+        return ret;
+}
+
 static struct regulator_ops arizona_micsupp_ops = {
-        .enable = regulator_enable_regmap,
-        .disable = regulator_disable_regmap,
+        .enable = arizona_micsupp_enable,
+        .disable = arizona_micsupp_disable,
         .is_enabled = regulator_is_enabled_regmap,
 
         .list_voltage = arizona_micsupp_list_voltage,
@@ -84,7 +152,7 @@ static struct regulator_ops arizona_micsupp_ops = {
         .set_voltage_sel = regulator_set_voltage_sel_regmap,
 
         .get_bypass = regulator_get_bypass_regmap,
-        .set_bypass = regulator_set_bypass_regmap,
+        .set_bypass = arizona_micsupp_set_bypass,
 };
 
 static const struct regulator_desc arizona_micsupp = {
@@ -109,7 +177,8 @@ static const struct regulator_desc arizona_micsupp = {
 static const struct regulator_init_data arizona_micsupp_default = {
         .constraints = {
                 .valid_ops_mask = REGULATOR_CHANGE_STATUS |
-                                REGULATOR_CHANGE_VOLTAGE,
+                                REGULATOR_CHANGE_VOLTAGE |
+                                REGULATOR_CHANGE_BYPASS,
                 .min_uV = 1700000,
                 .max_uV = 3300000,
         },
@@ -131,6 +200,7 @@ static int arizona_micsupp_probe(struct platform_device *pdev)
         }
 
         micsupp->arizona = arizona;
+        INIT_WORK(&micsupp->check_cp_work, arizona_micsupp_check_cp);
 
         /*
          * Since the chip usually supplies itself we provide some
diff --git a/drivers/regulator/as3711-regulator.c b/drivers/regulator/as3711-regulator.c
index 2f1341db38a0..f0ba8c4eefa9 100644
--- a/drivers/regulator/as3711-regulator.c
+++ b/drivers/regulator/as3711-regulator.c
@@ -303,7 +303,7 @@ static int as3711_regulator_probe(struct platform_device *pdev)
                 reg_data = pdata ? pdata->init_data[id] : NULL;
 
                 /* No need to register if there is no regulator data */
-                if (!ri->desc.name)
+                if (!reg_data)
                         continue;
 
                 reg = &regs[id];
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 0f65b246cc0c..da9782bd27d0 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -200,8 +200,8 @@ static int regulator_check_consumers(struct regulator_dev *rdev,
         }
 
         if (*min_uV > *max_uV) {
-                dev_err(regulator->dev, "Restricting voltage, %u-%uuV\n",
-                        regulator->min_uV, regulator->max_uV);
+                rdev_err(rdev, "Restricting voltage, %u-%uuV\n",
+                        *min_uV, *max_uV);
                 return -EINVAL;
         }
 
@@ -1885,9 +1885,15 @@ int regulator_can_change_voltage(struct regulator *regulator)
         struct regulator_dev    *rdev = regulator->rdev;
 
         if (rdev->constraints &&
-            rdev->constraints->valid_ops_mask & REGULATOR_CHANGE_VOLTAGE &&
-            (rdev->desc->n_voltages - rdev->desc->linear_min_sel) > 1)
-                return 1;
+            (rdev->constraints->valid_ops_mask & REGULATOR_CHANGE_VOLTAGE)) {
+                if (rdev->desc->n_voltages - rdev->desc->linear_min_sel > 1)
+                        return 1;
+
+                if (rdev->desc->continuous_voltage_range &&
+                    rdev->constraints->min_uV && rdev->constraints->max_uV &&
+                    rdev->constraints->min_uV != rdev->constraints->max_uV)
+                        return 1;
+        }
 
         return 0;
 }
@@ -2074,10 +2080,20 @@ EXPORT_SYMBOL_GPL(regulator_get_voltage_sel_regmap);
  */
 int regulator_set_voltage_sel_regmap(struct regulator_dev *rdev, unsigned sel)
 {
+        int ret;
+
         sel <<= ffs(rdev->desc->vsel_mask) - 1;
 
-        return regmap_update_bits(rdev->regmap, rdev->desc->vsel_reg,
+        ret = regmap_update_bits(rdev->regmap, rdev->desc->vsel_reg,
                                   rdev->desc->vsel_mask, sel);
+        if (ret)
+                return ret;
+
+        if (rdev->desc->apply_bit)
+                ret = regmap_update_bits(rdev->regmap, rdev->desc->apply_reg,
+                                         rdev->desc->apply_bit,
+                                         rdev->desc->apply_bit);
+        return ret;
 }
 EXPORT_SYMBOL_GPL(regulator_set_voltage_sel_regmap);
 
@@ -2223,8 +2239,11 @@ static int _regulator_do_set_voltage(struct regulator_dev *rdev,
                         best_val = rdev->desc->ops->list_voltage(rdev, ret);
                         if (min_uV <= best_val && max_uV >= best_val) {
                                 selector = ret;
-                                ret = rdev->desc->ops->set_voltage_sel(rdev,
-                                                                       ret);
+                                if (old_selector == selector)
+                                        ret = 0;
+                                else
+                                        ret = rdev->desc->ops->set_voltage_sel(
+                                                                rdev, ret);
                         } else {
                                 ret = -EINVAL;
                         }
@@ -2235,7 +2254,7 @@ static int _regulator_do_set_voltage(struct regulator_dev *rdev,
 
         /* Call set_voltage_time_sel if successfully obtained old_selector */
         if (ret == 0 && _regulator_is_enabled(rdev) && old_selector >= 0 &&
-            rdev->desc->ops->set_voltage_time_sel) {
+            old_selector != selector && rdev->desc->ops->set_voltage_time_sel) {
 
                 delay = rdev->desc->ops->set_voltage_time_sel(rdev,
                                                 old_selector, selector);
@@ -2288,6 +2307,7 @@ int regulator_set_voltage(struct regulator *regulator, int min_uV, int max_uV)
 {
         struct regulator_dev *rdev = regulator->rdev;
         int ret = 0;
+        int old_min_uV, old_max_uV;
 
         mutex_lock(&rdev->mutex);
 
@@ -2309,18 +2329,29 @@ int regulator_set_voltage(struct regulator *regulator, int min_uV, int max_uV)
         ret = regulator_check_voltage(rdev, &min_uV, &max_uV);
         if (ret < 0)
                 goto out;
+        
+        /* restore original values in case of error */
+        old_min_uV = regulator->min_uV;
+        old_max_uV = regulator->max_uV;
         regulator->min_uV = min_uV;
         regulator->max_uV = max_uV;
 
         ret = regulator_check_consumers(rdev, &min_uV, &max_uV);
         if (ret < 0)
-                goto out;
+                goto out2;
 
         ret = _regulator_do_set_voltage(rdev, min_uV, max_uV);
-
+        if (ret < 0)
+                goto out2;
+        
 out:
         mutex_unlock(&rdev->mutex);
         return ret;
+out2:
+        regulator->min_uV = old_min_uV;
+        regulator->max_uV = old_max_uV;
+        mutex_unlock(&rdev->mutex);
+        return ret;
 }
 EXPORT_SYMBOL_GPL(regulator_set_voltage);
 
@@ -3202,7 +3233,7 @@ static int add_regulator_attributes(struct regulator_dev *rdev)
                 if (status < 0)
                         return status;
         }
-        if (ops->is_enabled) {
+        if (rdev->ena_gpio || ops->is_enabled) {
                 status = device_create_file(dev, &dev_attr_state);
                 if (status < 0)
                         return status;
@@ -3315,7 +3346,8 @@ static void rdev_init_debugfs(struct regulator_dev *rdev)
  * @config: runtime configuration for regulator
  *
  * Called by regulator drivers to register a regulator.
- * Returns 0 on success.
+ * Returns a valid pointer to struct regulator_dev on success
+ * or an ERR_PTR() on error.
  */
 struct regulator_dev *
 regulator_register(const struct regulator_desc *regulator_desc,
diff --git a/drivers/regulator/da9052-regulator.c b/drivers/regulator/da9052-regulator.c
index d0963090442d..96b569abb46c 100644
--- a/drivers/regulator/da9052-regulator.c
+++ b/drivers/regulator/da9052-regulator.c
@@ -70,7 +70,6 @@ struct da9052_regulator_info {
         int step_uV;
         int min_uV;
         int max_uV;
-        unsigned char activate_bit;
 };
 
 struct da9052_regulator {
@@ -210,36 +209,6 @@ static int da9052_map_voltage(struct regulator_dev *rdev,
         return sel;
 }
 
-static int da9052_regulator_set_voltage_sel(struct regulator_dev *rdev,
-                                            unsigned int selector)
-{
-        struct da9052_regulator *regulator = rdev_get_drvdata(rdev);
-        struct da9052_regulator_info *info = regulator->info;
-        int id = rdev_get_id(rdev);
-        int ret;
-
-        ret = da9052_reg_update(regulator->da9052, rdev->desc->vsel_reg,
-                                rdev->desc->vsel_mask, selector);
-        if (ret < 0)
-                return ret;
-
-        /* Some LDOs and DCDCs are DVC controlled which requires enabling of
-         * the activate bit to implment the changes on the output.
-         */
-        switch (id) {
-        case DA9052_ID_BUCK1:
-        case DA9052_ID_BUCK2:
-        case DA9052_ID_BUCK3:
-        case DA9052_ID_LDO2:
-        case DA9052_ID_LDO3:
-                ret = da9052_reg_update(regulator->da9052, DA9052_SUPPLY_REG,
-                                        info->activate_bit, info->activate_bit);
-                break;
-        }
-
-        return ret;
-}
-
 static struct regulator_ops da9052_dcdc_ops = {
         .get_current_limit = da9052_dcdc_get_current_limit,
         .set_current_limit = da9052_dcdc_set_current_limit,
@@ -247,7 +216,7 @@ static struct regulator_ops da9052_dcdc_ops = {
         .list_voltage = da9052_list_voltage,
         .map_voltage = da9052_map_voltage,
         .get_voltage_sel = regulator_get_voltage_sel_regmap,
-        .set_voltage_sel = da9052_regulator_set_voltage_sel,
+        .set_voltage_sel = regulator_set_voltage_sel_regmap,
         .is_enabled = regulator_is_enabled_regmap,
         .enable = regulator_enable_regmap,
         .disable = regulator_disable_regmap,
@@ -257,7 +226,7 @@ static struct regulator_ops da9052_ldo_ops = {
         .list_voltage = da9052_list_voltage,
         .map_voltage = da9052_map_voltage,
         .get_voltage_sel = regulator_get_voltage_sel_regmap,
-        .set_voltage_sel = da9052_regulator_set_voltage_sel,
+        .set_voltage_sel = regulator_set_voltage_sel_regmap,
         .is_enabled = regulator_is_enabled_regmap,
         .enable = regulator_enable_regmap,
         .disable = regulator_disable_regmap,
@@ -274,13 +243,14 @@ static struct regulator_ops da9052_ldo_ops = {
                 .owner = THIS_MODULE,\
                 .vsel_reg = DA9052_BUCKCORE_REG + DA9052_ID_##_id, \
                 .vsel_mask = (1 << (sbits)) - 1,\
+                .apply_reg = DA9052_SUPPLY_REG, \
+                .apply_bit = (abits), \
                 .enable_reg = DA9052_BUCKCORE_REG + DA9052_ID_##_id, \
                 .enable_mask = 1 << (ebits),\
         },\
         .min_uV = (min) * 1000,\
         .max_uV = (max) * 1000,\
         .step_uV = (step) * 1000,\
-        .activate_bit = (abits),\
 }
 
 #define DA9052_DCDC(_id, step, min, max, sbits, ebits, abits) \
@@ -294,13 +264,14 @@ static struct regulator_ops da9052_ldo_ops = {
                 .owner = THIS_MODULE,\
                 .vsel_reg = DA9052_BUCKCORE_REG + DA9052_ID_##_id, \
                 .vsel_mask = (1 << (sbits)) - 1,\
+                .apply_reg = DA9052_SUPPLY_REG, \
+                .apply_bit = (abits), \
                 .enable_reg = DA9052_BUCKCORE_REG + DA9052_ID_##_id, \
                 .enable_mask = 1 << (ebits),\
         },\
         .min_uV = (min) * 1000,\
         .max_uV = (max) * 1000,\
         .step_uV = (step) * 1000,\
-        .activate_bit = (abits),\
 }
 
 static struct da9052_regulator_info da9052_regulator_info[] = {
@@ -395,9 +366,9 @@ static int da9052_regulator_probe(struct platform_device *pdev)
                 config.init_data = pdata->regulators[pdev->id];
         } else {
 #ifdef CONFIG_OF
-                struct device_node *nproot = da9052->dev->of_node;
-                struct device_node *np;
+                struct device_node *nproot, *np;
 
+                nproot = of_node_get(da9052->dev->of_node);
                 if (!nproot)
                         return -ENODEV;
 
@@ -414,6 +385,7 @@ static int da9052_regulator_probe(struct platform_device *pdev)
                                 break;
                         }
                 }
+                of_node_put(nproot);
 #endif
         }
 
diff --git a/drivers/regulator/da9055-regulator.c b/drivers/regulator/da9055-regulator.c
index 1a05ac66878f..30221099d09c 100644
--- a/drivers/regulator/da9055-regulator.c
+++ b/drivers/regulator/da9055-regulator.c
@@ -58,7 +58,6 @@ struct da9055_volt_reg {
         int reg_b;
         int sl_shift;
         int v_mask;
-        int v_shift;
 };
 
 struct da9055_mode_reg {
@@ -388,7 +387,6 @@ static struct regulator_ops da9055_ldo_ops = {
                 .reg_b = DA9055_REG_VBCORE_B + DA9055_ID_##_id, \
                 .sl_shift = 7,\
                 .v_mask = (1 << (vbits)) - 1,\
-                .v_shift = (vbits),\
         },\
 }
 
@@ -417,7 +415,6 @@ static struct regulator_ops da9055_ldo_ops = {
                 .reg_b = DA9055_REG_VBCORE_B + DA9055_ID_##_id, \
                 .sl_shift = 7,\
                 .v_mask = (1 << (vbits)) - 1,\
-                .v_shift = (vbits),\
         },\
         .mode = {\
                 .reg = DA9055_REG_BCORE_MODE,\
diff --git a/drivers/regulator/dbx500-prcmu.c b/drivers/regulator/dbx500-prcmu.c
index 261f3d2299bc..89bd2faaef8c 100644
--- a/drivers/regulator/dbx500-prcmu.c
+++ b/drivers/regulator/dbx500-prcmu.c
@@ -14,6 +14,7 @@
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
 #include <linux/slab.h>
+#include <linux/module.h>
 
 #include "dbx500-prcmu.h"
 
diff --git a/drivers/regulator/gpio-regulator.c b/drivers/regulator/gpio-regulator.c
index bae681ccd3ea..9d39eb4aafa3 100644
--- a/drivers/regulator/gpio-regulator.c
+++ b/drivers/regulator/gpio-regulator.c
@@ -132,7 +132,7 @@ static struct regulator_ops gpio_regulator_voltage_ops = {
         .list_voltage = gpio_regulator_list_voltage,
 };
 
-struct gpio_regulator_config *
+static struct gpio_regulator_config *
 of_get_gpio_regulator_config(struct device *dev, struct device_node *np)
 {
         struct gpio_regulator_config *config;
@@ -163,10 +163,7 @@ of_get_gpio_regulator_config(struct device *dev, struct device_node *np)
         config->enable_gpio = of_get_named_gpio(np, "enable-gpio", 0);
 
         /* Fetch GPIOs. */
-        for (i = 0; ; i++)
-                if (of_get_named_gpio(np, "gpios", i) < 0)
-                        break;
-        config->nr_gpios = i;
+        config->nr_gpios = of_gpio_count(np);
 
         config->gpios = devm_kzalloc(dev,
                                 sizeof(struct gpio) * config->nr_gpios,
diff --git a/drivers/regulator/lp3971.c b/drivers/regulator/lp3971.c
index 5f68ff11a298..9cb2c0f34515 100644
--- a/drivers/regulator/lp3971.c
+++ b/drivers/regulator/lp3971.c
@@ -73,8 +73,6 @@ static const unsigned int buck_voltage_map[] = {
 };
 
 #define BUCK_TARGET_VOL_MASK 0x3f
-#define BUCK_TARGET_VOL_MIN_IDX 0x01
-#define BUCK_TARGET_VOL_MAX_IDX 0x19
 
 #define LP3971_BUCK_RAMP_REG(x) (buck_base_addr[x]+2)
 
@@ -140,7 +138,7 @@ static int lp3971_ldo_disable(struct regulator_dev *dev)
         return lp3971_set_bits(lp3971, LP3971_LDO_ENABLE_REG, mask, 0);
 }
 
-static int lp3971_ldo_get_voltage(struct regulator_dev *dev)
+static int lp3971_ldo_get_voltage_sel(struct regulator_dev *dev)
 {
         struct lp3971 *lp3971 = rdev_get_drvdata(dev);
         int ldo = rdev_get_id(dev) - LP3971_LDO1;
@@ -149,7 +147,7 @@ static int lp3971_ldo_get_voltage(struct regulator_dev *dev)
         reg = lp3971_reg_read(lp3971, LP3971_LDO_VOL_CONTR_REG(ldo));
         val = (reg >> LDO_VOL_CONTR_SHIFT(ldo)) & LDO_VOL_CONTR_MASK;
 
-        return dev->desc->volt_table[val];
+        return val;
 }
 
 static int lp3971_ldo_set_voltage_sel(struct regulator_dev *dev,
@@ -168,7 +166,7 @@ static struct regulator_ops lp3971_ldo_ops = {
         .is_enabled = lp3971_ldo_is_enabled,
         .enable = lp3971_ldo_enable,
         .disable = lp3971_ldo_disable,
-        .get_voltage = lp3971_ldo_get_voltage,
+        .get_voltage_sel = lp3971_ldo_get_voltage_sel,
         .set_voltage_sel = lp3971_ldo_set_voltage_sel,
 };
 
@@ -201,24 +199,16 @@ static int lp3971_dcdc_disable(struct regulator_dev *dev)
         return lp3971_set_bits(lp3971, LP3971_BUCK_VOL_ENABLE_REG, mask, 0);
 }
 
-static int lp3971_dcdc_get_voltage(struct regulator_dev *dev)
+static int lp3971_dcdc_get_voltage_sel(struct regulator_dev *dev)
 {
         struct lp3971 *lp3971 = rdev_get_drvdata(dev);
         int buck = rdev_get_id(dev) - LP3971_DCDC1;
         u16 reg;
-        int val;
 
         reg = lp3971_reg_read(lp3971, LP3971_BUCK_TARGET_VOL1_REG(buck));
         reg &= BUCK_TARGET_VOL_MASK;
 
-        if (reg <= BUCK_TARGET_VOL_MAX_IDX)
-                val = buck_voltage_map[reg];
-        else {
-                val = 0;
-                dev_warn(&dev->dev, "chip reported incorrect voltage value.\n");
-        }
-
-        return val;
+        return reg;
 }
 
 static int lp3971_dcdc_set_voltage_sel(struct regulator_dev *dev,
@@ -249,7 +239,7 @@ static struct regulator_ops lp3971_dcdc_ops = {
         .is_enabled = lp3971_dcdc_is_enabled,
         .enable = lp3971_dcdc_enable,
         .disable = lp3971_dcdc_disable,
-        .get_voltage = lp3971_dcdc_get_voltage,
+        .get_voltage_sel = lp3971_dcdc_get_voltage_sel,
         .set_voltage_sel = lp3971_dcdc_set_voltage_sel,
 };
 
diff --git a/drivers/regulator/lp3972.c b/drivers/regulator/lp3972.c
index 69c42c318b87..0baabcfb578a 100644
--- a/drivers/regulator/lp3972.c
+++ b/drivers/regulator/lp3972.c
@@ -165,8 +165,6 @@ static const int buck_base_addr[] = {
 #define LP3972_BUCK_VOL_ENABLE_REG(x) (buck_vol_enable_addr[x])
 #define LP3972_BUCK_VOL1_REG(x) (buck_base_addr[x])
 #define LP3972_BUCK_VOL_MASK 0x1f
-#define LP3972_BUCK_VOL_MIN_IDX(x) ((x) ? 0x01 : 0x00)
-#define LP3972_BUCK_VOL_MAX_IDX(x) ((x) ? 0x19 : 0x1f)
 
 static int lp3972_i2c_read(struct i2c_client *i2c, char reg, int count,
         u16 *dest)
@@ -257,7 +255,7 @@ static int lp3972_ldo_disable(struct regulator_dev *dev)
                                 mask, 0);
 }
 
-static int lp3972_ldo_get_voltage(struct regulator_dev *dev)
+static int lp3972_ldo_get_voltage_sel(struct regulator_dev *dev)
 {
         struct lp3972 *lp3972 = rdev_get_drvdata(dev);
         int ldo = rdev_get_id(dev) - LP3972_LDO1;
@@ -267,7 +265,7 @@ static int lp3972_ldo_get_voltage(struct regulator_dev *dev)
         reg = lp3972_reg_read(lp3972, LP3972_LDO_VOL_CONTR_REG(ldo));
         val = (reg >> LP3972_LDO_VOL_CONTR_SHIFT(ldo)) & mask;
 
-        return dev->desc->volt_table[val];
+        return val;
 }
 
 static int lp3972_ldo_set_voltage_sel(struct regulator_dev *dev,
@@ -314,7 +312,7 @@ static struct regulator_ops lp3972_ldo_ops = {
         .is_enabled = lp3972_ldo_is_enabled,
         .enable = lp3972_ldo_enable,
         .disable = lp3972_ldo_disable,
-        .get_voltage = lp3972_ldo_get_voltage,
+        .get_voltage_sel = lp3972_ldo_get_voltage_sel,
         .set_voltage_sel = lp3972_ldo_set_voltage_sel,
 };
 
@@ -353,24 +351,16 @@ static int lp3972_dcdc_disable(struct regulator_dev *dev)
         return val;
 }
 
-static int lp3972_dcdc_get_voltage(struct regulator_dev *dev)
+static int lp3972_dcdc_get_voltage_sel(struct regulator_dev *dev)
 {
         struct lp3972 *lp3972 = rdev_get_drvdata(dev);
         int buck = rdev_get_id(dev) - LP3972_DCDC1;
         u16 reg;
-        int val;
 
         reg = lp3972_reg_read(lp3972, LP3972_BUCK_VOL1_REG(buck));
         reg &= LP3972_BUCK_VOL_MASK;
-        if (reg <= LP3972_BUCK_VOL_MAX_IDX(buck))
-                val = dev->desc->volt_table[reg];
-        else {
-                val = 0;
-                dev_warn(&dev->dev, "chip reported incorrect voltage value."
-                                    " reg = %d\n", reg);
-        }
 
-        return val;
+        return reg;
 }
 
 static int lp3972_dcdc_set_voltage_sel(struct regulator_dev *dev,
@@ -402,7 +392,7 @@ static struct regulator_ops lp3972_dcdc_ops = {
         .is_enabled = lp3972_dcdc_is_enabled,
         .enable = lp3972_dcdc_enable,
         .disable = lp3972_dcdc_disable,
-        .get_voltage = lp3972_dcdc_get_voltage,
+        .get_voltage_sel = lp3972_dcdc_get_voltage_sel,
         .set_voltage_sel = lp3972_dcdc_set_voltage_sel,
 };
 
diff --git a/drivers/regulator/lp872x.c b/drivers/regulator/lp872x.c
index 9289ead715ca..8e3c7ae0047f 100644
--- a/drivers/regulator/lp872x.c
+++ b/drivers/regulator/lp872x.c
@@ -181,20 +181,6 @@ static inline int lp872x_update_bits(struct lp872x *lp, u8 addr,
         return regmap_update_bits(lp->regmap, addr, mask, data);
 }
 
-static int _rdev_to_offset(struct regulator_dev *rdev)
-{
-        enum lp872x_regulator_id id = rdev_get_id(rdev);
-
-        switch (id) {
-        case LP8720_ID_LDO1 ... LP8720_ID_BUCK:
-                return id;
-        case LP8725_ID_LDO1 ... LP8725_ID_BUCK2:
-                return id - LP8725_ID_BASE;
-        default:
-                return -EINVAL;
-        }
-}
-
 static int lp872x_get_timestep_usec(struct lp872x *lp)
 {
         enum lp872x_id chip = lp->chipid;
@@ -234,28 +220,20 @@ static int lp872x_get_timestep_usec(struct lp872x *lp)
 static int lp872x_regulator_enable_time(struct regulator_dev *rdev)
 {
         struct lp872x *lp = rdev_get_drvdata(rdev);
-        enum lp872x_regulator_id regulator = rdev_get_id(rdev);
+        enum lp872x_regulator_id rid = rdev_get_id(rdev);
         int time_step_us = lp872x_get_timestep_usec(lp);
-        int ret, offset;
+        int ret;
         u8 addr, val;
 
         if (time_step_us < 0)
                 return -EINVAL;
 
-        switch (regulator) {
-        case LP8720_ID_LDO1 ... LP8720_ID_LDO5:
-        case LP8725_ID_LDO1 ... LP8725_ID_LILO2:
-                offset = _rdev_to_offset(rdev);
-                if (offset < 0)
-                        return -EINVAL;
-
-                addr = LP872X_LDO1_VOUT + offset;
-                break;
-        case LP8720_ID_BUCK:
-                addr = LP8720_BUCK_VOUT1;
+        switch (rid) {
+        case LP8720_ID_LDO1 ... LP8720_ID_BUCK:
+                addr = LP872X_LDO1_VOUT + rid;
                 break;
-        case LP8725_ID_BUCK1:
-                addr = LP8725_BUCK1_VOUT1;
+        case LP8725_ID_LDO1 ... LP8725_ID_BUCK1:
+                addr = LP872X_LDO1_VOUT + rid - LP8725_ID_BASE;
                 break;
         case LP8725_ID_BUCK2:
                 addr = LP8725_BUCK2_VOUT1;
diff --git a/drivers/regulator/lp8755.c b/drivers/regulator/lp8755.c
new file mode 100644
index 000000000000..f0f6ea05065b
--- /dev/null
+++ b/drivers/regulator/lp8755.c
@@ -0,0 +1,566 @@
+/*
+ * LP8755 High Performance Power Management Unit : System Interface Driver
+ * (based on rev. 0.26)
+ * Copyright 2012 Texas Instruments
+ *
+ * Author: Daniel(Geon Si) Jeong <daniel.jeong@ti.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/slab.h>
+#include <linux/i2c.h>
+#include <linux/err.h>
+#include <linux/irq.h>
+#include <linux/interrupt.h>
+#include <linux/gpio.h>
+#include <linux/regmap.h>
+#include <linux/delay.h>
+#include <linux/uaccess.h>
+#include <linux/regulator/driver.h>
+#include <linux/regulator/machine.h>
+#include <linux/platform_data/lp8755.h>
+
+#define LP8755_REG_BUCK0        0x00
+#define LP8755_REG_BUCK1        0x03
+#define LP8755_REG_BUCK2        0x04
+#define LP8755_REG_BUCK3        0x01
+#define LP8755_REG_BUCK4        0x05
+#define LP8755_REG_BUCK5        0x02
+#define LP8755_REG_MAX          0xFF
+
+#define LP8755_BUCK_EN_M        BIT(7)
+#define LP8755_BUCK_LINEAR_OUT_MAX      0x76
+#define LP8755_BUCK_VOUT_M      0x7F
+
+struct lp8755_mphase {
+        int nreg;
+        int buck_num[LP8755_BUCK_MAX];
+};
+
+struct lp8755_chip {
+        struct device *dev;
+        struct regmap *regmap;
+        struct lp8755_platform_data *pdata;
+
+        int irq;
+        unsigned int irqmask;
+
+        int mphase;
+        struct regulator_dev *rdev[LP8755_BUCK_MAX];
+};
+
+/**
+ *lp8755_read : read a single register value from lp8755.
+ *@pchip : device to read from
+ *@reg   : register to read from
+ *@val   : pointer to store read value
+ */
+static int lp8755_read(struct lp8755_chip *pchip, unsigned int reg,
+                       unsigned int *val)
+{
+        return regmap_read(pchip->regmap, reg, val);
+}
+
+/**
+ *lp8755_write : write a single register value to lp8755.
+ *@pchip : device to write to
+ *@reg   : register to write to
+ *@val   : value to be written
+ */
+static int lp8755_write(struct lp8755_chip *pchip, unsigned int reg,
+                        unsigned int val)
+{
+        return regmap_write(pchip->regmap, reg, val);
+}
+
+/**
+ *lp8755_update_bits : set the values of bit fields in lp8755 register.
+ *@pchip : device to read from
+ *@reg   : register to update
+ *@mask  : bitmask to be changed
+ *@val   : value for bitmask
+ */
+static int lp8755_update_bits(struct lp8755_chip *pchip, unsigned int reg,
+                              unsigned int mask, unsigned int val)
+{
+        return regmap_update_bits(pchip->regmap, reg, mask, val);
+}
+
+static int lp8755_buck_enable_time(struct regulator_dev *rdev)
+{
+        int ret;
+        unsigned int regval;
+        enum lp8755_bucks id = rdev_get_id(rdev);
+        struct lp8755_chip *pchip = rdev_get_drvdata(rdev);
+
+        ret = lp8755_read(pchip, 0x12 + id, &regval);
+        if (ret < 0) {
+                dev_err(pchip->dev, "i2c acceess error %s\n", __func__);
+                return ret;
+        }
+        return (regval & 0xff) * 100;
+}
+
+static int lp8755_buck_set_mode(struct regulator_dev *rdev, unsigned int mode)
+{
+        int ret;
+        unsigned int regbval = 0x0;
+        enum lp8755_bucks id = rdev_get_id(rdev);
+        struct lp8755_chip *pchip = rdev_get_drvdata(rdev);
+
+        switch (mode) {
+        case REGULATOR_MODE_FAST:
+                /* forced pwm mode */
+                regbval = (0x01 << id);
+                break;
+        case REGULATOR_MODE_NORMAL:
+                /* enable automatic pwm/pfm mode */
+                ret = lp8755_update_bits(pchip, 0x08 + id, 0x20, 0x00);
+                if (ret < 0)
+                        goto err_i2c;
+                break;
+        case REGULATOR_MODE_IDLE:
+                /* enable automatic pwm/pfm/lppfm mode */
+                ret = lp8755_update_bits(pchip, 0x08 + id, 0x20, 0x20);
+                if (ret < 0)
+                        goto err_i2c;
+
+                ret = lp8755_update_bits(pchip, 0x10, 0x01, 0x01);
+                if (ret < 0)
+                        goto err_i2c;
+                break;
+        default:
+                dev_err(pchip->dev, "Not supported buck mode %s\n", __func__);
+                /* forced pwm mode */
+                regbval = (0x01 << id);
+        }
+
+        ret = lp8755_update_bits(pchip, 0x06, 0x01 << id, regbval);
+        if (ret < 0)
+                goto err_i2c;
+        return ret;
+err_i2c:
+        dev_err(pchip->dev, "i2c acceess error %s\n", __func__);
+        return ret;
+}
+
+static unsigned int lp8755_buck_get_mode(struct regulator_dev *rdev)
+{
+        int ret;
+        unsigned int regval;
+        enum lp8755_bucks id = rdev_get_id(rdev);
+        struct lp8755_chip *pchip = rdev_get_drvdata(rdev);
+
+        ret = lp8755_read(pchip, 0x06, &regval);
+        if (ret < 0)
+                goto err_i2c;
+
+        /* mode fast means forced pwm mode */
+        if (regval & (0x01 << id))
+                return REGULATOR_MODE_FAST;
+
+        ret = lp8755_read(pchip, 0x08 + id, &regval);
+        if (ret < 0)
+                goto err_i2c;
+
+        /* mode idle means automatic pwm/pfm/lppfm mode */
+        if (regval & 0x20)
+                return REGULATOR_MODE_IDLE;
+
+        /* mode normal means automatic pwm/pfm mode */
+        return REGULATOR_MODE_NORMAL;
+
+err_i2c:
+        dev_err(pchip->dev, "i2c acceess error %s\n", __func__);
+        return 0;
+}
+
+static int lp8755_buck_set_ramp(struct regulator_dev *rdev, int ramp)
+{
+        int ret;
+        unsigned int regval = 0x00;
+        enum lp8755_bucks id = rdev_get_id(rdev);
+        struct lp8755_chip *pchip = rdev_get_drvdata(rdev);
+
+        /* uV/us */
+        switch (ramp) {
+        case 0 ... 230:
+                regval = 0x07;
+                break;
+        case 231 ... 470:
+                regval = 0x06;
+                break;
+        case 471 ... 940:
+                regval = 0x05;
+                break;
+        case 941 ... 1900:
+                regval = 0x04;
+                break;
+        case 1901 ... 3800:
+                regval = 0x03;
+                break;
+        case 3801 ... 7500:
+                regval = 0x02;
+                break;
+        case 7501 ... 15000:
+                regval = 0x01;
+                break;
+        case 15001 ... 30000:
+                regval = 0x00;
+                break;
+        default:
+                dev_err(pchip->dev,
+                        "Not supported ramp value %d %s\n", ramp, __func__);
+                return -EINVAL;
+        }
+
+        ret = lp8755_update_bits(pchip, 0x07 + id, 0x07, regval);
+        if (ret < 0)
+                goto err_i2c;
+        return ret;
+err_i2c:
+        dev_err(pchip->dev, "i2c acceess error %s\n", __func__);
+        return ret;
+}
+
+static struct regulator_ops lp8755_buck_ops = {
+        .list_voltage = regulator_list_voltage_linear,
+        .set_voltage_sel = regulator_set_voltage_sel_regmap,
+        .get_voltage_sel = regulator_get_voltage_sel_regmap,
+        .enable = regulator_enable_regmap,
+        .disable = regulator_disable_regmap,
+        .is_enabled = regulator_is_enabled_regmap,
+        .enable_time = lp8755_buck_enable_time,
+        .set_mode = lp8755_buck_set_mode,
+        .get_mode = lp8755_buck_get_mode,
+        .set_ramp_delay = lp8755_buck_set_ramp,
+};
+
+#define lp8755_rail(_id) "lp8755_buck"#_id
+#define lp8755_buck_init(_id)\
+{\
+        .constraints = {\
+                .name = lp8755_rail(_id),\
+                .valid_ops_mask = REGULATOR_CHANGE_VOLTAGE,\
+                .min_uV = 500000,\
+                .max_uV = 1675000,\
+        },\
+}
+
+static struct regulator_init_data lp8755_reg_default[LP8755_BUCK_MAX] = {
+        [LP8755_BUCK0] = lp8755_buck_init(0),
+        [LP8755_BUCK1] = lp8755_buck_init(1),
+        [LP8755_BUCK2] = lp8755_buck_init(2),
+        [LP8755_BUCK3] = lp8755_buck_init(3),
+        [LP8755_BUCK4] = lp8755_buck_init(4),
+        [LP8755_BUCK5] = lp8755_buck_init(5),
+};
+
+static const struct lp8755_mphase mphase_buck[MPHASE_CONF_MAX] = {
+        { 3, { LP8755_BUCK0, LP8755_BUCK3, LP8755_BUCK5 } },
+        { 6, { LP8755_BUCK0, LP8755_BUCK1, LP8755_BUCK2, LP8755_BUCK3,
+               LP8755_BUCK4, LP8755_BUCK5 } },
+        { 5, { LP8755_BUCK0, LP8755_BUCK2, LP8755_BUCK3, LP8755_BUCK4,
+               LP8755_BUCK5} },
+        { 4, { LP8755_BUCK0, LP8755_BUCK3, LP8755_BUCK4, LP8755_BUCK5} },
+        { 3, { LP8755_BUCK0, LP8755_BUCK4, LP8755_BUCK5} },
+        { 2, { LP8755_BUCK0, LP8755_BUCK5} },
+        { 1, { LP8755_BUCK0} },
+        { 2, { LP8755_BUCK0, LP8755_BUCK3} },
+        { 4, { LP8755_BUCK0, LP8755_BUCK2, LP8755_BUCK3, LP8755_BUCK5} },
+};
+
+static int lp8755_init_data(struct lp8755_chip *pchip)
+{
+        unsigned int regval;
+        int ret, icnt, buck_num;
+        struct lp8755_platform_data *pdata = pchip->pdata;
+
+        /* read back  muti-phase configuration */
+        ret = lp8755_read(pchip, 0x3D, &regval);
+        if (ret < 0)
+                goto out_i2c_error;
+        pchip->mphase = regval & 0x0F;
+
+        /* set default data based on multi-phase config */
+        for (icnt = 0; icnt < mphase_buck[pchip->mphase].nreg; icnt++) {
+                buck_num = mphase_buck[pchip->mphase].buck_num[icnt];
+                pdata->buck_data[buck_num] = &lp8755_reg_default[buck_num];
+        }
+        return ret;
+
+out_i2c_error:
+        dev_err(pchip->dev, "i2c acceess error %s\n", __func__);
+        return ret;
+}
+
+#define lp8755_buck_desc(_id)\
+{\
+        .name = lp8755_rail(_id),\
+        .id   = LP8755_BUCK##_id,\
+        .ops  = &lp8755_buck_ops,\
+        .n_voltages = LP8755_BUCK_LINEAR_OUT_MAX+1,\
+        .uV_step = 10000,\
+        .min_uV = 500000,\
+        .type = REGULATOR_VOLTAGE,\
+        .owner = THIS_MODULE,\
+        .enable_reg = LP8755_REG_BUCK##_id,\
+        .enable_mask = LP8755_BUCK_EN_M,\
+        .vsel_reg = LP8755_REG_BUCK##_id,\
+        .vsel_mask = LP8755_BUCK_VOUT_M,\
+}
+
+static struct regulator_desc lp8755_regulators[] = {
+        lp8755_buck_desc(0),
+        lp8755_buck_desc(1),
+        lp8755_buck_desc(2),
+        lp8755_buck_desc(3),
+        lp8755_buck_desc(4),
+        lp8755_buck_desc(5),
+};
+
+static int lp8755_regulator_init(struct lp8755_chip *pchip)
+{
+        int ret, icnt, buck_num;
+        struct lp8755_platform_data *pdata = pchip->pdata;
+        struct regulator_config rconfig = { };
+
+        rconfig.regmap = pchip->regmap;
+        rconfig.dev = pchip->dev;
+        rconfig.driver_data = pchip;
+
+        for (icnt = 0; icnt < mphase_buck[pchip->mphase].nreg; icnt++) {
+                buck_num = mphase_buck[pchip->mphase].buck_num[icnt];
+                rconfig.init_data = pdata->buck_data[buck_num];
+                rconfig.of_node = pchip->dev->of_node;
+                pchip->rdev[buck_num] =
+                    regulator_register(&lp8755_regulators[buck_num], &rconfig);
+                if (IS_ERR(pchip->rdev[buck_num])) {
+                        ret = PTR_ERR(pchip->rdev[buck_num]);
+                        pchip->rdev[buck_num] = NULL;
+                        dev_err(pchip->dev, "regulator init failed: buck %d\n",
+                                buck_num);
+                        goto err_buck;
+                }
+        }
+
+        return 0;
+
+err_buck:
+        for (icnt = 0; icnt < LP8755_BUCK_MAX; icnt++)
+                regulator_unregister(pchip->rdev[icnt]);
+        return ret;
+}
+
+static irqreturn_t lp8755_irq_handler(int irq, void *data)
+{
+        int ret, icnt;
+        unsigned int flag0, flag1;
+        struct lp8755_chip *pchip = data;
+
+        /* read flag0 register */
+        ret = lp8755_read(pchip, 0x0D, &flag0);
+        if (ret < 0)
+                goto err_i2c;
+        /* clear flag register to pull up int. pin */
+        ret = lp8755_write(pchip, 0x0D, 0x00);
+        if (ret < 0)
+                goto err_i2c;
+
+        /* sent power fault detection event to specific regulator */
+        for (icnt = 0; icnt < LP8755_BUCK_MAX; icnt++)
+                if ((flag0 & (0x4 << icnt))
+                    && (pchip->irqmask & (0x04 << icnt))
+                    && (pchip->rdev[icnt] != NULL))
+                        regulator_notifier_call_chain(pchip->rdev[icnt],
+                                                      LP8755_EVENT_PWR_FAULT,
+                                                      NULL);
+
+        /* read flag1 register */
+        ret = lp8755_read(pchip, 0x0E, &flag1);
+        if (ret < 0)
+                goto err_i2c;
+        /* clear flag register to pull up int. pin */
+        ret = lp8755_write(pchip, 0x0E, 0x00);
+        if (ret < 0)
+                goto err_i2c;
+
+        /* send OCP event to all regualtor devices */
+        if ((flag1 & 0x01) && (pchip->irqmask & 0x01))
+                for (icnt = 0; icnt < LP8755_BUCK_MAX; icnt++)
+                        if (pchip->rdev[icnt] != NULL)
+                                regulator_notifier_call_chain(pchip->rdev[icnt],
+                                                              LP8755_EVENT_OCP,
+                                                              NULL);
+
+        /* send OVP event to all regualtor devices */
+        if ((flag1 & 0x02) && (pchip->irqmask & 0x02))
+                for (icnt = 0; icnt < LP8755_BUCK_MAX; icnt++)
+                        if (pchip->rdev[icnt] != NULL)
+                                regulator_notifier_call_chain(pchip->rdev[icnt],
+                                                              LP8755_EVENT_OVP,
+                                                              NULL);
+        return IRQ_HANDLED;
+
+err_i2c:
+        dev_err(pchip->dev, "i2c acceess error %s\n", __func__);
+        return IRQ_NONE;
+}
+
+static int lp8755_int_config(struct lp8755_chip *pchip)
+{
+        int ret;
+        unsigned int regval;
+
+        if (pchip->irq == 0) {
+                dev_warn(pchip->dev, "not use interrupt : %s\n", __func__);
+                return 0;
+        }
+
+        ret = lp8755_read(pchip, 0x0F, &regval);
+        if (ret < 0)
+                goto err_i2c;
+        pchip->irqmask = regval;
+        ret = request_threaded_irq(pchip->irq, NULL, lp8755_irq_handler,
+                                   IRQF_TRIGGER_FALLING | IRQF_ONESHOT,
+                                   "lp8755-irq", pchip);
+        if (ret)
+                return ret;
+
+        return ret;
+
+err_i2c:
+        dev_err(pchip->dev, "i2c acceess error %s\n", __func__);
+        return ret;
+}
+
+static const struct regmap_config lp8755_regmap = {
+        .reg_bits = 8,
+        .val_bits = 8,
+        .max_register = LP8755_REG_MAX,
+};
+
+static int lp8755_probe(struct i2c_client *client,
+                        const struct i2c_device_id *id)
+{
+        int ret, icnt;
+        struct lp8755_chip *pchip;
+        struct lp8755_platform_data *pdata = client->dev.platform_data;
+
+        if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) {
+                dev_err(&client->dev, "i2c functionality check fail.\n");
+                return -EOPNOTSUPP;
+        }
+
+        pchip = devm_kzalloc(&client->dev,
+                             sizeof(struct lp8755_chip), GFP_KERNEL);
+        if (!pchip)
+                return -ENOMEM;
+
+        pchip->dev = &client->dev;
+        pchip->regmap = devm_regmap_init_i2c(client, &lp8755_regmap);
+        if (IS_ERR(pchip->regmap)) {
+                ret = PTR_ERR(pchip->regmap);
+                dev_err(&client->dev, "fail to allocate regmap %d\n", ret);
+                return ret;
+        }
+        i2c_set_clientdata(client, pchip);
+
+        if (pdata != NULL) {
+                pchip->pdata = pdata;
+                pchip->mphase = pdata->mphase;
+        } else {
+                pchip->pdata = devm_kzalloc(pchip->dev,
+                                            sizeof(struct lp8755_platform_data),
+                                            GFP_KERNEL);
+                if (!pchip->pdata)
+                        return -ENOMEM;
+                ret = lp8755_init_data(pchip);
+                if (ret < 0) {
+                        dev_err(&client->dev, "fail to initialize chip\n");
+                        return ret;
+                }
+        }
+
+        ret = lp8755_regulator_init(pchip);
+        if (ret < 0) {
+                dev_err(&client->dev, "fail to initialize regulators\n");
+                goto err_regulator;
+        }
+
+        pchip->irq = client->irq;
+        ret = lp8755_int_config(pchip);
+        if (ret < 0) {
+                dev_err(&client->dev, "fail to irq config\n");
+                goto err_irq;
+        }
+
+        return ret;
+
+err_irq:
+        for (icnt = 0; icnt < mphase_buck[pchip->mphase].nreg; icnt++)
+                regulator_unregister(pchip->rdev[icnt]);
+
+err_regulator:
+        /* output disable */
+        for (icnt = 0; icnt < LP8755_BUCK_MAX; icnt++)
+                lp8755_write(pchip, icnt, 0x00);
+
+        return ret;
+}
+
+static int lp8755_remove(struct i2c_client *client)
+{
+        int icnt;
+        struct lp8755_chip *pchip = i2c_get_clientdata(client);
+
+        for (icnt = 0; icnt < mphase_buck[pchip->mphase].nreg; icnt++)
+                regulator_unregister(pchip->rdev[icnt]);
+
+        for (icnt = 0; icnt < LP8755_BUCK_MAX; icnt++)
+                lp8755_write(pchip, icnt, 0x00);
+
+        if (pchip->irq != 0)
+                free_irq(pchip->irq, pchip);
+
+        return 0;
+}
+
+static const struct i2c_device_id lp8755_id[] = {
+        {LP8755_NAME, 0},
+        {}
+};
+
+MODULE_DEVICE_TABLE(i2c, lp8755_id);
+
+static struct i2c_driver lp8755_i2c_driver = {
+        .driver = {
+                   .name = LP8755_NAME,
+                   },
+        .probe = lp8755_probe,
+        .remove = lp8755_remove,
+        .id_table = lp8755_id,
+};
+
+static int __init lp8755_init(void)
+{
+        return i2c_add_driver(&lp8755_i2c_driver);
+}
+
+subsys_initcall(lp8755_init);
+
+static void __exit lp8755_exit(void)
+{
+        i2c_del_driver(&lp8755_i2c_driver);
+}
+
+module_exit(lp8755_exit);
+
+MODULE_DESCRIPTION("Texas Instruments lp8755 driver");
+MODULE_AUTHOR("Daniel Jeong <daniel.jeong@ti.com>");
+MODULE_LICENSE("GPL v2");
diff --git a/drivers/regulator/lp8788-buck.c b/drivers/regulator/lp8788-buck.c
index aef3f2b0c5ea..97891a7ea7b2 100644
--- a/drivers/regulator/lp8788-buck.c
+++ b/drivers/regulator/lp8788-buck.c
@@ -103,16 +103,6 @@ static const int lp8788_buck_vtbl[] = {
         1950000, 2000000,
 };
 
-static const u8 buck1_vout_addr[] = {
-        LP8788_BUCK1_VOUT0, LP8788_BUCK1_VOUT1,
-        LP8788_BUCK1_VOUT2, LP8788_BUCK1_VOUT3,
-};
-
-static const u8 buck2_vout_addr[] = {
-        LP8788_BUCK2_VOUT0, LP8788_BUCK2_VOUT1,
-        LP8788_BUCK2_VOUT2, LP8788_BUCK2_VOUT3,
-};
-
 static void lp8788_buck1_set_dvs(struct lp8788_buck *buck)
 {
         struct lp8788_buck1_dvs *dvs = (struct lp8788_buck1_dvs *)buck->dvs;
@@ -235,7 +225,7 @@ static u8 lp8788_select_buck_vout_addr(struct lp8788_buck *buck,
                         lp8788_read_byte(buck->lp, LP8788_BUCK_DVS_SEL, &val);
                         idx = (val & LP8788_BUCK1_DVS_M) >> LP8788_BUCK1_DVS_S;
                 }
-                addr = buck1_vout_addr[idx];
+                addr = LP8788_BUCK1_VOUT0 + idx;
                 break;
         case BUCK2:
                 if (mode == EXTPIN) {
@@ -258,7 +248,7 @@ static u8 lp8788_select_buck_vout_addr(struct lp8788_buck *buck,
                         lp8788_read_byte(buck->lp, LP8788_BUCK_DVS_SEL, &val);
                         idx = (val & LP8788_BUCK2_DVS_M) >> LP8788_BUCK2_DVS_S;
                 }
-                addr = buck2_vout_addr[idx];
+                addr = LP8788_BUCK2_VOUT0 + idx;
                 break;
         default:
                 goto err;
@@ -429,7 +419,8 @@ static struct regulator_desc lp8788_buck_desc[] = {
         },
 };
 
-static int lp8788_dvs_gpio_request(struct lp8788_buck *buck,
+static int lp8788_dvs_gpio_request(struct platform_device *pdev,
+                                struct lp8788_buck *buck,
                                 enum lp8788_buck_id id)
 {
         struct lp8788_platform_data *pdata = buck->lp->pdata;
@@ -440,7 +431,7 @@ static int lp8788_dvs_gpio_request(struct lp8788_buck *buck,
         switch (id) {
         case BUCK1:
                 gpio = pdata->buck1_dvs->gpio;
-                ret = devm_gpio_request_one(buck->lp->dev, gpio, DVS_LOW,
+                ret = devm_gpio_request_one(&pdev->dev, gpio, DVS_LOW,
                                             b1_name);
                 if (ret)
                         return ret;
@@ -448,9 +439,9 @@ static int lp8788_dvs_gpio_request(struct lp8788_buck *buck,
                 buck->dvs = pdata->buck1_dvs;
                 break;
         case BUCK2:
-                for (i = 0 ; i < LP8788_NUM_BUCK2_DVS ; i++) {
+                for (i = 0; i < LP8788_NUM_BUCK2_DVS; i++) {
                         gpio = pdata->buck2_dvs->gpio[i];
-                        ret = devm_gpio_request_one(buck->lp->dev, gpio,
+                        ret = devm_gpio_request_one(&pdev->dev, gpio,
                                                     DVS_LOW, b2_name[i]);
                         if (ret)
                                 return ret;
@@ -464,7 +455,8 @@ static int lp8788_dvs_gpio_request(struct lp8788_buck *buck,
         return 0;
 }
 
-static int lp8788_init_dvs(struct lp8788_buck *buck, enum lp8788_buck_id id)
+static int lp8788_init_dvs(struct platform_device *pdev,
+                        struct lp8788_buck *buck, enum lp8788_buck_id id)
 {
         struct lp8788_platform_data *pdata = buck->lp->pdata;
         u8 mask[] = { LP8788_BUCK1_DVS_SEL_M, LP8788_BUCK2_DVS_SEL_M };
@@ -472,7 +464,7 @@ static int lp8788_init_dvs(struct lp8788_buck *buck, enum lp8788_buck_id id)
         u8 default_dvs_mode[] = { LP8788_BUCK1_DVS_I2C, LP8788_BUCK2_DVS_I2C };
 
         /* no dvs for buck3, 4 */
-        if (id == BUCK3 || id == BUCK4)
+        if (id > BUCK2)
                 return 0;
 
         /* no dvs platform data, then dvs will be selected by I2C registers */
@@ -483,7 +475,7 @@ static int lp8788_init_dvs(struct lp8788_buck *buck, enum lp8788_buck_id id)
                 (id == BUCK2 && !pdata->buck2_dvs))
                 goto set_default_dvs_mode;
 
-        if (lp8788_dvs_gpio_request(buck, id))
+        if (lp8788_dvs_gpio_request(pdev, buck, id))
                 goto set_default_dvs_mode;
 
         return lp8788_update_bits(buck->lp, LP8788_BUCK_DVS_SEL, mask[id],
@@ -503,17 +495,20 @@ static int lp8788_buck_probe(struct platform_device *pdev)
         struct regulator_dev *rdev;
         int ret;
 
-        buck = devm_kzalloc(lp->dev, sizeof(struct lp8788_buck), GFP_KERNEL);
+        if (id >= LP8788_NUM_BUCKS)
+                return -EINVAL;
+
+        buck = devm_kzalloc(&pdev->dev, sizeof(struct lp8788_buck), GFP_KERNEL);
         if (!buck)
                 return -ENOMEM;
 
         buck->lp = lp;
 
-        ret = lp8788_init_dvs(buck, id);
+        ret = lp8788_init_dvs(pdev, buck, id);
         if (ret)
                 return ret;
 
-        cfg.dev = lp->dev;
+        cfg.dev = pdev->dev.parent;
         cfg.init_data = lp->pdata ? lp->pdata->buck_data[id] : NULL;
         cfg.driver_data = buck;
         cfg.regmap = lp->regmap;
@@ -521,7 +516,7 @@ static int lp8788_buck_probe(struct platform_device *pdev)
         rdev = regulator_register(&lp8788_buck_desc[id], &cfg);
         if (IS_ERR(rdev)) {
                 ret = PTR_ERR(rdev);
-                dev_err(lp->dev, "BUCK%d regulator register err = %d\n",
+                dev_err(&pdev->dev, "BUCK%d regulator register err = %d\n",
                                 id + 1, ret);
                 return ret;
         }
diff --git a/drivers/regulator/lp8788-ldo.c b/drivers/regulator/lp8788-ldo.c
index 3792741708ce..cd5a14ad9263 100644
--- a/drivers/regulator/lp8788-ldo.c
+++ b/drivers/regulator/lp8788-ldo.c
@@ -88,11 +88,6 @@
 #define ENABLE                          GPIOF_OUT_INIT_HIGH
 #define DISABLE                         GPIOF_OUT_INIT_LOW
 
-enum lp8788_enable_mode {
-        REGISTER,
-        EXTPIN,
-};
-
 enum lp8788_ldo_id {
         DLDO1,
         DLDO2,
@@ -189,114 +184,38 @@ static enum lp8788_ldo_id lp8788_aldo_id[] = {
         ALDO10,
 };
 
-/* DLDO 7, 9 and 11, ALDO 1 ~ 5 and 7
-   : can be enabled either by external pin or by i2c register */
-static enum lp8788_enable_mode
-lp8788_get_ldo_enable_mode(struct lp8788_ldo *ldo, enum lp8788_ldo_id id)
-{
-        int ret;
-        u8 val, mask;
-
-        ret = lp8788_read_byte(ldo->lp, LP8788_EN_SEL, &val);
-        if (ret)
-                return ret;
-
-        switch (id) {
-        case DLDO7:
-                mask =  LP8788_EN_SEL_DLDO7_M;
-                break;
-        case DLDO9:
-        case DLDO11:
-                mask =  LP8788_EN_SEL_DLDO911_M;
-                break;
-        case ALDO1:
-                mask =  LP8788_EN_SEL_ALDO1_M;
-                break;
-        case ALDO2 ... ALDO4:
-                mask =  LP8788_EN_SEL_ALDO234_M;
-                break;
-        case ALDO5:
-                mask =  LP8788_EN_SEL_ALDO5_M;
-                break;
-        case ALDO7:
-                mask =  LP8788_EN_SEL_ALDO7_M;
-                break;
-        default:
-                return REGISTER;
-        }
-
-        return val & mask ? EXTPIN : REGISTER;
-}
-
-static int lp8788_ldo_ctrl_by_extern_pin(struct lp8788_ldo *ldo, int pinstate)
-{
-        struct lp8788_ldo_enable_pin *pin = ldo->en_pin;
-
-        if (!pin)
-                return -EINVAL;
-
-        if (gpio_is_valid(pin->gpio))
-                gpio_set_value(pin->gpio, pinstate);
-
-        return 0;
-}
-
-static int lp8788_ldo_is_enabled_by_extern_pin(struct lp8788_ldo *ldo)
-{
-        struct lp8788_ldo_enable_pin *pin = ldo->en_pin;
-
-        if (!pin)
-                return -EINVAL;
-
-        return gpio_get_value(pin->gpio) ? 1 : 0;
-}
-
 static int lp8788_ldo_enable(struct regulator_dev *rdev)
 {
         struct lp8788_ldo *ldo = rdev_get_drvdata(rdev);
-        enum lp8788_ldo_id id = rdev_get_id(rdev);
-        enum lp8788_enable_mode mode = lp8788_get_ldo_enable_mode(ldo, id);
 
-        switch (mode) {
-        case EXTPIN:
-                return lp8788_ldo_ctrl_by_extern_pin(ldo, ENABLE);
-        case REGISTER:
+        if (ldo->en_pin) {
+                gpio_set_value(ldo->en_pin->gpio, ENABLE);
+                return 0;
+        } else {
                 return regulator_enable_regmap(rdev);
-        default:
-                return -EINVAL;
         }
 }
 
 static int lp8788_ldo_disable(struct regulator_dev *rdev)
 {
         struct lp8788_ldo *ldo = rdev_get_drvdata(rdev);
-        enum lp8788_ldo_id id = rdev_get_id(rdev);
-        enum lp8788_enable_mode mode = lp8788_get_ldo_enable_mode(ldo, id);
 
-        switch (mode) {
-        case EXTPIN:
-                return lp8788_ldo_ctrl_by_extern_pin(ldo, DISABLE);
-        case REGISTER:
+        if (ldo->en_pin) {
+                gpio_set_value(ldo->en_pin->gpio, DISABLE);
+                return 0;
+        } else {
                 return regulator_disable_regmap(rdev);
-        default:
-                return -EINVAL;
         }
 }
 
 static int lp8788_ldo_is_enabled(struct regulator_dev *rdev)
 {
         struct lp8788_ldo *ldo = rdev_get_drvdata(rdev);
-        enum lp8788_ldo_id id = rdev_get_id(rdev);
-        enum lp8788_enable_mode mode = lp8788_get_ldo_enable_mode(ldo, id);
 
-        switch (mode) {
-        case EXTPIN:
-                return lp8788_ldo_is_enabled_by_extern_pin(ldo);
-        case REGISTER:
+        if (ldo->en_pin)
+                return gpio_get_value(ldo->en_pin->gpio) ? 1 : 0;
+        else
                 return regulator_is_enabled_regmap(rdev);
-        default:
-                return -EINVAL;
-        }
 }
 
 static int lp8788_ldo_enable_time(struct regulator_dev *rdev)
@@ -616,10 +535,11 @@ static struct regulator_desc lp8788_aldo_desc[] = {
         },
 };
 
-static int lp8788_gpio_request_ldo_en(struct lp8788_ldo *ldo,
+static int lp8788_gpio_request_ldo_en(struct platform_device *pdev,
+                                struct lp8788_ldo *ldo,
                                 enum lp8788_ext_ldo_en_id id)
 {
-        struct device *dev = ldo->lp->dev;
+        struct device *dev = &pdev->dev;
         struct lp8788_ldo_enable_pin *pin = ldo->en_pin;
         int ret, gpio, pinstate;
         char *name[] = {
@@ -647,7 +567,8 @@ static int lp8788_gpio_request_ldo_en(struct lp8788_ldo *ldo,
         return ret;
 }
 
-static int lp8788_config_ldo_enable_mode(struct lp8788_ldo *ldo,
+static int lp8788_config_ldo_enable_mode(struct platform_device *pdev,
+                                        struct lp8788_ldo *ldo,
                                         enum lp8788_ldo_id id)
 {
         int ret;
@@ -693,9 +614,11 @@ static int lp8788_config_ldo_enable_mode(struct lp8788_ldo *ldo,
 
         ldo->en_pin = pdata->ldo_pin[enable_id];
 
-        ret = lp8788_gpio_request_ldo_en(ldo, enable_id);
-        if (ret)
+        ret = lp8788_gpio_request_ldo_en(pdev, ldo, enable_id);
+        if (ret) {
+                ldo->en_pin = NULL;
                 goto set_default_ldo_enable_mode;
+        }
 
         return ret;
 
@@ -712,16 +635,16 @@ static int lp8788_dldo_probe(struct platform_device *pdev)
         struct regulator_dev *rdev;
         int ret;
 
-        ldo = devm_kzalloc(lp->dev, sizeof(struct lp8788_ldo), GFP_KERNEL);
+        ldo = devm_kzalloc(&pdev->dev, sizeof(struct lp8788_ldo), GFP_KERNEL);
         if (!ldo)
                 return -ENOMEM;
 
         ldo->lp = lp;
-        ret = lp8788_config_ldo_enable_mode(ldo, lp8788_dldo_id[id]);
+        ret = lp8788_config_ldo_enable_mode(pdev, ldo, lp8788_dldo_id[id]);
         if (ret)
                 return ret;
 
-        cfg.dev = lp->dev;
+        cfg.dev = pdev->dev.parent;
         cfg.init_data = lp->pdata ? lp->pdata->dldo_data[id] : NULL;
         cfg.driver_data = ldo;
         cfg.regmap = lp->regmap;
@@ -729,7 +652,7 @@ static int lp8788_dldo_probe(struct platform_device *pdev)
         rdev = regulator_register(&lp8788_dldo_desc[id], &cfg);
         if (IS_ERR(rdev)) {
                 ret = PTR_ERR(rdev);
-                dev_err(lp->dev, "DLDO%d regulator register err = %d\n",
+                dev_err(&pdev->dev, "DLDO%d regulator register err = %d\n",
                                 id + 1, ret);
                 return ret;
         }
@@ -768,16 +691,16 @@ static int lp8788_aldo_probe(struct platform_device *pdev)
         struct regulator_dev *rdev;
         int ret;
 
-        ldo = devm_kzalloc(lp->dev, sizeof(struct lp8788_ldo), GFP_KERNEL);
+        ldo = devm_kzalloc(&pdev->dev, sizeof(struct lp8788_ldo), GFP_KERNEL);
         if (!ldo)
                 return -ENOMEM;
 
         ldo->lp = lp;
-        ret = lp8788_config_ldo_enable_mode(ldo, lp8788_aldo_id[id]);
+        ret = lp8788_config_ldo_enable_mode(pdev, ldo, lp8788_aldo_id[id]);
         if (ret)
                 return ret;
 
-        cfg.dev = lp->dev;
+        cfg.dev = pdev->dev.parent;
         cfg.init_data = lp->pdata ? lp->pdata->aldo_data[id] : NULL;
         cfg.driver_data = ldo;
         cfg.regmap = lp->regmap;
@@ -785,7 +708,7 @@ static int lp8788_aldo_probe(struct platform_device *pdev)
         rdev = regulator_register(&lp8788_aldo_desc[id], &cfg);
         if (IS_ERR(rdev)) {
                 ret = PTR_ERR(rdev);
-                dev_err(lp->dev, "ALDO%d regulator register err = %d\n",
+                dev_err(&pdev->dev, "ALDO%d regulator register err = %d\n",
                                 id + 1, ret);
                 return ret;
         }
diff --git a/drivers/regulator/max77686.c b/drivers/regulator/max77686.c
index b85040caaea3..e4586ee8858d 100644
--- a/drivers/regulator/max77686.c
+++ b/drivers/regulator/max77686.c
@@ -75,13 +75,14 @@ static int max77686_buck_set_suspend_disable(struct regulator_dev *rdev)
 {
         unsigned int val;
         struct max77686_data *max77686 = rdev_get_drvdata(rdev);
+        int id = rdev_get_id(rdev);
 
-        if (rdev->desc->id == MAX77686_BUCK1)
+        if (id == MAX77686_BUCK1)
                 val = 0x1;
         else
                 val = 0x1 << MAX77686_OPMODE_BUCK234_SHIFT;
 
-        max77686->opmode[rdev->desc->id] = val;
+        max77686->opmode[id] = val;
         return regmap_update_bits(rdev->regmap, rdev->desc->enable_reg,
                                   rdev->desc->enable_mask,
                                   val);
@@ -93,9 +94,10 @@ static int max77686_set_suspend_mode(struct regulator_dev *rdev,
 {
         struct max77686_data *max77686 = rdev_get_drvdata(rdev);
         unsigned int val;
+        int id = rdev_get_id(rdev);
 
         /* BUCK[5-9] doesn't support this feature */
-        if (rdev->desc->id >= MAX77686_BUCK5)
+        if (id >= MAX77686_BUCK5)
                 return 0;
 
         switch (mode) {
@@ -111,7 +113,7 @@ static int max77686_set_suspend_mode(struct regulator_dev *rdev,
                 return -EINVAL;
         }
 
-        max77686->opmode[rdev->desc->id] = val;
+        max77686->opmode[id] = val;
         return regmap_update_bits(rdev->regmap, rdev->desc->enable_reg,
                                   rdev->desc->enable_mask,
                                   val);
@@ -140,7 +142,7 @@ static int max77686_ldo_set_suspend_mode(struct regulator_dev *rdev,
                 return -EINVAL;
         }
 
-        max77686->opmode[rdev->desc->id] = val;
+        max77686->opmode[rdev_get_id(rdev)] = val;
         return regmap_update_bits(rdev->regmap, rdev->desc->enable_reg,
                                   rdev->desc->enable_mask,
                                   val);
@@ -152,7 +154,7 @@ static int max77686_enable(struct regulator_dev *rdev)
 
         return regmap_update_bits(rdev->regmap, rdev->desc->enable_reg,
                                   rdev->desc->enable_mask,
-                                  max77686->opmode[rdev->desc->id]);
+                                  max77686->opmode[rdev_get_id(rdev)]);
 }
 
 static int max77686_set_ramp_delay(struct regulator_dev *rdev, int ramp_delay)
@@ -379,9 +381,10 @@ static struct regulator_desc regulators[] = {
 };
 
 #ifdef CONFIG_OF
-static int max77686_pmic_dt_parse_pdata(struct max77686_dev *iodev,
+static int max77686_pmic_dt_parse_pdata(struct platform_device *pdev,
                                         struct max77686_platform_data *pdata)
 {
+        struct max77686_dev *iodev = dev_get_drvdata(pdev->dev.parent);
         struct device_node *pmic_np, *regulators_np;
         struct max77686_regulator_data *rdata;
         struct of_regulator_match rmatch;
@@ -390,15 +393,15 @@ static int max77686_pmic_dt_parse_pdata(struct max77686_dev *iodev,
         pmic_np = iodev->dev->of_node;
         regulators_np = of_find_node_by_name(pmic_np, "voltage-regulators");
         if (!regulators_np) {
-                dev_err(iodev->dev, "could not find regulators sub-node\n");
+                dev_err(&pdev->dev, "could not find regulators sub-node\n");
                 return -EINVAL;
         }
 
         pdata->num_regulators = ARRAY_SIZE(regulators);
-        rdata = devm_kzalloc(iodev->dev, sizeof(*rdata) *
+        rdata = devm_kzalloc(&pdev->dev, sizeof(*rdata) *
                              pdata->num_regulators, GFP_KERNEL);
         if (!rdata) {
-                dev_err(iodev->dev,
+                dev_err(&pdev->dev,
                         "could not allocate memory for regulator data\n");
                 return -ENOMEM;
         }
@@ -407,7 +410,7 @@ static int max77686_pmic_dt_parse_pdata(struct max77686_dev *iodev,
                 rmatch.name = regulators[i].name;
                 rmatch.init_data = NULL;
                 rmatch.of_node = NULL;
-                of_regulator_match(iodev->dev, regulators_np, &rmatch, 1);
+                of_regulator_match(&pdev->dev, regulators_np, &rmatch, 1);
                 rdata[i].initdata = rmatch.init_data;
                 rdata[i].of_node = rmatch.of_node;
         }
@@ -417,7 +420,7 @@ static int max77686_pmic_dt_parse_pdata(struct max77686_dev *iodev,
         return 0;
 }
 #else
-static int max77686_pmic_dt_parse_pdata(struct max77686_dev *iodev,
+static int max77686_pmic_dt_parse_pdata(struct platform_device *pdev,
                                         struct max77686_platform_data *pdata)
 {
         return 0;
@@ -440,7 +443,7 @@ static int max77686_pmic_probe(struct platform_device *pdev)
         }
 
         if (iodev->dev->of_node) {
-                ret = max77686_pmic_dt_parse_pdata(iodev, pdata);
+                ret = max77686_pmic_dt_parse_pdata(pdev, pdata);
                 if (ret)
                         return ret;
         }
diff --git a/drivers/regulator/max8907-regulator.c b/drivers/regulator/max8907-regulator.c
index d1a77512d83e..4568c15fa78d 100644
--- a/drivers/regulator/max8907-regulator.c
+++ b/drivers/regulator/max8907-regulator.c
@@ -224,11 +224,11 @@ static struct of_regulator_match max8907_matches[] = {
 
 static int max8907_regulator_parse_dt(struct platform_device *pdev)
 {
-        struct device_node *np = pdev->dev.parent->of_node;
-        struct device_node *regulators;
+        struct device_node *np, *regulators;
         int ret;
 
-        if (!pdev->dev.parent->of_node)
+        np = of_node_get(pdev->dev.parent->of_node);
+        if (!np)
                 return 0;
 
         regulators = of_find_node_by_name(np, "regulators");
@@ -237,9 +237,9 @@ static int max8907_regulator_parse_dt(struct platform_device *pdev)
                 return -EINVAL;
         }
 
-        ret = of_regulator_match(pdev->dev.parent, regulators,
-                                 max8907_matches,
+        ret = of_regulator_match(&pdev->dev, regulators, max8907_matches,
                                  ARRAY_SIZE(max8907_matches));
+        of_node_put(regulators);
         if (ret < 0) {
                 dev_err(&pdev->dev, "Error parsing regulator init data: %d\n",
                         ret);
diff --git a/drivers/regulator/max8925-regulator.c b/drivers/regulator/max8925-regulator.c
index 446a85445553..0d5f64a805a0 100644
--- a/drivers/regulator/max8925-regulator.c
+++ b/drivers/regulator/max8925-regulator.c
@@ -252,7 +252,7 @@ static int max8925_regulator_dt_init(struct platform_device *pdev,
 {
         struct device_node *nproot, *np;
         int rcount;
-        nproot = pdev->dev.parent->of_node;
+        nproot = of_node_get(pdev->dev.parent->of_node);
         if (!nproot)
                 return -ENODEV;
         np = of_find_node_by_name(nproot, "regulators");
@@ -263,6 +263,7 @@ static int max8925_regulator_dt_init(struct platform_device *pdev,
 
         rcount = of_regulator_match(&pdev->dev, np,
                                 &max8925_regulator_matches[ridx], 1);
+        of_node_put(np);
         if (rcount < 0)
                 return -ENODEV;
         config->init_data =     max8925_regulator_matches[ridx].init_data;
diff --git a/drivers/regulator/max8997.c b/drivers/regulator/max8997.c
index df0eafb0dc7e..0ac7a87519b4 100644
--- a/drivers/regulator/max8997.c
+++ b/drivers/regulator/max8997.c
@@ -54,6 +54,13 @@ struct max8997_data {
         u8 saved_states[MAX8997_REG_MAX];
 };
 
+static const unsigned int safeoutvolt[] = {
+        4850000,
+        4900000,
+        4950000,
+        3300000,
+};
+
 static inline void max8997_set_gpio(struct max8997_data *max8997)
 {
         int set3 = (max8997->buck125_gpioindex) & 0x1;
@@ -71,26 +78,26 @@ struct voltage_map_desc {
         int step;
 };
 
-/* Voltage maps in mV */
+/* Voltage maps in uV */
 static const struct voltage_map_desc ldo_voltage_map_desc = {
-        .min = 800,     .max = 3950,    .step = 50,
+        .min = 800000,  .max = 3950000, .step = 50000,
 }; /* LDO1 ~ 18, 21 all */
 
 static const struct voltage_map_desc buck1245_voltage_map_desc = {
-        .min = 650,     .max = 2225,    .step = 25,
+        .min = 650000,  .max = 2225000, .step = 25000,
 }; /* Buck1, 2, 4, 5 */
 
 static const struct voltage_map_desc buck37_voltage_map_desc = {
-        .min = 750,     .max = 3900,    .step = 50,
+        .min = 750000,  .max = 3900000, .step = 50000,
 }; /* Buck3, 7 */
 
-/* current map in mA */
+/* current map in uA */
 static const struct voltage_map_desc charger_current_map_desc = {
-        .min = 200,     .max = 950,     .step = 50,
+        .min = 200000,  .max = 950000,  .step = 50000,
 };
 
 static const struct voltage_map_desc topoff_current_map_desc = {
-        .min = 50,      .max = 200,     .step = 10,
+        .min = 50000,   .max = 200000,  .step = 10000,
 };
 
 static const struct voltage_map_desc *reg_voltage_map[] = {
@@ -130,29 +137,6 @@ static const struct voltage_map_desc *reg_voltage_map[] = {
         [MAX8997_CHARGER_TOPOFF] = &topoff_current_map_desc,
 };
 
-static int max8997_list_voltage_safeout(struct regulator_dev *rdev,
-                unsigned int selector)
-{
-        int rid = rdev_get_id(rdev);
-
-        if (rid == MAX8997_ESAFEOUT1 || rid == MAX8997_ESAFEOUT2) {
-                switch (selector) {
-                case 0:
-                        return 4850000;
-                case 1:
-                        return 4900000;
-                case 2:
-                        return 4950000;
-                case 3:
-                        return 3300000;
-                default:
-                        return -EINVAL;
-                }
-        }
-
-        return -EINVAL;
-}
-
 static int max8997_list_voltage_charger_cv(struct regulator_dev *rdev,
                 unsigned int selector)
 {
@@ -194,7 +178,7 @@ static int max8997_list_voltage(struct regulator_dev *rdev,
         if (val > desc->max)
                 return -EINVAL;
 
-        return val * 1000;
+        return val;
 }
 
 static int max8997_get_enable_register(struct regulator_dev *rdev,
@@ -485,7 +469,6 @@ static int max8997_set_voltage_ldobuck(struct regulator_dev *rdev,
 {
         struct max8997_data *max8997 = rdev_get_drvdata(rdev);
         struct i2c_client *i2c = max8997->iodev->i2c;
-        int min_vol = min_uV / 1000, max_vol = max_uV / 1000;
         const struct voltage_map_desc *desc;
         int rid = rdev_get_id(rdev);
         int i, reg, shift, mask, ret;
@@ -509,7 +492,7 @@ static int max8997_set_voltage_ldobuck(struct regulator_dev *rdev,
 
         desc = reg_voltage_map[rid];
 
-        i = max8997_get_voltage_proper_val(desc, min_vol, max_vol);
+        i = max8997_get_voltage_proper_val(desc, min_uV, max_uV);
         if (i < 0)
                 return i;
 
@@ -523,7 +506,7 @@ static int max8997_set_voltage_ldobuck(struct regulator_dev *rdev,
         return ret;
 }
 
-static int max8997_set_voltage_ldobuck_time_sel(struct regulator_dev *rdev,
+static int max8997_set_voltage_buck_time_sel(struct regulator_dev *rdev,
                                                 unsigned int old_selector,
                                                 unsigned int new_selector)
 {
@@ -557,7 +540,7 @@ static int max8997_set_voltage_ldobuck_time_sel(struct regulator_dev *rdev,
         case MAX8997_BUCK4:
         case MAX8997_BUCK5:
                 return DIV_ROUND_UP(desc->step * (new_selector - old_selector),
-                                    max8997->ramp_delay);
+                                    max8997->ramp_delay * 1000);
         }
 
         return 0;
@@ -656,7 +639,6 @@ static int max8997_set_voltage_buck(struct regulator_dev *rdev,
         const struct voltage_map_desc *desc;
         int new_val, new_idx, damage, tmp_val, tmp_idx, tmp_dmg;
         bool gpio_dvs_mode = false;
-        int min_vol = min_uV / 1000, max_vol = max_uV / 1000;
 
         if (rid < MAX8997_BUCK1 || rid > MAX8997_BUCK7)
                 return -EINVAL;
@@ -681,7 +663,7 @@ static int max8997_set_voltage_buck(struct regulator_dev *rdev,
                                                 selector);
 
         desc = reg_voltage_map[rid];
-        new_val = max8997_get_voltage_proper_val(desc, min_vol, max_vol);
+        new_val = max8997_get_voltage_proper_val(desc, min_uV, max_uV);
         if (new_val < 0)
                 return new_val;
 
@@ -722,49 +704,23 @@ out:
         return 0;
 }
 
-static const int safeoutvolt[] = {
-        3300000,
-        4850000,
-        4900000,
-        4950000,
-};
-
 /* For SAFEOUT1 and SAFEOUT2 */
-static int max8997_set_voltage_safeout(struct regulator_dev *rdev,
-                int min_uV, int max_uV, unsigned *selector)
+static int max8997_set_voltage_safeout_sel(struct regulator_dev *rdev,
+                                           unsigned selector)
 {
         struct max8997_data *max8997 = rdev_get_drvdata(rdev);
         struct i2c_client *i2c = max8997->iodev->i2c;
         int rid = rdev_get_id(rdev);
         int reg, shift = 0, mask, ret;
-        int i = 0;
-        u8 val;
 
         if (rid != MAX8997_ESAFEOUT1 && rid != MAX8997_ESAFEOUT2)
                 return -EINVAL;
 
-        for (i = 0; i < ARRAY_SIZE(safeoutvolt); i++) {
-                if (min_uV <= safeoutvolt[i] &&
-                                max_uV >= safeoutvolt[i])
-                        break;
-        }
-
-        if (i >= ARRAY_SIZE(safeoutvolt))
-                return -EINVAL;
-
-        if (i == 0)
-                val = 0x3;
-        else
-                val = i - 1;
-
         ret = max8997_get_voltage_register(rdev, &reg, &shift, &mask);
         if (ret)
                 return ret;
 
-        ret = max8997_update_reg(i2c, reg, val << shift, mask << shift);
-        *selector = val;
-
-        return ret;
+        return max8997_update_reg(i2c, reg, selector << shift, mask << shift);
 }
 
 static int max8997_reg_disable_suspend(struct regulator_dev *rdev)
@@ -801,7 +757,6 @@ static struct regulator_ops max8997_ldo_ops = {
         .disable                = max8997_reg_disable,
         .get_voltage_sel        = max8997_get_voltage_sel,
         .set_voltage            = max8997_set_voltage_ldobuck,
-        .set_voltage_time_sel   = max8997_set_voltage_ldobuck_time_sel,
         .set_suspend_disable    = max8997_reg_disable_suspend,
 };
 
@@ -812,7 +767,7 @@ static struct regulator_ops max8997_buck_ops = {
         .disable                = max8997_reg_disable,
         .get_voltage_sel        = max8997_get_voltage_sel,
         .set_voltage            = max8997_set_voltage_buck,
-        .set_voltage_time_sel   = max8997_set_voltage_ldobuck_time_sel,
+        .set_voltage_time_sel   = max8997_set_voltage_buck_time_sel,
         .set_suspend_disable    = max8997_reg_disable_suspend,
 };
 
@@ -825,12 +780,12 @@ static struct regulator_ops max8997_fixedvolt_ops = {
 };
 
 static struct regulator_ops max8997_safeout_ops = {
-        .list_voltage           = max8997_list_voltage_safeout,
+        .list_voltage           = regulator_list_voltage_table,
         .is_enabled             = max8997_reg_is_enabled,
         .enable                 = max8997_reg_enable,
         .disable                = max8997_reg_disable,
         .get_voltage_sel        = max8997_get_voltage_sel,
-        .set_voltage            = max8997_set_voltage_safeout,
+        .set_voltage_sel        = max8997_set_voltage_safeout_sel,
         .set_suspend_disable    = max8997_reg_disable_suspend,
 };
 
@@ -936,7 +891,7 @@ static struct regulator_desc regulators[] = {
 };
 
 #ifdef CONFIG_OF
-static int max8997_pmic_dt_parse_dvs_gpio(struct max8997_dev *iodev,
+static int max8997_pmic_dt_parse_dvs_gpio(struct platform_device *pdev,
                         struct max8997_platform_data *pdata,
                         struct device_node *pmic_np)
 {
@@ -946,7 +901,7 @@ static int max8997_pmic_dt_parse_dvs_gpio(struct max8997_dev *iodev,
                 gpio = of_get_named_gpio(pmic_np,
                                         "max8997,pmic-buck125-dvs-gpios", i);
                 if (!gpio_is_valid(gpio)) {
-                        dev_err(iodev->dev, "invalid gpio[%d]: %d\n", i, gpio);
+                        dev_err(&pdev->dev, "invalid gpio[%d]: %d\n", i, gpio);
                         return -EINVAL;
                 }
                 pdata->buck125_gpios[i] = gpio;
@@ -954,35 +909,34 @@ static int max8997_pmic_dt_parse_dvs_gpio(struct max8997_dev *iodev,
         return 0;
 }
 
-static int max8997_pmic_dt_parse_pdata(struct max8997_dev *iodev,
+static int max8997_pmic_dt_parse_pdata(struct platform_device *pdev,
                                         struct max8997_platform_data *pdata)
 {
+        struct max8997_dev *iodev = dev_get_drvdata(pdev->dev.parent);
         struct device_node *pmic_np, *regulators_np, *reg_np;
         struct max8997_regulator_data *rdata;
         unsigned int i, dvs_voltage_nr = 1, ret;
 
-        pmic_np = iodev->dev->of_node;
+        pmic_np = of_node_get(iodev->dev->of_node);
         if (!pmic_np) {
-                dev_err(iodev->dev, "could not find pmic sub-node\n");
+                dev_err(&pdev->dev, "could not find pmic sub-node\n");
                 return -ENODEV;
         }
 
         regulators_np = of_find_node_by_name(pmic_np, "regulators");
         if (!regulators_np) {
-                dev_err(iodev->dev, "could not find regulators sub-node\n");
+                dev_err(&pdev->dev, "could not find regulators sub-node\n");
                 return -EINVAL;
         }
 
         /* count the number of regulators to be supported in pmic */
-        pdata->num_regulators = 0;
-        for_each_child_of_node(regulators_np, reg_np)
-                pdata->num_regulators++;
+        pdata->num_regulators = of_get_child_count(regulators_np);
 
-        rdata = devm_kzalloc(iodev->dev, sizeof(*rdata) *
+        rdata = devm_kzalloc(&pdev->dev, sizeof(*rdata) *
                                 pdata->num_regulators, GFP_KERNEL);
         if (!rdata) {
-                dev_err(iodev->dev, "could not allocate memory for "
-                                                "regulator data\n");
+                of_node_put(regulators_np);
+                dev_err(&pdev->dev, "could not allocate memory for regulator data\n");
                 return -ENOMEM;
         }
 
@@ -993,17 +947,18 @@ static int max8997_pmic_dt_parse_pdata(struct max8997_dev *iodev,
                                 break;
 
                 if (i == ARRAY_SIZE(regulators)) {
-                        dev_warn(iodev->dev, "don't know how to configure "
-                                "regulator %s\n", reg_np->name);
+                        dev_warn(&pdev->dev, "don't know how to configure regulator %s\n",
+                                 reg_np->name);
                         continue;
                 }
 
                 rdata->id = i;
-                rdata->initdata = of_get_regulator_init_data(
-                                                iodev->dev, reg_np);
+                rdata->initdata = of_get_regulator_init_data(&pdev->dev,
+                                                             reg_np);
                 rdata->reg_node = reg_np;
                 rdata++;
         }
+        of_node_put(regulators_np);
 
         if (of_get_property(pmic_np, "max8997,pmic-buck1-uses-gpio-dvs", NULL))
                 pdata->buck1_gpiodvs = true;
@@ -1016,7 +971,7 @@ static int max8997_pmic_dt_parse_pdata(struct max8997_dev *iodev,
 
         if (pdata->buck1_gpiodvs || pdata->buck2_gpiodvs ||
                                                 pdata->buck5_gpiodvs) {
-                ret = max8997_pmic_dt_parse_dvs_gpio(iodev, pdata, pmic_np);
+                ret = max8997_pmic_dt_parse_dvs_gpio(pdev, pdata, pmic_np);
                 if (ret)
                         return -EINVAL;
 
@@ -1027,8 +982,7 @@ static int max8997_pmic_dt_parse_pdata(struct max8997_dev *iodev,
                 } else {
                         if (pdata->buck125_default_idx >= 8) {
                                 pdata->buck125_default_idx = 0;
-                                dev_info(iodev->dev, "invalid value for "
-                                "default dvs index, using 0 instead\n");
+                                dev_info(&pdev->dev, "invalid value for default dvs index, using 0 instead\n");
                         }
                 }
 
@@ -1042,28 +996,28 @@ static int max8997_pmic_dt_parse_pdata(struct max8997_dev *iodev,
         if (of_property_read_u32_array(pmic_np,
                                 "max8997,pmic-buck1-dvs-voltage",
                                 pdata->buck1_voltage, dvs_voltage_nr)) {
-                dev_err(iodev->dev, "buck1 voltages not specified\n");
+                dev_err(&pdev->dev, "buck1 voltages not specified\n");
                 return -EINVAL;
         }
 
         if (of_property_read_u32_array(pmic_np,
                                 "max8997,pmic-buck2-dvs-voltage",
                                 pdata->buck2_voltage, dvs_voltage_nr)) {
-                dev_err(iodev->dev, "buck2 voltages not specified\n");
+                dev_err(&pdev->dev, "buck2 voltages not specified\n");
                 return -EINVAL;
         }
 
         if (of_property_read_u32_array(pmic_np,
                                 "max8997,pmic-buck5-dvs-voltage",
                                 pdata->buck5_voltage, dvs_voltage_nr)) {
-                dev_err(iodev->dev, "buck5 voltages not specified\n");
+                dev_err(&pdev->dev, "buck5 voltages not specified\n");
                 return -EINVAL;
         }
 
         return 0;
 }
 #else
-static int max8997_pmic_dt_parse_pdata(struct max8997_dev *iodev,
+static int max8997_pmic_dt_parse_pdata(struct platform_device *pdev,
                                         struct max8997_platform_data *pdata)
 {
         return 0;
@@ -1087,7 +1041,7 @@ static int max8997_pmic_probe(struct platform_device *pdev)
         }
 
         if (iodev->dev->of_node) {
-                ret = max8997_pmic_dt_parse_pdata(iodev, pdata);
+                ret = max8997_pmic_dt_parse_pdata(pdev, pdata);
                 if (ret)
                         return ret;
         }
@@ -1123,8 +1077,8 @@ static int max8997_pmic_probe(struct platform_device *pdev)
                 max8997->buck1_vol[i] = ret =
                         max8997_get_voltage_proper_val(
                                         &buck1245_voltage_map_desc,
-                                        pdata->buck1_voltage[i] / 1000,
-                                        pdata->buck1_voltage[i] / 1000 +
+                                        pdata->buck1_voltage[i],
+                                        pdata->buck1_voltage[i] +
                                         buck1245_voltage_map_desc.step);
                 if (ret < 0)
                         goto err_out;
@@ -1132,8 +1086,8 @@ static int max8997_pmic_probe(struct platform_device *pdev)
                 max8997->buck2_vol[i] = ret =
                         max8997_get_voltage_proper_val(
                                         &buck1245_voltage_map_desc,
-                                        pdata->buck2_voltage[i] / 1000,
-                                        pdata->buck2_voltage[i] / 1000 +
+                                        pdata->buck2_voltage[i],
+                                        pdata->buck2_voltage[i] +
                                         buck1245_voltage_map_desc.step);
                 if (ret < 0)
                         goto err_out;
@@ -1141,8 +1095,8 @@ static int max8997_pmic_probe(struct platform_device *pdev)
                 max8997->buck5_vol[i] = ret =
                         max8997_get_voltage_proper_val(
                                         &buck1245_voltage_map_desc,
-                                        pdata->buck5_voltage[i] / 1000,
-                                        pdata->buck5_voltage[i] / 1000 +
+                                        pdata->buck5_voltage[i],
+                                        pdata->buck5_voltage[i] +
                                         buck1245_voltage_map_desc.step);
                 if (ret < 0)
                         goto err_out;
@@ -1236,13 +1190,15 @@ static int max8997_pmic_probe(struct platform_device *pdev)
                 int id = pdata->regulators[i].id;
 
                 desc = reg_voltage_map[id];
-                if (desc)
+                if (desc) {
                         regulators[id].n_voltages =
                                 (desc->max - desc->min) / desc->step + 1;
-                else if (id == MAX8997_ESAFEOUT1 || id == MAX8997_ESAFEOUT2)
-                        regulators[id].n_voltages = 4;
-                else if (id == MAX8997_CHARGER_CV)
+                } else if (id == MAX8997_ESAFEOUT1 || id == MAX8997_ESAFEOUT2) {
+                        regulators[id].volt_table = safeoutvolt;
+                        regulators[id].n_voltages = ARRAY_SIZE(safeoutvolt);
+                } else if (id == MAX8997_CHARGER_CV) {
                         regulators[id].n_voltages = 16;
+                }
 
                 config.dev = max8997->dev;
                 config.init_data = pdata->regulators[i].initdata;
diff --git a/drivers/regulator/max8998.c b/drivers/regulator/max8998.c
index b821d08eb64a..b588f07c7cad 100644
--- a/drivers/regulator/max8998.c
+++ b/drivers/regulator/max8998.c
@@ -51,39 +51,39 @@ struct voltage_map_desc {
         int step;
 };
 
-/* Voltage maps */
+/* Voltage maps in uV*/
 static const struct voltage_map_desc ldo23_voltage_map_desc = {
-        .min = 800,     .step = 50,     .max = 1300,
+        .min = 800000,  .step = 50000,  .max = 1300000,
 };
 static const struct voltage_map_desc ldo456711_voltage_map_desc = {
-        .min = 1600,    .step = 100,    .max = 3600,
+        .min = 1600000, .step = 100000, .max = 3600000,
 };
 static const struct voltage_map_desc ldo8_voltage_map_desc = {
-        .min = 3000,    .step = 100,    .max = 3600,
+        .min = 3000000, .step = 100000, .max = 3600000,
 };
 static const struct voltage_map_desc ldo9_voltage_map_desc = {
-        .min = 2800,    .step = 100,    .max = 3100,
+        .min = 2800000, .step = 100000, .max = 3100000,
 };
 static const struct voltage_map_desc ldo10_voltage_map_desc = {
-        .min = 950,     .step = 50,     .max = 1300,
+        .min = 950000,  .step = 50000,  .max = 1300000,
 };
 static const struct voltage_map_desc ldo1213_voltage_map_desc = {
-        .min = 800,     .step = 100,    .max = 3300,
+        .min = 800000,  .step = 100000, .max = 3300000,
 };
 static const struct voltage_map_desc ldo1415_voltage_map_desc = {
-        .min = 1200,    .step = 100,    .max = 3300,
+        .min = 1200000, .step = 100000, .max = 3300000,
 };
 static const struct voltage_map_desc ldo1617_voltage_map_desc = {
-        .min = 1600,    .step = 100,    .max = 3600,
+        .min = 1600000, .step = 100000, .max = 3600000,
 };
 static const struct voltage_map_desc buck12_voltage_map_desc = {
-        .min = 750,     .step = 25,     .max = 1525,
+        .min = 750000,  .step = 25000,  .max = 1525000,
 };
 static const struct voltage_map_desc buck3_voltage_map_desc = {
-        .min = 1600,    .step = 100,    .max = 3600,
+        .min = 1600000, .step = 100000, .max = 3600000,
 };
 static const struct voltage_map_desc buck4_voltage_map_desc = {
-        .min = 800,     .step = 100,    .max = 2300,
+        .min = 800000,  .step = 100000, .max = 2300000,
 };
 
 static const struct voltage_map_desc *ldo_voltage_map[] = {
@@ -311,25 +311,13 @@ static int max8998_set_voltage_buck_sel(struct regulator_dev *rdev,
                 dev_get_platdata(max8998->iodev->dev);
         struct i2c_client *i2c = max8998->iodev->i2c;
         int buck = rdev_get_id(rdev);
-        int reg, shift = 0, mask, ret;
-        int j, previous_sel;
+        int reg, shift = 0, mask, ret, j;
         static u8 buck1_last_val;
 
         ret = max8998_get_voltage_register(rdev, &reg, &shift, &mask);
         if (ret)
                 return ret;
 
-        previous_sel = max8998_get_voltage_sel(rdev);
-
-        /* Check if voltage needs to be changed */
-        /* if previous_voltage equal new voltage, return */
-        if (previous_sel == selector) {
-                dev_dbg(max8998->dev, "No voltage change, old:%d, new:%d\n",
-                        regulator_list_voltage_linear(rdev, previous_sel),
-                        regulator_list_voltage_linear(rdev, selector));
-                return ret;
-        }
-
         switch (buck) {
         case MAX8998_BUCK1:
                 dev_dbg(max8998->dev,
@@ -445,9 +433,9 @@ static int max8998_set_voltage_buck_time_sel(struct regulator_dev *rdev,
         if (max8998->iodev->type == TYPE_MAX8998 && !(val & MAX8998_ENRAMP))
                 return 0;
 
-        difference = (new_selector - old_selector) * desc->step;
+        difference = (new_selector - old_selector) * desc->step / 1000;
         if (difference > 0)
-                return difference / ((val & 0x0f) + 1);
+                return DIV_ROUND_UP(difference, (val & 0x0f) + 1);
 
         return 0;
 }
@@ -702,7 +690,7 @@ static int max8998_pmic_probe(struct platform_device *pdev)
                 i = 0;
                 while (buck12_voltage_map_desc.min +
                        buck12_voltage_map_desc.step*i
-                       < (pdata->buck1_voltage1 / 1000))
+                       < pdata->buck1_voltage1)
                         i++;
                 max8998->buck1_vol[0] = i;
                 ret = max8998_write_reg(i2c, MAX8998_REG_BUCK1_VOLTAGE1, i);
@@ -713,7 +701,7 @@ static int max8998_pmic_probe(struct platform_device *pdev)
                 i = 0;
                 while (buck12_voltage_map_desc.min +
                        buck12_voltage_map_desc.step*i
-                       < (pdata->buck1_voltage2 / 1000))
+                       < pdata->buck1_voltage2)
                         i++;
 
                 max8998->buck1_vol[1] = i;
@@ -725,7 +713,7 @@ static int max8998_pmic_probe(struct platform_device *pdev)
                 i = 0;
                 while (buck12_voltage_map_desc.min +
                        buck12_voltage_map_desc.step*i
-                       < (pdata->buck1_voltage3 / 1000))
+                       < pdata->buck1_voltage3)
                         i++;
 
                 max8998->buck1_vol[2] = i;
@@ -737,7 +725,7 @@ static int max8998_pmic_probe(struct platform_device *pdev)
                 i = 0;
                 while (buck12_voltage_map_desc.min +
                        buck12_voltage_map_desc.step*i
-                       < (pdata->buck1_voltage4 / 1000))
+                       < pdata->buck1_voltage4)
                         i++;
 
                 max8998->buck1_vol[3] = i;
@@ -763,7 +751,7 @@ static int max8998_pmic_probe(struct platform_device *pdev)
                 i = 0;
                 while (buck12_voltage_map_desc.min +
                        buck12_voltage_map_desc.step*i
-                       < (pdata->buck2_voltage1 / 1000))
+                       < pdata->buck2_voltage1)
                         i++;
                 max8998->buck2_vol[0] = i;
                 ret = max8998_write_reg(i2c, MAX8998_REG_BUCK2_VOLTAGE1, i);
@@ -774,7 +762,7 @@ static int max8998_pmic_probe(struct platform_device *pdev)
                 i = 0;
                 while (buck12_voltage_map_desc.min +
                        buck12_voltage_map_desc.step*i
-                       < (pdata->buck2_voltage2 / 1000))
+                       < pdata->buck2_voltage2)
                         i++;
                 max8998->buck2_vol[1] = i;
                 ret = max8998_write_reg(i2c, MAX8998_REG_BUCK2_VOLTAGE2, i);
@@ -792,8 +780,8 @@ static int max8998_pmic_probe(struct platform_device *pdev)
                         int count = (desc->max - desc->min) / desc->step + 1;
 
                         regulators[index].n_voltages = count;
-                        regulators[index].min_uV = desc->min * 1000;
-                        regulators[index].uV_step = desc->step * 1000;
+                        regulators[index].min_uV = desc->min;
+                        regulators[index].uV_step = desc->step;
                 }
 
                 config.dev = max8998->dev;
diff --git a/drivers/regulator/mc13892-regulator.c b/drivers/regulator/mc13892-regulator.c
index 0d84b1f33199..9891aec47b57 100644
--- a/drivers/regulator/mc13892-regulator.c
+++ b/drivers/regulator/mc13892-regulator.c
@@ -164,6 +164,14 @@ static const unsigned int mc13892_sw1[] = {
         1350000, 1375000
 };
 
+/*
+ * Note: this table is used to derive SWxVSEL by index into
+ * the array. Offset the values by the index of 1100000uV
+ * to get the actual register value for that voltage selector
+ * if the HI bit is to be set as well.
+ */
+#define MC13892_SWxHI_SEL_OFFSET                20
+
 static const unsigned int mc13892_sw[] = {
         600000,   625000,  650000,  675000,  700000,  725000,
         750000,   775000,  800000,  825000,  850000,  875000,
@@ -239,7 +247,6 @@ static const unsigned int mc13892_pwgtdrv[] = {
 };
 
 static struct regulator_ops mc13892_gpo_regulator_ops;
-/* sw regulators need special care due to the "hi bit" */
 static struct regulator_ops mc13892_sw_regulator_ops;
 
 
@@ -396,7 +403,7 @@ static int mc13892_sw_regulator_get_voltage_sel(struct regulator_dev *rdev)
 {
         struct mc13xxx_regulator_priv *priv = rdev_get_drvdata(rdev);
         int ret, id = rdev_get_id(rdev);
-        unsigned int val;
+        unsigned int val, selector;
 
         dev_dbg(rdev_get_dev(rdev), "%s id: %d\n", __func__, id);
 
@@ -407,12 +414,28 @@ static int mc13892_sw_regulator_get_voltage_sel(struct regulator_dev *rdev)
         if (ret)
                 return ret;
 
-        val = (val & mc13892_regulators[id].vsel_mask)
-                >> mc13892_regulators[id].vsel_shift;
+        /*
+         * Figure out if the HI bit is set inside the switcher mode register
+         * since this means the selector value we return is at a different
+         * offset into the selector table.
+         *
+         * According to the MC13892 documentation note 59 (Table 47) the SW1
+         * buck switcher does not support output range programming therefore
+         * the HI bit must always remain 0. So do not do anything strange if
+         * our register is MC13892_SWITCHERS0.
+         */
+
+        selector = val & mc13892_regulators[id].vsel_mask;
+
+        if ((mc13892_regulators[id].vsel_reg != MC13892_SWITCHERS0) &&
+            (val & MC13892_SWITCHERS0_SWxHI)) {
+                selector += MC13892_SWxHI_SEL_OFFSET;
+        }
 
-        dev_dbg(rdev_get_dev(rdev), "%s id: %d val: %d\n", __func__, id, val);
+        dev_dbg(rdev_get_dev(rdev), "%s id: %d val: 0x%08x selector: %d\n",
+                        __func__, id, val, selector);
 
-        return val;
+        return selector;
 }
 
 static int mc13892_sw_regulator_set_voltage_sel(struct regulator_dev *rdev,
@@ -425,18 +448,35 @@ static int mc13892_sw_regulator_set_voltage_sel(struct regulator_dev *rdev,
 
         volt = rdev->desc->volt_table[selector];
         mask = mc13892_regulators[id].vsel_mask;
-        reg_value = selector << mc13892_regulators[id].vsel_shift;
-
-        if (volt > 1375000) {
-                mask |= MC13892_SWITCHERS0_SWxHI;
-                reg_value |= MC13892_SWITCHERS0_SWxHI;
-        } else if (volt < 1100000) {
-                mask |= MC13892_SWITCHERS0_SWxHI;
-                reg_value &= ~MC13892_SWITCHERS0_SWxHI;
+        reg_value = selector;
+
+        /*
+         * Don't mess with the HI bit or support HI voltage offsets for SW1.
+         *
+         * Since the get_voltage_sel callback has given a fudged value for
+         * the selector offset, we need to back out that offset if HI is
+         * to be set so we write the correct value to the register.
+         *
+         * The HI bit addition and selector offset handling COULD be more
+         * complicated by shifting and masking off the voltage selector part
+         * of the register then logical OR it back in, but since the selector
+         * is at bits 4:0 there is very little point. This makes the whole
+         * thing more readable and we do far less work.
+         */
+
+        if (mc13892_regulators[id].vsel_reg != MC13892_SWITCHERS0) {
+                if (volt > 1375000) {
+                        reg_value -= MC13892_SWxHI_SEL_OFFSET;
+                        reg_value |= MC13892_SWITCHERS0_SWxHI;
+                        mask |= MC13892_SWITCHERS0_SWxHI;
+                } else if (volt < 1100000) {
+                        reg_value &= ~MC13892_SWITCHERS0_SWxHI;
+                        mask |= MC13892_SWITCHERS0_SWxHI;
+                }
         }
 
         mc13xxx_lock(priv->mc13xxx);
-        ret = mc13xxx_reg_rmw(priv->mc13xxx, mc13892_regulators[id].reg, mask,
+        ret = mc13xxx_reg_rmw(priv->mc13xxx, mc13892_regulators[id].vsel_reg, mask,
                               reg_value);
         mc13xxx_unlock(priv->mc13xxx);
 
@@ -495,15 +535,18 @@ static int mc13892_regulator_probe(struct platform_device *pdev)
         struct mc13xxx_regulator_init_data *mc13xxx_data;
         struct regulator_config config = { };
         int i, ret;
-        int num_regulators = 0;
+        int num_regulators = 0, num_parsed;
         u32 val;
 
         num_regulators = mc13xxx_get_num_regulators_dt(pdev);
+
         if (num_regulators <= 0 && pdata)
                 num_regulators = pdata->num_regulators;
         if (num_regulators <= 0)
                 return -EINVAL;
 
+        num_parsed = num_regulators;
+
         priv = devm_kzalloc(&pdev->dev, sizeof(*priv) +
                 num_regulators * sizeof(priv->regulators[0]),
                 GFP_KERNEL);
@@ -520,7 +563,7 @@ static int mc13892_regulator_probe(struct platform_device *pdev)
         if (ret)
                 goto err_unlock;
 
-        /* enable switch auto mode */
+        /* enable switch auto mode (on 2.0A silicon only) */
         if ((val & 0x0000FFFF) == 0x45d0) {
                 ret = mc13xxx_reg_rmw(mc13892, MC13892_SWITCHERS4,
                         MC13892_SWITCHERS4_SW1MODE_M |
@@ -546,7 +589,39 @@ static int mc13892_regulator_probe(struct platform_device *pdev)
                 = mc13892_vcam_get_mode;
 
         mc13xxx_data = mc13xxx_parse_regulators_dt(pdev, mc13892_regulators,
-                                        ARRAY_SIZE(mc13892_regulators));
+                                        ARRAY_SIZE(mc13892_regulators),
+                                        &num_parsed);
+
+        /*
+         * Perform a little sanity check on the regulator tree - if we found
+         * a number of regulators from mc13xxx_get_num_regulators_dt and
+         * then parsed a smaller number in mc13xxx_parse_regulators_dt then
+         * there is a regulator defined in the regulators node which has
+         * not matched any usable regulator in the driver. In this case,
+         * there is one missing and what will happen is the first regulator
+         * will get registered again.
+         *
+         * Fix this by basically making our number of registerable regulators
+         * equal to the number of regulators we parsed. We are allocating
+         * too much memory for priv, but this is unavoidable at this point.
+         *
+         * As an example of how this can happen, try making a typo in your
+         * regulators node (vviohi {} instead of viohi {}) so that the name
+         * does not match..
+         *
+         * The check will basically pass for platform data (non-DT) because
+         * mc13xxx_parse_regulators_dt for !CONFIG_OF will not touch num_parsed.
+         *
+         */
+        if (num_parsed != num_regulators) {
+                dev_warn(&pdev->dev,
+                "parsed %d != regulators %d - check your device tree!\n",
+                        num_parsed, num_regulators);
+
+                num_regulators = num_parsed;
+                priv->num_regulators = num_regulators;
+        }
+
         for (i = 0; i < num_regulators; i++) {
                 struct regulator_init_data *init_data;
                 struct regulator_desc *desc;
diff --git a/drivers/regulator/mc13xxx-regulator-core.c b/drivers/regulator/mc13xxx-regulator-core.c
index 4ed89c654110..23cf9f9c383b 100644
--- a/drivers/regulator/mc13xxx-regulator-core.c
+++ b/drivers/regulator/mc13xxx-regulator-core.c
@@ -164,29 +164,30 @@ EXPORT_SYMBOL_GPL(mc13xxx_fixed_regulator_ops);
 #ifdef CONFIG_OF
 int mc13xxx_get_num_regulators_dt(struct platform_device *pdev)
 {
-        struct device_node *parent, *child;
-        int num = 0;
+        struct device_node *parent;
+        int num;
 
         of_node_get(pdev->dev.parent->of_node);
         parent = of_find_node_by_name(pdev->dev.parent->of_node, "regulators");
         if (!parent)
                 return -ENODEV;
 
-        for_each_child_of_node(parent, child)
-                num++;
-
+        num = of_get_child_count(parent);
+        of_node_put(parent);
         return num;
 }
 EXPORT_SYMBOL_GPL(mc13xxx_get_num_regulators_dt);
 
 struct mc13xxx_regulator_init_data *mc13xxx_parse_regulators_dt(
         struct platform_device *pdev, struct mc13xxx_regulator *regulators,
-        int num_regulators)
+        int num_regulators, int *num_parsed)
 {
         struct mc13xxx_regulator_priv *priv = platform_get_drvdata(pdev);
         struct mc13xxx_regulator_init_data *data, *p;
         struct device_node *parent, *child;
-        int i;
+        int i, parsed = 0;
+
+        *num_parsed = 0;
 
         of_node_get(pdev->dev.parent->of_node);
         parent = of_find_node_by_name(pdev->dev.parent->of_node, "regulators");
@@ -195,24 +196,32 @@ struct mc13xxx_regulator_init_data *mc13xxx_parse_regulators_dt(
 
         data = devm_kzalloc(&pdev->dev, sizeof(*data) * priv->num_regulators,
                             GFP_KERNEL);
-        if (!data)
+        if (!data) {
+                of_node_put(parent);
                 return NULL;
+        }
+
         p = data;
 
         for_each_child_of_node(parent, child) {
                 for (i = 0; i < num_regulators; i++) {
                         if (!of_node_cmp(child->name,
                                          regulators[i].desc.name)) {
+
                                 p->id = i;
                                 p->init_data = of_get_regulator_init_data(
                                                         &pdev->dev, child);
                                 p->node = child;
                                 p++;
+
+                                parsed++;
                                 break;
                         }
                 }
         }
+        of_node_put(parent);
 
+        *num_parsed = parsed;
         return data;
 }
 EXPORT_SYMBOL_GPL(mc13xxx_parse_regulators_dt);
diff --git a/drivers/regulator/mc13xxx.h b/drivers/regulator/mc13xxx.h
index 06c8903f182a..007f83387fd6 100644
--- a/drivers/regulator/mc13xxx.h
+++ b/drivers/regulator/mc13xxx.h
@@ -39,7 +39,7 @@ extern int mc13xxx_fixed_regulator_set_voltage(struct regulator_dev *rdev,
 extern int mc13xxx_get_num_regulators_dt(struct platform_device *pdev);
 extern struct mc13xxx_regulator_init_data *mc13xxx_parse_regulators_dt(
         struct platform_device *pdev, struct mc13xxx_regulator *regulators,
-        int num_regulators);
+        int num_regulators, int *num_parsed);
 #else
 static inline int mc13xxx_get_num_regulators_dt(struct platform_device *pdev)
 {
@@ -48,7 +48,7 @@ static inline int mc13xxx_get_num_regulators_dt(struct platform_device *pdev)
 
 static inline struct mc13xxx_regulator_init_data *mc13xxx_parse_regulators_dt(
         struct platform_device *pdev, struct mc13xxx_regulator *regulators,
-        int num_regulators)
+        int num_regulators, int *num_parsed)
 {
         return NULL;
 }
diff --git a/drivers/regulator/of_regulator.c b/drivers/regulator/of_regulator.c
index 6f684916fd79..66ca769287ab 100644
--- a/drivers/regulator/of_regulator.c
+++ b/drivers/regulator/of_regulator.c
@@ -120,6 +120,12 @@ int of_regulator_match(struct device *dev, struct device_node *node,
         if (!dev || !node)
                 return -EINVAL;
 
+        for (i = 0; i < num_matches; i++) {
+                struct of_regulator_match *match = &matches[i];
+                match->init_data = NULL;
+                match->of_node = NULL;
+        }
+
         for_each_child_of_node(node, child) {
                 name = of_get_property(child,
                                         "regulator-compatible", NULL);
diff --git a/drivers/regulator/palmas-regulator.c b/drivers/regulator/palmas-regulator.c
index c9e912f583bc..cde13bb5a8fb 100644
--- a/drivers/regulator/palmas-regulator.c
+++ b/drivers/regulator/palmas-regulator.c
@@ -527,6 +527,7 @@ static void palmas_dt_to_pdata(struct device *dev,
         u32 prop;
         int idx, ret;
 
+        node = of_node_get(node);
         regulators = of_find_node_by_name(node, "regulators");
         if (!regulators) {
                 dev_info(dev, "regulator node not found\n");
@@ -535,6 +536,7 @@ static void palmas_dt_to_pdata(struct device *dev,
 
         ret = of_regulator_match(dev, regulators, palmas_matches,
                         PALMAS_NUM_REGS);
+        of_node_put(regulators);
         if (ret < 0) {
                 dev_err(dev, "Error parsing regulator init data: %d\n", ret);
                 return;
@@ -566,11 +568,6 @@ static void palmas_dt_to_pdata(struct device *dev,
                         pdata->reg_init[idx]->mode_sleep = prop;
 
                 ret = of_property_read_u32(palmas_matches[idx].of_node,
-                                "ti,warm_reset", &prop);
-                if (!ret)
-                        pdata->reg_init[idx]->warm_reset = prop;
-
-                ret = of_property_read_u32(palmas_matches[idx].of_node,
                                 "ti,tstep", &prop);
                 if (!ret)
                         pdata->reg_init[idx]->tstep = prop;
diff --git a/drivers/regulator/s2mps11.c b/drivers/regulator/s2mps11.c
index bd062a2ffbe2..cd9ea2ea1826 100644
--- a/drivers/regulator/s2mps11.c
+++ b/drivers/regulator/s2mps11.c
@@ -174,9 +174,9 @@ static struct regulator_ops s2mps11_buck_ops = {
         .min_uV         = S2MPS11_BUCK_MIN2,                    \
         .uV_step        = S2MPS11_BUCK_STEP2,                   \
         .n_voltages     = S2MPS11_BUCK_N_VOLTAGES,              \
-        .vsel_reg       = S2MPS11_REG_B9CTRL2,                  \
+        .vsel_reg       = S2MPS11_REG_B10CTRL2,                 \
         .vsel_mask      = S2MPS11_BUCK_VSEL_MASK,               \
-        .enable_reg     = S2MPS11_REG_B9CTRL1,                  \
+        .enable_reg     = S2MPS11_REG_B10CTRL1,                 \
         .enable_mask    = S2MPS11_ENABLE_MASK                   \
 }
 
diff --git a/drivers/regulator/s5m8767.c b/drivers/regulator/s5m8767.c
index 9f991f2c525a..8a831947c351 100644
--- a/drivers/regulator/s5m8767.c
+++ b/drivers/regulator/s5m8767.c
@@ -14,6 +14,7 @@
 #include <linux/bug.h>
 #include <linux/err.h>
 #include <linux/gpio.h>
+#include <linux/of_gpio.h>
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/platform_device.h>
@@ -21,6 +22,9 @@
 #include <linux/regulator/machine.h>
 #include <linux/mfd/samsung/core.h>
 #include <linux/mfd/samsung/s5m8767.h>
+#include <linux/regulator/of_regulator.h>
+
+#define S5M8767_OPMODE_NORMAL_MODE 0x1
 
 struct s5m8767_info {
         struct device *dev;
@@ -214,7 +218,7 @@ static int s5m8767_reg_is_enabled(struct regulator_dev *rdev)
         struct s5m8767_info *s5m8767 = rdev_get_drvdata(rdev);
         int ret, reg;
         int mask = 0xc0, enable_ctrl;
-        u8 val;
+        unsigned int val;
 
         ret = s5m8767_get_register(rdev, &reg, &enable_ctrl);
         if (ret == -EINVAL)
@@ -255,10 +259,8 @@ static int s5m8767_reg_disable(struct regulator_dev *rdev)
         return sec_reg_update(s5m8767->iodev, reg, ~mask, mask);
 }
 
-static int s5m8767_get_voltage_register(struct regulator_dev *rdev, int *_reg)
+static int s5m8767_get_vsel_reg(int reg_id, struct s5m8767_info *s5m8767)
 {
-        struct s5m8767_info *s5m8767 = rdev_get_drvdata(rdev);
-        int reg_id = rdev_get_id(rdev);
         int reg;
 
         switch (reg_id) {
@@ -296,43 +298,18 @@ static int s5m8767_get_voltage_register(struct regulator_dev *rdev, int *_reg)
                 return -EINVAL;
         }
 
-        *_reg = reg;
-
-        return 0;
+        return reg;
 }
 
-static int s5m8767_get_voltage_sel(struct regulator_dev *rdev)
-{
-        struct s5m8767_info *s5m8767 = rdev_get_drvdata(rdev);
-        int reg, mask, ret;
-        int reg_id = rdev_get_id(rdev);
-        u8 val;
-
-        ret = s5m8767_get_voltage_register(rdev, &reg);
-        if (ret)
-                return ret;
-
-        mask = (reg_id < S5M8767_BUCK1) ? 0x3f : 0xff;
-
-        ret = sec_reg_read(s5m8767->iodev, reg, &val);
-        if (ret)
-                return ret;
-
-        val &= mask;
-
-        return val;
-}
-
-static int s5m8767_convert_voltage_to_sel(
-                const struct sec_voltage_desc *desc,
-                int min_vol, int max_vol)
+static int s5m8767_convert_voltage_to_sel(const struct sec_voltage_desc *desc,
+                                          int min_vol)
 {
         int selector = 0;
 
         if (desc == NULL)
                 return -EINVAL;
 
-        if (max_vol < desc->min || min_vol > desc->max)
+        if (min_vol > desc->max)
                 return -EINVAL;
 
         if (min_vol < desc->min)
@@ -340,7 +317,7 @@ static int s5m8767_convert_voltage_to_sel(
 
         selector = DIV_ROUND_UP(min_vol - desc->min, desc->step);
 
-        if (desc->min + desc->step * selector > max_vol)
+        if (desc->min + desc->step * selector > desc->max)
                 return -EINVAL;
 
         return selector;
@@ -373,15 +350,13 @@ static int s5m8767_set_voltage_sel(struct regulator_dev *rdev,
 {
         struct s5m8767_info *s5m8767 = rdev_get_drvdata(rdev);
         int reg_id = rdev_get_id(rdev);
-        int reg, mask, ret = 0, old_index, index = 0;
+        int old_index, index = 0;
         u8 *buck234_vol = NULL;
 
         switch (reg_id) {
         case S5M8767_LDO1 ... S5M8767_LDO28:
-                mask = 0x3f;
                 break;
         case S5M8767_BUCK1 ... S5M8767_BUCK6:
-                mask = 0xff;
                 if (reg_id == S5M8767_BUCK2 && s5m8767->buck2_gpiodvs)
                         buck234_vol = &s5m8767->buck2_vol[0];
                 else if (reg_id == S5M8767_BUCK3 && s5m8767->buck3_gpiodvs)
@@ -392,7 +367,6 @@ static int s5m8767_set_voltage_sel(struct regulator_dev *rdev,
         case S5M8767_BUCK7 ... S5M8767_BUCK8:
                 return -EINVAL;
         case S5M8767_BUCK9:
-                mask = 0xff;
                 break;
         default:
                 return -EINVAL;
@@ -412,11 +386,7 @@ static int s5m8767_set_voltage_sel(struct regulator_dev *rdev,
                 else
                         return s5m8767_set_low(s5m8767);
         } else {
-                ret = s5m8767_get_voltage_register(rdev, &reg);
-                if (ret)
-                        return ret;
-
-                return sec_reg_update(s5m8767->iodev, reg, selector, mask);
+                return regulator_set_voltage_sel_regmap(rdev, selector);
         }
 }
 
@@ -441,7 +411,7 @@ static struct regulator_ops s5m8767_ops = {
         .is_enabled             = s5m8767_reg_is_enabled,
         .enable                 = s5m8767_reg_enable,
         .disable                = s5m8767_reg_disable,
-        .get_voltage_sel        = s5m8767_get_voltage_sel,
+        .get_voltage_sel        = regulator_get_voltage_sel_regmap,
         .set_voltage_sel        = s5m8767_set_voltage_sel,
         .set_voltage_time_sel   = s5m8767_set_voltage_time_sel,
 };
@@ -508,10 +478,182 @@ static struct regulator_desc regulators[] = {
         s5m8767_regulator_desc(BUCK9),
 };
 
+#ifdef CONFIG_OF
+static int s5m8767_pmic_dt_parse_dvs_gpio(struct sec_pmic_dev *iodev,
+                        struct sec_platform_data *pdata,
+                        struct device_node *pmic_np)
+{
+        int i, gpio;
+
+        for (i = 0; i < 3; i++) {
+                gpio = of_get_named_gpio(pmic_np,
+                                        "s5m8767,pmic-buck-dvs-gpios", i);
+                if (!gpio_is_valid(gpio)) {
+                        dev_err(iodev->dev, "invalid gpio[%d]: %d\n", i, gpio);
+                        return -EINVAL;
+                }
+                pdata->buck_gpios[i] = gpio;
+        }
+        return 0;
+}
+
+static int s5m8767_pmic_dt_parse_ds_gpio(struct sec_pmic_dev *iodev,
+                        struct sec_platform_data *pdata,
+                        struct device_node *pmic_np)
+{
+        int i, gpio;
+
+        for (i = 0; i < 3; i++) {
+                gpio = of_get_named_gpio(pmic_np,
+                                        "s5m8767,pmic-buck-ds-gpios", i);
+                if (!gpio_is_valid(gpio)) {
+                        dev_err(iodev->dev, "invalid gpio[%d]: %d\n", i, gpio);
+                        return -EINVAL;
+                }
+                pdata->buck_ds[i] = gpio;
+        }
+        return 0;
+}
+
+static int s5m8767_pmic_dt_parse_pdata(struct platform_device *pdev,
+                                        struct sec_platform_data *pdata)
+{
+        struct sec_pmic_dev *iodev = dev_get_drvdata(pdev->dev.parent);
+        struct device_node *pmic_np, *regulators_np, *reg_np;
+        struct sec_regulator_data *rdata;
+        struct sec_opmode_data *rmode;
+        unsigned int i, dvs_voltage_nr = 1, ret;
+
+        pmic_np = iodev->dev->of_node;
+        if (!pmic_np) {
+                dev_err(iodev->dev, "could not find pmic sub-node\n");
+                return -ENODEV;
+        }
+
+        regulators_np = of_find_node_by_name(pmic_np, "regulators");
+        if (!regulators_np) {
+                dev_err(iodev->dev, "could not find regulators sub-node\n");
+                return -EINVAL;
+        }
+
+        /* count the number of regulators to be supported in pmic */
+        pdata->num_regulators = of_get_child_count(regulators_np);
+
+        rdata = devm_kzalloc(&pdev->dev, sizeof(*rdata) *
+                                pdata->num_regulators, GFP_KERNEL);
+        if (!rdata) {
+                dev_err(iodev->dev,
+                        "could not allocate memory for regulator data\n");
+                return -ENOMEM;
+        }
+
+        rmode = devm_kzalloc(&pdev->dev, sizeof(*rmode) *
+                                pdata->num_regulators, GFP_KERNEL);
+        if (!rdata) {
+                dev_err(iodev->dev,
+                        "could not allocate memory for regulator mode\n");
+                return -ENOMEM;
+        }
+
+        pdata->regulators = rdata;
+        pdata->opmode = rmode;
+        for_each_child_of_node(regulators_np, reg_np) {
+                for (i = 0; i < ARRAY_SIZE(regulators); i++)
+                        if (!of_node_cmp(reg_np->name, regulators[i].name))
+                                break;
+
+                if (i == ARRAY_SIZE(regulators)) {
+                        dev_warn(iodev->dev,
+                        "don't know how to configure regulator %s\n",
+                        reg_np->name);
+                        continue;
+                }
+
+                rdata->id = i;
+                rdata->initdata = of_get_regulator_init_data(
+                                                &pdev->dev, reg_np);
+                rdata->reg_node = reg_np;
+                rdata++;
+                rmode->id = i;
+                if (of_property_read_u32(reg_np, "op_mode",
+                                &rmode->mode)) {
+                        dev_warn(iodev->dev,
+                                "no op_mode property property at %s\n",
+                                reg_np->full_name);
+
+                        rmode->mode = S5M8767_OPMODE_NORMAL_MODE;
+                }
+                rmode++;
+        }
+
+        if (of_get_property(pmic_np, "s5m8767,pmic-buck2-uses-gpio-dvs", NULL))
+                pdata->buck2_gpiodvs = true;
+
+        if (of_get_property(pmic_np, "s5m8767,pmic-buck3-uses-gpio-dvs", NULL))
+                pdata->buck3_gpiodvs = true;
+
+        if (of_get_property(pmic_np, "s5m8767,pmic-buck4-uses-gpio-dvs", NULL))
+                pdata->buck4_gpiodvs = true;
+
+        if (pdata->buck2_gpiodvs || pdata->buck3_gpiodvs ||
+                                                pdata->buck4_gpiodvs) {
+                ret = s5m8767_pmic_dt_parse_dvs_gpio(iodev, pdata, pmic_np);
+                if (ret)
+                        return -EINVAL;
+
+                if (of_property_read_u32(pmic_np,
+                                "s5m8767,pmic-buck-default-dvs-idx",
+                                &pdata->buck_default_idx)) {
+                        pdata->buck_default_idx = 0;
+                } else {
+                        if (pdata->buck_default_idx >= 8) {
+                                pdata->buck_default_idx = 0;
+                                dev_info(iodev->dev,
+                                "invalid value for default dvs index, use 0\n");
+                        }
+                }
+                dvs_voltage_nr = 8;
+        }
+
+        ret = s5m8767_pmic_dt_parse_ds_gpio(iodev, pdata, pmic_np);
+        if (ret)
+                return -EINVAL;
+
+        if (of_property_read_u32_array(pmic_np,
+                                "s5m8767,pmic-buck2-dvs-voltage",
+                                pdata->buck2_voltage, dvs_voltage_nr)) {
+                dev_err(iodev->dev, "buck2 voltages not specified\n");
+                return -EINVAL;
+        }
+
+        if (of_property_read_u32_array(pmic_np,
+                                "s5m8767,pmic-buck3-dvs-voltage",
+                                pdata->buck3_voltage, dvs_voltage_nr)) {
+                dev_err(iodev->dev, "buck3 voltages not specified\n");
+                return -EINVAL;
+        }
+
+        if (of_property_read_u32_array(pmic_np,
+                                "s5m8767,pmic-buck4-dvs-voltage",
+                                pdata->buck4_voltage, dvs_voltage_nr)) {
+                dev_err(iodev->dev, "buck4 voltages not specified\n");
+                return -EINVAL;
+        }
+
+        return 0;
+}
+#else
+static int s5m8767_pmic_dt_parse_pdata(struct platform_device *pdev,
+                                        struct sec_platform_data *pdata)
+{
+        return 0;
+}
+#endif /* CONFIG_OF */
+
 static int s5m8767_pmic_probe(struct platform_device *pdev)
 {
         struct sec_pmic_dev *iodev = dev_get_drvdata(pdev->dev.parent);
-        struct sec_platform_data *pdata = dev_get_platdata(iodev->dev);
+        struct sec_platform_data *pdata = iodev->pdata;
         struct regulator_config config = { };
         struct regulator_dev **rdev;
         struct s5m8767_info *s5m8767;
@@ -522,6 +664,12 @@ static int s5m8767_pmic_probe(struct platform_device *pdev)
                 return -ENODEV;
         }
 
+        if (iodev->dev->of_node) {
+                ret = s5m8767_pmic_dt_parse_pdata(pdev, pdata);
+                if (ret)
+                        return ret;
+        }
+
         if (pdata->buck2_gpiodvs) {
                 if (pdata->buck3_gpiodvs || pdata->buck4_gpiodvs) {
                         dev_err(&pdev->dev, "S5M8767 GPIO DVS NOT VALID\n");
@@ -577,23 +725,17 @@ static int s5m8767_pmic_probe(struct platform_device *pdev)
         s5m8767->opmode = pdata->opmode;
 
         buck_init = s5m8767_convert_voltage_to_sel(&buck_voltage_val2,
-                                                pdata->buck2_init,
-                                                pdata->buck2_init +
-                                                buck_voltage_val2.step);
+                                                   pdata->buck2_init);
 
         sec_reg_write(s5m8767->iodev, S5M8767_REG_BUCK2DVS2, buck_init);
 
         buck_init = s5m8767_convert_voltage_to_sel(&buck_voltage_val2,
-                                                pdata->buck3_init,
-                                                pdata->buck3_init +
-                                                buck_voltage_val2.step);
+                                                   pdata->buck3_init);
 
         sec_reg_write(s5m8767->iodev, S5M8767_REG_BUCK3DVS2, buck_init);
 
         buck_init = s5m8767_convert_voltage_to_sel(&buck_voltage_val2,
-                                                pdata->buck4_init,
-                                                pdata->buck4_init +
-                                                buck_voltage_val2.step);
+                                                   pdata->buck4_init);
 
         sec_reg_write(s5m8767->iodev, S5M8767_REG_BUCK4DVS2, buck_init);
 
@@ -602,27 +744,21 @@ static int s5m8767_pmic_probe(struct platform_device *pdev)
                         s5m8767->buck2_vol[i] =
                                 s5m8767_convert_voltage_to_sel(
                                                 &buck_voltage_val2,
-                                                pdata->buck2_voltage[i],
-                                                pdata->buck2_voltage[i] +
-                                                buck_voltage_val2.step);
+                                                pdata->buck2_voltage[i]);
                 }
 
                 if (s5m8767->buck3_gpiodvs) {
                         s5m8767->buck3_vol[i] =
                                 s5m8767_convert_voltage_to_sel(
                                                 &buck_voltage_val2,
-                                                pdata->buck3_voltage[i],
-                                                pdata->buck3_voltage[i] +
-                                                buck_voltage_val2.step);
+                                                pdata->buck3_voltage[i]);
                 }
 
                 if (s5m8767->buck4_gpiodvs) {
                         s5m8767->buck4_vol[i] =
                                 s5m8767_convert_voltage_to_sel(
                                                 &buck_voltage_val2,
-                                                pdata->buck4_voltage[i],
-                                                pdata->buck4_voltage[i] +
-                                                buck_voltage_val2.step);
+                                                pdata->buck4_voltage[i]);
                 }
         }
 
@@ -760,11 +896,19 @@ static int s5m8767_pmic_probe(struct platform_device *pdev)
                                 (desc->max - desc->min) / desc->step + 1;
                         regulators[id].min_uV = desc->min;
                         regulators[id].uV_step = desc->step;
+                        regulators[id].vsel_reg =
+                                s5m8767_get_vsel_reg(id, s5m8767);
+                        if (id < S5M8767_BUCK1)
+                                regulators[id].vsel_mask = 0x3f;
+                        else
+                                regulators[id].vsel_mask = 0xff;
                 }
 
                 config.dev = s5m8767->dev;
                 config.init_data = pdata->regulators[i].initdata;
                 config.driver_data = s5m8767;
+                config.regmap = iodev->regmap;
+                config.of_node = pdata->regulators[i].reg_node;
 
                 rdev[i] = regulator_register(&regulators[id], &config);
                 if (IS_ERR(rdev[i])) {
diff --git a/drivers/regulator/tps51632-regulator.c b/drivers/regulator/tps51632-regulator.c
index ab21133e6784..6e67be75ea1b 100644
--- a/drivers/regulator/tps51632-regulator.c
+++ b/drivers/regulator/tps51632-regulator.c
@@ -28,10 +28,13 @@
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <linux/of.h>
+#include <linux/of_device.h>
 #include <linux/platform_device.h>
 #include <linux/regmap.h>
 #include <linux/regulator/driver.h>
 #include <linux/regulator/machine.h>
+#include <linux/regulator/of_regulator.h>
 #include <linux/regulator/tps51632-regulator.h>
 #include <linux/slab.h>
 
@@ -85,49 +88,8 @@ struct tps51632_chip {
         struct regulator_desc desc;
         struct regulator_dev *rdev;
         struct regmap *regmap;
-        bool enable_pwm_dvfs;
 };
 
-static int tps51632_dcdc_get_voltage_sel(struct regulator_dev *rdev)
-{
-        struct tps51632_chip *tps = rdev_get_drvdata(rdev);
-        unsigned int data;
-        int ret;
-        unsigned int reg = TPS51632_VOLTAGE_SELECT_REG;
-        int vsel;
-
-        if (tps->enable_pwm_dvfs)
-                reg = TPS51632_VOLTAGE_BASE_REG;
-
-        ret = regmap_read(tps->regmap, reg, &data);
-        if (ret < 0) {
-                dev_err(tps->dev, "reg read failed, err %d\n", ret);
-                return ret;
-        }
-
-        vsel = data & TPS51632_VOUT_MASK;
-        return vsel;
-}
-
-static int tps51632_dcdc_set_voltage_sel(struct regulator_dev *rdev,
-                unsigned selector)
-{
-        struct tps51632_chip *tps = rdev_get_drvdata(rdev);
-        int ret;
-        unsigned int reg = TPS51632_VOLTAGE_SELECT_REG;
-
-        if (tps->enable_pwm_dvfs)
-                reg = TPS51632_VOLTAGE_BASE_REG;
-
-        if (selector > TPS51632_MAX_VSEL)
-                return -EINVAL;
-
-        ret = regmap_write(tps->regmap, reg, selector);
-        if (ret < 0)
-                dev_err(tps->dev, "reg write failed, err %d\n", ret);
-        return ret;
-}
-
 static int tps51632_dcdc_set_ramp_delay(struct regulator_dev *rdev,
                 int ramp_delay)
 {
@@ -144,8 +106,8 @@ static int tps51632_dcdc_set_ramp_delay(struct regulator_dev *rdev,
 }
 
 static struct regulator_ops tps51632_dcdc_ops = {
-        .get_voltage_sel        = tps51632_dcdc_get_voltage_sel,
-        .set_voltage_sel        = tps51632_dcdc_set_voltage_sel,
+        .get_voltage_sel        = regulator_get_voltage_sel_regmap,
+        .set_voltage_sel        = regulator_set_voltage_sel_regmap,
         .list_voltage           = regulator_list_voltage_linear,
         .set_voltage_time_sel   = regulator_set_voltage_time_sel,
         .set_ramp_delay         = tps51632_dcdc_set_ramp_delay,
@@ -162,7 +124,6 @@ static int tps51632_init_dcdc(struct tps51632_chip *tps,
                 goto skip_pwm_config;
 
         control |= TPS51632_DVFS_PWMEN;
-        tps->enable_pwm_dvfs = pdata->enable_pwm_dvfs;
         vsel = TPS51632_VOLT_VSEL(pdata->base_voltage_uV);
         ret = regmap_write(tps->regmap, TPS51632_VOLTAGE_BASE_REG, vsel);
         if (ret < 0) {
@@ -205,22 +166,96 @@ skip_pwm_config:
         return ret;
 }
 
-static bool rd_wr_reg(struct device *dev, unsigned int reg)
+static bool is_volatile_reg(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case TPS51632_OFFSET_REG:
+        case TPS51632_FAULT_REG:
+        case TPS51632_IMON_REG:
+                return true;
+        default:
+                return false;
+        }
+}
+
+static bool is_read_reg(struct device *dev, unsigned int reg)
 {
-        if ((reg >= 0x8) && (reg <= 0x10))
+        switch (reg) {
+        case 0x08 ... 0x0F:
                 return false;
-        return true;
+        default:
+                return true;
+        }
+}
+
+static bool is_write_reg(struct device *dev, unsigned int reg)
+{
+        switch (reg) {
+        case TPS51632_VOLTAGE_SELECT_REG:
+        case TPS51632_VOLTAGE_BASE_REG:
+        case TPS51632_VMAX_REG:
+        case TPS51632_DVFS_CONTROL_REG:
+        case TPS51632_POWER_STATE_REG:
+        case TPS51632_SLEW_REGS:
+                return true;
+        default:
+                return false;
+        }
 }
 
 static const struct regmap_config tps51632_regmap_config = {
         .reg_bits               = 8,
         .val_bits               = 8,
-        .writeable_reg          = rd_wr_reg,
-        .readable_reg           = rd_wr_reg,
+        .writeable_reg          = is_write_reg,
+        .readable_reg           = is_read_reg,
+        .volatile_reg           = is_volatile_reg,
         .max_register           = TPS51632_MAX_REG - 1,
         .cache_type             = REGCACHE_RBTREE,
 };
 
+#if defined(CONFIG_OF)
+static const struct of_device_id tps51632_of_match[] = {
+        { .compatible = "ti,tps51632",},
+        {},
+};
+MODULE_DEVICE_TABLE(of, tps51632_of_match);
+
+static struct tps51632_regulator_platform_data *
+        of_get_tps51632_platform_data(struct device *dev)
+{
+        struct tps51632_regulator_platform_data *pdata;
+        struct device_node *np = dev->of_node;
+
+        pdata = devm_kzalloc(dev, sizeof(*pdata), GFP_KERNEL);
+        if (!pdata) {
+                dev_err(dev, "Memory alloc failed for platform data\n");
+                return NULL;
+        }
+
+        pdata->reg_init_data = of_get_regulator_init_data(dev, dev->of_node);
+        if (!pdata->reg_init_data) {
+                dev_err(dev, "Not able to get OF regulator init data\n");
+                return NULL;
+        }
+
+        pdata->enable_pwm_dvfs =
+                        of_property_read_bool(np, "ti,enable-pwm-dvfs");
+        pdata->dvfs_step_20mV = of_property_read_bool(np, "ti,dvfs-step-20mV");
+
+        pdata->base_voltage_uV = pdata->reg_init_data->constraints.min_uV ? :
+                                        TPS51632_MIN_VOLATGE;
+        pdata->max_voltage_uV = pdata->reg_init_data->constraints.max_uV ? :
+                                        TPS51632_MAX_VOLATGE;
+        return pdata;
+}
+#else
+static struct tps51632_regulator_platform_data *
+        of_get_tps51632_platform_data(struct device *dev)
+{
+        return NULL;
+}
+#endif
+
 static int tps51632_probe(struct i2c_client *client,
                                 const struct i2c_device_id *id)
 {
@@ -230,7 +265,19 @@ static int tps51632_probe(struct i2c_client *client,
         int ret;
         struct regulator_config config = { };
 
+        if (client->dev.of_node) {
+                const struct of_device_id *match;
+                match = of_match_device(of_match_ptr(tps51632_of_match),
+                                &client->dev);
+                if (!match) {
+                        dev_err(&client->dev, "Error: No device match found\n");
+                        return -ENODEV;
+                }
+        }
+
         pdata = client->dev.platform_data;
+        if (!pdata && client->dev.of_node)
+                pdata = of_get_tps51632_platform_data(&client->dev);
         if (!pdata) {
                 dev_err(&client->dev, "No Platform data\n");
                 return -EINVAL;
@@ -269,6 +316,12 @@ static int tps51632_probe(struct i2c_client *client,
         tps->desc.type = REGULATOR_VOLTAGE;
         tps->desc.owner = THIS_MODULE;
 
+        if (pdata->enable_pwm_dvfs)
+                tps->desc.vsel_reg = TPS51632_VOLTAGE_BASE_REG;
+        else
+                tps->desc.vsel_reg = TPS51632_VOLTAGE_SELECT_REG;
+        tps->desc.vsel_mask = TPS51632_VOUT_MASK;
+
         tps->regmap = devm_regmap_init_i2c(client, &tps51632_regmap_config);
         if (IS_ERR(tps->regmap)) {
                 ret = PTR_ERR(tps->regmap);
@@ -319,6 +372,7 @@ static struct i2c_driver tps51632_i2c_driver = {
         .driver = {
                 .name = "tps51632",
                 .owner = THIS_MODULE,
+                .of_match_table = of_match_ptr(tps51632_of_match),
         },
         .probe = tps51632_probe,
         .remove = tps51632_remove,
diff --git a/drivers/regulator/tps6507x-regulator.c b/drivers/regulator/tps6507x-regulator.c
index 0233cfb56560..54aa2da7283b 100644
--- a/drivers/regulator/tps6507x-regulator.c
+++ b/drivers/regulator/tps6507x-regulator.c
@@ -23,8 +23,10 @@
 #include <linux/regulator/driver.h>
 #include <linux/regulator/machine.h>
 #include <linux/regulator/tps6507x.h>
+#include <linux/of.h>
 #include <linux/slab.h>
 #include <linux/mfd/tps6507x.h>
+#include <linux/regulator/of_regulator.h>
 
 /* DCDC's */
 #define TPS6507X_DCDC_1                         0
@@ -356,6 +358,80 @@ static struct regulator_ops tps6507x_pmic_ops = {
         .list_voltage = regulator_list_voltage_table,
 };
 
+#ifdef CONFIG_OF
+static struct of_regulator_match tps6507x_matches[] = {
+        { .name = "VDCDC1"},
+        { .name = "VDCDC2"},
+        { .name = "VDCDC3"},
+        { .name = "LDO1"},
+        { .name = "LDO2"},
+};
+
+static struct tps6507x_board *tps6507x_parse_dt_reg_data(
+                struct platform_device *pdev,
+                struct of_regulator_match **tps6507x_reg_matches)
+{
+        struct tps6507x_board *tps_board;
+        struct device_node *np = pdev->dev.parent->of_node;
+        struct device_node *regulators;
+        struct of_regulator_match *matches;
+        static struct regulator_init_data *reg_data;
+        int idx = 0, count, ret;
+
+        tps_board = devm_kzalloc(&pdev->dev, sizeof(*tps_board),
+                                        GFP_KERNEL);
+        if (!tps_board) {
+                dev_err(&pdev->dev, "Failure to alloc pdata for regulators.\n");
+                return NULL;
+        }
+
+        regulators = of_find_node_by_name(np, "regulators");
+        if (!regulators) {
+                dev_err(&pdev->dev, "regulator node not found\n");
+                return NULL;
+        }
+
+        count = ARRAY_SIZE(tps6507x_matches);
+        matches = tps6507x_matches;
+
+        ret = of_regulator_match(&pdev->dev, regulators, matches, count);
+        if (ret < 0) {
+                dev_err(&pdev->dev, "Error parsing regulator init data: %d\n",
+                        ret);
+                return NULL;
+        }
+
+        *tps6507x_reg_matches = matches;
+
+        reg_data = devm_kzalloc(&pdev->dev, (sizeof(struct regulator_init_data)
+                                        * TPS6507X_NUM_REGULATOR), GFP_KERNEL);
+        if (!reg_data) {
+                dev_err(&pdev->dev, "Failure to alloc init data for regulators.\n");
+                return NULL;
+        }
+
+        tps_board->tps6507x_pmic_init_data = reg_data;
+
+        for (idx = 0; idx < count; idx++) {
+                if (!matches[idx].init_data || !matches[idx].of_node)
+                        continue;
+
+                memcpy(&reg_data[idx], matches[idx].init_data,
+                                sizeof(struct regulator_init_data));
+
+        }
+
+        return tps_board;
+}
+#else
+static inline struct tps6507x_board *tps6507x_parse_dt_reg_data(
+                        struct platform_device *pdev,
+                        struct of_regulator_match **tps6507x_reg_matches)
+{
+        *tps6507x_reg_matches = NULL;
+        return NULL;
+}
+#endif
 static int tps6507x_pmic_probe(struct platform_device *pdev)
 {
         struct tps6507x_dev *tps6507x_dev = dev_get_drvdata(pdev->dev.parent);
@@ -365,8 +441,10 @@ static int tps6507x_pmic_probe(struct platform_device *pdev)
         struct regulator_dev *rdev;
         struct tps6507x_pmic *tps;
         struct tps6507x_board *tps_board;
+        struct of_regulator_match *tps6507x_reg_matches = NULL;
         int i;
         int error;
+        unsigned int prop;
 
         /**
          * tps_board points to pmic related constants
@@ -374,6 +452,9 @@ static int tps6507x_pmic_probe(struct platform_device *pdev)
          */
 
         tps_board = dev_get_platdata(tps6507x_dev->dev);
+        if (!tps_board && tps6507x_dev->dev->of_node)
+                tps_board = tps6507x_parse_dt_reg_data(pdev,
+                                                &tps6507x_reg_matches);
         if (!tps_board)
                 return -EINVAL;
 
@@ -415,6 +496,17 @@ static int tps6507x_pmic_probe(struct platform_device *pdev)
                 config.init_data = init_data;
                 config.driver_data = tps;
 
+                if (tps6507x_reg_matches) {
+                        error = of_property_read_u32(
+                                tps6507x_reg_matches[i].of_node,
+                                        "ti,defdcdc_default", &prop);
+
+                        if (!error)
+                                tps->info[i]->defdcdc_default = prop;
+
+                        config.of_node = tps6507x_reg_matches[i].of_node;
+                }
+
                 rdev = regulator_register(&tps->desc[i], &config);
                 if (IS_ERR(rdev)) {
                         dev_err(tps6507x_dev->dev,
diff --git a/drivers/regulator/tps65090-regulator.c b/drivers/regulator/tps65090-regulator.c
index 41c391789c97..c8e70451df38 100644
--- a/drivers/regulator/tps65090-regulator.c
+++ b/drivers/regulator/tps65090-regulator.c
@@ -19,11 +19,13 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/gpio.h>
+#include <linux/of_gpio.h>
 #include <linux/slab.h>
 #include <linux/err.h>
 #include <linux/platform_device.h>
 #include <linux/regulator/driver.h>
 #include <linux/regulator/machine.h>
+#include <linux/regulator/of_regulator.h>
 #include <linux/mfd/tps65090.h>
 
 struct tps65090_regulator {
@@ -67,8 +69,8 @@ static struct regulator_desc tps65090_regulator_desc[] = {
         tps65090_REG_DESC(FET5,  "infet5",  0x13, tps65090_reg_contol_ops),
         tps65090_REG_DESC(FET6,  "infet6",  0x14, tps65090_reg_contol_ops),
         tps65090_REG_DESC(FET7,  "infet7",  0x15, tps65090_reg_contol_ops),
-        tps65090_REG_DESC(LDO1,  "vsys_l1", 0,    tps65090_ldo_ops),
-        tps65090_REG_DESC(LDO2,  "vsys_l2", 0,    tps65090_ldo_ops),
+        tps65090_REG_DESC(LDO1,  "vsys-l1", 0,    tps65090_ldo_ops),
+        tps65090_REG_DESC(LDO2,  "vsys-l2", 0,    tps65090_ldo_ops),
 };
 
 static inline bool is_dcdc(int id)
@@ -138,6 +140,92 @@ static void tps65090_configure_regulator_config(
         }
 }
 
+#ifdef CONFIG_OF
+static struct of_regulator_match tps65090_matches[] = {
+        { .name = "dcdc1", },
+        { .name = "dcdc2", },
+        { .name = "dcdc3", },
+        { .name = "fet1",  },
+        { .name = "fet2",  },
+        { .name = "fet3",  },
+        { .name = "fet4",  },
+        { .name = "fet5",  },
+        { .name = "fet6",  },
+        { .name = "fet7",  },
+        { .name = "ldo1",  },
+        { .name = "ldo2",  },
+};
+
+static struct tps65090_platform_data *tps65090_parse_dt_reg_data(
+                struct platform_device *pdev,
+                struct of_regulator_match **tps65090_reg_matches)
+{
+        struct tps65090_platform_data *tps65090_pdata;
+        struct device_node *np = pdev->dev.parent->of_node;
+        struct device_node *regulators;
+        int idx = 0, ret;
+        struct tps65090_regulator_plat_data *reg_pdata;
+
+        tps65090_pdata = devm_kzalloc(&pdev->dev, sizeof(*tps65090_pdata),
+                                GFP_KERNEL);
+        if (!tps65090_pdata) {
+                dev_err(&pdev->dev, "Memory alloc for tps65090_pdata failed\n");
+                return ERR_PTR(-ENOMEM);
+        }
+
+        reg_pdata = devm_kzalloc(&pdev->dev, TPS65090_REGULATOR_MAX *
+                                sizeof(*reg_pdata), GFP_KERNEL);
+        if (!reg_pdata) {
+                dev_err(&pdev->dev, "Memory alloc for reg_pdata failed\n");
+                return ERR_PTR(-ENOMEM);
+        }
+
+        regulators = of_find_node_by_name(np, "regulators");
+        if (!regulators) {
+                dev_err(&pdev->dev, "regulator node not found\n");
+                return ERR_PTR(-ENODEV);
+        }
+
+        ret = of_regulator_match(&pdev->dev, regulators, tps65090_matches,
+                        ARRAY_SIZE(tps65090_matches));
+        if (ret < 0) {
+                dev_err(&pdev->dev,
+                        "Error parsing regulator init data: %d\n", ret);
+                return ERR_PTR(ret);
+        }
+
+        *tps65090_reg_matches = tps65090_matches;
+        for (idx = 0; idx < ARRAY_SIZE(tps65090_matches); idx++) {
+                struct regulator_init_data *ri_data;
+                struct tps65090_regulator_plat_data *rpdata;
+
+                rpdata = &reg_pdata[idx];
+                ri_data = tps65090_matches[idx].init_data;
+                if (!ri_data || !tps65090_matches[idx].of_node)
+                        continue;
+
+                rpdata->reg_init_data = ri_data;
+                rpdata->enable_ext_control = of_property_read_bool(
+                                        tps65090_matches[idx].of_node,
+                                        "ti,enable-ext-control");
+                if (rpdata->enable_ext_control)
+                        rpdata->gpio = of_get_named_gpio(np,
+                                        "dcdc-ext-control-gpios", 0);
+
+                tps65090_pdata->reg_pdata[idx] = rpdata;
+        }
+        return tps65090_pdata;
+}
+#else
+static inline struct tps65090_platform_data *tps65090_parse_dt_reg_data(
+                        struct platform_device *pdev,
+                        struct of_regulator_match **tps65090_reg_matches)
+{
+        *tps65090_reg_matches = NULL;
+        return NULL;
+}
+#endif
+
 static int tps65090_regulator_probe(struct platform_device *pdev)
 {
         struct tps65090 *tps65090_mfd = dev_get_drvdata(pdev->dev.parent);
@@ -147,15 +235,19 @@ static int tps65090_regulator_probe(struct platform_device *pdev)
         struct tps65090_regulator_plat_data *tps_pdata;
         struct tps65090_regulator *pmic;
         struct tps65090_platform_data *tps65090_pdata;
+        struct of_regulator_match *tps65090_reg_matches = NULL;
         int num;
         int ret;
 
         dev_dbg(&pdev->dev, "Probing regulator\n");
 
         tps65090_pdata = dev_get_platdata(pdev->dev.parent);
-        if (!tps65090_pdata) {
+        if (!tps65090_pdata && tps65090_mfd->dev->of_node)
+                tps65090_pdata = tps65090_parse_dt_reg_data(pdev,
+                                        &tps65090_reg_matches);
+        if (IS_ERR_OR_NULL(tps65090_pdata)) {
                 dev_err(&pdev->dev, "Platform data missing\n");
-                return -EINVAL;
+                return tps65090_pdata ? PTR_ERR(tps65090_pdata) : -EINVAL;
         }
 
         pmic = devm_kzalloc(&pdev->dev, TPS65090_REGULATOR_MAX * sizeof(*pmic),
@@ -192,13 +284,17 @@ static int tps65090_regulator_probe(struct platform_device *pdev)
                         }
                 }
 
-                config.dev = &pdev->dev;
+                config.dev = pdev->dev.parent;
                 config.driver_data = ri;
                 config.regmap = tps65090_mfd->rmap;
                 if (tps_pdata)
                         config.init_data = tps_pdata->reg_init_data;
                 else
                         config.init_data = NULL;
+                if (tps65090_reg_matches)
+                        config.of_node = tps65090_reg_matches[num].of_node;
+                else
+                        config.of_node = NULL;
 
                 rdev = regulator_register(ri->desc, &config);
                 if (IS_ERR(rdev)) {
diff --git a/drivers/regulator/tps65217-regulator.c b/drivers/regulator/tps65217-regulator.c
index 73dce7664126..df395187c063 100644
--- a/drivers/regulator/tps65217-regulator.c
+++ b/drivers/regulator/tps65217-regulator.c
@@ -305,8 +305,8 @@ static struct tps65217_board *tps65217_parse_dt(struct platform_device *pdev)
         if (!regs)
                 return NULL;
 
-        count = of_regulator_match(pdev->dev.parent, regs,
-                                reg_matches, TPS65217_NUM_REGULATOR);
+        count = of_regulator_match(&pdev->dev, regs, reg_matches,
+                                   TPS65217_NUM_REGULATOR);
         of_node_put(regs);
         if ((count < 0) || (count > TPS65217_NUM_REGULATOR))
                 return NULL;
diff --git a/drivers/regulator/tps6586x-regulator.c b/drivers/regulator/tps6586x-regulator.c
index f86da672c758..e68382d0e1ea 100644
--- a/drivers/regulator/tps6586x-regulator.c
+++ b/drivers/regulator/tps6586x-regulator.c
@@ -61,10 +61,6 @@ struct tps6586x_regulator {
 
         int enable_bit[2];
         int enable_reg[2];
-
-        /* for DVM regulators */
-        int go_reg;
-        int go_bit;
 };
 
 static inline struct device *to_tps6586x_dev(struct regulator_dev *rdev)
@@ -72,37 +68,10 @@ static inline struct device *to_tps6586x_dev(struct regulator_dev *rdev)
         return rdev_get_dev(rdev)->parent;
 }
 
-static int tps6586x_set_voltage_sel(struct regulator_dev *rdev,
-                                    unsigned selector)
-{
-        struct tps6586x_regulator *ri = rdev_get_drvdata(rdev);
-        struct device *parent = to_tps6586x_dev(rdev);
-        int ret, val, rid = rdev_get_id(rdev);
-        uint8_t mask;
-
-        val = selector << (ffs(rdev->desc->vsel_mask) - 1);
-        mask = rdev->desc->vsel_mask;
-
-        ret = tps6586x_update(parent, rdev->desc->vsel_reg, val, mask);
-        if (ret)
-                return ret;
-
-        /* Update go bit for DVM regulators */
-        switch (rid) {
-        case TPS6586X_ID_LDO_2:
-        case TPS6586X_ID_LDO_4:
-        case TPS6586X_ID_SM_0:
-        case TPS6586X_ID_SM_1:
-                ret = tps6586x_set_bits(parent, ri->go_reg, 1 << ri->go_bit);
-                break;
-        }
-        return ret;
-}
-
 static struct regulator_ops tps6586x_regulator_ops = {
         .list_voltage = regulator_list_voltage_table,
         .get_voltage_sel = regulator_get_voltage_sel_regmap,
-        .set_voltage_sel = tps6586x_set_voltage_sel,
+        .set_voltage_sel = regulator_set_voltage_sel_regmap,
 
         .is_enabled = regulator_is_enabled_regmap,
         .enable = regulator_enable_regmap,
@@ -142,7 +111,7 @@ static const unsigned int tps6586x_dvm_voltages[] = {
 };
 
 #define TPS6586X_REGULATOR(_id, _pin_name, vdata, vreg, shift, nbits,   \
-                           ereg0, ebit0, ereg1, ebit1)                  \
+                           ereg0, ebit0, ereg1, ebit1, goreg, gobit)    \
         .desc   = {                                                     \
                 .supply_name = _pin_name,                               \
                 .name   = "REG-" #_id,                                  \
@@ -156,29 +125,26 @@ static const unsigned int tps6586x_dvm_voltages[] = {
                 .enable_mask = 1 << (ebit0),                            \
                 .vsel_reg = TPS6586X_##vreg,                            \
                 .vsel_mask = ((1 << (nbits)) - 1) << (shift),           \
+                .apply_reg = (goreg),                           \
+                .apply_bit = (gobit),                           \
         },                                                              \
         .enable_reg[0]  = TPS6586X_SUPPLY##ereg0,                       \
         .enable_bit[0]  = (ebit0),                                      \
         .enable_reg[1]  = TPS6586X_SUPPLY##ereg1,                       \
         .enable_bit[1]  = (ebit1),
 
-#define TPS6586X_REGULATOR_DVM_GOREG(goreg, gobit)                      \
-        .go_reg = TPS6586X_##goreg,                                     \
-        .go_bit = (gobit),
-
 #define TPS6586X_LDO(_id, _pname, vdata, vreg, shift, nbits,            \
                      ereg0, ebit0, ereg1, ebit1)                        \
 {                                                                       \
         TPS6586X_REGULATOR(_id, _pname, vdata, vreg, shift, nbits,      \
-                           ereg0, ebit0, ereg1, ebit1)                  \
+                           ereg0, ebit0, ereg1, ebit1, 0, 0)            \
 }
 
 #define TPS6586X_DVM(_id, _pname, vdata, vreg, shift, nbits,            \
                      ereg0, ebit0, ereg1, ebit1, goreg, gobit)          \
 {                                                                       \
         TPS6586X_REGULATOR(_id, _pname, vdata, vreg, shift, nbits,      \
-                           ereg0, ebit0, ereg1, ebit1)                  \
-        TPS6586X_REGULATOR_DVM_GOREG(goreg, gobit)                      \
+                           ereg0, ebit0, ereg1, ebit1, goreg, gobit)    \
 }
 
 #define TPS6586X_SYS_REGULATOR()                                        \
@@ -207,13 +173,13 @@ static struct tps6586x_regulator tps6586x_regulator[] = {
         TPS6586X_LDO(SM_2, "vin-sm2", sm2, SUPPLYV2, 0, 5, ENC, 7, END, 7),
 
         TPS6586X_DVM(LDO_2, "vinldo23", dvm, LDO2BV1, 0, 5, ENA, 3,
-                                        ENB, 3, VCC2, 6),
+                                        ENB, 3, TPS6586X_VCC2, BIT(6)),
         TPS6586X_DVM(LDO_4, "vinldo4", ldo4, LDO4V1, 0, 5, ENC, 3,
-                                        END, 3, VCC1, 6),
+                                        END, 3, TPS6586X_VCC1, BIT(6)),
         TPS6586X_DVM(SM_0, "vin-sm0", dvm, SM0V1, 0, 5, ENA, 1,
-                                        ENB, 1, VCC1, 2),
+                                        ENB, 1, TPS6586X_VCC1, BIT(2)),
         TPS6586X_DVM(SM_1, "vin-sm1", dvm, SM1V1, 0, 5, ENA, 0,
-                                        ENB, 0, VCC1, 0),
+                                        ENB, 0, TPS6586X_VCC1, BIT(0)),
 };
 
 /*
diff --git a/drivers/regulator/tps65910-regulator.c b/drivers/regulator/tps65910-regulator.c
index 59c3770fa77d..6ba6931ac855 100644
--- a/drivers/regulator/tps65910-regulator.c
+++ b/drivers/regulator/tps65910-regulator.c
@@ -964,8 +964,7 @@ static struct tps65910_board *tps65910_parse_dt_reg_data(
 {
         struct tps65910_board *pmic_plat_data;
         struct tps65910 *tps65910 = dev_get_drvdata(pdev->dev.parent);
-        struct device_node *np = pdev->dev.parent->of_node;
-        struct device_node *regulators;
+        struct device_node *np, *regulators;
         struct of_regulator_match *matches;
         unsigned int prop;
         int idx = 0, ret, count;
@@ -978,6 +977,7 @@ static struct tps65910_board *tps65910_parse_dt_reg_data(
                 return NULL;
         }
 
+        np = of_node_get(pdev->dev.parent->of_node);
         regulators = of_find_node_by_name(np, "regulators");
         if (!regulators) {
                 dev_err(&pdev->dev, "regulator node not found\n");
@@ -994,11 +994,13 @@ static struct tps65910_board *tps65910_parse_dt_reg_data(
                 matches = tps65911_matches;
                 break;
         default:
+                of_node_put(regulators);
                 dev_err(&pdev->dev, "Invalid tps chip version\n");
                 return NULL;
         }
 
-        ret = of_regulator_match(pdev->dev.parent, regulators, matches, count);
+        ret = of_regulator_match(&pdev->dev, regulators, matches, count);
+        of_node_put(regulators);
         if (ret < 0) {
                 dev_err(&pdev->dev, "Error parsing regulator init data: %d\n",
                         ret);
diff --git a/drivers/regulator/tps80031-regulator.c b/drivers/regulator/tps80031-regulator.c
index b15d711bc8c6..9019d0e7ecb6 100644
--- a/drivers/regulator/tps80031-regulator.c
+++ b/drivers/regulator/tps80031-regulator.c
@@ -728,7 +728,7 @@ static int tps80031_regulator_probe(struct platform_device *pdev)
                         }
                 }
                 rdev = regulator_register(&ri->rinfo->desc, &config);
-                if (IS_ERR_OR_NULL(rdev)) {
+                if (IS_ERR(rdev)) {
                         dev_err(&pdev->dev,
                                 "register regulator failed %s\n",
                                         ri->rinfo->desc.name);
diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
index 923a9da9c829..5e44eaabf457 100644
--- a/drivers/rtc/Kconfig
+++ b/drivers/rtc/Kconfig
@@ -20,14 +20,24 @@ if RTC_CLASS
 config RTC_HCTOSYS
         bool "Set system time from RTC on startup and resume"
         default y
+        depends on !ALWAYS_USE_PERSISTENT_CLOCK
         help
           If you say yes here, the system time (wall clock) will be set using
           the value read from a specified RTC device. This is useful to avoid
           unnecessary fsck runs at boot time, and to network better.
 
+config RTC_SYSTOHC
+        bool "Set the RTC time based on NTP synchronization"
+        default y
+        depends on !ALWAYS_USE_PERSISTENT_CLOCK
+        help
+          If you say yes here, the system time (wall clock) will be stored
+          in the RTC specified by RTC_HCTOSYS_DEVICE approximately every 11
+          minutes if userspace reports synchronized NTP status.
+
 config RTC_HCTOSYS_DEVICE
         string "RTC used to set the system time"
-        depends on RTC_HCTOSYS = y
+        depends on RTC_HCTOSYS = y || RTC_SYSTOHC = y
         default "rtc0"
         help
           The RTC device that will be used to (re)initialize the system
diff --git a/drivers/rtc/Makefile b/drivers/rtc/Makefile
index 4418ef3f9ecc..ec2988b00a44 100644
--- a/drivers/rtc/Makefile
+++ b/drivers/rtc/Makefile
@@ -6,6 +6,7 @@ ccflags-$(CONFIG_RTC_DEBUG)	:= -DDEBUG
 
 obj-$(CONFIG_RTC_LIB)           += rtc-lib.o
 obj-$(CONFIG_RTC_HCTOSYS)       += hctosys.o
+obj-$(CONFIG_RTC_SYSTOHC)       += systohc.o
 obj-$(CONFIG_RTC_CLASS)         += rtc-core.o
 rtc-core-y                      := class.o interface.o
 
diff --git a/drivers/rtc/class.c b/drivers/rtc/class.c
index 5143629dedbd..26388f182594 100644
--- a/drivers/rtc/class.c
+++ b/drivers/rtc/class.c
@@ -50,6 +50,10 @@ static int rtc_suspend(struct device *dev, pm_message_t mesg)
         struct rtc_device       *rtc = to_rtc_device(dev);
         struct rtc_time         tm;
         struct timespec         delta, delta_delta;
+
+        if (has_persistent_clock())
+                return 0;
+
         if (strcmp(dev_name(&rtc->dev), CONFIG_RTC_HCTOSYS_DEVICE) != 0)
                 return 0;
 
@@ -88,6 +92,9 @@ static int rtc_resume(struct device *dev)
         struct timespec         new_system, new_rtc;
         struct timespec         sleep_time;
 
+        if (has_persistent_clock())
+                return 0;
+
         rtc_hctosys_ret = -ENODEV;
         if (strcmp(dev_name(&rtc->dev), CONFIG_RTC_HCTOSYS_DEVICE) != 0)
                 return 0;
diff --git a/drivers/rtc/rtc-da9055.c b/drivers/rtc/rtc-da9055.c
index 96bafc5c3bf8..8f0dcfedb83c 100644
--- a/drivers/rtc/rtc-da9055.c
+++ b/drivers/rtc/rtc-da9055.c
@@ -227,7 +227,7 @@ static const struct rtc_class_ops da9055_rtc_ops = {
         .alarm_irq_enable = da9055_rtc_alarm_irq_enable,
 };
 
-static int __init da9055_rtc_device_init(struct da9055 *da9055,
+static int da9055_rtc_device_init(struct da9055 *da9055,
                                         struct da9055_pdata *pdata)
 {
         int ret;
diff --git a/drivers/rtc/rtc-isl1208.c b/drivers/rtc/rtc-isl1208.c
index afb7cfa85ccc..c016ad81767a 100644
--- a/drivers/rtc/rtc-isl1208.c
+++ b/drivers/rtc/rtc-isl1208.c
@@ -506,6 +506,7 @@ isl1208_rtc_interrupt(int irq, void *data)
 {
         unsigned long timeout = jiffies + msecs_to_jiffies(1000);
         struct i2c_client *client = data;
+        struct rtc_device *rtc = i2c_get_clientdata(client);
         int handled = 0, sr, err;
 
         /*
@@ -528,6 +529,8 @@ isl1208_rtc_interrupt(int irq, void *data)
         if (sr & ISL1208_REG_SR_ALM) {
                 dev_dbg(&client->dev, "alarm!\n");
 
+                rtc_update_irq(rtc, 1, RTC_IRQF | RTC_AF);
+
                 /* Clear the alarm */
                 sr &= ~ISL1208_REG_SR_ALM;
                 sr = i2c_smbus_write_byte_data(client, ISL1208_REG_SR, sr);
diff --git a/drivers/rtc/rtc-pl031.c b/drivers/rtc/rtc-pl031.c
index 08378e3cc21c..81c5077feff3 100644
--- a/drivers/rtc/rtc-pl031.c
+++ b/drivers/rtc/rtc-pl031.c
@@ -44,6 +44,7 @@
 #define RTC_YMR         0x34    /* Year match register */
 #define RTC_YLR         0x38    /* Year data load register */
 
+#define RTC_CR_EN       (1 << 0)        /* counter enable bit */
 #define RTC_CR_CWEN     (1 << 26)       /* Clockwatch enable bit */
 
 #define RTC_TCR_EN      (1 << 1) /* Periodic timer enable bit */
@@ -320,7 +321,7 @@ static int pl031_probe(struct amba_device *adev, const struct amba_id *id)
         struct pl031_local *ldata;
         struct pl031_vendor_data *vendor = id->data;
         struct rtc_class_ops *ops = &vendor->ops;
-        unsigned long time;
+        unsigned long time, data;
 
         ret = amba_request_regions(adev, NULL);
         if (ret)
@@ -345,10 +346,13 @@ static int pl031_probe(struct amba_device *adev, const struct amba_id *id)
         dev_dbg(&adev->dev, "designer ID = 0x%02x\n", amba_manf(adev));
         dev_dbg(&adev->dev, "revision = 0x%01x\n", amba_rev(adev));
 
+        data = readl(ldata->base + RTC_CR);
         /* Enable the clockwatch on ST Variants */
         if (vendor->clockwatch)
-                writel(readl(ldata->base + RTC_CR) | RTC_CR_CWEN,
-                       ldata->base + RTC_CR);
+                data |= RTC_CR_CWEN;
+        else
+                data |= RTC_CR_EN;
+        writel(data, ldata->base + RTC_CR);
 
         /*
          * On ST PL031 variants, the RTC reset value does not provide correct
diff --git a/drivers/rtc/rtc-vt8500.c b/drivers/rtc/rtc-vt8500.c
index 00c930f4b6f3..2730533e2d2d 100644
--- a/drivers/rtc/rtc-vt8500.c
+++ b/drivers/rtc/rtc-vt8500.c
@@ -137,7 +137,7 @@ static int vt8500_rtc_set_time(struct device *dev, struct rtc_time *tm)
                 return -EINVAL;
         }
 
-        writel((bin2bcd(tm->tm_year - 100) << DATE_YEAR_S)
+        writel((bin2bcd(tm->tm_year % 100) << DATE_YEAR_S)
                 | (bin2bcd(tm->tm_mon + 1) << DATE_MONTH_S)
                 | (bin2bcd(tm->tm_mday))
                 | ((tm->tm_year >= 200) << DATE_CENTURY_S),
diff --git a/drivers/rtc/systohc.c b/drivers/rtc/systohc.c
new file mode 100644
index 000000000000..bf3e242ccc5c
--- /dev/null
+++ b/drivers/rtc/systohc.c
@@ -0,0 +1,44 @@
+/*
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ */
+#include <linux/rtc.h>
+#include <linux/time.h>
+
+/**
+ * rtc_set_ntp_time - Save NTP synchronized time to the RTC
+ * @now: Current time of day
+ *
+ * Replacement for the NTP platform function update_persistent_clock
+ * that stores time for later retrieval by rtc_hctosys.
+ *
+ * Returns 0 on successful RTC update, -ENODEV if a RTC update is not
+ * possible at all, and various other -errno for specific temporary failure
+ * cases.
+ *
+ * If temporary failure is indicated the caller should try again 'soon'
+ */
+int rtc_set_ntp_time(struct timespec now)
+{
+        struct rtc_device *rtc;
+        struct rtc_time tm;
+        int err = -ENODEV;
+
+        if (now.tv_nsec < (NSEC_PER_SEC >> 1))
+                rtc_time_to_tm(now.tv_sec, &tm);
+        else
+                rtc_time_to_tm(now.tv_sec + 1, &tm);
+
+        rtc = rtc_class_open(CONFIG_RTC_HCTOSYS_DEVICE);
+        if (rtc) {
+                /* rtc_hctosys exclusively uses UTC, so we call set_time here,
+                 * not set_mmss. */
+                if (rtc->ops && (rtc->ops->set_time || rtc->ops->set_mmss))
+                        err = rtc_set_time(rtc, &tm);
+                rtc_class_close(rtc);
+        }
+
+        return err;
+}
diff --git a/drivers/s390/block/dasd_diag.c b/drivers/s390/block/dasd_diag.c
index 9bd5da36f99e..704488d0f819 100644
--- a/drivers/s390/block/dasd_diag.c
+++ b/drivers/s390/block/dasd_diag.c
@@ -248,7 +248,7 @@ static void dasd_ext_handler(struct ext_code ext_code,
         default:
                 return;
         }
-        kstat_cpu(smp_processor_id()).irqs[EXTINT_DSD]++;
+        inc_irq_stat(IRQEXT_DSD);
         if (!ip) {              /* no intparm: unsolicited interrupt */
                 DBF_EVENT(DBF_NOTICE, "%s", "caught unsolicited "
                               "interrupt");
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 806fe912d6e7..e37bc1620d14 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -4274,7 +4274,7 @@ static struct ccw_driver dasd_eckd_driver = {
         .thaw        = dasd_generic_restore_device,
         .restore     = dasd_generic_restore_device,
         .uc_handler  = dasd_generic_uc_handler,
-        .int_class   = IOINT_DAS,
+        .int_class   = IRQIO_DAS,
 };
 
 /*
diff --git a/drivers/s390/block/dasd_fba.c b/drivers/s390/block/dasd_fba.c
index eb748507c7fa..414698584344 100644
--- a/drivers/s390/block/dasd_fba.c
+++ b/drivers/s390/block/dasd_fba.c
@@ -78,7 +78,7 @@ static struct ccw_driver dasd_fba_driver = {
         .freeze      = dasd_generic_pm_freeze,
         .thaw        = dasd_generic_restore_device,
         .restore     = dasd_generic_restore_device,
-        .int_class   = IOINT_DAS,
+        .int_class   = IRQIO_DAS,
 };
 
 static void
diff --git a/drivers/s390/char/con3215.c b/drivers/s390/char/con3215.c
index 40084501c31b..33b7141a182f 100644
--- a/drivers/s390/char/con3215.c
+++ b/drivers/s390/char/con3215.c
@@ -44,6 +44,7 @@
 #define RAW3215_NR_CCWS     3
 #define RAW3215_TIMEOUT     HZ/10     /* time for delayed output */
 
+#define RAW3215_FIXED       1         /* 3215 console device is not be freed */
 #define RAW3215_WORKING     4         /* set if a request is being worked on */
 #define RAW3215_THROTTLED   8         /* set if reading is disabled */
 #define RAW3215_STOPPED     16        /* set if writing is disabled */
@@ -630,7 +631,8 @@ static void raw3215_shutdown(struct raw3215_info *raw)
         DECLARE_WAITQUEUE(wait, current);
         unsigned long flags;
 
-        if (!(raw->port.flags & ASYNC_INITIALIZED))
+        if (!(raw->port.flags & ASYNC_INITIALIZED) ||
+            (raw->flags & RAW3215_FIXED))
                 return;
         /* Wait for outstanding requests, then free irq */
         spin_lock_irqsave(get_ccwdev_lock(raw->cdev), flags);
@@ -805,7 +807,7 @@ static struct ccw_driver raw3215_ccw_driver = {
         .freeze         = &raw3215_pm_stop,
         .thaw           = &raw3215_pm_start,
         .restore        = &raw3215_pm_start,
-        .int_class      = IOINT_C15,
+        .int_class      = IRQIO_C15,
 };
 
 #ifdef CONFIG_TN3215_CONSOLE
@@ -927,6 +929,8 @@ static int __init con3215_init(void)
         dev_set_drvdata(&cdev->dev, raw);
         cdev->handler = raw3215_irq;
 
+        raw->flags |= RAW3215_FIXED;
+
         /* Request the console irq */
         if (raw3215_startup(raw) != 0) {
                 raw3215_free_info(raw);
diff --git a/drivers/s390/char/raw3270.c b/drivers/s390/char/raw3270.c
index f3b8bb84faf2..9a6c140c5f07 100644
--- a/drivers/s390/char/raw3270.c
+++ b/drivers/s390/char/raw3270.c
@@ -1396,7 +1396,7 @@ static struct ccw_driver raw3270_ccw_driver = {
         .freeze         = &raw3270_pm_stop,
         .thaw           = &raw3270_pm_start,
         .restore        = &raw3270_pm_start,
-        .int_class      = IOINT_C70,
+        .int_class      = IRQIO_C70,
 };
 
 static int
diff --git a/drivers/s390/char/sclp.c b/drivers/s390/char/sclp.c
index 4fa21f7e2308..12c16a65dd25 100644
--- a/drivers/s390/char/sclp.c
+++ b/drivers/s390/char/sclp.c
@@ -400,7 +400,7 @@ static void sclp_interrupt_handler(struct ext_code ext_code,
         u32 finished_sccb;
         u32 evbuf_pending;
 
-        kstat_cpu(smp_processor_id()).irqs[EXTINT_SCP]++;
+        inc_irq_stat(IRQEXT_SCP);
         spin_lock(&sclp_lock);
         finished_sccb = param32 & 0xfffffff8;
         evbuf_pending = param32 & 0x3;
@@ -813,7 +813,7 @@ static void sclp_check_handler(struct ext_code ext_code,
 {
         u32 finished_sccb;
 
-        kstat_cpu(smp_processor_id()).irqs[EXTINT_SCP]++;
+        inc_irq_stat(IRQEXT_SCP);
         finished_sccb = param32 & 0xfffffff8;
         /* Is this the interrupt we are waiting for? */
         if (finished_sccb == 0)
diff --git a/drivers/s390/char/tape_34xx.c b/drivers/s390/char/tape_34xx.c
index 6ae929c024ae..9aa79702b370 100644
--- a/drivers/s390/char/tape_34xx.c
+++ b/drivers/s390/char/tape_34xx.c
@@ -1193,7 +1193,7 @@ static struct ccw_driver tape_34xx_driver = {
         .set_online = tape_34xx_online,
         .set_offline = tape_generic_offline,
         .freeze = tape_generic_pm_suspend,
-        .int_class = IOINT_TAP,
+        .int_class = IRQIO_TAP,
 };
 
 static int
diff --git a/drivers/s390/char/tape_3590.c b/drivers/s390/char/tape_3590.c
index 1b0eb49f739c..327cb19ad0b0 100644
--- a/drivers/s390/char/tape_3590.c
+++ b/drivers/s390/char/tape_3590.c
@@ -1656,7 +1656,7 @@ static struct ccw_driver tape_3590_driver = {
         .set_offline = tape_generic_offline,
         .set_online = tape_3590_online,
         .freeze = tape_generic_pm_suspend,
-        .int_class = IOINT_TAP,
+        .int_class = IRQIO_TAP,
 };
 
 /*
diff --git a/drivers/s390/char/vmur.c b/drivers/s390/char/vmur.c
index 73bef0bd394c..483f72ba030d 100644
--- a/drivers/s390/char/vmur.c
+++ b/drivers/s390/char/vmur.c
@@ -74,7 +74,7 @@ static struct ccw_driver ur_driver = {
         .set_online     = ur_set_online,
         .set_offline    = ur_set_offline,
         .freeze         = ur_pm_suspend,
-        .int_class      = IOINT_VMR,
+        .int_class      = IRQIO_VMR,
 };
 
 static DEFINE_MUTEX(vmur_mutex);
diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index 68e80e2734a4..10729bbceced 100644
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -283,7 +283,7 @@ struct chsc_sei_nt2_area {
         u8  ccdf[PAGE_SIZE - 24 - 56];  /* content-code dependent field */
 } __packed;
 
-#define CHSC_SEI_NT0    0ULL
+#define CHSC_SEI_NT0    (1ULL << 63)
 #define CHSC_SEI_NT2    (1ULL << 61)
 
 struct chsc_sei {
@@ -291,7 +291,8 @@ struct chsc_sei {
         u32 reserved1;
         u64 ntsm;                       /* notification type mask */
         struct chsc_header response;
-        u32 reserved2;
+        u32 :24;
+        u8 nt;
         union {
                 struct chsc_sei_nt0_area nt0_area;
                 struct chsc_sei_nt2_area nt2_area;
@@ -496,17 +497,17 @@ static int __chsc_process_crw(struct chsc_sei *sei, u64 ntsm)
                                 css_schedule_eval_all();
                         }
 
-                        switch (sei->ntsm) {
-                        case CHSC_SEI_NT0:
+                        switch (sei->nt) {
+                        case 0:
                                 chsc_process_sei_nt0(&sei->u.nt0_area);
-                                return 1;
-                        case CHSC_SEI_NT2:
+                                break;
+                        case 2:
                                 chsc_process_sei_nt2(&sei->u.nt2_area);
-                                return 1;
+                                break;
                         default:
-                                CIO_CRW_EVENT(2, "chsc: unhandled nt (nt=%08Lx)\n",
-                                              sei->ntsm);
-                                return 0;
+                                CIO_CRW_EVENT(2, "chsc: unhandled nt=%d\n",
+                                              sei->nt);
+                                break;
                         }
                 } else {
                         CIO_CRW_EVENT(2, "chsc: sei failed (rc=%04x)\n",
@@ -537,15 +538,7 @@ static void chsc_process_crw(struct crw *crw0, struct crw *crw1, int overflow)
         sei = sei_page;
 
         CIO_TRACE_EVENT(2, "prcss");
-
-        /*
-         * The ntsm does not allow to select NT0 and NT2 together. We need to
-         * first check for NT2, than additionally for NT0...
-         */
-#ifdef CONFIG_PCI
-        if (!__chsc_process_crw(sei, CHSC_SEI_NT2))
-#endif
-                __chsc_process_crw(sei, CHSC_SEI_NT0);
+        __chsc_process_crw(sei, CHSC_SEI_NT0 | CHSC_SEI_NT2);
 }
 
 void chsc_chp_online(struct chp_id chpid)
diff --git a/drivers/s390/cio/chsc_sch.c b/drivers/s390/cio/chsc_sch.c
index 8f9a1a384496..facdf809113f 100644
--- a/drivers/s390/cio/chsc_sch.c
+++ b/drivers/s390/cio/chsc_sch.c
@@ -58,7 +58,7 @@ static void chsc_subchannel_irq(struct subchannel *sch)
 
         CHSC_LOG(4, "irb");
         CHSC_LOG_HEX(4, irb, sizeof(*irb));
-        kstat_cpu(smp_processor_id()).irqs[IOINT_CSC]++;
+        inc_irq_stat(IRQIO_CSC);
 
         /* Copy irb to provided request and set done. */
         if (!request) {
diff --git a/drivers/s390/cio/cio.c b/drivers/s390/cio/cio.c
index 8e927b9f285f..c8faf6230b0f 100644
--- a/drivers/s390/cio/cio.c
+++ b/drivers/s390/cio/cio.c
@@ -611,7 +611,7 @@ void __irq_entry do_IRQ(struct pt_regs *regs)
         tpi_info = (struct tpi_info *)&S390_lowcore.subchannel_id;
         irb = (struct irb *)&S390_lowcore.irb;
         do {
-                kstat_cpu(smp_processor_id()).irqs[IO_INTERRUPT]++;
+                kstat_incr_irqs_this_cpu(IO_INTERRUPT, NULL);
                 if (tpi_info->adapter_IO) {
                         do_adapter_IO(tpi_info->isc);
                         continue;
@@ -619,7 +619,7 @@ void __irq_entry do_IRQ(struct pt_regs *regs)
                 sch = (struct subchannel *)(unsigned long)tpi_info->intparm;
                 if (!sch) {
                         /* Clear pending interrupt condition. */
-                        kstat_cpu(smp_processor_id()).irqs[IOINT_CIO]++;
+                        inc_irq_stat(IRQIO_CIO);
                         tsch(tpi_info->schid, irb);
                         continue;
                 }
@@ -633,9 +633,9 @@ void __irq_entry do_IRQ(struct pt_regs *regs)
                         if (sch->driver && sch->driver->irq)
                                 sch->driver->irq(sch);
                         else
-                                kstat_cpu(smp_processor_id()).irqs[IOINT_CIO]++;
+                                inc_irq_stat(IRQIO_CIO);
                 } else
-                        kstat_cpu(smp_processor_id()).irqs[IOINT_CIO]++;
+                        inc_irq_stat(IRQIO_CIO);
                 spin_unlock(sch->lock);
                 /*
                  * Are more interrupts pending?
@@ -678,7 +678,7 @@ static void cio_tsch(struct subchannel *sch)
         if (sch->driver && sch->driver->irq)
                 sch->driver->irq(sch);
         else
-                kstat_cpu(smp_processor_id()).irqs[IOINT_CIO]++;
+                inc_irq_stat(IRQIO_CIO);
         if (!irq_context) {
                 irq_exit();
                 _local_bh_enable();
diff --git a/drivers/s390/cio/device.c b/drivers/s390/cio/device.c
index 6995cff44636..7cd5c6812ac7 100644
--- a/drivers/s390/cio/device.c
+++ b/drivers/s390/cio/device.c
@@ -758,7 +758,7 @@ static int io_subchannel_initialize_dev(struct subchannel *sch,
                                         struct ccw_device *cdev)
 {
         cdev->private->cdev = cdev;
-        cdev->private->int_class = IOINT_CIO;
+        cdev->private->int_class = IRQIO_CIO;
         atomic_set(&cdev->private->onoff, 0);
         cdev->dev.parent = &sch->dev;
         cdev->dev.release = ccw_device_release;
@@ -1023,7 +1023,7 @@ static void io_subchannel_irq(struct subchannel *sch)
         if (cdev)
                 dev_fsm_event(cdev, DEV_EVENT_INTERRUPT);
         else
-                kstat_cpu(smp_processor_id()).irqs[IOINT_CIO]++;
+                inc_irq_stat(IRQIO_CIO);
 }
 
 void io_subchannel_init_config(struct subchannel *sch)
@@ -1634,7 +1634,7 @@ ccw_device_probe_console(void)
         memset(&console_private, 0, sizeof(struct ccw_device_private));
         console_cdev.private = &console_private;
         console_private.cdev = &console_cdev;
-        console_private.int_class = IOINT_CIO;
+        console_private.int_class = IRQIO_CIO;
         ret = ccw_device_console_enable(&console_cdev, sch);
         if (ret) {
                 cio_release_console();
@@ -1715,13 +1715,13 @@ ccw_device_probe (struct device *dev)
         if (cdrv->int_class != 0)
                 cdev->private->int_class = cdrv->int_class;
         else
-                cdev->private->int_class = IOINT_CIO;
+                cdev->private->int_class = IRQIO_CIO;
 
         ret = cdrv->probe ? cdrv->probe(cdev) : -ENODEV;
 
         if (ret) {
                 cdev->drv = NULL;
-                cdev->private->int_class = IOINT_CIO;
+                cdev->private->int_class = IRQIO_CIO;
                 return ret;
         }
 
@@ -1755,7 +1755,7 @@ ccw_device_remove (struct device *dev)
         }
         ccw_device_set_timeout(cdev, 0);
         cdev->drv = NULL;
-        cdev->private->int_class = IOINT_CIO;
+        cdev->private->int_class = IRQIO_CIO;
         return 0;
 }
 
diff --git a/drivers/s390/cio/device.h b/drivers/s390/cio/device.h
index 2e575cff9845..7d4ecb65db00 100644
--- a/drivers/s390/cio/device.h
+++ b/drivers/s390/cio/device.h
@@ -61,11 +61,10 @@ dev_fsm_event(struct ccw_device *cdev, enum dev_event dev_event)
 
         if (dev_event == DEV_EVENT_INTERRUPT) {
                 if (state == DEV_STATE_ONLINE)
-                        kstat_cpu(smp_processor_id()).
-                                irqs[cdev->private->int_class]++;
+                        inc_irq_stat(cdev->private->int_class);
                 else if (state != DEV_STATE_CMFCHANGE &&
                          state != DEV_STATE_CMFUPDATE)
-                        kstat_cpu(smp_processor_id()).irqs[IOINT_CIO]++;
+                        inc_irq_stat(IRQIO_CIO);
         }
         dev_jumptable[state][dev_event](cdev, dev_event);
 }
diff --git a/drivers/s390/cio/eadm_sch.c b/drivers/s390/cio/eadm_sch.c
index 6c9673400464..d9eddcba7e88 100644
--- a/drivers/s390/cio/eadm_sch.c
+++ b/drivers/s390/cio/eadm_sch.c
@@ -139,7 +139,7 @@ static void eadm_subchannel_irq(struct subchannel *sch)
         EADM_LOG(6, "irq");
         EADM_LOG_HEX(6, irb, sizeof(*irb));
 
-        kstat_cpu(smp_processor_id()).irqs[IOINT_ADM]++;
+        inc_irq_stat(IRQIO_ADM);
 
         if ((scsw->stctl & (SCSW_STCTL_ALERT_STATUS | SCSW_STCTL_STATUS_PEND))
             && scsw->eswf == 1 && irb->esw.eadm.erw.r)
diff --git a/drivers/s390/cio/qdio_thinint.c b/drivers/s390/cio/qdio_thinint.c
index bdb394b066fc..bde5255200dc 100644
--- a/drivers/s390/cio/qdio_thinint.c
+++ b/drivers/s390/cio/qdio_thinint.c
@@ -182,7 +182,7 @@ static void tiqdio_thinint_handler(void *alsi, void *data)
         struct qdio_q *q;
 
         last_ai_time = S390_lowcore.int_clock;
-        kstat_cpu(smp_processor_id()).irqs[IOINT_QAI]++;
+        inc_irq_stat(IRQIO_QAI);
 
         /* protect tiq_list entries, only changed in activate or shutdown */
         rcu_read_lock();
diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c
index 7b865a7300e6..b8b340ac5332 100644
--- a/drivers/s390/crypto/ap_bus.c
+++ b/drivers/s390/crypto/ap_bus.c
@@ -1272,7 +1272,7 @@ out:
 
 static void ap_interrupt_handler(void *unused1, void *unused2)
 {
-        kstat_cpu(smp_processor_id()).irqs[IOINT_APB]++;
+        inc_irq_stat(IRQIO_APB);
         tasklet_schedule(&ap_tasklet);
 }
 
diff --git a/drivers/s390/kvm/kvm_virtio.c b/drivers/s390/kvm/kvm_virtio.c
index 7dabef624da3..8491111aec12 100644
--- a/drivers/s390/kvm/kvm_virtio.c
+++ b/drivers/s390/kvm/kvm_virtio.c
@@ -392,7 +392,7 @@ static void kvm_extint_handler(struct ext_code ext_code,
 
         if ((ext_code.subcode & 0xff00) != VIRTIO_SUBCODE_64)
                 return;
-        kstat_cpu(smp_processor_id()).irqs[EXTINT_VRT]++;
+        inc_irq_stat(IRQEXT_VRT);
 
         /* The LSB might be overloaded, we have to mask it */
         vq = (struct virtqueue *)(param64 & ~1UL);
diff --git a/drivers/s390/net/claw.c b/drivers/s390/net/claw.c
index 5c70a6599578..83bc9c5fa0c1 100644
--- a/drivers/s390/net/claw.c
+++ b/drivers/s390/net/claw.c
@@ -282,7 +282,7 @@ static struct ccw_driver claw_ccw_driver = {
         .ids    = claw_ids,
         .probe  = ccwgroup_probe_ccwdev,
         .remove = ccwgroup_remove_ccwdev,
-        .int_class = IOINT_CLW,
+        .int_class = IRQIO_CLW,
 };
 
 static ssize_t claw_driver_group_store(struct device_driver *ddrv,
diff --git a/drivers/s390/net/ctcm_main.c b/drivers/s390/net/ctcm_main.c
index 817b68925ddd..676f12049a36 100644
--- a/drivers/s390/net/ctcm_main.c
+++ b/drivers/s390/net/ctcm_main.c
@@ -1755,7 +1755,7 @@ static struct ccw_driver ctcm_ccw_driver = {
         .ids    = ctcm_ids,
         .probe  = ccwgroup_probe_ccwdev,
         .remove = ccwgroup_remove_ccwdev,
-        .int_class = IOINT_CTC,
+        .int_class = IRQIO_CTC,
 };
 
 static struct ccwgroup_driver ctcm_group_driver = {
diff --git a/drivers/s390/net/lcs.c b/drivers/s390/net/lcs.c
index 2ca0f1dd7a00..c645dc9e98af 100644
--- a/drivers/s390/net/lcs.c
+++ b/drivers/s390/net/lcs.c
@@ -2384,7 +2384,7 @@ static struct ccw_driver lcs_ccw_driver = {
         .ids    = lcs_ids,
         .probe  = ccwgroup_probe_ccwdev,
         .remove = ccwgroup_remove_ccwdev,
-        .int_class = IOINT_LCS,
+        .int_class = IRQIO_LCS,
 };
 
 /**
diff --git a/drivers/scsi/isci/init.c b/drivers/scsi/isci/init.c
index d73fdcfeb45a..2839baa82a5a 100644
--- a/drivers/scsi/isci/init.c
+++ b/drivers/scsi/isci/init.c
@@ -633,7 +633,7 @@ static int isci_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
                 return -ENOMEM;
         pci_set_drvdata(pdev, pci_info);
 
-        if (efi_enabled)
+        if (efi_enabled(EFI_RUNTIME_SERVICES))
                 orom = isci_get_efi_var(pdev);
 
         if (!orom)
diff --git a/drivers/sh/clk/cpg.c b/drivers/sh/clk/cpg.c
index 5aedcdf4ac5c..1ebe67cd1833 100644
--- a/drivers/sh/clk/cpg.c
+++ b/drivers/sh/clk/cpg.c
@@ -126,6 +126,12 @@ static int sh_clk_div_set_rate(struct clk *clk, unsigned long rate)
 
 static int sh_clk_div_enable(struct clk *clk)
 {
+        if (clk->div_mask == SH_CLK_DIV6_MSK) {
+                int ret = sh_clk_div_set_rate(clk, clk->rate);
+                if (ret < 0)
+                        return ret;
+        }
+
         sh_clk_write(sh_clk_read(clk) & ~CPG_CKSTP_BIT, clk);
         return 0;
 }
diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index 19ee901577da..3a6083b386a1 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -33,7 +33,7 @@
 #include <linux/of_gpio.h>
 #include <linux/pm_runtime.h>
 #include <linux/export.h>
-#include <linux/sched.h>
+#include <linux/sched/rt.h>
 #include <linux/delay.h>
 #include <linux/kthread.h>
 #include <linux/ioport.h>
diff --git a/drivers/ssb/driver_gpio.c b/drivers/ssb/driver_gpio.c
index 97ac0a38e3d0..eb2753008ef0 100644
--- a/drivers/ssb/driver_gpio.c
+++ b/drivers/ssb/driver_gpio.c
@@ -174,3 +174,15 @@ int ssb_gpio_init(struct ssb_bus *bus)
 
         return -1;
 }
+
+int ssb_gpio_unregister(struct ssb_bus *bus)
+{
+        if (ssb_chipco_available(&bus->chipco) ||
+            ssb_extif_available(&bus->extif)) {
+                return gpiochip_remove(&bus->gpio);
+        } else {
+                SSB_WARN_ON(1);
+        }
+
+        return -1;
+}
diff --git a/drivers/ssb/main.c b/drivers/ssb/main.c
index 772ad9b5c304..24dc331b4701 100644
--- a/drivers/ssb/main.c
+++ b/drivers/ssb/main.c
@@ -443,6 +443,15 @@ static void ssb_devices_unregister(struct ssb_bus *bus)
 
 void ssb_bus_unregister(struct ssb_bus *bus)
 {
+        int err;
+
+        err = ssb_gpio_unregister(bus);
+        if (err == -EBUSY)
+                ssb_dprintk(KERN_ERR PFX "Some GPIOs are still in use.\n");
+        else if (err)
+                ssb_dprintk(KERN_ERR PFX
+                            "Can not unregister GPIO driver: %i\n", err);
+
         ssb_buses_lock();
         ssb_devices_unregister(bus);
         list_del(&bus->list);
diff --git a/drivers/ssb/ssb_private.h b/drivers/ssb/ssb_private.h
index 6c10b66c796c..da38305a2d22 100644
--- a/drivers/ssb/ssb_private.h
+++ b/drivers/ssb/ssb_private.h
@@ -252,11 +252,16 @@ static inline void ssb_extif_init(struct ssb_extif *extif)
 
 #ifdef CONFIG_SSB_DRIVER_GPIO
 extern int ssb_gpio_init(struct ssb_bus *bus);
+extern int ssb_gpio_unregister(struct ssb_bus *bus);
 #else /* CONFIG_SSB_DRIVER_GPIO */
 static inline int ssb_gpio_init(struct ssb_bus *bus)
 {
         return -ENOTSUPP;
 }
+static inline int ssb_gpio_unregister(struct ssb_bus *bus)
+{
+        return 0;
+}
 #endif /* CONFIG_SSB_DRIVER_GPIO */
 
 #endif /* LINUX_SSB_PRIVATE_H_ */
diff --git a/drivers/staging/comedi/Kconfig b/drivers/staging/comedi/Kconfig
index 7de2a10213bd..36eec320569c 100644
--- a/drivers/staging/comedi/Kconfig
+++ b/drivers/staging/comedi/Kconfig
@@ -444,6 +444,7 @@ config COMEDI_ADQ12B
 
 config COMEDI_NI_AT_A2150
         tristate "NI AT-A2150 ISA card support"
+        select COMEDI_FC
         depends on VIRT_TO_BUS
         ---help---
           Enable support for National Instruments AT-A2150 cards
diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c
index b7bba1790a20..9b038e4a7e71 100644
--- a/drivers/staging/comedi/comedi_fops.c
+++ b/drivers/staging/comedi/comedi_fops.c
@@ -1549,6 +1549,9 @@ static long comedi_unlocked_ioctl(struct file *file, unsigned int cmd,
         if (cmd == COMEDI_DEVCONFIG) {
                 rc = do_devconfig_ioctl(dev,
                                         (struct comedi_devconfig __user *)arg);
+                if (rc == 0)
+                        /* Evade comedi_auto_unconfig(). */
+                        dev_file_info->hardware_device = NULL;
                 goto done;
         }
 
diff --git a/drivers/staging/comedi/drivers/comedi_test.c b/drivers/staging/comedi/drivers/comedi_test.c
index fb3d09323ba1..01de996239f1 100644
--- a/drivers/staging/comedi/drivers/comedi_test.c
+++ b/drivers/staging/comedi/drivers/comedi_test.c
@@ -345,7 +345,7 @@ static int waveform_ai_cancel(struct comedi_device *dev,
         struct waveform_private *devpriv = dev->private;
 
         devpriv->timer_running = 0;
-        del_timer(&devpriv->timer);
+        del_timer_sync(&devpriv->timer);
         return 0;
 }
 
diff --git a/drivers/staging/comedi/drivers/ni_pcimio.c b/drivers/staging/comedi/drivers/ni_pcimio.c
index aaac0b2cc9eb..fd1662b4175d 100644
--- a/drivers/staging/comedi/drivers/ni_pcimio.c
+++ b/drivers/staging/comedi/drivers/ni_pcimio.c
@@ -963,7 +963,7 @@ static const struct ni_board_struct ni_boards[] = {
          .ao_range_table = &range_ni_M_625x_ao,
          .reg_type = ni_reg_625x,
          .ao_unipolar = 0,
-         .ao_speed = 357,
+         .ao_speed = 350,
          .num_p0_dio_channels = 8,
          .caldac = {caldac_none},
          .has_8255 = 0,
@@ -982,7 +982,7 @@ static const struct ni_board_struct ni_boards[] = {
          .ao_range_table = &range_ni_M_625x_ao,
          .reg_type = ni_reg_625x,
          .ao_unipolar = 0,
-         .ao_speed = 357,
+         .ao_speed = 350,
          .num_p0_dio_channels = 8,
          .caldac = {caldac_none},
          .has_8255 = 0,
@@ -1001,7 +1001,7 @@ static const struct ni_board_struct ni_boards[] = {
          .ao_range_table = &range_ni_M_625x_ao,
          .reg_type = ni_reg_625x,
          .ao_unipolar = 0,
-         .ao_speed = 357,
+         .ao_speed = 350,
          .num_p0_dio_channels = 8,
          .caldac = {caldac_none},
          .has_8255 = 0,
@@ -1037,7 +1037,7 @@ static const struct ni_board_struct ni_boards[] = {
          .ao_range_table = &range_ni_M_625x_ao,
          .reg_type = ni_reg_625x,
          .ao_unipolar = 0,
-         .ao_speed = 357,
+         .ao_speed = 350,
          .num_p0_dio_channels = 32,
          .caldac = {caldac_none},
          .has_8255 = 0,
@@ -1056,7 +1056,7 @@ static const struct ni_board_struct ni_boards[] = {
          .ao_range_table = &range_ni_M_625x_ao,
          .reg_type = ni_reg_625x,
          .ao_unipolar = 0,
-         .ao_speed = 357,
+         .ao_speed = 350,
          .num_p0_dio_channels = 32,
          .caldac = {caldac_none},
          .has_8255 = 0,
@@ -1092,7 +1092,7 @@ static const struct ni_board_struct ni_boards[] = {
          .ao_range_table = &range_ni_M_628x_ao,
          .reg_type = ni_reg_628x,
          .ao_unipolar = 1,
-         .ao_speed = 357,
+         .ao_speed = 350,
          .num_p0_dio_channels = 8,
          .caldac = {caldac_none},
          .has_8255 = 0,
@@ -1111,7 +1111,7 @@ static const struct ni_board_struct ni_boards[] = {
          .ao_range_table = &range_ni_M_628x_ao,
          .reg_type = ni_reg_628x,
          .ao_unipolar = 1,
-         .ao_speed = 357,
+         .ao_speed = 350,
          .num_p0_dio_channels = 8,
          .caldac = {caldac_none},
          .has_8255 = 0,
@@ -1147,7 +1147,7 @@ static const struct ni_board_struct ni_boards[] = {
          .ao_range_table = &range_ni_M_628x_ao,
          .reg_type = ni_reg_628x,
          .ao_unipolar = 1,
-         .ao_speed = 357,
+         .ao_speed = 350,
          .num_p0_dio_channels = 32,
          .caldac = {caldac_none},
          .has_8255 = 0,
diff --git a/drivers/staging/csr/bh.c b/drivers/staging/csr/bh.c
index 1a1f5c79822a..7b133597e923 100644
--- a/drivers/staging/csr/bh.c
+++ b/drivers/staging/csr/bh.c
@@ -15,7 +15,7 @@
  */
 #include "csr_wifi_hip_unifi.h"
 #include "unifi_priv.h"
-
+#include <linux/sched/rt.h>
 
 /*
  * ---------------------------------------------------------------------------
diff --git a/drivers/staging/csr/unifi_sme.c b/drivers/staging/csr/unifi_sme.c
index 7c6c4138fc76..49395da34b7f 100644
--- a/drivers/staging/csr/unifi_sme.c
+++ b/drivers/staging/csr/unifi_sme.c
@@ -15,7 +15,7 @@
 #include "unifi_priv.h"
 #include "csr_wifi_hip_unifi.h"
 #include "csr_wifi_hip_conversions.h"
-
+#include <linux/sched/rt.h>
 
 
 
diff --git a/drivers/staging/fwserial/Kconfig b/drivers/staging/fwserial/Kconfig
index 580406cb1808..b2f8331e4acf 100644
--- a/drivers/staging/fwserial/Kconfig
+++ b/drivers/staging/fwserial/Kconfig
@@ -3,7 +3,9 @@ config FIREWIRE_SERIAL
        depends on FIREWIRE
        help
           This enables TTY over IEEE 1394, providing high-speed serial
-          connectivity to cabled peers.
+          connectivity to cabled peers. This driver implements a
+          ad-hoc transport protocol and is currently limited to
+          Linux-to-Linux communication.
 
           To compile this driver as a module, say M here:  the module will
           be called firewire-serial.
diff --git a/drivers/staging/fwserial/TODO b/drivers/staging/fwserial/TODO
index 726900548eae..8dae8fb25223 100644
--- a/drivers/staging/fwserial/TODO
+++ b/drivers/staging/fwserial/TODO
@@ -1,5 +1,5 @@
-TODOs
------
+TODOs prior to this driver moving out of staging
+------------------------------------------------
 1. Implement retries for RCODE_BUSY, RCODE_NO_ACK and RCODE_SEND_ERROR
    - I/O is handled asynchronously which presents some issues when error
      conditions occur.
@@ -11,17 +11,9 @@ TODOs
 -- Issues with firewire stack --
 1. This driver uses the same unregistered vendor id that the firewire core does
      (0xd00d1e). Perhaps this could be exposed as a define in
-     firewire-constants.h?
-2. MAX_ASYNC_PAYLOAD needs to be publicly exposed by core/ohci
-   - otherwise how will this driver know the max size of address window to
-     open for one packet write?
+     firewire.h?
 3. Maybe device_max_receive() and link_speed_to_max_payload() should be
      taken up by the firewire core?
-4. To avoid dropping rx data while still limiting the maximum buffering,
-     the size of the AR context must be known. How to expose this to drivers?
-5. Explore if bigger AR context will reduce RCODE_BUSY responses
-   (or auto-grow to certain max size -- but this would require major surgery
-    as the current AR is contiguously mapped)
 
 -- Issues with TTY core --
   1. Hack for alternate device name scheme
diff --git a/drivers/staging/fwserial/fwserial.c b/drivers/staging/fwserial/fwserial.c
index 61ee29083b26..d03a7f57e8d4 100644
--- a/drivers/staging/fwserial/fwserial.c
+++ b/drivers/staging/fwserial/fwserial.c
@@ -179,7 +179,7 @@ static void dump_profile(struct seq_file *m, struct stats *stats)
 /* Returns the max receive packet size for the given card */
 static inline int device_max_receive(struct fw_device *fw_device)
 {
-        return 1 <<  (clamp_t(int, fw_device->max_rec, 8U, 13U) + 1);
+        return 1 <<  (clamp_t(int, fw_device->max_rec, 8U, 11U) + 1);
 }
 
 static void fwtty_log_tx_error(struct fwtty_port *port, int rcode)
diff --git a/drivers/staging/fwserial/fwserial.h b/drivers/staging/fwserial/fwserial.h
index 8b572edf9563..caa1c1ea82d5 100644
--- a/drivers/staging/fwserial/fwserial.h
+++ b/drivers/staging/fwserial/fwserial.h
@@ -374,10 +374,10 @@ static inline void fwtty_bind_console(struct fwtty_port *port,
  */
 static inline int link_speed_to_max_payload(unsigned speed)
 {
-        static const int max_async[] = { 307, 614, 1229, 2458, 4916, 9832, };
-        BUILD_BUG_ON(ARRAY_SIZE(max_async) - 1 != SCODE_3200);
+        static const int max_async[] = { 307, 614, 1229, 2458, };
+        BUILD_BUG_ON(ARRAY_SIZE(max_async) - 1 != SCODE_800);
 
-        speed = clamp(speed, (unsigned) SCODE_100, (unsigned) SCODE_3200);
+        speed = clamp(speed, (unsigned) SCODE_100, (unsigned) SCODE_800);
         if (limit_bw)
                 return max_async[speed];
         else
diff --git a/drivers/staging/iio/adc/mxs-lradc.c b/drivers/staging/iio/adc/mxs-lradc.c
index fb31b457a56a..c5ceb9d90ea8 100644
--- a/drivers/staging/iio/adc/mxs-lradc.c
+++ b/drivers/staging/iio/adc/mxs-lradc.c
@@ -239,7 +239,7 @@ static irqreturn_t mxs_lradc_trigger_handler(int irq, void *p)
         struct mxs_lradc *lradc = iio_priv(iio);
         const uint32_t chan_value = LRADC_CH_ACCUMULATE |
                 ((LRADC_DELAY_TIMER_LOOP - 1) << LRADC_CH_NUM_SAMPLES_OFFSET);
-        int i, j = 0;
+        unsigned int i, j = 0;
 
         for_each_set_bit(i, iio->active_scan_mask, iio->masklength) {
                 lradc->buffer[j] = readl(lradc->base + LRADC_CH(j));
diff --git a/drivers/staging/iio/gyro/Kconfig b/drivers/staging/iio/gyro/Kconfig
index ea295b25308c..87979a0d03a9 100644
--- a/drivers/staging/iio/gyro/Kconfig
+++ b/drivers/staging/iio/gyro/Kconfig
@@ -27,8 +27,8 @@ config ADIS16130
 config ADIS16260
         tristate "Analog Devices ADIS16260 Digital Gyroscope Sensor SPI driver"
         depends on SPI
-        select IIO_TRIGGER if IIO_BUFFER
-        select IIO_SW_RING if IIO_BUFFER
+        select IIO_ADIS_LIB
+        select IIO_ADIS_LIB_BUFFER if IIO_BUFFER
         help
           Say yes here to build support for Analog Devices ADIS16260 ADIS16265
           ADIS16250 ADIS16255 and ADIS16251 programmable digital gyroscope sensors.
diff --git a/drivers/staging/iio/gyro/adis16080_core.c b/drivers/staging/iio/gyro/adis16080_core.c
index 3525a68d6a75..41d7350d030f 100644
--- a/drivers/staging/iio/gyro/adis16080_core.c
+++ b/drivers/staging/iio/gyro/adis16080_core.c
@@ -69,7 +69,7 @@ static int adis16080_spi_read(struct iio_dev *indio_dev,
         ret = spi_read(st->us, st->buf, 2);
 
         if (ret == 0)
-                *val = ((st->buf[0] & 0xF) << 8) | st->buf[1];
+                *val = sign_extend32(((st->buf[0] & 0xF) << 8) | st->buf[1], 11);
         mutex_unlock(&st->buf_lock);
 
         return ret;
diff --git a/drivers/staging/iio/trigger/Kconfig b/drivers/staging/iio/trigger/Kconfig
index 7d3207559265..d44d3ad26fa5 100644
--- a/drivers/staging/iio/trigger/Kconfig
+++ b/drivers/staging/iio/trigger/Kconfig
@@ -21,7 +21,6 @@ config IIO_GPIO_TRIGGER
 config IIO_SYSFS_TRIGGER
         tristate "SYSFS trigger"
         depends on SYSFS
-        depends on HAVE_IRQ_WORK
         select IRQ_WORK
         help
           Provides support for using SYSFS entry as IIO triggers.
diff --git a/drivers/staging/imx-drm/imx-drm-core.c b/drivers/staging/imx-drm/imx-drm-core.c
index ecf0f44bc70e..cec19f1cf56c 100644
--- a/drivers/staging/imx-drm/imx-drm-core.c
+++ b/drivers/staging/imx-drm/imx-drm-core.c
@@ -584,7 +584,6 @@ int imx_drm_add_encoder(struct drm_encoder *encoder,
 
         ret = imx_drm_encoder_register(imx_drm_encoder);
         if (ret) {
-                kfree(imx_drm_encoder);
                 ret = -ENOMEM;
                 goto err_register;
         }
diff --git a/drivers/staging/imx-drm/ipu-v3/ipu-common.c b/drivers/staging/imx-drm/ipu-v3/ipu-common.c
index 677e665ca86d..f7059cddd7fd 100644
--- a/drivers/staging/imx-drm/ipu-v3/ipu-common.c
+++ b/drivers/staging/imx-drm/ipu-v3/ipu-common.c
@@ -1104,7 +1104,9 @@ static int ipu_probe(struct platform_device *pdev)
         if (ret)
                 goto out_failed_irq;
 
-        ipu_reset(ipu);
+        ret = ipu_reset(ipu);
+        if (ret)
+                goto out_failed_reset;
 
         /* Set MCU_T to divide MCU access window into 2 */
         ipu_cm_write(ipu, 0x00400000L | (IPU_MCU_T_DEFAULT << 18),
@@ -1129,6 +1131,7 @@ failed_add_clients:
         ipu_submodules_exit(ipu);
 failed_submodules_init:
         ipu_irq_exit(ipu);
+out_failed_reset:
 out_failed_irq:
         clk_disable_unprepare(ipu->clk);
 failed_clk_get:
diff --git a/drivers/staging/imx-drm/ipuv3-crtc.c b/drivers/staging/imx-drm/ipuv3-crtc.c
index 1892006526b5..4b3a019409b5 100644
--- a/drivers/staging/imx-drm/ipuv3-crtc.c
+++ b/drivers/staging/imx-drm/ipuv3-crtc.c
@@ -452,7 +452,7 @@ static int ipu_get_resources(struct ipu_crtc *ipu_crtc,
         int ret;
 
         ipu_crtc->ipu_ch = ipu_idmac_get(ipu, pdata->dma[0]);
-        if (IS_ERR_OR_NULL(ipu_crtc->ipu_ch)) {
+        if (IS_ERR(ipu_crtc->ipu_ch)) {
                 ret = PTR_ERR(ipu_crtc->ipu_ch);
                 goto err_out;
         }
@@ -472,7 +472,7 @@ static int ipu_get_resources(struct ipu_crtc *ipu_crtc,
         if (pdata->dp >= 0) {
                 ipu_crtc->dp = ipu_dp_get(ipu, pdata->dp);
                 if (IS_ERR(ipu_crtc->dp)) {
-                        ret = PTR_ERR(ipu_crtc->ipu_ch);
+                        ret = PTR_ERR(ipu_crtc->dp);
                         goto err_out;
                 }
         }
@@ -548,6 +548,8 @@ static int ipu_drm_probe(struct platform_device *pdev)
         ipu_crtc->dev = &pdev->dev;
 
         ret = ipu_crtc_init(ipu_crtc, pdata);
+        if (ret)
+                return ret;
 
         platform_set_drvdata(pdev, ipu_crtc);
 
diff --git a/drivers/staging/omapdrm/Kconfig b/drivers/staging/omapdrm/Kconfig
index b724a4131435..09f65dc3d2c8 100644
--- a/drivers/staging/omapdrm/Kconfig
+++ b/drivers/staging/omapdrm/Kconfig
@@ -3,8 +3,8 @@ config DRM_OMAP
         tristate "OMAP DRM"
         depends on DRM && !CONFIG_FB_OMAP2
         depends on ARCH_OMAP2PLUS || ARCH_MULTIPLATFORM
+        depends on OMAP2_DSS
         select DRM_KMS_HELPER
-        select OMAP2_DSS
         select FB_SYS_FILLRECT
         select FB_SYS_COPYAREA
         select FB_SYS_IMAGEBLIT
diff --git a/drivers/staging/omapdrm/Makefile b/drivers/staging/omapdrm/Makefile
index 1ca0e0016de4..d85e058f2845 100644
--- a/drivers/staging/omapdrm/Makefile
+++ b/drivers/staging/omapdrm/Makefile
@@ -5,6 +5,7 @@
 
 ccflags-y := -Iinclude/drm -Werror
 omapdrm-y := omap_drv.o \
+        omap_irq.o \
         omap_debugfs.o \
         omap_crtc.o \
         omap_plane.o \
diff --git a/drivers/staging/omapdrm/TODO b/drivers/staging/omapdrm/TODO
index 938c7888ca31..abeeb00aaa12 100644
--- a/drivers/staging/omapdrm/TODO
+++ b/drivers/staging/omapdrm/TODO
@@ -17,9 +17,6 @@ TODO
 . Revisit GEM sync object infrastructure.. TTM has some framework for this
   already.  Possibly this could be refactored out and made more common?
   There should be some way to do this with less wheel-reinvention.
-. Review DSS vs KMS mismatches.  The omap_dss_device is sort of part encoder,
-  part connector.  Which results in a bit of duct tape to fwd calls from
-  encoder to connector.  Possibly this could be done a bit better.
 . Solve PM sequencing on resume.  DMM/TILER must be reloaded before any
   access is made from any component in the system.  Which means on suspend
   CRTC's should be disabled, and on resume the LUT should be reprogrammed
diff --git a/drivers/staging/omapdrm/omap_connector.c b/drivers/staging/omapdrm/omap_connector.c
index 91edb3f96972..4cc9ee733c5f 100644
--- a/drivers/staging/omapdrm/omap_connector.c
+++ b/drivers/staging/omapdrm/omap_connector.c
@@ -31,9 +31,10 @@
 struct omap_connector {
         struct drm_connector base;
         struct omap_dss_device *dssdev;
+        struct drm_encoder *encoder;
 };
 
-static inline void copy_timings_omap_to_drm(struct drm_display_mode *mode,
+void copy_timings_omap_to_drm(struct drm_display_mode *mode,
                 struct omap_video_timings *timings)
 {
         mode->clock = timings->pixel_clock;
@@ -64,7 +65,7 @@ static inline void copy_timings_omap_to_drm(struct drm_display_mode *mode,
                 mode->flags |= DRM_MODE_FLAG_NVSYNC;
 }
 
-static inline void copy_timings_drm_to_omap(struct omap_video_timings *timings,
+void copy_timings_drm_to_omap(struct omap_video_timings *timings,
                 struct drm_display_mode *mode)
 {
         timings->pixel_clock = mode->clock;
@@ -96,48 +97,7 @@ static inline void copy_timings_drm_to_omap(struct omap_video_timings *timings,
         timings->sync_pclk_edge = OMAPDSS_DRIVE_SIG_OPPOSITE_EDGES;
 }
 
-static void omap_connector_dpms(struct drm_connector *connector, int mode)
-{
-        struct omap_connector *omap_connector = to_omap_connector(connector);
-        struct omap_dss_device *dssdev = omap_connector->dssdev;
-        int old_dpms;
-
-        DBG("%s: %d", dssdev->name, mode);
-
-        old_dpms = connector->dpms;
-
-        /* from off to on, do from crtc to connector */
-        if (mode < old_dpms)
-                drm_helper_connector_dpms(connector, mode);
-
-        if (mode == DRM_MODE_DPMS_ON) {
-                /* store resume info for suspended displays */
-                switch (dssdev->state) {
-                case OMAP_DSS_DISPLAY_SUSPENDED:
-                        dssdev->activate_after_resume = true;
-                        break;
-                case OMAP_DSS_DISPLAY_DISABLED: {
-                        int ret = dssdev->driver->enable(dssdev);
-                        if (ret) {
-                                DBG("%s: failed to enable: %d",
-                                                dssdev->name, ret);
-                                dssdev->driver->disable(dssdev);
-                        }
-                        break;
-                }
-                default:
-                        break;
-                }
-        } else {
-                /* TODO */
-        }
-
-        /* from on to off, do from connector to crtc */
-        if (mode > old_dpms)
-                drm_helper_connector_dpms(connector, mode);
-}
-
-enum drm_connector_status omap_connector_detect(
+static enum drm_connector_status omap_connector_detect(
                 struct drm_connector *connector, bool force)
 {
         struct omap_connector *omap_connector = to_omap_connector(connector);
@@ -164,8 +124,6 @@ static void omap_connector_destroy(struct drm_connector *connector)
         struct omap_connector *omap_connector = to_omap_connector(connector);
         struct omap_dss_device *dssdev = omap_connector->dssdev;
 
-        dssdev->driver->disable(dssdev);
-
         DBG("%s", omap_connector->dssdev->name);
         drm_sysfs_connector_remove(connector);
         drm_connector_cleanup(connector);
@@ -261,36 +219,12 @@ static int omap_connector_mode_valid(struct drm_connector *connector,
 struct drm_encoder *omap_connector_attached_encoder(
                 struct drm_connector *connector)
 {
-        int i;
         struct omap_connector *omap_connector = to_omap_connector(connector);
-
-        for (i = 0; i < DRM_CONNECTOR_MAX_ENCODER; i++) {
-                struct drm_mode_object *obj;
-
-                if (connector->encoder_ids[i] == 0)
-                        break;
-
-                obj = drm_mode_object_find(connector->dev,
-                                connector->encoder_ids[i],
-                                DRM_MODE_OBJECT_ENCODER);
-
-                if (obj) {
-                        struct drm_encoder *encoder = obj_to_encoder(obj);
-                        struct omap_overlay_manager *mgr =
-                                        omap_encoder_get_manager(encoder);
-                        DBG("%s: found %s", omap_connector->dssdev->name,
-                                        mgr->name);
-                        return encoder;
-                }
-        }
-
-        DBG("%s: no encoder", omap_connector->dssdev->name);
-
-        return NULL;
+        return omap_connector->encoder;
 }
 
 static const struct drm_connector_funcs omap_connector_funcs = {
-        .dpms = omap_connector_dpms,
+        .dpms = drm_helper_connector_dpms,
         .detect = omap_connector_detect,
         .fill_modes = drm_helper_probe_single_connector_modes,
         .destroy = omap_connector_destroy,
@@ -302,34 +236,6 @@ static const struct drm_connector_helper_funcs omap_connector_helper_funcs = {
         .best_encoder = omap_connector_attached_encoder,
 };
 
-/* called from encoder when mode is set, to propagate settings to the dssdev */
-void omap_connector_mode_set(struct drm_connector *connector,
-                struct drm_display_mode *mode)
-{
-        struct drm_device *dev = connector->dev;
-        struct omap_connector *omap_connector = to_omap_connector(connector);
-        struct omap_dss_device *dssdev = omap_connector->dssdev;
-        struct omap_dss_driver *dssdrv = dssdev->driver;
-        struct omap_video_timings timings = {0};
-
-        copy_timings_drm_to_omap(&timings, mode);
-
-        DBG("%s: set mode: %d:\"%s\" %d %d %d %d %d %d %d %d %d %d 0x%x 0x%x",
-                        omap_connector->dssdev->name,
-                        mode->base.id, mode->name, mode->vrefresh, mode->clock,
-                        mode->hdisplay, mode->hsync_start,
-                        mode->hsync_end, mode->htotal,
-                        mode->vdisplay, mode->vsync_start,
-                        mode->vsync_end, mode->vtotal, mode->type, mode->flags);
-
-        if (dssdrv->check_timings(dssdev, &timings)) {
-                dev_err(dev->dev, "could not set timings\n");
-                return;
-        }
-
-        dssdrv->set_timings(dssdev, &timings);
-}
-
 /* flush an area of the framebuffer (in case of manual update display that
  * is not automatically flushed)
  */
@@ -344,7 +250,8 @@ void omap_connector_flush(struct drm_connector *connector,
 
 /* initialize connector */
 struct drm_connector *omap_connector_init(struct drm_device *dev,
-                int connector_type, struct omap_dss_device *dssdev)
+                int connector_type, struct omap_dss_device *dssdev,
+                struct drm_encoder *encoder)
 {
         struct drm_connector *connector = NULL;
         struct omap_connector *omap_connector;
@@ -360,6 +267,8 @@ struct drm_connector *omap_connector_init(struct drm_device *dev,
         }
 
         omap_connector->dssdev = dssdev;
+        omap_connector->encoder = encoder;
+
         connector = &omap_connector->base;
 
         drm_connector_init(dev, connector, &omap_connector_funcs,
diff --git a/drivers/staging/omapdrm/omap_crtc.c b/drivers/staging/omapdrm/omap_crtc.c
index d87bd84257bd..5c6ed6040eff 100644
--- a/drivers/staging/omapdrm/omap_crtc.c
+++ b/drivers/staging/omapdrm/omap_crtc.c
@@ -28,19 +28,131 @@
 struct omap_crtc {
         struct drm_crtc base;
         struct drm_plane *plane;
+
         const char *name;
-        int id;
+        int pipe;
+        enum omap_channel channel;
+        struct omap_overlay_manager_info info;
+
+        /*
+         * Temporary: eventually this will go away, but it is needed
+         * for now to keep the output's happy.  (They only need
+         * mgr->id.)  Eventually this will be replaced w/ something
+         * more common-panel-framework-y
+         */
+        struct omap_overlay_manager mgr;
+
+        struct omap_video_timings timings;
+        bool enabled;
+        bool full_update;
+
+        struct omap_drm_apply apply;
+
+        struct omap_drm_irq apply_irq;
+        struct omap_drm_irq error_irq;
+
+        /* list of in-progress apply's: */
+        struct list_head pending_applies;
+
+        /* list of queued apply's: */
+        struct list_head queued_applies;
+
+        /* for handling queued and in-progress applies: */
+        struct work_struct apply_work;
 
         /* if there is a pending flip, these will be non-null: */
         struct drm_pending_vblank_event *event;
         struct drm_framebuffer *old_fb;
+
+        /* for handling page flips without caring about what
+         * the callback is called from.  Possibly we should just
+         * make omap_gem always call the cb from the worker so
+         * we don't have to care about this..
+         *
+         * XXX maybe fold into apply_work??
+         */
+        struct work_struct page_flip_work;
+};
+
+/*
+ * Manager-ops, callbacks from output when they need to configure
+ * the upstream part of the video pipe.
+ *
+ * Most of these we can ignore until we add support for command-mode
+ * panels.. for video-mode the crtc-helpers already do an adequate
+ * job of sequencing the setup of the video pipe in the proper order
+ */
+
+/* we can probably ignore these until we support command-mode panels: */
+static void omap_crtc_start_update(struct omap_overlay_manager *mgr)
+{
+}
+
+static int omap_crtc_enable(struct omap_overlay_manager *mgr)
+{
+        return 0;
+}
+
+static void omap_crtc_disable(struct omap_overlay_manager *mgr)
+{
+}
+
+static void omap_crtc_set_timings(struct omap_overlay_manager *mgr,
+                const struct omap_video_timings *timings)
+{
+        struct omap_crtc *omap_crtc = container_of(mgr, struct omap_crtc, mgr);
+        DBG("%s", omap_crtc->name);
+        omap_crtc->timings = *timings;
+        omap_crtc->full_update = true;
+}
+
+static void omap_crtc_set_lcd_config(struct omap_overlay_manager *mgr,
+                const struct dss_lcd_mgr_config *config)
+{
+        struct omap_crtc *omap_crtc = container_of(mgr, struct omap_crtc, mgr);
+        DBG("%s", omap_crtc->name);
+        dispc_mgr_set_lcd_config(omap_crtc->channel, config);
+}
+
+static int omap_crtc_register_framedone_handler(
+                struct omap_overlay_manager *mgr,
+                void (*handler)(void *), void *data)
+{
+        return 0;
+}
+
+static void omap_crtc_unregister_framedone_handler(
+                struct omap_overlay_manager *mgr,
+                void (*handler)(void *), void *data)
+{
+}
+
+static const struct dss_mgr_ops mgr_ops = {
+                .start_update = omap_crtc_start_update,
+                .enable = omap_crtc_enable,
+                .disable = omap_crtc_disable,
+                .set_timings = omap_crtc_set_timings,
+                .set_lcd_config = omap_crtc_set_lcd_config,
+                .register_framedone_handler = omap_crtc_register_framedone_handler,
+                .unregister_framedone_handler = omap_crtc_unregister_framedone_handler,
 };
 
+/*
+ * CRTC funcs:
+ */
+
 static void omap_crtc_destroy(struct drm_crtc *crtc)
 {
         struct omap_crtc *omap_crtc = to_omap_crtc(crtc);
+
+        DBG("%s", omap_crtc->name);
+
+        WARN_ON(omap_crtc->apply_irq.registered);
+        omap_irq_unregister(crtc->dev, &omap_crtc->error_irq);
+
         omap_crtc->plane->funcs->destroy(omap_crtc->plane);
         drm_crtc_cleanup(crtc);
+
         kfree(omap_crtc);
 }
 
@@ -48,14 +160,25 @@ static void omap_crtc_dpms(struct drm_crtc *crtc, int mode)
 {
         struct omap_drm_private *priv = crtc->dev->dev_private;
         struct omap_crtc *omap_crtc = to_omap_crtc(crtc);
+        bool enabled = (mode == DRM_MODE_DPMS_ON);
         int i;
 
-        WARN_ON(omap_plane_dpms(omap_crtc->plane, mode));
+        DBG("%s: %d", omap_crtc->name, mode);
+
+        if (enabled != omap_crtc->enabled) {
+                omap_crtc->enabled = enabled;
+                omap_crtc->full_update = true;
+                omap_crtc_apply(crtc, &omap_crtc->apply);
 
-        for (i = 0; i < priv->num_planes; i++) {
-                struct drm_plane *plane = priv->planes[i];
-                if (plane->crtc == crtc)
-                        WARN_ON(omap_plane_dpms(plane, mode));
+                /* also enable our private plane: */
+                WARN_ON(omap_plane_dpms(omap_crtc->plane, mode));
+
+                /* and any attached overlay planes: */
+                for (i = 0; i < priv->num_planes; i++) {
+                        struct drm_plane *plane = priv->planes[i];
+                        if (plane->crtc == crtc)
+                                WARN_ON(omap_plane_dpms(plane, mode));
+                }
         }
 }
 
@@ -73,12 +196,26 @@ static int omap_crtc_mode_set(struct drm_crtc *crtc,
                 struct drm_framebuffer *old_fb)
 {
         struct omap_crtc *omap_crtc = to_omap_crtc(crtc);
-        struct drm_plane *plane = omap_crtc->plane;
 
-        return omap_plane_mode_set(plane, crtc, crtc->fb,
+        mode = adjusted_mode;
+
+        DBG("%s: set mode: %d:\"%s\" %d %d %d %d %d %d %d %d %d %d 0x%x 0x%x",
+                        omap_crtc->name, mode->base.id, mode->name,
+                        mode->vrefresh, mode->clock,
+                        mode->hdisplay, mode->hsync_start,
+                        mode->hsync_end, mode->htotal,
+                        mode->vdisplay, mode->vsync_start,
+                        mode->vsync_end, mode->vtotal,
+                        mode->type, mode->flags);
+
+        copy_timings_drm_to_omap(&omap_crtc->timings, mode);
+        omap_crtc->full_update = true;
+
+        return omap_plane_mode_set(omap_crtc->plane, crtc, crtc->fb,
                         0, 0, mode->hdisplay, mode->vdisplay,
                         x << 16, y << 16,
-                        mode->hdisplay << 16, mode->vdisplay << 16);
+                        mode->hdisplay << 16, mode->vdisplay << 16,
+                        NULL, NULL);
 }
 
 static void omap_crtc_prepare(struct drm_crtc *crtc)
@@ -102,10 +239,11 @@ static int omap_crtc_mode_set_base(struct drm_crtc *crtc, int x, int y,
         struct drm_plane *plane = omap_crtc->plane;
         struct drm_display_mode *mode = &crtc->mode;
 
-        return plane->funcs->update_plane(plane, crtc, crtc->fb,
+        return omap_plane_mode_set(plane, crtc, crtc->fb,
                         0, 0, mode->hdisplay, mode->vdisplay,
                         x << 16, y << 16,
-                        mode->hdisplay << 16, mode->vdisplay << 16);
+                        mode->hdisplay << 16, mode->vdisplay << 16,
+                        NULL, NULL);
 }
 
 static void omap_crtc_load_lut(struct drm_crtc *crtc)
@@ -114,63 +252,54 @@ static void omap_crtc_load_lut(struct drm_crtc *crtc)
 
 static void vblank_cb(void *arg)
 {
-        static uint32_t sequence;
         struct drm_crtc *crtc = arg;
         struct drm_device *dev = crtc->dev;
         struct omap_crtc *omap_crtc = to_omap_crtc(crtc);
-        struct drm_pending_vblank_event *event = omap_crtc->event;
         unsigned long flags;
-        struct timeval now;
 
-        WARN_ON(!event);
+        spin_lock_irqsave(&dev->event_lock, flags);
+
+        /* wakeup userspace */
+        if (omap_crtc->event)
+                drm_send_vblank_event(dev, omap_crtc->pipe, omap_crtc->event);
 
         omap_crtc->event = NULL;
+        omap_crtc->old_fb = NULL;
 
-        /* wakeup userspace */
-        if (event) {
-                do_gettimeofday(&now);
-
-                spin_lock_irqsave(&dev->event_lock, flags);
-                /* TODO: we can't yet use the vblank time accounting,
-                 * because omapdss lower layer is the one that knows
-                 * the irq # and registers the handler, which more or
-                 * less defeats how drm_irq works.. for now just fake
-                 * the sequence number and use gettimeofday..
-                 *
-                event->event.sequence = drm_vblank_count_and_time(
-                                dev, omap_crtc->id, &now);
-                 */
-                event->event.sequence = sequence++;
-                event->event.tv_sec = now.tv_sec;
-                event->event.tv_usec = now.tv_usec;
-                list_add_tail(&event->base.link,
-                                &event->base.file_priv->event_list);
-                wake_up_interruptible(&event->base.file_priv->event_wait);
-                spin_unlock_irqrestore(&dev->event_lock, flags);
-        }
+        spin_unlock_irqrestore(&dev->event_lock, flags);
 }
 
-static void page_flip_cb(void *arg)
+static void page_flip_worker(struct work_struct *work)
 {
-        struct drm_crtc *crtc = arg;
-        struct omap_crtc *omap_crtc = to_omap_crtc(crtc);
-        struct drm_framebuffer *old_fb = omap_crtc->old_fb;
+        struct omap_crtc *omap_crtc =
+                        container_of(work, struct omap_crtc, page_flip_work);
+        struct drm_crtc *crtc = &omap_crtc->base;
+        struct drm_device *dev = crtc->dev;
+        struct drm_display_mode *mode = &crtc->mode;
         struct drm_gem_object *bo;
 
-        omap_crtc->old_fb = NULL;
-
-        omap_crtc_mode_set_base(crtc, crtc->x, crtc->y, old_fb);
-
-        /* really we'd like to setup the callback atomically w/ setting the
-         * new scanout buffer to avoid getting stuck waiting an extra vblank
-         * cycle.. for now go for correctness and later figure out speed..
-         */
-        omap_plane_on_endwin(omap_crtc->plane, vblank_cb, crtc);
+        mutex_lock(&dev->mode_config.mutex);
+        omap_plane_mode_set(omap_crtc->plane, crtc, crtc->fb,
+                        0, 0, mode->hdisplay, mode->vdisplay,
+                        crtc->x << 16, crtc->y << 16,
+                        mode->hdisplay << 16, mode->vdisplay << 16,
+                        vblank_cb, crtc);
+        mutex_unlock(&dev->mode_config.mutex);
 
         bo = omap_framebuffer_bo(crtc->fb, 0);
         drm_gem_object_unreference_unlocked(bo);
 }
 
+static void page_flip_cb(void *arg)
+{
+        struct drm_crtc *crtc = arg;
+        struct omap_crtc *omap_crtc = to_omap_crtc(crtc);
+        struct omap_drm_private *priv = crtc->dev->dev_private;
+
+        /* avoid assumptions about what ctxt we are called from: */
+        queue_work(priv->wq, &omap_crtc->page_flip_work);
+}
+
 static int omap_crtc_page_flip_locked(struct drm_crtc *crtc,
                  struct drm_framebuffer *fb,
                  struct drm_pending_vblank_event *event)
@@ -179,14 +308,14 @@ static int omap_crtc_page_flip_locked(struct drm_crtc *crtc,
         struct omap_crtc *omap_crtc = to_omap_crtc(crtc);
         struct drm_gem_object *bo;
 
-        DBG("%d -> %d", crtc->fb ? crtc->fb->base.id : -1, fb->base.id);
+        DBG("%d -> %d (event=%p)", crtc->fb ? crtc->fb->base.id : -1,
+                        fb->base.id, event);
 
-        if (omap_crtc->event) {
+        if (omap_crtc->old_fb) {
                 dev_err(dev->dev, "already a pending flip\n");
                 return -EINVAL;
         }
 
-        omap_crtc->old_fb = crtc->fb;
         omap_crtc->event = event;
         crtc->fb = fb;
 
@@ -234,14 +363,244 @@ static const struct drm_crtc_helper_funcs omap_crtc_helper_funcs = {
         .load_lut = omap_crtc_load_lut,
 };
 
+const struct omap_video_timings *omap_crtc_timings(struct drm_crtc *crtc)
+{
+        struct omap_crtc *omap_crtc = to_omap_crtc(crtc);
+        return &omap_crtc->timings;
+}
+
+enum omap_channel omap_crtc_channel(struct drm_crtc *crtc)
+{
+        struct omap_crtc *omap_crtc = to_omap_crtc(crtc);
+        return omap_crtc->channel;
+}
+
+static void omap_crtc_error_irq(struct omap_drm_irq *irq, uint32_t irqstatus)
+{
+        struct omap_crtc *omap_crtc =
+                        container_of(irq, struct omap_crtc, error_irq);
+        struct drm_crtc *crtc = &omap_crtc->base;
+        DRM_ERROR("%s: errors: %08x\n", omap_crtc->name, irqstatus);
+        /* avoid getting in a flood, unregister the irq until next vblank */
+        omap_irq_unregister(crtc->dev, &omap_crtc->error_irq);
+}
+
+static void omap_crtc_apply_irq(struct omap_drm_irq *irq, uint32_t irqstatus)
+{
+        struct omap_crtc *omap_crtc =
+                        container_of(irq, struct omap_crtc, apply_irq);
+        struct drm_crtc *crtc = &omap_crtc->base;
+
+        if (!omap_crtc->error_irq.registered)
+                omap_irq_register(crtc->dev, &omap_crtc->error_irq);
+
+        if (!dispc_mgr_go_busy(omap_crtc->channel)) {
+                struct omap_drm_private *priv =
+                                crtc->dev->dev_private;
+                DBG("%s: apply done", omap_crtc->name);
+                omap_irq_unregister(crtc->dev, &omap_crtc->apply_irq);
+                queue_work(priv->wq, &omap_crtc->apply_work);
+        }
+}
+
+static void apply_worker(struct work_struct *work)
+{
+        struct omap_crtc *omap_crtc =
+                        container_of(work, struct omap_crtc, apply_work);
+        struct drm_crtc *crtc = &omap_crtc->base;
+        struct drm_device *dev = crtc->dev;
+        struct omap_drm_apply *apply, *n;
+        bool need_apply;
+
+        /*
+         * Synchronize everything on mode_config.mutex, to keep
+         * the callbacks and list modification all serialized
+         * with respect to modesetting ioctls from userspace.
+         */
+        mutex_lock(&dev->mode_config.mutex);
+        dispc_runtime_get();
+
+        /*
+         * If we are still pending a previous update, wait.. when the
+         * pending update completes, we get kicked again.
+         */
+        if (omap_crtc->apply_irq.registered)
+                goto out;
+
+        /* finish up previous apply's: */
+        list_for_each_entry_safe(apply, n,
+                        &omap_crtc->pending_applies, pending_node) {
+                apply->post_apply(apply);
+                list_del(&apply->pending_node);
+        }
+
+        need_apply = !list_empty(&omap_crtc->queued_applies);
+
+        /* then handle the next round of of queued apply's: */
+        list_for_each_entry_safe(apply, n,
+                        &omap_crtc->queued_applies, queued_node) {
+                apply->pre_apply(apply);
+                list_del(&apply->queued_node);
+                apply->queued = false;
+                list_add_tail(&apply->pending_node,
+                                &omap_crtc->pending_applies);
+        }
+
+        if (need_apply) {
+                enum omap_channel channel = omap_crtc->channel;
+
+                DBG("%s: GO", omap_crtc->name);
+
+                if (dispc_mgr_is_enabled(channel)) {
+                        omap_irq_register(dev, &omap_crtc->apply_irq);
+                        dispc_mgr_go(channel);
+                } else {
+                        struct omap_drm_private *priv = dev->dev_private;
+                        queue_work(priv->wq, &omap_crtc->apply_work);
+                }
+        }
+
+out:
+        dispc_runtime_put();
+        mutex_unlock(&dev->mode_config.mutex);
+}
+
+int omap_crtc_apply(struct drm_crtc *crtc,
+                struct omap_drm_apply *apply)
+{
+        struct omap_crtc *omap_crtc = to_omap_crtc(crtc);
+        struct drm_device *dev = crtc->dev;
+
+        WARN_ON(!mutex_is_locked(&dev->mode_config.mutex));
+
+        /* no need to queue it again if it is already queued: */
+        if (apply->queued)
+                return 0;
+
+        apply->queued = true;
+        list_add_tail(&apply->queued_node, &omap_crtc->queued_applies);
+
+        /*
+         * If there are no currently pending updates, then go ahead and
+         * kick the worker immediately, otherwise it will run again when
+         * the current update finishes.
+         */
+        if (list_empty(&omap_crtc->pending_applies)) {
+                struct omap_drm_private *priv = crtc->dev->dev_private;
+                queue_work(priv->wq, &omap_crtc->apply_work);
+        }
+
+        return 0;
+}
+
+/* called only from apply */
+static void set_enabled(struct drm_crtc *crtc, bool enable)
+{
+        struct drm_device *dev = crtc->dev;
+        struct omap_crtc *omap_crtc = to_omap_crtc(crtc);
+        enum omap_channel channel = omap_crtc->channel;
+        struct omap_irq_wait *wait = NULL;
+
+        if (dispc_mgr_is_enabled(channel) == enable)
+                return;
+
+        /* ignore sync-lost irqs during enable/disable */
+        omap_irq_unregister(crtc->dev, &omap_crtc->error_irq);
+
+        if (dispc_mgr_get_framedone_irq(channel)) {
+                if (!enable) {
+                        wait = omap_irq_wait_init(dev,
+                                        dispc_mgr_get_framedone_irq(channel), 1);
+                }
+        } else {
+                /*
+                 * When we disable digit output, we need to wait until fields
+                 * are done.  Otherwise the DSS is still working, and turning
+                 * off the clocks prevents DSS from going to OFF mode. And when
+                 * enabling, we need to wait for the extra sync losts
+                 */
+                wait = omap_irq_wait_init(dev,
+                                dispc_mgr_get_vsync_irq(channel), 2);
+        }
+
+        dispc_mgr_enable(channel, enable);
+
+        if (wait) {
+                int ret = omap_irq_wait(dev, wait, msecs_to_jiffies(100));
+                if (ret) {
+                        dev_err(dev->dev, "%s: timeout waiting for %s\n",
+                                        omap_crtc->name, enable ? "enable" : "disable");
+                }
+        }
+
+        omap_irq_register(crtc->dev, &omap_crtc->error_irq);
+}
+
+static void omap_crtc_pre_apply(struct omap_drm_apply *apply)
+{
+        struct omap_crtc *omap_crtc =
+                        container_of(apply, struct omap_crtc, apply);
+        struct drm_crtc *crtc = &omap_crtc->base;
+        struct drm_encoder *encoder = NULL;
+
+        DBG("%s: enabled=%d, full=%d", omap_crtc->name,
+                        omap_crtc->enabled, omap_crtc->full_update);
+
+        if (omap_crtc->full_update) {
+                struct omap_drm_private *priv = crtc->dev->dev_private;
+                int i;
+                for (i = 0; i < priv->num_encoders; i++) {
+                        if (priv->encoders[i]->crtc == crtc) {
+                                encoder = priv->encoders[i];
+                                break;
+                        }
+                }
+        }
+
+        if (!omap_crtc->enabled) {
+                set_enabled(&omap_crtc->base, false);
+                if (encoder)
+                        omap_encoder_set_enabled(encoder, false);
+        } else {
+                if (encoder) {
+                        omap_encoder_set_enabled(encoder, false);
+                        omap_encoder_update(encoder, &omap_crtc->mgr,
+                                        &omap_crtc->timings);
+                        omap_encoder_set_enabled(encoder, true);
+                        omap_crtc->full_update = false;
+                }
+
+                dispc_mgr_setup(omap_crtc->channel, &omap_crtc->info);
+                dispc_mgr_set_timings(omap_crtc->channel,
+                                &omap_crtc->timings);
+                set_enabled(&omap_crtc->base, true);
+        }
+
+        omap_crtc->full_update = false;
+}
+
+static void omap_crtc_post_apply(struct omap_drm_apply *apply)
+{
+        /* nothing needed for post-apply */
+}
+
+static const char *channel_names[] = {
+                [OMAP_DSS_CHANNEL_LCD] = "lcd",
+                [OMAP_DSS_CHANNEL_DIGIT] = "tv",
+                [OMAP_DSS_CHANNEL_LCD2] = "lcd2",
+};
+
 /* initialize crtc */
 struct drm_crtc *omap_crtc_init(struct drm_device *dev,
-                struct omap_overlay *ovl, int id)
+                struct drm_plane *plane, enum omap_channel channel, int id)
 {
         struct drm_crtc *crtc = NULL;
-        struct omap_crtc *omap_crtc = kzalloc(sizeof(*omap_crtc), GFP_KERNEL);
+        struct omap_crtc *omap_crtc;
+        struct omap_overlay_manager_info *info;
+
+        DBG("%s", channel_names[channel]);
 
-        DBG("%s", ovl->name);
+        omap_crtc = kzalloc(sizeof(*omap_crtc), GFP_KERNEL);
 
         if (!omap_crtc) {
                 dev_err(dev->dev, "could not allocate CRTC\n");
@@ -250,10 +609,40 @@ struct drm_crtc *omap_crtc_init(struct drm_device *dev,
 
         crtc = &omap_crtc->base;
 
-        omap_crtc->plane = omap_plane_init(dev, ovl, (1 << id), true);
+        INIT_WORK(&omap_crtc->page_flip_work, page_flip_worker);
+        INIT_WORK(&omap_crtc->apply_work, apply_worker);
+
+        INIT_LIST_HEAD(&omap_crtc->pending_applies);
+        INIT_LIST_HEAD(&omap_crtc->queued_applies);
+
+        omap_crtc->apply.pre_apply  = omap_crtc_pre_apply;
+        omap_crtc->apply.post_apply = omap_crtc_post_apply;
+
+        omap_crtc->apply_irq.irqmask = pipe2vbl(id);
+        omap_crtc->apply_irq.irq = omap_crtc_apply_irq;
+
+        omap_crtc->error_irq.irqmask =
+                        dispc_mgr_get_sync_lost_irq(channel);
+        omap_crtc->error_irq.irq = omap_crtc_error_irq;
+        omap_irq_register(dev, &omap_crtc->error_irq);
+
+        omap_crtc->channel = channel;
+        omap_crtc->plane = plane;
         omap_crtc->plane->crtc = crtc;
-        omap_crtc->name = ovl->name;
-        omap_crtc->id = id;
+        omap_crtc->name = channel_names[channel];
+        omap_crtc->pipe = id;
+
+        /* temporary: */
+        omap_crtc->mgr.id = channel;
+
+        dss_install_mgr_ops(&mgr_ops);
+
+        /* TODO: fix hard-coded setup.. add properties! */
+        info = &omap_crtc->info;
+        info->default_color = 0x00000000;
+        info->trans_key = 0x00000000;
+        info->trans_key_type = OMAP_DSS_COLOR_KEY_GFX_DST;
+        info->trans_enabled = false;
 
         drm_crtc_init(dev, crtc, &omap_crtc_funcs);
         drm_crtc_helper_add(crtc, &omap_crtc_helper_funcs);
diff --git a/drivers/staging/omapdrm/omap_drv.c b/drivers/staging/omapdrm/omap_drv.c
index 84943e5ba1d6..ae5ecc2efbc7 100644
--- a/drivers/staging/omapdrm/omap_drv.c
+++ b/drivers/staging/omapdrm/omap_drv.c
@@ -74,320 +74,99 @@ static int get_connector_type(struct omap_dss_device *dssdev)
         }
 }
 
-#if 0 /* enable when dss2 supports hotplug */
-static int omap_drm_notifier(struct notifier_block *nb,
-                unsigned long evt, void *arg)
-{
-        switch (evt) {
-        case OMAP_DSS_SIZE_CHANGE:
-        case OMAP_DSS_HOTPLUG_CONNECT:
-        case OMAP_DSS_HOTPLUG_DISCONNECT: {
-                struct drm_device *dev = drm_device;
-                DBG("hotplug event: evt=%d, dev=%p", evt, dev);
-                if (dev)
-                        drm_sysfs_hotplug_event(dev);
-
-                return NOTIFY_OK;
-        }
-        default:  /* don't care about other events for now */
-                return NOTIFY_DONE;
-        }
-}
-#endif
-
-static void dump_video_chains(void)
-{
-        int i;
-
-        DBG("dumping video chains: ");
-        for (i = 0; i < omap_dss_get_num_overlays(); i++) {
-                struct omap_overlay *ovl = omap_dss_get_overlay(i);
-                struct omap_overlay_manager *mgr = ovl->manager;
-                struct omap_dss_device *dssdev = mgr ?
-                                        mgr->get_device(mgr) : NULL;
-                if (dssdev) {
-                        DBG("%d: %s -> %s -> %s", i, ovl->name, mgr->name,
-                                                dssdev->name);
-                } else if (mgr) {
-                        DBG("%d: %s -> %s", i, ovl->name, mgr->name);
-                } else {
-                        DBG("%d: %s", i, ovl->name);
-                }
-        }
-}
-
-/* create encoders for each manager */
-static int create_encoder(struct drm_device *dev,
-                struct omap_overlay_manager *mgr)
-{
-        struct omap_drm_private *priv = dev->dev_private;
-        struct drm_encoder *encoder = omap_encoder_init(dev, mgr);
-
-        if (!encoder) {
-                dev_err(dev->dev, "could not create encoder: %s\n",
-                                mgr->name);
-                return -ENOMEM;
-        }
-
-        BUG_ON(priv->num_encoders >= ARRAY_SIZE(priv->encoders));
-
-        priv->encoders[priv->num_encoders++] = encoder;
-
-        return 0;
-}
-
-/* create connectors for each display device */
-static int create_connector(struct drm_device *dev,
-                struct omap_dss_device *dssdev)
+static int omap_modeset_init(struct drm_device *dev)
 {
         struct omap_drm_private *priv = dev->dev_private;
-        static struct notifier_block *notifier;
-        struct drm_connector *connector;
-        int j;
-
-        if (!dssdev->driver) {
-                dev_warn(dev->dev, "%s has no driver.. skipping it\n",
-                                dssdev->name);
-                return 0;
-        }
+        struct omap_dss_device *dssdev = NULL;
+        int num_ovls = dss_feat_get_num_ovls();
+        int id;
 
-        if (!(dssdev->driver->get_timings ||
-                                dssdev->driver->read_edid)) {
-                dev_warn(dev->dev, "%s driver does not support "
-                        "get_timings or read_edid.. skipping it!\n",
-                        dssdev->name);
-                return 0;
-        }
+        drm_mode_config_init(dev);
 
-        connector = omap_connector_init(dev,
-                        get_connector_type(dssdev), dssdev);
+        omap_drm_irq_install(dev);
 
-        if (!connector) {
-                dev_err(dev->dev, "could not create connector: %s\n",
-                                dssdev->name);
-                return -ENOMEM;
-        }
-
-        BUG_ON(priv->num_connectors >= ARRAY_SIZE(priv->connectors));
+        /*
+         * Create private planes and CRTCs for the last NUM_CRTCs overlay
+         * plus manager:
+         */
+        for (id = 0; id < min(num_crtc, num_ovls); id++) {
+                struct drm_plane *plane;
+                struct drm_crtc *crtc;
 
-        priv->connectors[priv->num_connectors++] = connector;
+                plane = omap_plane_init(dev, id, true);
+                crtc = omap_crtc_init(dev, plane, pipe2chan(id), id);
 
-#if 0 /* enable when dss2 supports hotplug */
-        notifier = kzalloc(sizeof(struct notifier_block), GFP_KERNEL);
-        notifier->notifier_call = omap_drm_notifier;
-        omap_dss_add_notify(dssdev, notifier);
-#else
-        notifier = NULL;
-#endif
+                BUG_ON(priv->num_crtcs >= ARRAY_SIZE(priv->crtcs));
+                priv->crtcs[id] = crtc;
+                priv->num_crtcs++;
 
-        for (j = 0; j < priv->num_encoders; j++) {
-                struct omap_overlay_manager *mgr =
-                        omap_encoder_get_manager(priv->encoders[j]);
-                if (mgr->get_device(mgr) == dssdev) {
-                        drm_mode_connector_attach_encoder(connector,
-                                        priv->encoders[j]);
-                }
+                priv->planes[id] = plane;
+                priv->num_planes++;
         }
 
-        return 0;
-}
-
-/* create up to max_overlays CRTCs mapping to overlays.. by default,
- * connect the overlays to different managers/encoders, giving priority
- * to encoders connected to connectors with a detected connection
- */
-static int create_crtc(struct drm_device *dev, struct omap_overlay *ovl,
-                int *j, unsigned int connected_connectors)
-{
-        struct omap_drm_private *priv = dev->dev_private;
-        struct omap_overlay_manager *mgr = NULL;
-        struct drm_crtc *crtc;
-
-        /* find next best connector, ones with detected connection first
+        /*
+         * Create normal planes for the remaining overlays:
          */
-        while (*j < priv->num_connectors && !mgr) {
-                if (connected_connectors & (1 << *j)) {
-                        struct drm_encoder *encoder =
-                                omap_connector_attached_encoder(
-                                                priv->connectors[*j]);
-                        if (encoder)
-                                mgr = omap_encoder_get_manager(encoder);
+        for (; id < num_ovls; id++) {
+                struct drm_plane *plane = omap_plane_init(dev, id, false);
 
-                }
-                (*j)++;
+                BUG_ON(priv->num_planes >= ARRAY_SIZE(priv->planes));
+                priv->planes[priv->num_planes++] = plane;
         }
 
-        /* if we couldn't find another connected connector, lets start
-         * looking at the unconnected connectors:
-         *
-         * note: it might not be immediately apparent, but thanks to
-         * the !mgr check in both this loop and the one above, the only
-         * way to enter this loop is with *j == priv->num_connectors,
-         * so idx can never go negative.
-         */
-        while (*j < 2 * priv->num_connectors && !mgr) {
-                int idx = *j - priv->num_connectors;
-                if (!(connected_connectors & (1 << idx))) {
-                        struct drm_encoder *encoder =
-                                omap_connector_attached_encoder(
-                                                priv->connectors[idx]);
-                        if (encoder)
-                                mgr = omap_encoder_get_manager(encoder);
+        for_each_dss_dev(dssdev) {
+                struct drm_connector *connector;
+                struct drm_encoder *encoder;
 
+                if (!dssdev->driver) {
+                        dev_warn(dev->dev, "%s has no driver.. skipping it\n",
+                                        dssdev->name);
+                        return 0;
                 }
-                (*j)++;
-        }
-
-        crtc = omap_crtc_init(dev, ovl, priv->num_crtcs);
-
-        if (!crtc) {
-                dev_err(dev->dev, "could not create CRTC: %s\n",
-                                ovl->name);
-                return -ENOMEM;
-        }
 
-        BUG_ON(priv->num_crtcs >= ARRAY_SIZE(priv->crtcs));
-
-        priv->crtcs[priv->num_crtcs++] = crtc;
-
-        return 0;
-}
-
-static int create_plane(struct drm_device *dev, struct omap_overlay *ovl,
-                unsigned int possible_crtcs)
-{
-        struct omap_drm_private *priv = dev->dev_private;
-        struct drm_plane *plane =
-                        omap_plane_init(dev, ovl, possible_crtcs, false);
-
-        if (!plane) {
-                dev_err(dev->dev, "could not create plane: %s\n",
-                                ovl->name);
-                return -ENOMEM;
-        }
-
-        BUG_ON(priv->num_planes >= ARRAY_SIZE(priv->planes));
-
-        priv->planes[priv->num_planes++] = plane;
-
-        return 0;
-}
-
-static int match_dev_name(struct omap_dss_device *dssdev, void *data)
-{
-        return !strcmp(dssdev->name, data);
-}
-
-static unsigned int detect_connectors(struct drm_device *dev)
-{
-        struct omap_drm_private *priv = dev->dev_private;
-        unsigned int connected_connectors = 0;
-        int i;
-
-        for (i = 0; i < priv->num_connectors; i++) {
-                struct drm_connector *connector = priv->connectors[i];
-                if (omap_connector_detect(connector, true) ==
-                                connector_status_connected) {
-                        connected_connectors |= (1 << i);
+                if (!(dssdev->driver->get_timings ||
+                                        dssdev->driver->read_edid)) {
+                        dev_warn(dev->dev, "%s driver does not support "
+                                "get_timings or read_edid.. skipping it!\n",
+                                dssdev->name);
+                        return 0;
                 }
-        }
-
-        return connected_connectors;
-}
 
-static int omap_modeset_init(struct drm_device *dev)
-{
-        const struct omap_drm_platform_data *pdata = dev->dev->platform_data;
-        struct omap_kms_platform_data *kms_pdata = NULL;
-        struct omap_drm_private *priv = dev->dev_private;
-        struct omap_dss_device *dssdev = NULL;
-        int i, j;
-        unsigned int connected_connectors = 0;
+                encoder = omap_encoder_init(dev, dssdev);
 
-        drm_mode_config_init(dev);
-
-        if (pdata && pdata->kms_pdata) {
-                kms_pdata = pdata->kms_pdata;
-
-                /* if platform data is provided by the board file, use it to
-                 * control which overlays, managers, and devices we own.
-                 */
-                for (i = 0; i < kms_pdata->mgr_cnt; i++) {
-                        struct omap_overlay_manager *mgr =
-                                omap_dss_get_overlay_manager(
-                                                kms_pdata->mgr_ids[i]);
-                        create_encoder(dev, mgr);
-                }
-
-                for (i = 0; i < kms_pdata->dev_cnt; i++) {
-                        struct omap_dss_device *dssdev =
-                                omap_dss_find_device(
-                                        (void *)kms_pdata->dev_names[i],
-                                        match_dev_name);
-                        if (!dssdev) {
-                                dev_warn(dev->dev, "no such dssdev: %s\n",
-                                                kms_pdata->dev_names[i]);
-                                continue;
-                        }
-                        create_connector(dev, dssdev);
+                if (!encoder) {
+                        dev_err(dev->dev, "could not create encoder: %s\n",
+                                        dssdev->name);
+                        return -ENOMEM;
                 }
 
-                connected_connectors = detect_connectors(dev);
+                connector = omap_connector_init(dev,
+                                get_connector_type(dssdev), dssdev, encoder);
 
-                j = 0;
-                for (i = 0; i < kms_pdata->ovl_cnt; i++) {
-                        struct omap_overlay *ovl =
-                                omap_dss_get_overlay(kms_pdata->ovl_ids[i]);
-                        create_crtc(dev, ovl, &j, connected_connectors);
+                if (!connector) {
+                        dev_err(dev->dev, "could not create connector: %s\n",
+                                        dssdev->name);
+                        return -ENOMEM;
                 }
 
-                for (i = 0; i < kms_pdata->pln_cnt; i++) {
-                        struct omap_overlay *ovl =
-                                omap_dss_get_overlay(kms_pdata->pln_ids[i]);
-                        create_plane(dev, ovl, (1 << priv->num_crtcs) - 1);
-                }
-        } else {
-                /* otherwise just grab up to CONFIG_DRM_OMAP_NUM_CRTCS and try
-                 * to make educated guesses about everything else
-                 */
-                int max_overlays = min(omap_dss_get_num_overlays(), num_crtc);
+                BUG_ON(priv->num_encoders >= ARRAY_SIZE(priv->encoders));
+                BUG_ON(priv->num_connectors >= ARRAY_SIZE(priv->connectors));
 
-                for (i = 0; i < omap_dss_get_num_overlay_managers(); i++)
-                        create_encoder(dev, omap_dss_get_overlay_manager(i));
-
-                for_each_dss_dev(dssdev) {
-                        create_connector(dev, dssdev);
-                }
+                priv->encoders[priv->num_encoders++] = encoder;
+                priv->connectors[priv->num_connectors++] = connector;
 
-                connected_connectors = detect_connectors(dev);
+                drm_mode_connector_attach_encoder(connector, encoder);
 
-                j = 0;
-                for (i = 0; i < max_overlays; i++) {
-                        create_crtc(dev, omap_dss_get_overlay(i),
-                                        &j, connected_connectors);
-                }
-
-                /* use any remaining overlays as drm planes */
-                for (; i < omap_dss_get_num_overlays(); i++) {
-                        struct omap_overlay *ovl = omap_dss_get_overlay(i);
-                        create_plane(dev, ovl, (1 << priv->num_crtcs) - 1);
+                /* figure out which crtc's we can connect the encoder to: */
+                encoder->possible_crtcs = 0;
+                for (id = 0; id < priv->num_crtcs; id++) {
+                        enum omap_dss_output_id supported_outputs =
+                                        dss_feat_get_supported_outputs(pipe2chan(id));
+                        if (supported_outputs & dssdev->output->id)
+                                encoder->possible_crtcs |= (1 << id);
                 }
         }
 
-        /* for now keep the mapping of CRTCs and encoders static.. */
-        for (i = 0; i < priv->num_encoders; i++) {
-                struct drm_encoder *encoder = priv->encoders[i];
-                struct omap_overlay_manager *mgr =
-                                omap_encoder_get_manager(encoder);
-
-                encoder->possible_crtcs = (1 << priv->num_crtcs) - 1;
-
-                DBG("%s: possible_crtcs=%08x", mgr->name,
-                                        encoder->possible_crtcs);
-        }
-
-        dump_video_chains();
-
         dev->mode_config.min_width = 32;
         dev->mode_config.min_height = 32;
 
@@ -450,7 +229,7 @@ static int ioctl_gem_new(struct drm_device *dev, void *data,
                 struct drm_file *file_priv)
 {
         struct drm_omap_gem_new *args = data;
-        DBG("%p:%p: size=0x%08x, flags=%08x", dev, file_priv,
+        VERB("%p:%p: size=0x%08x, flags=%08x", dev, file_priv,
                         args->size.bytes, args->flags);
         return omap_gem_new_handle(dev, file_priv, args->size,
                         args->flags, &args->handle);
@@ -510,7 +289,7 @@ static int ioctl_gem_info(struct drm_device *dev, void *data,
         struct drm_gem_object *obj;
         int ret = 0;
 
-        DBG("%p:%p: handle=%d", dev, file_priv, args->handle);
+        VERB("%p:%p: handle=%d", dev, file_priv, args->handle);
 
         obj = drm_gem_object_lookup(dev, file_priv, args->handle);
         if (!obj)
@@ -565,14 +344,6 @@ static int dev_load(struct drm_device *dev, unsigned long flags)
 
         dev->dev_private = priv;
 
-        ret = omapdss_compat_init();
-        if (ret) {
-                dev_err(dev->dev, "coult not init omapdss\n");
-                dev->dev_private = NULL;
-                kfree(priv);
-                return ret;
-        }
-
         priv->wq = alloc_ordered_workqueue("omapdrm", 0);
 
         INIT_LIST_HEAD(&priv->obj_list);
@@ -584,10 +355,13 @@ static int dev_load(struct drm_device *dev, unsigned long flags)
                 dev_err(dev->dev, "omap_modeset_init failed: ret=%d\n", ret);
                 dev->dev_private = NULL;
                 kfree(priv);
-                omapdss_compat_uninit();
                 return ret;
         }
 
+        ret = drm_vblank_init(dev, priv->num_crtcs);
+        if (ret)
+                dev_warn(dev->dev, "could not init vblank\n");
+
         priv->fbdev = omap_fbdev_init(dev);
         if (!priv->fbdev) {
                 dev_warn(dev->dev, "omap_fbdev_init failed\n");
@@ -596,10 +370,6 @@ static int dev_load(struct drm_device *dev, unsigned long flags)
 
         drm_kms_helper_poll_init(dev);
 
-        ret = drm_vblank_init(dev, priv->num_crtcs);
-        if (ret)
-                dev_warn(dev->dev, "could not init vblank\n");
-
         return 0;
 }
 
@@ -609,8 +379,9 @@ static int dev_unload(struct drm_device *dev)
 
         DBG("unload: dev=%p", dev);
 
-        drm_vblank_cleanup(dev);
         drm_kms_helper_poll_fini(dev);
+        drm_vblank_cleanup(dev);
+        omap_drm_irq_uninstall(dev);
 
         omap_fbdev_free(dev);
         omap_modeset_free(dev);
@@ -619,8 +390,6 @@ static int dev_unload(struct drm_device *dev)
         flush_workqueue(priv->wq);
         destroy_workqueue(priv->wq);
 
-        omapdss_compat_uninit();
-
         kfree(dev->dev_private);
         dev->dev_private = NULL;
 
@@ -680,7 +449,9 @@ static void dev_lastclose(struct drm_device *dev)
                 }
         }
 
+        mutex_lock(&dev->mode_config.mutex);
         ret = drm_fb_helper_restore_fbdev_mode(priv->fbdev);
+        mutex_unlock(&dev->mode_config.mutex);
         if (ret)
                 DBG("failed to restore crtc mode");
 }
@@ -695,60 +466,6 @@ static void dev_postclose(struct drm_device *dev, struct drm_file *file)
         DBG("postclose: dev=%p, file=%p", dev, file);
 }
 
-/**
- * enable_vblank - enable vblank interrupt events
- * @dev: DRM device
- * @crtc: which irq to enable
- *
- * Enable vblank interrupts for @crtc.  If the device doesn't have
- * a hardware vblank counter, this routine should be a no-op, since
- * interrupts will have to stay on to keep the count accurate.
- *
- * RETURNS
- * Zero on success, appropriate errno if the given @crtc's vblank
- * interrupt cannot be enabled.
- */
-static int dev_enable_vblank(struct drm_device *dev, int crtc)
-{
-        DBG("enable_vblank: dev=%p, crtc=%d", dev, crtc);
-        return 0;
-}
-
-/**
- * disable_vblank - disable vblank interrupt events
- * @dev: DRM device
- * @crtc: which irq to enable
- *
- * Disable vblank interrupts for @crtc.  If the device doesn't have
- * a hardware vblank counter, this routine should be a no-op, since
- * interrupts will have to stay on to keep the count accurate.
- */
-static void dev_disable_vblank(struct drm_device *dev, int crtc)
-{
-        DBG("disable_vblank: dev=%p, crtc=%d", dev, crtc);
-}
-
-static irqreturn_t dev_irq_handler(DRM_IRQ_ARGS)
-{
-        return IRQ_HANDLED;
-}
-
-static void dev_irq_preinstall(struct drm_device *dev)
-{
-        DBG("irq_preinstall: dev=%p", dev);
-}
-
-static int dev_irq_postinstall(struct drm_device *dev)
-{
-        DBG("irq_postinstall: dev=%p", dev);
-        return 0;
-}
-
-static void dev_irq_uninstall(struct drm_device *dev)
-{
-        DBG("irq_uninstall: dev=%p", dev);
-}
-
 static const struct vm_operations_struct omap_gem_vm_ops = {
         .fault = omap_gem_fault,
         .open = drm_gem_vm_open,
@@ -778,12 +495,12 @@ static struct drm_driver omap_drm_driver = {
                 .preclose = dev_preclose,
                 .postclose = dev_postclose,
                 .get_vblank_counter = drm_vblank_count,
-                .enable_vblank = dev_enable_vblank,
-                .disable_vblank = dev_disable_vblank,
-                .irq_preinstall = dev_irq_preinstall,
-                .irq_postinstall = dev_irq_postinstall,
-                .irq_uninstall = dev_irq_uninstall,
-                .irq_handler = dev_irq_handler,
+                .enable_vblank = omap_irq_enable_vblank,
+                .disable_vblank = omap_irq_disable_vblank,
+                .irq_preinstall = omap_irq_preinstall,
+                .irq_postinstall = omap_irq_postinstall,
+                .irq_uninstall = omap_irq_uninstall,
+                .irq_handler = omap_irq_handler,
 #ifdef CONFIG_DEBUG_FS
                 .debugfs_init = omap_debugfs_init,
                 .debugfs_cleanup = omap_debugfs_cleanup,
diff --git a/drivers/staging/omapdrm/omap_drv.h b/drivers/staging/omapdrm/omap_drv.h
index 1d4aea53b75d..cd1f22b0b124 100644
--- a/drivers/staging/omapdrm/omap_drv.h
+++ b/drivers/staging/omapdrm/omap_drv.h
@@ -28,6 +28,7 @@
 #include <linux/platform_data/omap_drm.h>
 #include "omap_drm.h"
 
+
 #define DBG(fmt, ...) DRM_DEBUG(fmt"\n", ##__VA_ARGS__)
 #define VERB(fmt, ...) if (0) DRM_DEBUG(fmt, ##__VA_ARGS__) /* verbose debug */
 
@@ -39,6 +40,51 @@
  */
 #define MAX_MAPPERS 2
 
+/* parameters which describe (unrotated) coordinates of scanout within a fb: */
+struct omap_drm_window {
+        uint32_t rotation;
+        int32_t  crtc_x, crtc_y;                /* signed because can be offscreen */
+        uint32_t crtc_w, crtc_h;
+        uint32_t src_x, src_y;
+        uint32_t src_w, src_h;
+};
+
+/* Once GO bit is set, we can't make further updates to shadowed registers
+ * until the GO bit is cleared.  So various parts in the kms code that need
+ * to update shadowed registers queue up a pair of callbacks, pre_apply
+ * which is called before setting GO bit, and post_apply that is called
+ * after GO bit is cleared.  The crtc manages the queuing, and everyone
+ * else goes thru omap_crtc_apply() using these callbacks so that the
+ * code which has to deal w/ GO bit state is centralized.
+ */
+struct omap_drm_apply {
+        struct list_head pending_node, queued_node;
+        bool queued;
+        void (*pre_apply)(struct omap_drm_apply *apply);
+        void (*post_apply)(struct omap_drm_apply *apply);
+};
+
+/* For transiently registering for different DSS irqs that various parts
+ * of the KMS code need during setup/configuration.  We these are not
+ * necessarily the same as what drm_vblank_get/put() are requesting, and
+ * the hysteresis in drm_vblank_put() is not necessarily desirable for
+ * internal housekeeping related irq usage.
+ */
+struct omap_drm_irq {
+        struct list_head node;
+        uint32_t irqmask;
+        bool registered;
+        void (*irq)(struct omap_drm_irq *irq, uint32_t irqstatus);
+};
+
+/* For KMS code that needs to wait for a certain # of IRQs:
+ */
+struct omap_irq_wait;
+struct omap_irq_wait * omap_irq_wait_init(struct drm_device *dev,
+                uint32_t irqmask, int count);
+int omap_irq_wait(struct drm_device *dev, struct omap_irq_wait *wait,
+                unsigned long timeout);
+
 struct omap_drm_private {
         uint32_t omaprev;
 
@@ -58,6 +104,7 @@ struct omap_drm_private {
 
         struct workqueue_struct *wq;
 
+        /* list of GEM objects: */
         struct list_head obj_list;
 
         bool has_dmm;
@@ -65,6 +112,11 @@ struct omap_drm_private {
         /* properties: */
         struct drm_property *rotation_prop;
         struct drm_property *zorder_prop;
+
+        /* irq handling: */
+        struct list_head irq_list;    /* list of omap_drm_irq */
+        uint32_t vblank_mask;         /* irq bits set for userspace vblank */
+        struct omap_drm_irq error_handler;
 };
 
 /* this should probably be in drm-core to standardize amongst drivers */
@@ -75,15 +127,6 @@ struct omap_drm_private {
 #define DRM_REFLECT_X   4
 #define DRM_REFLECT_Y   5
 
-/* parameters which describe (unrotated) coordinates of scanout within a fb: */
-struct omap_drm_window {
-        uint32_t rotation;
-        int32_t  crtc_x, crtc_y;                /* signed because can be offscreen */
-        uint32_t crtc_w, crtc_h;
-        uint32_t src_x, src_y;
-        uint32_t src_w, src_h;
-};
-
 #ifdef CONFIG_DEBUG_FS
 int omap_debugfs_init(struct drm_minor *minor);
 void omap_debugfs_cleanup(struct drm_minor *minor);
@@ -92,23 +135,36 @@ void omap_gem_describe(struct drm_gem_object *obj, struct seq_file *m);
 void omap_gem_describe_objects(struct list_head *list, struct seq_file *m);
 #endif
 
+int omap_irq_enable_vblank(struct drm_device *dev, int crtc);
+void omap_irq_disable_vblank(struct drm_device *dev, int crtc);
+irqreturn_t omap_irq_handler(DRM_IRQ_ARGS);
+void omap_irq_preinstall(struct drm_device *dev);
+int omap_irq_postinstall(struct drm_device *dev);
+void omap_irq_uninstall(struct drm_device *dev);
+void omap_irq_register(struct drm_device *dev, struct omap_drm_irq *irq);
+void omap_irq_unregister(struct drm_device *dev, struct omap_drm_irq *irq);
+int omap_drm_irq_uninstall(struct drm_device *dev);
+int omap_drm_irq_install(struct drm_device *dev);
+
 struct drm_fb_helper *omap_fbdev_init(struct drm_device *dev);
 void omap_fbdev_free(struct drm_device *dev);
 
+const struct omap_video_timings *omap_crtc_timings(struct drm_crtc *crtc);
+enum omap_channel omap_crtc_channel(struct drm_crtc *crtc);
+int omap_crtc_apply(struct drm_crtc *crtc,
+                struct omap_drm_apply *apply);
 struct drm_crtc *omap_crtc_init(struct drm_device *dev,
-                struct omap_overlay *ovl, int id);
+                struct drm_plane *plane, enum omap_channel channel, int id);
 
 struct drm_plane *omap_plane_init(struct drm_device *dev,
-                struct omap_overlay *ovl, unsigned int possible_crtcs,
-                bool priv);
+                int plane_id, bool private_plane);
 int omap_plane_dpms(struct drm_plane *plane, int mode);
 int omap_plane_mode_set(struct drm_plane *plane,
                 struct drm_crtc *crtc, struct drm_framebuffer *fb,
                 int crtc_x, int crtc_y,
                 unsigned int crtc_w, unsigned int crtc_h,
                 uint32_t src_x, uint32_t src_y,
-                uint32_t src_w, uint32_t src_h);
-void omap_plane_on_endwin(struct drm_plane *plane,
+                uint32_t src_w, uint32_t src_h,
                 void (*fxn)(void *), void *arg);
 void omap_plane_install_properties(struct drm_plane *plane,
                 struct drm_mode_object *obj);
@@ -116,21 +172,25 @@ int omap_plane_set_property(struct drm_plane *plane,
                 struct drm_property *property, uint64_t val);
 
 struct drm_encoder *omap_encoder_init(struct drm_device *dev,
-                struct omap_overlay_manager *mgr);
-struct omap_overlay_manager *omap_encoder_get_manager(
+                struct omap_dss_device *dssdev);
+int omap_encoder_set_enabled(struct drm_encoder *encoder, bool enabled);
+int omap_encoder_update(struct drm_encoder *encoder,
+                struct omap_overlay_manager *mgr,
+                struct omap_video_timings *timings);
+
+struct drm_connector *omap_connector_init(struct drm_device *dev,
+                int connector_type, struct omap_dss_device *dssdev,
                 struct drm_encoder *encoder);
 struct drm_encoder *omap_connector_attached_encoder(
                 struct drm_connector *connector);
-enum drm_connector_status omap_connector_detect(
-                struct drm_connector *connector, bool force);
-
-struct drm_connector *omap_connector_init(struct drm_device *dev,
-                int connector_type, struct omap_dss_device *dssdev);
-void omap_connector_mode_set(struct drm_connector *connector,
-                struct drm_display_mode *mode);
 void omap_connector_flush(struct drm_connector *connector,
                 int x, int y, int w, int h);
 
+void copy_timings_omap_to_drm(struct drm_display_mode *mode,
+                struct omap_video_timings *timings);
+void copy_timings_drm_to_omap(struct omap_video_timings *timings,
+                struct drm_display_mode *mode);
+
 uint32_t omap_framebuffer_get_formats(uint32_t *pixel_formats,
                 uint32_t max_formats, enum omap_color_mode supported_modes);
 struct drm_framebuffer *omap_framebuffer_create(struct drm_device *dev,
@@ -207,6 +267,40 @@ static inline int align_pitch(int pitch, int width, int bpp)
         return ALIGN(pitch, 8 * bytespp);
 }
 
+static inline enum omap_channel pipe2chan(int pipe)
+{
+        int num_mgrs = dss_feat_get_num_mgrs();
+
+        /*
+         * We usually don't want to create a CRTC for each manager,
+         * at least not until we have a way to expose private planes
+         * to userspace.  Otherwise there would not be enough video
+         * pipes left for drm planes.  The higher #'d managers tend
+         * to have more features so start in reverse order.
+         */
+        return num_mgrs - pipe - 1;
+}
+
+/* map crtc to vblank mask */
+static inline uint32_t pipe2vbl(int crtc)
+{
+        enum omap_channel channel = pipe2chan(crtc);
+        return dispc_mgr_get_vsync_irq(channel);
+}
+
+static inline int crtc2pipe(struct drm_device *dev, struct drm_crtc *crtc)
+{
+        struct omap_drm_private *priv = dev->dev_private;
+        int i;
+
+        for (i = 0; i < ARRAY_SIZE(priv->crtcs); i++)
+                if (priv->crtcs[i] == crtc)
+                        return i;
+
+        BUG();  /* bogus CRTC ptr */
+        return -1;
+}
+
 /* should these be made into common util helpers?
  */
 
diff --git a/drivers/staging/omapdrm/omap_encoder.c b/drivers/staging/omapdrm/omap_encoder.c
index 5341d5e3e317..e053160d2db3 100644
--- a/drivers/staging/omapdrm/omap_encoder.c
+++ b/drivers/staging/omapdrm/omap_encoder.c
@@ -22,37 +22,56 @@
 #include "drm_crtc.h"
 #include "drm_crtc_helper.h"
 
+#include <linux/list.h>
+
+
 /*
  * encoder funcs
  */
 
 #define to_omap_encoder(x) container_of(x, struct omap_encoder, base)
 
+/* The encoder and connector both map to same dssdev.. the encoder
+ * handles the 'active' parts, ie. anything the modifies the state
+ * of the hw, and the connector handles the 'read-only' parts, like
+ * detecting connection and reading edid.
+ */
 struct omap_encoder {
         struct drm_encoder base;
-        struct omap_overlay_manager *mgr;
+        struct omap_dss_device *dssdev;
 };
 
 static void omap_encoder_destroy(struct drm_encoder *encoder)
 {
         struct omap_encoder *omap_encoder = to_omap_encoder(encoder);
-        DBG("%s", omap_encoder->mgr->name);
         drm_encoder_cleanup(encoder);
         kfree(omap_encoder);
 }
 
+static const struct drm_encoder_funcs omap_encoder_funcs = {
+        .destroy = omap_encoder_destroy,
+};
+
+/*
+ * The CRTC drm_crtc_helper_set_mode() doesn't really give us the right
+ * order.. the easiest way to work around this for now is to make all
+ * the encoder-helper's no-op's and have the omap_crtc code take care
+ * of the sequencing and call us in the right points.
+ *
+ * Eventually to handle connecting CRTCs to different encoders properly,
+ * either the CRTC helpers need to change or we need to replace
+ * drm_crtc_helper_set_mode(), but lets wait until atomic-modeset for
+ * that.
+ */
+
 static void omap_encoder_dpms(struct drm_encoder *encoder, int mode)
 {
-        struct omap_encoder *omap_encoder = to_omap_encoder(encoder);
-        DBG("%s: %d", omap_encoder->mgr->name, mode);
 }
 
 static bool omap_encoder_mode_fixup(struct drm_encoder *encoder,
                                   const struct drm_display_mode *mode,
                                   struct drm_display_mode *adjusted_mode)
 {
-        struct omap_encoder *omap_encoder = to_omap_encoder(encoder);
-        DBG("%s", omap_encoder->mgr->name);
         return true;
 }
 
@@ -60,47 +79,16 @@ static void omap_encoder_mode_set(struct drm_encoder *encoder,
                                 struct drm_display_mode *mode,
                                 struct drm_display_mode *adjusted_mode)
 {
-        struct omap_encoder *omap_encoder = to_omap_encoder(encoder);
-        struct drm_device *dev = encoder->dev;
-        struct omap_drm_private *priv = dev->dev_private;
-        int i;
-
-        mode = adjusted_mode;
-
-        DBG("%s: set mode: %dx%d", omap_encoder->mgr->name,
-                        mode->hdisplay, mode->vdisplay);
-
-        for (i = 0; i < priv->num_connectors; i++) {
-                struct drm_connector *connector = priv->connectors[i];
-                if (connector->encoder == encoder)
-                        omap_connector_mode_set(connector, mode);
-
-        }
 }
 
 static void omap_encoder_prepare(struct drm_encoder *encoder)
 {
-        struct omap_encoder *omap_encoder = to_omap_encoder(encoder);
-        struct drm_encoder_helper_funcs *encoder_funcs =
-                                encoder->helper_private;
-        DBG("%s", omap_encoder->mgr->name);
-        encoder_funcs->dpms(encoder, DRM_MODE_DPMS_OFF);
 }
 
 static void omap_encoder_commit(struct drm_encoder *encoder)
 {
-        struct omap_encoder *omap_encoder = to_omap_encoder(encoder);
-        struct drm_encoder_helper_funcs *encoder_funcs =
-                                encoder->helper_private;
-        DBG("%s", omap_encoder->mgr->name);
-        omap_encoder->mgr->apply(omap_encoder->mgr);
-        encoder_funcs->dpms(encoder, DRM_MODE_DPMS_ON);
 }
 
-static const struct drm_encoder_funcs omap_encoder_funcs = {
-        .destroy = omap_encoder_destroy,
-};
-
 static const struct drm_encoder_helper_funcs omap_encoder_helper_funcs = {
         .dpms = omap_encoder_dpms,
         .mode_fixup = omap_encoder_mode_fixup,
@@ -109,23 +97,54 @@ static const struct drm_encoder_helper_funcs omap_encoder_helper_funcs = {
         .commit = omap_encoder_commit,
 };
 
-struct omap_overlay_manager *omap_encoder_get_manager(
-                struct drm_encoder *encoder)
+/*
+ * Instead of relying on the helpers for modeset, the omap_crtc code
+ * calls these functions in the proper sequence.
+ */
+
+int omap_encoder_set_enabled(struct drm_encoder *encoder, bool enabled)
 {
         struct omap_encoder *omap_encoder = to_omap_encoder(encoder);
-        return omap_encoder->mgr;
+        struct omap_dss_device *dssdev = omap_encoder->dssdev;
+        struct omap_dss_driver *dssdrv = dssdev->driver;
+
+        if (enabled) {
+                return dssdrv->enable(dssdev);
+        } else {
+                dssdrv->disable(dssdev);
+                return 0;
+        }
+}
+
+int omap_encoder_update(struct drm_encoder *encoder,
+                struct omap_overlay_manager *mgr,
+                struct omap_video_timings *timings)
+{
+        struct drm_device *dev = encoder->dev;
+        struct omap_encoder *omap_encoder = to_omap_encoder(encoder);
+        struct omap_dss_device *dssdev = omap_encoder->dssdev;
+        struct omap_dss_driver *dssdrv = dssdev->driver;
+        int ret;
+
+        dssdev->output->manager = mgr;
+
+        ret = dssdrv->check_timings(dssdev, timings);
+        if (ret) {
+                dev_err(dev->dev, "could not set timings: %d\n", ret);
+                return ret;
+        }
+
+        dssdrv->set_timings(dssdev, timings);
+
+        return 0;
 }
 
 /* initialize encoder */
 struct drm_encoder *omap_encoder_init(struct drm_device *dev,
-                struct omap_overlay_manager *mgr)
+                struct omap_dss_device *dssdev)
 {
         struct drm_encoder *encoder = NULL;
         struct omap_encoder *omap_encoder;
-        struct omap_overlay_manager_info info;
-        int ret;
-
-        DBG("%s", mgr->name);
 
         omap_encoder = kzalloc(sizeof(*omap_encoder), GFP_KERNEL);
         if (!omap_encoder) {
@@ -133,33 +152,14 @@ struct drm_encoder *omap_encoder_init(struct drm_device *dev,
                 goto fail;
         }
 
-        omap_encoder->mgr = mgr;
+        omap_encoder->dssdev = dssdev;
+
         encoder = &omap_encoder->base;
 
         drm_encoder_init(dev, encoder, &omap_encoder_funcs,
                          DRM_MODE_ENCODER_TMDS);
         drm_encoder_helper_add(encoder, &omap_encoder_helper_funcs);
 
-        mgr->get_manager_info(mgr, &info);
-
-        /* TODO: fix hard-coded setup.. */
-        info.default_color = 0x00000000;
-        info.trans_key = 0x00000000;
-        info.trans_key_type = OMAP_DSS_COLOR_KEY_GFX_DST;
-        info.trans_enabled = false;
-
-        ret = mgr->set_manager_info(mgr, &info);
-        if (ret) {
-                dev_err(dev->dev, "could not set manager info\n");
-                goto fail;
-        }
-
-        ret = mgr->apply(mgr);
-        if (ret) {
-                dev_err(dev->dev, "could not apply\n");
-                goto fail;
-        }
-
         return encoder;
 
 fail:
diff --git a/drivers/staging/omapdrm/omap_gem_dmabuf.c b/drivers/staging/omapdrm/omap_gem_dmabuf.c
index ea3840038250..b6c5b5c6c8c5 100644
--- a/drivers/staging/omapdrm/omap_gem_dmabuf.c
+++ b/drivers/staging/omapdrm/omap_gem_dmabuf.c
@@ -194,7 +194,7 @@ struct dma_buf_ops omap_dmabuf_ops = {
 struct dma_buf *omap_gem_prime_export(struct drm_device *dev,
                 struct drm_gem_object *obj, int flags)
 {
-        return dma_buf_export(obj, &omap_dmabuf_ops, obj->size, 0600);
+        return dma_buf_export(obj, &omap_dmabuf_ops, obj->size, flags);
 }
 
 struct drm_gem_object *omap_gem_prime_import(struct drm_device *dev,
diff --git a/drivers/staging/omapdrm/omap_irq.c b/drivers/staging/omapdrm/omap_irq.c
new file mode 100644
index 000000000000..2629ba7be6c8
--- /dev/null
+++ b/drivers/staging/omapdrm/omap_irq.c
@@ -0,0 +1,322 @@
+/*
+ * drivers/staging/omapdrm/omap_irq.c
+ *
+ * Copyright (C) 2012 Texas Instruments
+ * Author: Rob Clark <rob.clark@linaro.org>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License version 2 as published by
+ * the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License for
+ * more details.
+ *
+ * You should have received a copy of the GNU General Public License along with
+ * this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "omap_drv.h"
+
+static DEFINE_SPINLOCK(list_lock);
+
+static void omap_irq_error_handler(struct omap_drm_irq *irq,
+                uint32_t irqstatus)
+{
+        DRM_ERROR("errors: %08x\n", irqstatus);
+}
+
+/* call with list_lock and dispc runtime held */
+static void omap_irq_update(struct drm_device *dev)
+{
+        struct omap_drm_private *priv = dev->dev_private;
+        struct omap_drm_irq *irq;
+        uint32_t irqmask = priv->vblank_mask;
+
+        BUG_ON(!spin_is_locked(&list_lock));
+
+        list_for_each_entry(irq, &priv->irq_list, node)
+                irqmask |= irq->irqmask;
+
+        DBG("irqmask=%08x", irqmask);
+
+        dispc_write_irqenable(irqmask);
+        dispc_read_irqenable();        /* flush posted write */
+}
+
+void omap_irq_register(struct drm_device *dev, struct omap_drm_irq *irq)
+{
+        struct omap_drm_private *priv = dev->dev_private;
+        unsigned long flags;
+
+        dispc_runtime_get();
+        spin_lock_irqsave(&list_lock, flags);
+
+        if (!WARN_ON(irq->registered)) {
+                irq->registered = true;
+                list_add(&irq->node, &priv->irq_list);
+                omap_irq_update(dev);
+        }
+
+        spin_unlock_irqrestore(&list_lock, flags);
+        dispc_runtime_put();
+}
+
+void omap_irq_unregister(struct drm_device *dev, struct omap_drm_irq *irq)
+{
+        unsigned long flags;
+
+        dispc_runtime_get();
+        spin_lock_irqsave(&list_lock, flags);
+
+        if (!WARN_ON(!irq->registered)) {
+                irq->registered = false;
+                list_del(&irq->node);
+                omap_irq_update(dev);
+        }
+
+        spin_unlock_irqrestore(&list_lock, flags);
+        dispc_runtime_put();
+}
+
+struct omap_irq_wait {
+        struct omap_drm_irq irq;
+        int count;
+};
+
+static DECLARE_WAIT_QUEUE_HEAD(wait_event);
+
+static void wait_irq(struct omap_drm_irq *irq, uint32_t irqstatus)
+{
+        struct omap_irq_wait *wait =
+                        container_of(irq, struct omap_irq_wait, irq);
+        wait->count--;
+        wake_up_all(&wait_event);
+}
+
+struct omap_irq_wait * omap_irq_wait_init(struct drm_device *dev,
+                uint32_t irqmask, int count)
+{
+        struct omap_irq_wait *wait = kzalloc(sizeof(*wait), GFP_KERNEL);
+        wait->irq.irq = wait_irq;
+        wait->irq.irqmask = irqmask;
+        wait->count = count;
+        omap_irq_register(dev, &wait->irq);
+        return wait;
+}
+
+int omap_irq_wait(struct drm_device *dev, struct omap_irq_wait *wait,
+                unsigned long timeout)
+{
+        int ret = wait_event_timeout(wait_event, (wait->count <= 0), timeout);
+        omap_irq_unregister(dev, &wait->irq);
+        kfree(wait);
+        if (ret == 0)
+                return -1;
+        return 0;
+}
+
+/**
+ * enable_vblank - enable vblank interrupt events
+ * @dev: DRM device
+ * @crtc: which irq to enable
+ *
+ * Enable vblank interrupts for @crtc.  If the device doesn't have
+ * a hardware vblank counter, this routine should be a no-op, since
+ * interrupts will have to stay on to keep the count accurate.
+ *
+ * RETURNS
+ * Zero on success, appropriate errno if the given @crtc's vblank
+ * interrupt cannot be enabled.
+ */
+int omap_irq_enable_vblank(struct drm_device *dev, int crtc)
+{
+        struct omap_drm_private *priv = dev->dev_private;
+        unsigned long flags;
+
+        DBG("dev=%p, crtc=%d", dev, crtc);
+
+        dispc_runtime_get();
+        spin_lock_irqsave(&list_lock, flags);
+        priv->vblank_mask |= pipe2vbl(crtc);
+        omap_irq_update(dev);
+        spin_unlock_irqrestore(&list_lock, flags);
+        dispc_runtime_put();
+
+        return 0;
+}
+
+/**
+ * disable_vblank - disable vblank interrupt events
+ * @dev: DRM device
+ * @crtc: which irq to enable
+ *
+ * Disable vblank interrupts for @crtc.  If the device doesn't have
+ * a hardware vblank counter, this routine should be a no-op, since
+ * interrupts will have to stay on to keep the count accurate.
+ */
+void omap_irq_disable_vblank(struct drm_device *dev, int crtc)
+{
+        struct omap_drm_private *priv = dev->dev_private;
+        unsigned long flags;
+
+        DBG("dev=%p, crtc=%d", dev, crtc);
+
+        dispc_runtime_get();
+        spin_lock_irqsave(&list_lock, flags);
+        priv->vblank_mask &= ~pipe2vbl(crtc);
+        omap_irq_update(dev);
+        spin_unlock_irqrestore(&list_lock, flags);
+        dispc_runtime_put();
+}
+
+irqreturn_t omap_irq_handler(DRM_IRQ_ARGS)
+{
+        struct drm_device *dev = (struct drm_device *) arg;
+        struct omap_drm_private *priv = dev->dev_private;
+        struct omap_drm_irq *handler, *n;
+        unsigned long flags;
+        unsigned int id;
+        u32 irqstatus;
+
+        irqstatus = dispc_read_irqstatus();
+        dispc_clear_irqstatus(irqstatus);
+        dispc_read_irqstatus();        /* flush posted write */
+
+        VERB("irqs: %08x", irqstatus);
+
+        for (id = 0; id < priv->num_crtcs; id++)
+                if (irqstatus & pipe2vbl(id))
+                        drm_handle_vblank(dev, id);
+
+        spin_lock_irqsave(&list_lock, flags);
+        list_for_each_entry_safe(handler, n, &priv->irq_list, node) {
+                if (handler->irqmask & irqstatus) {
+                        spin_unlock_irqrestore(&list_lock, flags);
+                        handler->irq(handler, handler->irqmask & irqstatus);
+                        spin_lock_irqsave(&list_lock, flags);
+                }
+        }
+        spin_unlock_irqrestore(&list_lock, flags);
+
+        return IRQ_HANDLED;
+}
+
+void omap_irq_preinstall(struct drm_device *dev)
+{
+        DBG("dev=%p", dev);
+        dispc_runtime_get();
+        dispc_clear_irqstatus(0xffffffff);
+        dispc_runtime_put();
+}
+
+int omap_irq_postinstall(struct drm_device *dev)
+{
+        struct omap_drm_private *priv = dev->dev_private;
+        struct omap_drm_irq *error_handler = &priv->error_handler;
+
+        DBG("dev=%p", dev);
+
+        INIT_LIST_HEAD(&priv->irq_list);
+
+        error_handler->irq = omap_irq_error_handler;
+        error_handler->irqmask = DISPC_IRQ_OCP_ERR;
+
+        /* for now ignore DISPC_IRQ_SYNC_LOST_DIGIT.. really I think
+         * we just need to ignore it while enabling tv-out
+         */
+        error_handler->irqmask &= ~DISPC_IRQ_SYNC_LOST_DIGIT;
+
+        omap_irq_register(dev, error_handler);
+
+        return 0;
+}
+
+void omap_irq_uninstall(struct drm_device *dev)
+{
+        DBG("dev=%p", dev);
+        // TODO prolly need to call drm_irq_uninstall() somewhere too
+}
+
+/*
+ * We need a special version, instead of just using drm_irq_install(),
+ * because we need to register the irq via omapdss.  Once omapdss and
+ * omapdrm are merged together we can assign the dispc hwmod data to
+ * ourselves and drop these and just use drm_irq_{install,uninstall}()
+ */
+
+int omap_drm_irq_install(struct drm_device *dev)
+{
+        int ret;
+
+        mutex_lock(&dev->struct_mutex);
+
+        if (dev->irq_enabled) {
+                mutex_unlock(&dev->struct_mutex);
+                return -EBUSY;
+        }
+        dev->irq_enabled = 1;
+        mutex_unlock(&dev->struct_mutex);
+
+        /* Before installing handler */
+        if (dev->driver->irq_preinstall)
+                dev->driver->irq_preinstall(dev);
+
+        ret = dispc_request_irq(dev->driver->irq_handler, dev);
+
+        if (ret < 0) {
+                mutex_lock(&dev->struct_mutex);
+                dev->irq_enabled = 0;
+                mutex_unlock(&dev->struct_mutex);
+                return ret;
+        }
+
+        /* After installing handler */
+        if (dev->driver->irq_postinstall)
+                ret = dev->driver->irq_postinstall(dev);
+
+        if (ret < 0) {
+                mutex_lock(&dev->struct_mutex);
+                dev->irq_enabled = 0;
+                mutex_unlock(&dev->struct_mutex);
+                dispc_free_irq(dev);
+        }
+
+        return ret;
+}
+
+int omap_drm_irq_uninstall(struct drm_device *dev)
+{
+        unsigned long irqflags;
+        int irq_enabled, i;
+
+        mutex_lock(&dev->struct_mutex);
+        irq_enabled = dev->irq_enabled;
+        dev->irq_enabled = 0;
+        mutex_unlock(&dev->struct_mutex);
+
+        /*
+         * Wake up any waiters so they don't hang.
+         */
+        if (dev->num_crtcs) {
+                spin_lock_irqsave(&dev->vbl_lock, irqflags);
+                for (i = 0; i < dev->num_crtcs; i++) {
+                        DRM_WAKEUP(&dev->vbl_queue[i]);
+                        dev->vblank_enabled[i] = 0;
+                        dev->last_vblank[i] =
+                                dev->driver->get_vblank_counter(dev, i);
+                }
+                spin_unlock_irqrestore(&dev->vbl_lock, irqflags);
+        }
+
+        if (!irq_enabled)
+                return -EINVAL;
+
+        if (dev->driver->irq_uninstall)
+                dev->driver->irq_uninstall(dev);
+
+        dispc_free_irq(dev);
+
+        return 0;
+}
diff --git a/drivers/staging/omapdrm/omap_plane.c b/drivers/staging/omapdrm/omap_plane.c
index 2a8e5bab49c9..bb989d7f026d 100644
--- a/drivers/staging/omapdrm/omap_plane.c
+++ b/drivers/staging/omapdrm/omap_plane.c
@@ -41,12 +41,14 @@ struct callback {
 
 struct omap_plane {
         struct drm_plane base;
-        struct omap_overlay *ovl;
+        int id;  /* TODO rename omap_plane -> omap_plane_id in omapdss so I can use the enum */
+        const char *name;
         struct omap_overlay_info info;
+        struct omap_drm_apply apply;
 
         /* position/orientation of scanout within the fb: */
         struct omap_drm_window win;
-
+        bool enabled;
 
         /* last fb that we pinned: */
         struct drm_framebuffer *pinned_fb;
@@ -54,189 +56,15 @@ struct omap_plane {
         uint32_t nformats;
         uint32_t formats[32];
 
-        /* for synchronizing access to unpins fifo */
-        struct mutex unpin_mutex;
+        struct omap_drm_irq error_irq;
 
-        /* set of bo's pending unpin until next END_WIN irq */
+        /* set of bo's pending unpin until next post_apply() */
         DECLARE_KFIFO_PTR(unpin_fifo, struct drm_gem_object *);
-        int num_unpins, pending_num_unpins;
-
-        /* for deferred unpin when we need to wait for scanout complete irq */
-        struct work_struct work;
-
-        /* callback on next endwin irq */
-        struct callback endwin;
-};
 
-/* map from ovl->id to the irq we are interested in for scanout-done */
-static const uint32_t id2irq[] = {
-                [OMAP_DSS_GFX]    = DISPC_IRQ_GFX_END_WIN,
-                [OMAP_DSS_VIDEO1] = DISPC_IRQ_VID1_END_WIN,
-                [OMAP_DSS_VIDEO2] = DISPC_IRQ_VID2_END_WIN,
-                [OMAP_DSS_VIDEO3] = DISPC_IRQ_VID3_END_WIN,
+        // XXX maybe get rid of this and handle vblank in crtc too?
+        struct callback apply_done_cb;
 };
 
-static void dispc_isr(void *arg, uint32_t mask)
-{
-        struct drm_plane *plane = arg;
-        struct omap_plane *omap_plane = to_omap_plane(plane);
-        struct omap_drm_private *priv = plane->dev->dev_private;
-
-        omap_dispc_unregister_isr(dispc_isr, plane,
-                        id2irq[omap_plane->ovl->id]);
-
-        queue_work(priv->wq, &omap_plane->work);
-}
-
-static void unpin_worker(struct work_struct *work)
-{
-        struct omap_plane *omap_plane =
-                        container_of(work, struct omap_plane, work);
-        struct callback endwin;
-
-        mutex_lock(&omap_plane->unpin_mutex);
-        DBG("unpinning %d of %d", omap_plane->num_unpins,
-                        omap_plane->num_unpins + omap_plane->pending_num_unpins);
-        while (omap_plane->num_unpins > 0) {
-                struct drm_gem_object *bo = NULL;
-                int ret = kfifo_get(&omap_plane->unpin_fifo, &bo);
-                WARN_ON(!ret);
-                omap_gem_put_paddr(bo);
-                drm_gem_object_unreference_unlocked(bo);
-                omap_plane->num_unpins--;
-        }
-        endwin = omap_plane->endwin;
-        omap_plane->endwin.fxn = NULL;
-        mutex_unlock(&omap_plane->unpin_mutex);
-
-        if (endwin.fxn)
-                endwin.fxn(endwin.arg);
-}
-
-static void install_irq(struct drm_plane *plane)
-{
-        struct omap_plane *omap_plane = to_omap_plane(plane);
-        struct omap_overlay *ovl = omap_plane->ovl;
-        int ret;
-
-        ret = omap_dispc_register_isr(dispc_isr, plane, id2irq[ovl->id]);
-
-        /*
-         * omapdss has upper limit on # of registered irq handlers,
-         * which we shouldn't hit.. but if we do the limit should
-         * be raised or bad things happen:
-         */
-        WARN_ON(ret == -EBUSY);
-}
-
-/* push changes down to dss2 */
-static int commit(struct drm_plane *plane)
-{
-        struct drm_device *dev = plane->dev;
-        struct omap_plane *omap_plane = to_omap_plane(plane);
-        struct omap_overlay *ovl = omap_plane->ovl;
-        struct omap_overlay_info *info = &omap_plane->info;
-        int ret;
-
-        DBG("%s", ovl->name);
-        DBG("%dx%d -> %dx%d (%d)", info->width, info->height, info->out_width,
-                        info->out_height, info->screen_width);
-        DBG("%d,%d %08x %08x", info->pos_x, info->pos_y,
-                        info->paddr, info->p_uv_addr);
-
-        /* NOTE: do we want to do this at all here, or just wait
-         * for dpms(ON) since other CRTC's may not have their mode
-         * set yet, so fb dimensions may still change..
-         */
-        ret = ovl->set_overlay_info(ovl, info);
-        if (ret) {
-                dev_err(dev->dev, "could not set overlay info\n");
-                return ret;
-        }
-
-        mutex_lock(&omap_plane->unpin_mutex);
-        omap_plane->num_unpins += omap_plane->pending_num_unpins;
-        omap_plane->pending_num_unpins = 0;
-        mutex_unlock(&omap_plane->unpin_mutex);
-
-        /* our encoder doesn't necessarily get a commit() after this, in
-         * particular in the dpms() and mode_set_base() cases, so force the
-         * manager to update:
-         *
-         * could this be in the encoder somehow?
-         */
-        if (ovl->manager) {
-                ret = ovl->manager->apply(ovl->manager);
-                if (ret) {
-                        dev_err(dev->dev, "could not apply settings\n");
-                        return ret;
-                }
-
-                /*
-                 * NOTE: really this should be atomic w/ mgr->apply() but
-                 * omapdss does not expose such an API
-                 */
-                if (omap_plane->num_unpins > 0)
-                        install_irq(plane);
-
-        } else {
-                struct omap_drm_private *priv = dev->dev_private;
-                queue_work(priv->wq, &omap_plane->work);
-        }
-
-
-        if (ovl->is_enabled(ovl)) {
-                omap_framebuffer_flush(plane->fb, info->pos_x, info->pos_y,
-                                info->out_width, info->out_height);
-        }
-
-        return 0;
-}
-
-/* when CRTC that we are attached to has potentially changed, this checks
- * if we are attached to proper manager, and if necessary updates.
- */
-static void update_manager(struct drm_plane *plane)
-{
-        struct omap_drm_private *priv = plane->dev->dev_private;
-        struct omap_plane *omap_plane = to_omap_plane(plane);
-        struct omap_overlay *ovl = omap_plane->ovl;
-        struct omap_overlay_manager *mgr = NULL;
-        int i;
-
-        if (plane->crtc) {
-                for (i = 0; i < priv->num_encoders; i++) {
-                        struct drm_encoder *encoder = priv->encoders[i];
-                        if (encoder->crtc == plane->crtc) {
-                                mgr = omap_encoder_get_manager(encoder);
-                                break;
-                        }
-                }
-        }
-
-        if (ovl->manager != mgr) {
-                bool enabled = ovl->is_enabled(ovl);
-
-                /* don't switch things around with enabled overlays: */
-                if (enabled)
-                        omap_plane_dpms(plane, DRM_MODE_DPMS_OFF);
-
-                if (ovl->manager) {
-                        DBG("disconnecting %s from %s", ovl->name,
-                                        ovl->manager->name);
-                        ovl->unset_manager(ovl);
-                }
-
-                if (mgr) {
-                        DBG("connecting %s to %s", ovl->name, mgr->name);
-                        ovl->set_manager(ovl, mgr);
-                }
-
-                if (enabled && mgr)
-                        omap_plane_dpms(plane, DRM_MODE_DPMS_ON);
-        }
-}
-
 static void unpin(void *arg, struct drm_gem_object *bo)
 {
         struct drm_plane *plane = arg;
@@ -244,7 +72,6 @@ static void unpin(void *arg, struct drm_gem_object *bo)
 
         if (kfifo_put(&omap_plane->unpin_fifo,
                         (const struct drm_gem_object **)&bo)) {
-                omap_plane->pending_num_unpins++;
                 /* also hold a ref so it isn't free'd while pinned */
                 drm_gem_object_reference(bo);
         } else {
@@ -264,13 +91,19 @@ static int update_pin(struct drm_plane *plane, struct drm_framebuffer *fb)
 
                 DBG("%p -> %p", pinned_fb, fb);
 
-                mutex_lock(&omap_plane->unpin_mutex);
+                if (fb)
+                        drm_framebuffer_reference(fb);
+
                 ret = omap_framebuffer_replace(pinned_fb, fb, plane, unpin);
-                mutex_unlock(&omap_plane->unpin_mutex);
+
+                if (pinned_fb)
+                        drm_framebuffer_unreference(pinned_fb);
 
                 if (ret) {
                         dev_err(plane->dev->dev, "could not swap %p -> %p\n",
                                         omap_plane->pinned_fb, fb);
+                        if (fb)
+                                drm_framebuffer_unreference(fb);
                         omap_plane->pinned_fb = NULL;
                         return ret;
                 }
@@ -281,31 +114,90 @@ static int update_pin(struct drm_plane *plane, struct drm_framebuffer *fb)
         return 0;
 }
 
-/* update parameters that are dependent on the framebuffer dimensions and
- * position within the fb that this plane scans out from. This is called
- * when framebuffer or x,y base may have changed.
- */
-static void update_scanout(struct drm_plane *plane)
+static void omap_plane_pre_apply(struct omap_drm_apply *apply)
 {
-        struct omap_plane *omap_plane = to_omap_plane(plane);
-        struct omap_overlay_info *info = &omap_plane->info;
+        struct omap_plane *omap_plane =
+                        container_of(apply, struct omap_plane, apply);
         struct omap_drm_window *win = &omap_plane->win;
+        struct drm_plane *plane = &omap_plane->base;
+        struct drm_device *dev = plane->dev;
+        struct omap_overlay_info *info = &omap_plane->info;
+        struct drm_crtc *crtc = plane->crtc;
+        enum omap_channel channel;
+        bool enabled = omap_plane->enabled && crtc;
+        bool ilace, replication;
         int ret;
 
-        ret = update_pin(plane, plane->fb);
-        if (ret) {
-                dev_err(plane->dev->dev,
-                        "could not pin fb: %d\n", ret);
-                omap_plane_dpms(plane, DRM_MODE_DPMS_OFF);
+        DBG("%s, enabled=%d", omap_plane->name, enabled);
+
+        /* if fb has changed, pin new fb: */
+        update_pin(plane, enabled ? plane->fb : NULL);
+
+        if (!enabled) {
+                dispc_ovl_enable(omap_plane->id, false);
                 return;
         }
 
+        channel = omap_crtc_channel(crtc);
+
+        /* update scanout: */
         omap_framebuffer_update_scanout(plane->fb, win, info);
 
-        DBG("%s: %d,%d: %08x %08x (%d)", omap_plane->ovl->name,
-                        win->src_x, win->src_y,
-                        (u32)info->paddr, (u32)info->p_uv_addr,
+        DBG("%dx%d -> %dx%d (%d)", info->width, info->height,
+                        info->out_width, info->out_height,
                         info->screen_width);
+        DBG("%d,%d %08x %08x", info->pos_x, info->pos_y,
+                        info->paddr, info->p_uv_addr);
+
+        /* TODO: */
+        ilace = false;
+        replication = false;
+
+        /* and finally, update omapdss: */
+        ret = dispc_ovl_setup(omap_plane->id, info,
+                        replication, omap_crtc_timings(crtc), false);
+        if (ret) {
+                dev_err(dev->dev, "dispc_ovl_setup failed: %d\n", ret);
+                return;
+        }
+
+        dispc_ovl_enable(omap_plane->id, true);
+        dispc_ovl_set_channel_out(omap_plane->id, channel);
+}
+
+static void omap_plane_post_apply(struct omap_drm_apply *apply)
+{
+        struct omap_plane *omap_plane =
+                        container_of(apply, struct omap_plane, apply);
+        struct drm_plane *plane = &omap_plane->base;
+        struct omap_overlay_info *info = &omap_plane->info;
+        struct drm_gem_object *bo = NULL;
+        struct callback cb;
+
+        cb = omap_plane->apply_done_cb;
+        omap_plane->apply_done_cb.fxn = NULL;
+
+        while (kfifo_get(&omap_plane->unpin_fifo, &bo)) {
+                omap_gem_put_paddr(bo);
+                drm_gem_object_unreference_unlocked(bo);
+        }
+
+        if (cb.fxn)
+                cb.fxn(cb.arg);
+
+        if (omap_plane->enabled) {
+                omap_framebuffer_flush(plane->fb, info->pos_x, info->pos_y,
+                                info->out_width, info->out_height);
+        }
+}
+
+static int apply(struct drm_plane *plane)
+{
+        if (plane->crtc) {
+                struct omap_plane *omap_plane = to_omap_plane(plane);
+                return omap_crtc_apply(plane->crtc, &omap_plane->apply);
+        }
+        return 0;
 }
 
 int omap_plane_mode_set(struct drm_plane *plane,
@@ -313,7 +205,8 @@ int omap_plane_mode_set(struct drm_plane *plane,
                 int crtc_x, int crtc_y,
                 unsigned int crtc_w, unsigned int crtc_h,
                 uint32_t src_x, uint32_t src_y,
-                uint32_t src_w, uint32_t src_h)
+                uint32_t src_w, uint32_t src_h,
+                void (*fxn)(void *), void *arg)
 {
         struct omap_plane *omap_plane = to_omap_plane(plane);
         struct omap_drm_window *win = &omap_plane->win;
@@ -329,17 +222,20 @@ int omap_plane_mode_set(struct drm_plane *plane,
         win->src_w = src_w >> 16;
         win->src_h = src_h >> 16;
 
-        /* note: this is done after this fxn returns.. but if we need
-         * to do a commit/update_scanout, etc before this returns we
-         * need the current value.
-         */
+        if (fxn) {
+                /* omap_crtc should ensure that a new page flip
+                 * isn't permitted while there is one pending:
+                 */
+                BUG_ON(omap_plane->apply_done_cb.fxn);
+
+                omap_plane->apply_done_cb.fxn = fxn;
+                omap_plane->apply_done_cb.arg = arg;
+        }
+
         plane->fb = fb;
         plane->crtc = crtc;
 
-        update_scanout(plane);
-        update_manager(plane);
-
-        return 0;
+        return apply(plane);
 }
 
 static int omap_plane_update(struct drm_plane *plane,
@@ -349,9 +245,12 @@ static int omap_plane_update(struct drm_plane *plane,
                 uint32_t src_x, uint32_t src_y,
                 uint32_t src_w, uint32_t src_h)
 {
-        omap_plane_mode_set(plane, crtc, fb, crtc_x, crtc_y, crtc_w, crtc_h,
-                        src_x, src_y, src_w, src_h);
-        return omap_plane_dpms(plane, DRM_MODE_DPMS_ON);
+        struct omap_plane *omap_plane = to_omap_plane(plane);
+        omap_plane->enabled = true;
+        return omap_plane_mode_set(plane, crtc, fb,
+                        crtc_x, crtc_y, crtc_w, crtc_h,
+                        src_x, src_y, src_w, src_h,
+                        NULL, NULL);
 }
 
 static int omap_plane_disable(struct drm_plane *plane)
@@ -364,48 +263,32 @@ static int omap_plane_disable(struct drm_plane *plane)
 static void omap_plane_destroy(struct drm_plane *plane)
 {
         struct omap_plane *omap_plane = to_omap_plane(plane);
-        DBG("%s", omap_plane->ovl->name);
+
+        DBG("%s", omap_plane->name);
+
+        omap_irq_unregister(plane->dev, &omap_plane->error_irq);
+
         omap_plane_disable(plane);
         drm_plane_cleanup(plane);
-        WARN_ON(omap_plane->pending_num_unpins + omap_plane->num_unpins > 0);
+
+        WARN_ON(!kfifo_is_empty(&omap_plane->unpin_fifo));
         kfifo_free(&omap_plane->unpin_fifo);
+
         kfree(omap_plane);
 }
 
 int omap_plane_dpms(struct drm_plane *plane, int mode)
 {
         struct omap_plane *omap_plane = to_omap_plane(plane);
-        struct omap_overlay *ovl = omap_plane->ovl;
-        int r;
+        bool enabled = (mode == DRM_MODE_DPMS_ON);
+        int ret = 0;
 
-        DBG("%s: %d", omap_plane->ovl->name, mode);
-
-        if (mode == DRM_MODE_DPMS_ON) {
-                update_scanout(plane);
-                r = commit(plane);
-                if (!r)
-                        r = ovl->enable(ovl);
-        } else {
-                struct omap_drm_private *priv = plane->dev->dev_private;
-                r = ovl->disable(ovl);
-                update_pin(plane, NULL);
-                queue_work(priv->wq, &omap_plane->work);
+        if (enabled != omap_plane->enabled) {
+                omap_plane->enabled = enabled;
+                ret = apply(plane);
         }
 
-        return r;
-}
-
-void omap_plane_on_endwin(struct drm_plane *plane,
-                void (*fxn)(void *), void *arg)
-{
-        struct omap_plane *omap_plane = to_omap_plane(plane);
-
-        mutex_lock(&omap_plane->unpin_mutex);
-        omap_plane->endwin.fxn = fxn;
-        omap_plane->endwin.arg = arg;
-        mutex_unlock(&omap_plane->unpin_mutex);
-
-        install_irq(plane);
+        return ret;
 }
 
 /* helper to install properties which are common to planes and crtcs */
@@ -454,25 +337,13 @@ int omap_plane_set_property(struct drm_plane *plane,
         int ret = -EINVAL;
 
         if (property == priv->rotation_prop) {
-                struct omap_overlay *ovl = omap_plane->ovl;
-
-                DBG("%s: rotation: %02x", ovl->name, (uint32_t)val);
+                DBG("%s: rotation: %02x", omap_plane->name, (uint32_t)val);
                 omap_plane->win.rotation = val;
-
-                if (ovl->is_enabled(ovl))
-                        ret = omap_plane_dpms(plane, DRM_MODE_DPMS_ON);
-                else
-                        ret = 0;
+                ret = apply(plane);
         } else if (property == priv->zorder_prop) {
-                struct omap_overlay *ovl = omap_plane->ovl;
-
-                DBG("%s: zorder: %d", ovl->name, (uint32_t)val);
+                DBG("%s: zorder: %02x", omap_plane->name, (uint32_t)val);
                 omap_plane->info.zorder = val;
-
-                if (ovl->is_enabled(ovl))
-                        ret = omap_plane_dpms(plane, DRM_MODE_DPMS_ON);
-                else
-                        ret = 0;
+                ret = apply(plane);
         }
 
         return ret;
@@ -485,20 +356,38 @@ static const struct drm_plane_funcs omap_plane_funcs = {
                 .set_property = omap_plane_set_property,
 };
 
+static void omap_plane_error_irq(struct omap_drm_irq *irq, uint32_t irqstatus)
+{
+        struct omap_plane *omap_plane =
+                        container_of(irq, struct omap_plane, error_irq);
+        DRM_ERROR("%s: errors: %08x\n", omap_plane->name, irqstatus);
+}
+
+static const char *plane_names[] = {
+                [OMAP_DSS_GFX] = "gfx",
+                [OMAP_DSS_VIDEO1] = "vid1",
+                [OMAP_DSS_VIDEO2] = "vid2",
+                [OMAP_DSS_VIDEO3] = "vid3",
+};
+
+static const uint32_t error_irqs[] = {
+                [OMAP_DSS_GFX] = DISPC_IRQ_GFX_FIFO_UNDERFLOW,
+                [OMAP_DSS_VIDEO1] = DISPC_IRQ_VID1_FIFO_UNDERFLOW,
+                [OMAP_DSS_VIDEO2] = DISPC_IRQ_VID2_FIFO_UNDERFLOW,
+                [OMAP_DSS_VIDEO3] = DISPC_IRQ_VID3_FIFO_UNDERFLOW,
+};
+
 /* initialize plane */
 struct drm_plane *omap_plane_init(struct drm_device *dev,
-                struct omap_overlay *ovl, unsigned int possible_crtcs,
-                bool priv)
+                int id, bool private_plane)
 {
+        struct omap_drm_private *priv = dev->dev_private;
         struct drm_plane *plane = NULL;
         struct omap_plane *omap_plane;
+        struct omap_overlay_info *info;
         int ret;
 
-        DBG("%s: possible_crtcs=%08x, priv=%d", ovl->name,
-                        possible_crtcs, priv);
-
-        /* friendly reminder to update table for future hw: */
-        WARN_ON(ovl->id >= ARRAY_SIZE(id2irq));
+        DBG("%s: priv=%d", plane_names[id], private_plane);
 
         omap_plane = kzalloc(sizeof(*omap_plane), GFP_KERNEL);
         if (!omap_plane) {
@@ -506,47 +395,50 @@ struct drm_plane *omap_plane_init(struct drm_device *dev,
                 goto fail;
         }
 
-        mutex_init(&omap_plane->unpin_mutex);
-
         ret = kfifo_alloc(&omap_plane->unpin_fifo, 16, GFP_KERNEL);
         if (ret) {
                 dev_err(dev->dev, "could not allocate unpin FIFO\n");
                 goto fail;
         }
 
-        INIT_WORK(&omap_plane->work, unpin_worker);
-
         omap_plane->nformats = omap_framebuffer_get_formats(
                         omap_plane->formats, ARRAY_SIZE(omap_plane->formats),
-                        ovl->supported_modes);
-        omap_plane->ovl = ovl;
+                        dss_feat_get_supported_color_modes(id));
+        omap_plane->id = id;
+        omap_plane->name = plane_names[id];
+
         plane = &omap_plane->base;
 
-        drm_plane_init(dev, plane, possible_crtcs, &omap_plane_funcs,
-                        omap_plane->formats, omap_plane->nformats, priv);
+        omap_plane->apply.pre_apply  = omap_plane_pre_apply;
+        omap_plane->apply.post_apply = omap_plane_post_apply;
+
+        omap_plane->error_irq.irqmask = error_irqs[id];
+        omap_plane->error_irq.irq = omap_plane_error_irq;
+        omap_irq_register(dev, &omap_plane->error_irq);
+
+        drm_plane_init(dev, plane, (1 << priv->num_crtcs) - 1, &omap_plane_funcs,
+                        omap_plane->formats, omap_plane->nformats, private_plane);
 
         omap_plane_install_properties(plane, &plane->base);
 
         /* get our starting configuration, set defaults for parameters
          * we don't currently use, etc:
          */
-        ovl->get_overlay_info(ovl, &omap_plane->info);
-        omap_plane->info.rotation_type = OMAP_DSS_ROT_DMA;
-        omap_plane->info.rotation = OMAP_DSS_ROT_0;
-        omap_plane->info.global_alpha = 0xff;
-        omap_plane->info.mirror = 0;
+        info = &omap_plane->info;
+        info->rotation_type = OMAP_DSS_ROT_DMA;
+        info->rotation = OMAP_DSS_ROT_0;
+        info->global_alpha = 0xff;
+        info->mirror = 0;
 
         /* Set defaults depending on whether we are a CRTC or overlay
          * layer.
          * TODO add ioctl to give userspace an API to change this.. this
          * will come in a subsequent patch.
          */
-        if (priv)
+        if (private_plane)
                 omap_plane->info.zorder = 0;
         else
-                omap_plane->info.zorder = ovl->id;
-
-        update_manager(plane);
+                omap_plane->info.zorder = id;
 
         return plane;
 
diff --git a/drivers/staging/rtl8187se/r8180_core.c b/drivers/staging/rtl8187se/r8180_core.c
index ae38475854b5..d10d75e8a33f 100644
--- a/drivers/staging/rtl8187se/r8180_core.c
+++ b/drivers/staging/rtl8187se/r8180_core.c
@@ -937,7 +937,8 @@ short alloc_rx_desc_ring(struct net_device *dev, u16 bufsize, int count)
 
                 dma_tmp = pci_map_single(pdev, buf, bufsize * sizeof(u8),
                                          PCI_DMA_FROMDEVICE);
-
+                if (pci_dma_mapping_error(pdev, dma_tmp))
+                        return -1;
                 if (-1 == buffer_add(&(priv->rxbuffer), buf, dma_tmp,
                            &(priv->rxbufferhead))) {
                         DMESGE("Unable to allocate mem RX buf");
diff --git a/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c b/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
index 808aab6fa5ef..a9d78e9651c6 100644
--- a/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
+++ b/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c
@@ -1183,6 +1183,8 @@ void  rtl8192_tx_fill_desc(struct net_device *dev, struct tx_desc *pdesc,
                                                 pTxFwInfo->TxRate,
                                                 cb_desc);
 
+        if (pci_dma_mapping_error(priv->pdev, mapping))
+                RT_TRACE(COMP_ERR, "DMA Mapping error\n");;
         if (cb_desc->bAMPDUEnable) {
                 pTxFwInfo->AllowAggregation = 1;
                 pTxFwInfo->RxMF = cb_desc->ampdu_factor;
@@ -1280,6 +1282,8 @@ void  rtl8192_tx_fill_cmd_desc(struct net_device *dev,
         dma_addr_t mapping = pci_map_single(priv->pdev, skb->data, skb->len,
                          PCI_DMA_TODEVICE);
 
+        if (pci_dma_mapping_error(priv->pdev, mapping))
+                RT_TRACE(COMP_ERR, "DMA Mapping error\n");;
         memset(entry, 0, 12);
         entry->LINIP = cb_desc->bLastIniPkt;
         entry->FirstSeg = 1;
diff --git a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
index 1a70f324552f..4ebf99b30975 100644
--- a/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
+++ b/drivers/staging/rtl8192e/rtl8192e/rtl_core.c
@@ -2104,7 +2104,10 @@ static short rtl8192_alloc_rx_desc_ring(struct net_device *dev)
                                                   skb_tail_pointer_rsl(skb),
                                                   priv->rxbuffersize,
                                                   PCI_DMA_FROMDEVICE);
-
+                        if (pci_dma_mapping_error(priv->pdev, *mapping)) {
+                                dev_kfree_skb_any(skb);
+                                return -1;
+                        }
                         entry->BufferAddress = cpu_to_le32(*mapping);
 
                         entry->Length = priv->rxbuffersize;
@@ -2397,7 +2400,11 @@ static void rtl8192_rx_normal(struct net_device *dev)
                                                     skb_tail_pointer_rsl(skb),
                                                     priv->rxbuffersize,
                                                     PCI_DMA_FROMDEVICE);
-
+                        if (pci_dma_mapping_error(priv->pdev,
+                                                  *((dma_addr_t *)skb->cb))) {
+                                dev_kfree_skb_any(skb);
+                                return;
+                        }
                 }
 done:
                 pdesc->BufferAddress = cpu_to_le32(*((dma_addr_t *)skb->cb));
diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c
index 6b73843e580a..a96cd06d69dd 100644
--- a/drivers/staging/rtl8712/usb_intf.c
+++ b/drivers/staging/rtl8712/usb_intf.c
@@ -63,6 +63,8 @@ static struct usb_device_id rtl871x_usb_id_tbl[] = {
         {USB_DEVICE(0x0B05, 0x1791)}, /* 11n mode disable */
         /* Belkin */
         {USB_DEVICE(0x050D, 0x945A)},
+        /* ISY IWL - Belkin clone */
+        {USB_DEVICE(0x050D, 0x11F1)},
         /* Corega */
         {USB_DEVICE(0x07AA, 0x0047)},
         /* D-Link */
diff --git a/drivers/staging/sb105x/Kconfig b/drivers/staging/sb105x/Kconfig
index ac87c5e38dee..1facad625554 100644
--- a/drivers/staging/sb105x/Kconfig
+++ b/drivers/staging/sb105x/Kconfig
@@ -2,6 +2,7 @@ config SB105X
         tristate "SystemBase PCI Multiport UART"
         select SERIAL_CORE
         depends on PCI
+        depends on X86
         help
           A driver for the SystemBase Multi-2/PCI serial card
 
diff --git a/drivers/staging/sb105x/sb_pci_mp.c b/drivers/staging/sb105x/sb_pci_mp.c
index edb2a85b9d52..9464f3874346 100644
--- a/drivers/staging/sb105x/sb_pci_mp.c
+++ b/drivers/staging/sb105x/sb_pci_mp.c
@@ -3054,6 +3054,7 @@ static int init_mp_dev(struct pci_dev *pcidev, mppcibrd_t brd)
                                 sbdev->nr_ports = ((portnum_hex/16)*10) + (portnum_hex % 16);
                         }
                         break;
+#ifdef CONFIG_PARPORT_PC
                 case PCI_DEVICE_ID_MP2S1P :
                         sbdev->nr_ports = 2;
 
@@ -3073,6 +3074,7 @@ static int init_mp_dev(struct pci_dev *pcidev, mppcibrd_t brd)
                         /* add PC compatible parallel port */
                         parport_pc_probe_port(pcidev->resource[2].start, pcidev->resource[3].start, PARPORT_IRQ_NONE, PARPORT_DMA_NONE, &pcidev->dev, 0);
                         break;
+#endif
         }
 
         ret = request_region(sbdev->uart_access_addr, (8*sbdev->nr_ports), sbdev->name);
diff --git a/drivers/staging/speakup/synth.c b/drivers/staging/speakup/synth.c
index df9533798095..7616f058a00b 100644
--- a/drivers/staging/speakup/synth.c
+++ b/drivers/staging/speakup/synth.c
@@ -342,7 +342,7 @@ int synth_init(char *synth_name)
 
         mutex_lock(&spk_mutex);
         /* First, check if we already have it loaded. */
-        for (i = 0; synths[i] != NULL && i < MAXSYNTHS; i++)
+        for (i = 0; i < MAXSYNTHS && synths[i] != NULL; i++)
                 if (strcmp(synths[i]->name, synth_name) == 0)
                         synth = synths[i];
 
@@ -423,7 +423,7 @@ int synth_add(struct spk_synth *in_synth)
         int i;
         int status = 0;
         mutex_lock(&spk_mutex);
-        for (i = 0; synths[i] != NULL && i < MAXSYNTHS; i++)
+        for (i = 0; i < MAXSYNTHS && synths[i] != NULL; i++)
                 /* synth_remove() is responsible for rotating the array down */
                 if (in_synth == synths[i]) {
                         mutex_unlock(&spk_mutex);
diff --git a/drivers/staging/tidspbridge/core/_tiomap.h b/drivers/staging/tidspbridge/core/_tiomap.h
index 543a127c7d4d..b783bfa59b1c 100644
--- a/drivers/staging/tidspbridge/core/_tiomap.h
+++ b/drivers/staging/tidspbridge/core/_tiomap.h
@@ -31,7 +31,7 @@
  * driver should read or write to PRM/CM registers directly; they
  * should rely on OMAP core code to do this.
  */
-#include <mach-omap2/cm2xxx_3xxx.h>
+#include <mach-omap2/cm3xxx.h>
 #include <mach-omap2/prm-regbits-34xx.h>
 #include <mach-omap2/cm-regbits-34xx.h>
 #include <dspbridge/devdefs.h>
diff --git a/drivers/staging/tidspbridge/core/dsp-clock.c b/drivers/staging/tidspbridge/core/dsp-clock.c
index b647207928b1..2f084e181d39 100644
--- a/drivers/staging/tidspbridge/core/dsp-clock.c
+++ b/drivers/staging/tidspbridge/core/dsp-clock.c
@@ -121,9 +121,13 @@ void dsp_clk_exit(void)
         for (i = 0; i < DM_TIMER_CLOCKS; i++)
                 omap_dm_timer_free(timer[i]);
 
+        clk_unprepare(iva2_clk);
         clk_put(iva2_clk);
+        clk_unprepare(ssi.sst_fck);
         clk_put(ssi.sst_fck);
+        clk_unprepare(ssi.ssr_fck);
         clk_put(ssi.ssr_fck);
+        clk_unprepare(ssi.ick);
         clk_put(ssi.ick);
 }
 
@@ -145,14 +149,21 @@ void dsp_clk_init(void)
         iva2_clk = clk_get(&dspbridge_device.dev, "iva2_ck");
         if (IS_ERR(iva2_clk))
                 dev_err(bridge, "failed to get iva2 clock %p\n", iva2_clk);
+        else
+                clk_prepare(iva2_clk);
 
         ssi.sst_fck = clk_get(&dspbridge_device.dev, "ssi_sst_fck");
         ssi.ssr_fck = clk_get(&dspbridge_device.dev, "ssi_ssr_fck");
         ssi.ick = clk_get(&dspbridge_device.dev, "ssi_ick");
 
-        if (IS_ERR(ssi.sst_fck) || IS_ERR(ssi.ssr_fck) || IS_ERR(ssi.ick))
+        if (IS_ERR(ssi.sst_fck) || IS_ERR(ssi.ssr_fck) || IS_ERR(ssi.ick)) {
                 dev_err(bridge, "failed to get ssi: sst %p, ssr %p, ick %p\n",
                                         ssi.sst_fck, ssi.ssr_fck, ssi.ick);
+        } else {
+                clk_prepare(ssi.sst_fck);
+                clk_prepare(ssi.ssr_fck);
+                clk_prepare(ssi.ick);
+        }
 }
 
 /**
diff --git a/drivers/staging/tidspbridge/core/wdt.c b/drivers/staging/tidspbridge/core/wdt.c
index 1dce36fb828f..7ff0e6c98039 100644
--- a/drivers/staging/tidspbridge/core/wdt.c
+++ b/drivers/staging/tidspbridge/core/wdt.c
@@ -63,11 +63,15 @@ int dsp_wdt_init(void)
         dsp_wdt.fclk = clk_get(NULL, "wdt3_fck");
 
         if (!IS_ERR(dsp_wdt.fclk)) {
+                clk_prepare(dsp_wdt.fclk);
+
                 dsp_wdt.iclk = clk_get(NULL, "wdt3_ick");
                 if (IS_ERR(dsp_wdt.iclk)) {
                         clk_put(dsp_wdt.fclk);
                         dsp_wdt.fclk = NULL;
                         ret = -EFAULT;
+                } else {
+                        clk_prepare(dsp_wdt.iclk);
                 }
         } else
                 ret = -EFAULT;
@@ -95,10 +99,14 @@ void dsp_wdt_exit(void)
         free_irq(INT_34XX_WDT3_IRQ, &dsp_wdt);
         tasklet_kill(&dsp_wdt.wdt3_tasklet);
 
-        if (dsp_wdt.fclk)
+        if (dsp_wdt.fclk) {
+                clk_unprepare(dsp_wdt.fclk);
                 clk_put(dsp_wdt.fclk);
-        if (dsp_wdt.iclk)
+        }
+        if (dsp_wdt.iclk) {
+                clk_unprepare(dsp_wdt.iclk);
                 clk_put(dsp_wdt.iclk);
+        }
 
         dsp_wdt.fclk = NULL;
         dsp_wdt.iclk = NULL;
diff --git a/drivers/staging/vme/devices/vme_pio2_core.c b/drivers/staging/vme/devices/vme_pio2_core.c
index 0331178ca3b3..bf73ba26e88a 100644
--- a/drivers/staging/vme/devices/vme_pio2_core.c
+++ b/drivers/staging/vme/devices/vme_pio2_core.c
@@ -162,11 +162,9 @@ static struct vme_driver pio2_driver = {
 
 static int __init pio2_init(void)
 {
-        int retval = 0;
-
         if (bus_num == 0) {
                 pr_err("No cards, skipping registration\n");
-                goto err_nocard;
+                return -ENODEV;
         }
 
         if (bus_num > PIO2_CARDS_MAX) {
@@ -176,15 +174,7 @@ static int __init pio2_init(void)
         }
 
         /* Register the PIO2 driver */
-        retval = vme_register_driver(&pio2_driver, bus_num);
-        if (retval != 0)
-                goto err_reg;
-
-        return retval;
-
-err_reg:
-err_nocard:
-        return retval;
+        return  vme_register_driver(&pio2_driver, bus_num);
 }
 
 static int pio2_match(struct vme_dev *vdev)
diff --git a/drivers/staging/vt6656/bssdb.h b/drivers/staging/vt6656/bssdb.h
index 6b2ec390e775..806cbf72fb59 100644
--- a/drivers/staging/vt6656/bssdb.h
+++ b/drivers/staging/vt6656/bssdb.h
@@ -90,7 +90,6 @@ typedef struct tagSRSNCapObject {
 } SRSNCapObject, *PSRSNCapObject;
 
 // BSS info(AP)
-#pragma pack(1)
 typedef struct tagKnownBSS {
     // BSS info
     BOOL            bActive;
diff --git a/drivers/staging/vt6656/int.h b/drivers/staging/vt6656/int.h
index 5d8faf9f96ec..e0d2b07ba608 100644
--- a/drivers/staging/vt6656/int.h
+++ b/drivers/staging/vt6656/int.h
@@ -34,7 +34,6 @@
 #include "device.h"
 
 /*---------------------  Export Definitions -------------------------*/
-#pragma pack(1)
 typedef struct tagSINTData {
         BYTE byTSR0;
         BYTE byPkt0;
diff --git a/drivers/staging/vt6656/iocmd.h b/drivers/staging/vt6656/iocmd.h
index 22710cef751d..ae6e2d237b20 100644
--- a/drivers/staging/vt6656/iocmd.h
+++ b/drivers/staging/vt6656/iocmd.h
@@ -95,13 +95,12 @@ typedef enum tagWZONETYPE {
 // Ioctl interface structure
 // Command structure
 //
-#pragma pack(1)
 typedef struct tagSCmdRequest {
         u8 name[16];
         void    *data;
         u16         wResult;
         u16     wCmdCode;
-} SCmdRequest, *PSCmdRequest;
+} __packed SCmdRequest, *PSCmdRequest;
 
 //
 // Scan
@@ -111,7 +110,7 @@ typedef struct tagSCmdScan {
 
     u8      ssid[SSID_MAXLEN + 2];
 
-} SCmdScan, *PSCmdScan;
+} __packed SCmdScan, *PSCmdScan;
 
 //
 // BSS Join
@@ -126,7 +125,7 @@ typedef struct tagSCmdBSSJoin {
     BOOL    bPSEnable;
     BOOL    bShareKeyAuth;
 
-} SCmdBSSJoin, *PSCmdBSSJoin;
+} __packed SCmdBSSJoin, *PSCmdBSSJoin;
 
 //
 // Zonetype Setting
@@ -137,7 +136,7 @@ typedef struct tagSCmdZoneTypeSet {
  BOOL       bWrite;
  WZONETYPE  ZoneType;
 
-} SCmdZoneTypeSet, *PSCmdZoneTypeSet;
+} __packed SCmdZoneTypeSet, *PSCmdZoneTypeSet;
 
 typedef struct tagSWPAResult {
          char   ifname[100];
@@ -145,7 +144,7 @@ typedef struct tagSWPAResult {
         u8 key_mgmt;
         u8 eap_type;
          BOOL authenticated;
-} SWPAResult, *PSWPAResult;
+} __packed SWPAResult, *PSWPAResult;
 
 typedef struct tagSCmdStartAP {
 
@@ -157,7 +156,7 @@ typedef struct tagSCmdStartAP {
     BOOL    bShareKeyAuth;
     u8      byBasicRate;
 
-} SCmdStartAP, *PSCmdStartAP;
+} __packed SCmdStartAP, *PSCmdStartAP;
 
 typedef struct tagSCmdSetWEP {
 
@@ -167,7 +166,7 @@ typedef struct tagSCmdSetWEP {
     BOOL    bWepKeyAvailable[WEP_NKEYS];
     u32     auWepKeyLength[WEP_NKEYS];
 
-} SCmdSetWEP, *PSCmdSetWEP;
+} __packed SCmdSetWEP, *PSCmdSetWEP;
 
 typedef struct tagSBSSIDItem {
 
@@ -180,14 +179,14 @@ typedef struct tagSBSSIDItem {
     BOOL    bWEPOn;
     u32     uRSSI;
 
-} SBSSIDItem;
+} __packed SBSSIDItem;
 
 
 typedef struct tagSBSSIDList {
 
         u32                 uItem;
         SBSSIDItem      sBSSIDList[0];
-} SBSSIDList, *PSBSSIDList;
+} __packed SBSSIDList, *PSBSSIDList;
 
 
 typedef struct tagSNodeItem {
@@ -208,7 +207,7 @@ typedef struct tagSNodeItem {
     u32            uTxAttempts;
     u16            wFailureRatio;
 
-} SNodeItem;
+} __packed SNodeItem;
 
 
 typedef struct tagSNodeList {
@@ -216,7 +215,7 @@ typedef struct tagSNodeList {
         u32                 uItem;
         SNodeItem       sNodeList[0];
 
-} SNodeList, *PSNodeList;
+} __packed SNodeList, *PSNodeList;
 
 
 typedef struct tagSCmdLinkStatus {
@@ -229,7 +228,7 @@ typedef struct tagSCmdLinkStatus {
     u32     uChannel;
     u32     uLinkRate;
 
-} SCmdLinkStatus, *PSCmdLinkStatus;
+} __packed SCmdLinkStatus, *PSCmdLinkStatus;
 
 //
 // 802.11 counter
@@ -247,7 +246,7 @@ typedef struct tagSDot11MIBCount {
     u32 ReceivedFragmentCount;
     u32 MulticastReceivedFrameCount;
     u32 FCSErrorCount;
-} SDot11MIBCount, *PSDot11MIBCount;
+} __packed SDot11MIBCount, *PSDot11MIBCount;
 
 
 
@@ -355,13 +354,13 @@ typedef struct tagSStatMIBCount {
     u32   ullTxBroadcastBytes[2];
     u32   ullTxMulticastBytes[2];
     u32   ullTxDirectedBytes[2];
-} SStatMIBCount, *PSStatMIBCount;
+} __packed SStatMIBCount, *PSStatMIBCount;
 
 typedef struct tagSCmdValue {
 
     u32     dwValue;
 
-} SCmdValue,  *PSCmdValue;
+} __packed SCmdValue,  *PSCmdValue;
 
 //
 // hostapd & viawget ioctl related
@@ -431,7 +430,7 @@ struct viawget_hostapd_param {
                         u8 ssid[32];
                 } scan_req;
         } u;
-};
+} __packed;
 
 /*---------------------  Export Classes  ----------------------------*/
 
diff --git a/drivers/staging/vt6656/iowpa.h b/drivers/staging/vt6656/iowpa.h
index 959c8868f6e2..2522ddec718d 100644
--- a/drivers/staging/vt6656/iowpa.h
+++ b/drivers/staging/vt6656/iowpa.h
@@ -67,12 +67,11 @@ enum {
 
 
 
-#pragma pack(1)
 typedef struct viawget_wpa_header {
         u8 type;
         u16 req_ie_len;
         u16 resp_ie_len;
-} viawget_wpa_header;
+} __packed viawget_wpa_header;
 
 struct viawget_wpa_param {
         u32 cmd;
@@ -113,9 +112,8 @@ struct viawget_wpa_param {
                         u8 *buf;
                 } scan_results;
         } u;
-};
+} __packed;
 
-#pragma pack(1)
 struct viawget_scan_result {
         u8 bssid[6];
         u8 ssid[32];
@@ -130,7 +128,7 @@ struct viawget_scan_result {
         int noise;
         int level;
         int maxrate;
-};
+} __packed;
 
 /*---------------------  Export Classes  ----------------------------*/
 
diff --git a/drivers/staging/wlan-ng/cfg80211.c b/drivers/staging/wlan-ng/cfg80211.c
index 18c06a59c091..1d31eab19d16 100644
--- a/drivers/staging/wlan-ng/cfg80211.c
+++ b/drivers/staging/wlan-ng/cfg80211.c
@@ -638,8 +638,8 @@ int prism2_leave_ibss(struct wiphy *wiphy, struct net_device *dev)
 }
 
 
-int prism2_set_tx_power(struct wiphy *wiphy, enum nl80211_tx_power_setting type,
-                        int mbm)
+int prism2_set_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
+                        enum nl80211_tx_power_setting type, int mbm)
 {
         struct prism2_wiphy_private *priv = wiphy_priv(wiphy);
         wlandevice_t *wlandev = priv->wlandev;
@@ -665,7 +665,8 @@ exit:
         return err;
 }
 
-int prism2_get_tx_power(struct wiphy *wiphy, int *dbm)
+int prism2_get_tx_power(struct wiphy *wiphy, struct wireless_dev *wdev,
+                        int *dbm)
 {
         struct prism2_wiphy_private *priv = wiphy_priv(wiphy);
         wlandevice_t *wlandev = priv->wlandev;
diff --git a/drivers/staging/wlan-ng/prism2mgmt.c b/drivers/staging/wlan-ng/prism2mgmt.c
index 4efa9bc0fcf0..89bfd858bb28 100644
--- a/drivers/staging/wlan-ng/prism2mgmt.c
+++ b/drivers/staging/wlan-ng/prism2mgmt.c
@@ -406,7 +406,7 @@ int prism2mgmt_scan_results(wlandevice_t *wlandev, void *msgp)
         /* SSID */
         req->ssid.status = P80211ENUM_msgitem_status_data_ok;
         req->ssid.data.len = le16_to_cpu(item->ssid.len);
-        req->ssid.data.len = min_t(u16, req->ssid.data.len, WLAN_BSSID_LEN);
+        req->ssid.data.len = min_t(u16, req->ssid.data.len, WLAN_SSID_MAXLEN);
         memcpy(req->ssid.data.data, item->ssid.data, req->ssid.data.len);
 
         /* supported rates */
diff --git a/drivers/staging/zram/zram_drv.c b/drivers/staging/zram/zram_drv.c
index fb4a7c94aed3..f2a73bd739fb 100644
--- a/drivers/staging/zram/zram_drv.c
+++ b/drivers/staging/zram/zram_drv.c
@@ -265,7 +265,7 @@ out_cleanup:
 static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
                            int offset)
 {
-        int ret;
+        int ret = 0;
         size_t clen;
         unsigned long handle;
         struct page *page;
@@ -286,10 +286,8 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
                         goto out;
                 }
                 ret = zram_decompress_page(zram, uncmem, index);
-                if (ret) {
-                        kfree(uncmem);
+                if (ret)
                         goto out;
-                }
         }
 
         /*
@@ -302,16 +300,18 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
 
         user_mem = kmap_atomic(page);
 
-        if (is_partial_io(bvec))
+        if (is_partial_io(bvec)) {
                 memcpy(uncmem + offset, user_mem + bvec->bv_offset,
                        bvec->bv_len);
-        else
+                kunmap_atomic(user_mem);
+                user_mem = NULL;
+        } else {
                 uncmem = user_mem;
+        }
 
         if (page_zero_filled(uncmem)) {
-                kunmap_atomic(user_mem);
-                if (is_partial_io(bvec))
-                        kfree(uncmem);
+                if (!is_partial_io(bvec))
+                        kunmap_atomic(user_mem);
                 zram_stat_inc(&zram->stats.pages_zero);
                 zram_set_flag(zram, index, ZRAM_ZERO);
                 ret = 0;
@@ -321,9 +321,11 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
         ret = lzo1x_1_compress(uncmem, PAGE_SIZE, src, &clen,
                                zram->compress_workmem);
 
-        kunmap_atomic(user_mem);
-        if (is_partial_io(bvec))
-                        kfree(uncmem);
+        if (!is_partial_io(bvec)) {
+                kunmap_atomic(user_mem);
+                user_mem = NULL;
+                uncmem = NULL;
+        }
 
         if (unlikely(ret != LZO_E_OK)) {
                 pr_err("Compression failed! err=%d\n", ret);
@@ -332,8 +334,10 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
 
         if (unlikely(clen > max_zpage_size)) {
                 zram_stat_inc(&zram->stats.bad_compress);
-                src = uncmem;
                 clen = PAGE_SIZE;
+                src = NULL;
+                if (is_partial_io(bvec))
+                        src = uncmem;
         }
 
         handle = zs_malloc(zram->mem_pool, clen);
@@ -345,7 +349,11 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
         }
         cmem = zs_map_object(zram->mem_pool, handle, ZS_MM_WO);
 
+        if ((clen == PAGE_SIZE) && !is_partial_io(bvec))
+                src = kmap_atomic(page);
         memcpy(cmem, src, clen);
+        if ((clen == PAGE_SIZE) && !is_partial_io(bvec))
+                kunmap_atomic(src);
 
         zs_unmap_object(zram->mem_pool, handle);
 
@@ -358,9 +366,10 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index,
         if (clen <= PAGE_SIZE / 2)
                 zram_stat_inc(&zram->stats.good_compress);
 
-        return 0;
-
 out:
+        if (is_partial_io(bvec))
+                kfree(uncmem);
+
         if (ret)
                 zram_stat64_inc(zram, &zram->stats.failed_writes);
         return ret;
diff --git a/drivers/target/iscsi/iscsi_target_erl2.c b/drivers/target/iscsi/iscsi_target_erl2.c
index 9ac4c151eae4..ba6091bf93fc 100644
--- a/drivers/target/iscsi/iscsi_target_erl2.c
+++ b/drivers/target/iscsi/iscsi_target_erl2.c
@@ -372,7 +372,7 @@ int iscsit_prepare_cmds_for_realligance(struct iscsi_conn *conn)
                  * made generic here.
                  */
                 if (!(cmd->cmd_flags & ICF_OOO_CMDSN) && !cmd->immediate_cmd &&
-                     iscsi_sna_gte(cmd->stat_sn, conn->sess->exp_cmd_sn)) {
+                     iscsi_sna_gte(cmd->cmd_sn, conn->sess->exp_cmd_sn)) {
                         list_del(&cmd->i_conn_node);
                         spin_unlock_bh(&conn->cmd_lock);
                         iscsit_free_cmd(cmd);
diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c
index 85140f7dde1e..7d4ec02e29a9 100644
--- a/drivers/target/target_core_alua.c
+++ b/drivers/target/target_core_alua.c
@@ -212,7 +212,7 @@ target_emulate_set_target_port_groups(struct se_cmd *cmd)
         struct t10_alua_tg_pt_gp_member *tg_pt_gp_mem, *l_tg_pt_gp_mem;
         unsigned char *buf;
         unsigned char *ptr;
-        sense_reason_t rc;
+        sense_reason_t rc = TCM_NO_SENSE;
         u32 len = 4; /* Skip over RESERVED area in header */
         int alua_access_state, primary = 0;
         u16 tg_pt_id, rtpi;
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index e2695101bb99..f2aa7543d20a 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -941,6 +941,8 @@ int se_dev_set_queue_depth(struct se_device *dev, u32 queue_depth)
 
 int se_dev_set_fabric_max_sectors(struct se_device *dev, u32 fabric_max_sectors)
 {
+        int block_size = dev->dev_attrib.block_size;
+
         if (dev->export_count) {
                 pr_err("dev[%p]: Unable to change SE Device"
                         " fabric_max_sectors while export_count is %d\n",
@@ -978,8 +980,12 @@ int se_dev_set_fabric_max_sectors(struct se_device *dev, u32 fabric_max_sectors)
         /*
          * Align max_sectors down to PAGE_SIZE to follow transport_allocate_data_tasks()
          */
+        if (!block_size) {
+                block_size = 512;
+                pr_warn("Defaulting to 512 for zero block_size\n");
+        }
         fabric_max_sectors = se_dev_align_max_sectors(fabric_max_sectors,
-                                                      dev->dev_attrib.block_size);
+                                                      block_size);
 
         dev->dev_attrib.fabric_max_sectors = fabric_max_sectors;
         pr_debug("dev[%p]: SE Device max_sectors changed to %u\n",
diff --git a/drivers/target/target_core_fabric_configfs.c b/drivers/target/target_core_fabric_configfs.c
index 810263dfa4a1..c57bbbc7a7d1 100644
--- a/drivers/target/target_core_fabric_configfs.c
+++ b/drivers/target/target_core_fabric_configfs.c
@@ -754,6 +754,11 @@ static int target_fabric_port_link(
                 return -EFAULT;
         }
 
+        if (!(dev->dev_flags & DF_CONFIGURED)) {
+                pr_err("se_device not configured yet, cannot port link\n");
+                return -ENODEV;
+        }
+
         tpg_ci = &lun_ci->ci_parent->ci_group->cg_item;
         se_tpg = container_of(to_config_group(tpg_ci),
                                 struct se_portal_group, tpg_group);
diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
index e35dbf85841f..8e0290b38e43 100644
--- a/drivers/target/target_core_pr.c
+++ b/drivers/target/target_core_pr.c
@@ -2053,7 +2053,7 @@ core_scsi3_emulate_pro_register(struct se_cmd *cmd, u64 res_key, u64 sa_res_key,
         /* Used for APTPL metadata w/ UNREGISTER */
         unsigned char *pr_aptpl_buf = NULL;
         unsigned char isid_buf[PR_REG_ISID_LEN], *isid_ptr = NULL;
-        sense_reason_t ret;
+        sense_reason_t ret = TCM_NO_SENSE;
         int pr_holder = 0, type;
 
         if (!se_sess || !se_lun) {
diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index 26a6d183ccb1..a664c664a31a 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -58,11 +58,10 @@ sbc_emulate_readcapacity(struct se_cmd *cmd)
         buf[7] = dev->dev_attrib.block_size & 0xff;
 
         rbuf = transport_kmap_data_sg(cmd);
-        if (!rbuf)
-                return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
-
-        memcpy(rbuf, buf, min_t(u32, sizeof(buf), cmd->data_length));
-        transport_kunmap_data_sg(cmd);
+        if (rbuf) {
+                memcpy(rbuf, buf, min_t(u32, sizeof(buf), cmd->data_length));
+                transport_kunmap_data_sg(cmd);
+        }
 
         target_complete_cmd(cmd, GOOD);
         return 0;
@@ -97,11 +96,10 @@ sbc_emulate_readcapacity_16(struct se_cmd *cmd)
                 buf[14] = 0x80;
 
         rbuf = transport_kmap_data_sg(cmd);
-        if (!rbuf)
-                return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
-
-        memcpy(rbuf, buf, min_t(u32, sizeof(buf), cmd->data_length));
-        transport_kunmap_data_sg(cmd);
+        if (rbuf) {
+                memcpy(rbuf, buf, min_t(u32, sizeof(buf), cmd->data_length));
+                transport_kunmap_data_sg(cmd);
+        }
 
         target_complete_cmd(cmd, GOOD);
         return 0;
diff --git a/drivers/target/target_core_spc.c b/drivers/target/target_core_spc.c
index 84f9e96e8ace..2d88f087d961 100644
--- a/drivers/target/target_core_spc.c
+++ b/drivers/target/target_core_spc.c
@@ -641,11 +641,10 @@ spc_emulate_inquiry(struct se_cmd *cmd)
 
 out:
         rbuf = transport_kmap_data_sg(cmd);
-        if (!rbuf)
-                return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
-
-        memcpy(rbuf, buf, min_t(u32, sizeof(buf), cmd->data_length));
-        transport_kunmap_data_sg(cmd);
+        if (rbuf) {
+                memcpy(rbuf, buf, min_t(u32, sizeof(buf), cmd->data_length));
+                transport_kunmap_data_sg(cmd);
+        }
 
         if (!ret)
                 target_complete_cmd(cmd, GOOD);
@@ -851,7 +850,7 @@ static sense_reason_t spc_emulate_modesense(struct se_cmd *cmd)
 {
         struct se_device *dev = cmd->se_dev;
         char *cdb = cmd->t_task_cdb;
-        unsigned char *buf, *map_buf;
+        unsigned char buf[SE_MODE_PAGE_BUF], *rbuf;
         int type = dev->transport->get_device_type(dev);
         int ten = (cmd->t_task_cdb[0] == MODE_SENSE_10);
         bool dbd = !!(cdb[1] & 0x08);
@@ -863,26 +862,8 @@ static sense_reason_t spc_emulate_modesense(struct se_cmd *cmd)
         int ret;
         int i;
 
-        map_buf = transport_kmap_data_sg(cmd);
-        if (!map_buf)
-                return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
-        /*
-         * If SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC is not set, then we
-         * know we actually allocated a full page.  Otherwise, if the
-         * data buffer is too small, allocate a temporary buffer so we
-         * don't have to worry about overruns in all our INQUIRY
-         * emulation handling.
-         */
-        if (cmd->data_length < SE_MODE_PAGE_BUF &&
-            (cmd->se_cmd_flags & SCF_PASSTHROUGH_SG_TO_MEM_NOALLOC)) {
-                buf = kzalloc(SE_MODE_PAGE_BUF, GFP_KERNEL);
-                if (!buf) {
-                        transport_kunmap_data_sg(cmd);
-                        return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
-                }
-        } else {
-                buf = map_buf;
-        }
+        memset(buf, 0, SE_MODE_PAGE_BUF);
+
         /*
          * Skip over MODE DATA LENGTH + MEDIUM TYPE fields to byte 3 for
          * MODE_SENSE_10 and byte 2 for MODE_SENSE (6).
@@ -934,8 +915,6 @@ static sense_reason_t spc_emulate_modesense(struct se_cmd *cmd)
         if (page == 0x3f) {
                 if (subpage != 0x00 && subpage != 0xff) {
                         pr_warn("MODE_SENSE: Invalid subpage code: 0x%02x\n", subpage);
-                        kfree(buf);
-                        transport_kunmap_data_sg(cmd);
                         return TCM_INVALID_CDB_FIELD;
                 }
 
@@ -972,7 +951,6 @@ static sense_reason_t spc_emulate_modesense(struct se_cmd *cmd)
                 pr_err("MODE SENSE: unimplemented page/subpage: 0x%02x/0x%02x\n",
                        page, subpage);
 
-        transport_kunmap_data_sg(cmd);
         return TCM_UNKNOWN_MODE_PAGE;
 
 set_length:
@@ -981,12 +959,12 @@ set_length:
         else
                 buf[0] = length - 1;
 
-        if (buf != map_buf) {
-                memcpy(map_buf, buf, cmd->data_length);
-                kfree(buf);
+        rbuf = transport_kmap_data_sg(cmd);
+        if (rbuf) {
+                memcpy(rbuf, buf, min_t(u32, SE_MODE_PAGE_BUF, cmd->data_length));
+                transport_kunmap_data_sg(cmd);
         }
 
-        transport_kunmap_data_sg(cmd);
         target_complete_cmd(cmd, GOOD);
         return 0;
 }
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index c23c76ccef65..bd587b70661a 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -541,9 +541,6 @@ static void transport_lun_remove_cmd(struct se_cmd *cmd)
 
 void transport_cmd_finish_abort(struct se_cmd *cmd, int remove)
 {
-        if (!(cmd->se_cmd_flags & SCF_SCSI_TMR_CDB))
-                transport_lun_remove_cmd(cmd);
-
         if (transport_cmd_check_stop_to_fabric(cmd))
                 return;
         if (remove)
@@ -1396,6 +1393,8 @@ static void target_complete_tmr_failure(struct work_struct *work)
 
         se_cmd->se_tmr_req->response = TMR_LUN_DOES_NOT_EXIST;
         se_cmd->se_tfo->queue_tm_rsp(se_cmd);
+
+        transport_cmd_check_stop_to_fabric(se_cmd);
 }
 
 /**
@@ -1688,6 +1687,7 @@ void target_execute_cmd(struct se_cmd *cmd)
         }
 
         cmd->t_state = TRANSPORT_PROCESSING;
+        cmd->transport_state |= CMD_T_ACTIVE;
         spin_unlock_irq(&cmd->t_state_lock);
 
         if (!target_handle_task_attr(cmd))
@@ -2597,6 +2597,16 @@ transport_send_check_condition_and_sense(struct se_cmd *cmd,
          * SENSE KEY values from include/scsi/scsi.h
          */
         switch (reason) {
+        case TCM_NO_SENSE:
+                /* CURRENT ERROR */
+                buffer[0] = 0x70;
+                buffer[SPC_ADD_SENSE_LEN_OFFSET] = 10;
+                /* Not Ready */
+                buffer[SPC_SENSE_KEY_OFFSET] = NOT_READY;
+                /* NO ADDITIONAL SENSE INFORMATION */
+                buffer[SPC_ASC_KEY_OFFSET] = 0;
+                buffer[SPC_ASCQ_KEY_OFFSET] = 0;
+                break;
         case TCM_NON_EXISTENT_LUN:
                 /* CURRENT ERROR */
                 buffer[0] = 0x70;
@@ -2743,7 +2753,7 @@ transport_send_check_condition_and_sense(struct se_cmd *cmd,
                 /* ILLEGAL REQUEST */
                 buffer[SPC_SENSE_KEY_OFFSET] = ILLEGAL_REQUEST;
                 /* LOGICAL UNIT COMMUNICATION FAILURE */
-                buffer[SPC_ASC_KEY_OFFSET] = 0x80;
+                buffer[SPC_ASC_KEY_OFFSET] = 0x08;
                 break;
         }
         /*
@@ -2804,6 +2814,8 @@ void transport_send_task_abort(struct se_cmd *cmd)
         }
         cmd->scsi_status = SAM_STAT_TASK_ABORTED;
 
+        transport_lun_remove_cmd(cmd);
+
         pr_debug("Setting SAM_STAT_TASK_ABORTED status for CDB: 0x%02x,"
                 " ITT: 0x%08x\n", cmd->t_task_cdb[0],
                 cmd->se_tfo->get_task_tag(cmd));
diff --git a/drivers/target/tcm_fc/tfc_sess.c b/drivers/target/tcm_fc/tfc_sess.c
index 12d6fa21e5e1..6659dd36e806 100644
--- a/drivers/target/tcm_fc/tfc_sess.c
+++ b/drivers/target/tcm_fc/tfc_sess.c
@@ -355,11 +355,11 @@ static int ft_prli_locked(struct fc_rport_priv *rdata, u32 spp_len,
 
         tport = ft_tport_create(rdata->local_port);
         if (!tport)
-                return 0;       /* not a target for this local port */
+                goto not_target;        /* not a target for this local port */
 
         acl = ft_acl_get(tport->tpg, rdata);
         if (!acl)
-                return 0;
+                goto not_target;        /* no target for this remote */
 
         if (!rspp)
                 goto fill;
@@ -396,12 +396,18 @@ static int ft_prli_locked(struct fc_rport_priv *rdata, u32 spp_len,
 
         /*
          * OR in our service parameters with other provider (initiator), if any.
-         * TBD XXX - indicate RETRY capability?
          */
 fill:
         fcp_parm = ntohl(spp->spp_params);
+        fcp_parm &= ~FCP_SPPF_RETRY;
         spp->spp_params = htonl(fcp_parm | FCP_SPPF_TARG_FCN);
         return FC_SPP_RESP_ACK;
+
+not_target:
+        fcp_parm = ntohl(spp->spp_params);
+        fcp_parm &= ~FCP_SPPF_TARG_FCN;
+        spp->spp_params = htonl(fcp_parm);
+        return 0;
 }
 
 /**
diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
index be6a373601b7..79ff3a5e925d 100644
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -441,6 +441,8 @@ static int pty_bsd_ioctl(struct tty_struct *tty,
                 return pty_get_pktmode(tty, (int __user *)arg);
         case TIOCSIG:    /* Send signal to other side of pty */
                 return pty_signal(tty, (int) arg);
+        case TIOCGPTN: /* TTY returns ENOTTY, but glibc expects EINVAL here */
+                return -EINVAL;
         }
         return -ENOIOCTLCMD;
 }
diff --git a/drivers/tty/serial/8250/8250.c b/drivers/tty/serial/8250/8250.c
index d085e3a8ec06..f9320437a649 100644
--- a/drivers/tty/serial/8250/8250.c
+++ b/drivers/tty/serial/8250/8250.c
@@ -300,6 +300,12 @@ static const struct serial8250_config uart_config[] = {
                                   UART_FCR_R_TRIG_00 | UART_FCR_T_TRIG_00,
                 .flags          = UART_CAP_FIFO,
         },
+        [PORT_BRCM_TRUMANAGE] = {
+                .name           = "TruManage",
+                .fifo_size      = 1,
+                .tx_loadsz      = 1024,
+                .flags          = UART_CAP_HFIFO,
+        },
         [PORT_8250_CIR] = {
                 .name           = "CIR port"
         }
@@ -1490,6 +1496,11 @@ void serial8250_tx_chars(struct uart_8250_port *up)
                 port->icount.tx++;
                 if (uart_circ_empty(xmit))
                         break;
+                if (up->capabilities & UART_CAP_HFIFO) {
+                        if ((serial_port_in(port, UART_LSR) & BOTH_EMPTY) !=
+                            BOTH_EMPTY)
+                                break;
+                }
         } while (--count > 0);
 
         if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS)
diff --git a/drivers/tty/serial/8250/8250.h b/drivers/tty/serial/8250/8250.h
index 3b4ea84898c2..12caa1292b75 100644
--- a/drivers/tty/serial/8250/8250.h
+++ b/drivers/tty/serial/8250/8250.h
@@ -40,6 +40,7 @@ struct serial8250_config {
 #define UART_CAP_AFE    (1 << 11)       /* MCR-based hw flow control */
 #define UART_CAP_UUE    (1 << 12)       /* UART needs IER bit 6 set (Xscale) */
 #define UART_CAP_RTOIE  (1 << 13)       /* UART needs IER bit 4 set (Xscale, Tegra) */
+#define UART_CAP_HFIFO  (1 << 14)       /* UART has a "hidden" FIFO */
 
 #define UART_BUG_QUOT   (1 << 0)        /* UART has buggy quot LSB */
 #define UART_BUG_TXEN   (1 << 1)        /* UART has buggy TX IIR status */
diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c
index 1d0dba2d562d..096d2ef48b32 100644
--- a/drivers/tty/serial/8250/8250_dw.c
+++ b/drivers/tty/serial/8250/8250_dw.c
@@ -79,7 +79,7 @@ static int dw8250_handle_irq(struct uart_port *p)
         } else if ((iir & UART_IIR_BUSY) == UART_IIR_BUSY) {
                 /* Clear the USR and write the LCR again. */
                 (void)p->serial_in(p, UART_USR);
-                p->serial_out(p, d->last_lcr, UART_LCR);
+                p->serial_out(p, UART_LCR, d->last_lcr);
 
                 return 1;
         }
diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c
index 26b9dc012ed0..a27a98e1b066 100644
--- a/drivers/tty/serial/8250/8250_pci.c
+++ b/drivers/tty/serial/8250/8250_pci.c
@@ -1085,6 +1085,18 @@ pci_omegapci_setup(struct serial_private *priv,
         return setup_port(priv, port, 2, idx * 8, 0);
 }
 
+static int
+pci_brcm_trumanage_setup(struct serial_private *priv,
+                         const struct pciserial_board *board,
+                         struct uart_8250_port *port, int idx)
+{
+        int ret = pci_default_setup(priv, board, port, idx);
+
+        port->port.type = PORT_BRCM_TRUMANAGE;
+        port->port.flags = (port->port.flags | UPF_FIXED_PORT | UPF_FIXED_TYPE);
+        return ret;
+}
+
 static int skip_tx_en_setup(struct serial_private *priv,
                         const struct pciserial_board *board,
                         struct uart_8250_port *port, int idx)
@@ -1301,9 +1313,10 @@ pci_wch_ch353_setup(struct serial_private *priv,
 #define PCI_VENDOR_ID_AGESTAR           0x5372
 #define PCI_DEVICE_ID_AGESTAR_9375      0x6872
 #define PCI_VENDOR_ID_ASIX              0x9710
-#define PCI_DEVICE_ID_COMMTECH_4222PCIE 0x0019
 #define PCI_DEVICE_ID_COMMTECH_4224PCIE 0x0020
 #define PCI_DEVICE_ID_COMMTECH_4228PCIE 0x0021
+#define PCI_DEVICE_ID_COMMTECH_4222PCIE 0x0022
+#define PCI_DEVICE_ID_BROADCOM_TRUMANAGE 0x160a
 
 
 /* Unknown vendors/cards - this should not be in linux/pci_ids.h */
@@ -1954,6 +1967,17 @@ static struct pci_serial_quirk pci_serial_quirks[] __refdata = {
                 .setup          = pci_xr17v35x_setup,
         },
         /*
+         * Broadcom TruManage (NetXtreme)
+         */
+        {
+                .vendor         = PCI_VENDOR_ID_BROADCOM,
+                .device         = PCI_DEVICE_ID_BROADCOM_TRUMANAGE,
+                .subvendor      = PCI_ANY_ID,
+                .subdevice      = PCI_ANY_ID,
+                .setup          = pci_brcm_trumanage_setup,
+        },
+
+        /*
          * Default "match everything" terminator entry
          */
         {
@@ -2148,6 +2172,7 @@ enum pci_board_num_t {
         pbn_ce4100_1_115200,
         pbn_omegapci,
         pbn_NETMOS9900_2s_115200,
+        pbn_brcm_trumanage,
 };
 
 /*
@@ -2246,7 +2271,7 @@ static struct pciserial_board pci_boards[] = {
 
         [pbn_b0_8_1152000_200] = {
                 .flags          = FL_BASE0,
-                .num_ports      = 2,
+                .num_ports      = 8,
                 .base_baud      = 1152000,
                 .uart_offset    = 0x200,
         },
@@ -2892,6 +2917,12 @@ static struct pciserial_board pci_boards[] = {
                 .num_ports      = 2,
                 .base_baud      = 115200,
         },
+        [pbn_brcm_trumanage] = {
+                .flags          = FL_BASE0,
+                .num_ports      = 1,
+                .reg_shift      = 2,
+                .base_baud      = 115200,
+        },
 };
 
 static const struct pci_device_id blacklist[] = {
@@ -4471,6 +4502,13 @@ static struct pci_device_id serial_pci_tbl[] = {
                 pbn_omegapci },
 
         /*
+         * Broadcom TruManage
+         */
+        {       PCI_VENDOR_ID_BROADCOM, PCI_DEVICE_ID_BROADCOM_TRUMANAGE,
+                PCI_ANY_ID, PCI_ANY_ID, 0, 0,
+                pbn_brcm_trumanage },
+
+        /*
          * AgeStar as-prs2-009
          */
         {       PCI_VENDOR_ID_AGESTAR, PCI_DEVICE_ID_AGESTAR_9375,
diff --git a/drivers/tty/serial/ifx6x60.c b/drivers/tty/serial/ifx6x60.c
index 675d94ab0aff..8cb6d8d66a13 100644
--- a/drivers/tty/serial/ifx6x60.c
+++ b/drivers/tty/serial/ifx6x60.c
@@ -637,6 +637,7 @@ static void ifx_port_shutdown(struct tty_port *port)
 
         clear_bit(IFX_SPI_STATE_IO_AVAILABLE, &ifx_dev->flags);
         mrdy_set_low(ifx_dev);
+        del_timer(&ifx_dev->spi_timer);
         clear_bit(IFX_SPI_STATE_TIMER_PENDING, &ifx_dev->flags);
         tasklet_kill(&ifx_dev->io_work_tasklet);
 }
@@ -810,7 +811,8 @@ static void ifx_spi_io(unsigned long data)
                 ifx_dev->spi_xfer.cs_change = 0;
                 ifx_dev->spi_xfer.speed_hz = ifx_dev->spi_dev->max_speed_hz;
                 /* ifx_dev->spi_xfer.speed_hz = 390625; */
-                ifx_dev->spi_xfer.bits_per_word = spi_bpw;
+                ifx_dev->spi_xfer.bits_per_word =
+                        ifx_dev->spi_dev->bits_per_word;
 
                 ifx_dev->spi_xfer.tx_buf = ifx_dev->tx_buffer;
                 ifx_dev->spi_xfer.rx_buf = ifx_dev->rx_buffer;
diff --git a/drivers/tty/serial/max3100.c b/drivers/tty/serial/max3100.c
index 7ce3197087bb..dd6277eb5a38 100644
--- a/drivers/tty/serial/max3100.c
+++ b/drivers/tty/serial/max3100.c
@@ -179,8 +179,7 @@ static void max3100_work(struct work_struct *w);
 
 static void max3100_dowork(struct max3100_port *s)
 {
-        if (!s->force_end_work && !work_pending(&s->work) &&
-            !freezing(current) && !s->suspending)
+        if (!s->force_end_work && !freezing(current) && !s->suspending)
                 queue_work(s->workqueue, &s->work);
 }
 
diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
index 6db23b035efe..e55615eb34ad 100644
--- a/drivers/tty/serial/mxs-auart.c
+++ b/drivers/tty/serial/mxs-auart.c
@@ -253,7 +253,7 @@ static void mxs_auart_tx_chars(struct mxs_auart_port *s)
         struct circ_buf *xmit = &s->port.state->xmit;
 
         if (auart_dma_enabled(s)) {
-                int i = 0;
+                u32 i = 0;
                 int size;
                 void *buffer = s->tx_dma_buf;
 
@@ -412,10 +412,12 @@ static void mxs_auart_set_mctrl(struct uart_port *u, unsigned mctrl)
 
         u32 ctrl = readl(u->membase + AUART_CTRL2);
 
-        ctrl &= ~AUART_CTRL2_RTSEN;
+        ctrl &= ~(AUART_CTRL2_RTSEN | AUART_CTRL2_RTS);
         if (mctrl & TIOCM_RTS) {
                 if (tty_port_cts_enabled(&u->state->port))
                         ctrl |= AUART_CTRL2_RTSEN;
+                else
+                        ctrl |= AUART_CTRL2_RTS;
         }
 
         s->ctrl = mctrl;
diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
index 12e5249d053e..e514b3a4dc57 100644
--- a/drivers/tty/serial/samsung.c
+++ b/drivers/tty/serial/samsung.c
@@ -1006,7 +1006,6 @@ static void s3c24xx_serial_resetport(struct uart_port *port,
 
         ucon &= ucon_mask;
         wr_regl(port, S3C2410_UCON,  ucon | cfg->ucon);
-        wr_regl(port, S3C2410_ULCON, cfg->ulcon);
 
         /* reset both fifos */
         wr_regl(port, S3C2410_UFCON, cfg->ufcon | S3C2410_UFCON_RESETBOTH);
diff --git a/drivers/tty/serial/vt8500_serial.c b/drivers/tty/serial/vt8500_serial.c
index 8fd181436a6b..d5ed9f613005 100644
--- a/drivers/tty/serial/vt8500_serial.c
+++ b/drivers/tty/serial/vt8500_serial.c
@@ -604,7 +604,7 @@ static int vt8500_serial_probe(struct platform_device *pdev)
         vt8500_port->uart.flags = UPF_IOREMAP | UPF_BOOT_AUTOCONF;
 
         vt8500_port->clk = of_clk_get(pdev->dev.of_node, 0);
-        if (vt8500_port->clk) {
+        if (!IS_ERR(vt8500_port->clk)) {
                 vt8500_port->uart.uartclk = clk_get_rate(vt8500_port->clk);
         } else {
                 /* use the default of 24Mhz if not specified and warn */
diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c
index b3c4a250ff86..40e5b3919e27 100644
--- a/drivers/tty/sysrq.c
+++ b/drivers/tty/sysrq.c
@@ -15,6 +15,7 @@
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
 #include <linux/sched.h>
+#include <linux/sched/rt.h>
 #include <linux/interrupt.h>
 #include <linux/mm.h>
 #include <linux/fs.h>
diff --git a/drivers/usb/Kconfig b/drivers/usb/Kconfig
index 4c90b510d016..640ae6c6d2d2 100644
--- a/drivers/usb/Kconfig
+++ b/drivers/usb/Kconfig
@@ -37,6 +37,7 @@ config USB_ARCH_HAS_EHCI
         default y if ARCH_W90X900
         default y if ARCH_AT91
         default y if ARCH_MXC
+        default y if ARCH_MXS
         default y if ARCH_OMAP3
         default y if ARCH_CNS3XXX
         default y if ARCH_VT8500
diff --git a/drivers/usb/chipidea/host.c b/drivers/usb/chipidea/host.c
index caecad9213f5..8e9d31277c43 100644
--- a/drivers/usb/chipidea/host.c
+++ b/drivers/usb/chipidea/host.c
@@ -70,6 +70,9 @@ static int host_start(struct ci13xxx *ci)
         else
                 ci->hcd = hcd;
 
+        if (ci->platdata->flags & CI13XXX_DISABLE_STREAMING)
+                hw_write(ci, OP_USBMODE, USBMODE_CI_SDIS, USBMODE_CI_SDIS);
+
         return ret;
 }
 
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 8d809a811e16..2d92cce260d7 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1602,6 +1602,9 @@ static const struct usb_device_id acm_ids[] = {
         { USB_DEVICE(0x0572, 0x1340), /* Conexant CX93010-2x UCMxx */
         .driver_info = NO_UNION_NORMAL,
         },
+        { USB_DEVICE(0x05f9, 0x4002), /* PSC Scanning, Magellan 800i */
+        .driver_info = NO_UNION_NORMAL,
+        },
         { USB_DEVICE(0x1bbb, 0x0003), /* Alcatel OT-I650 */
         .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
         },
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 4225d5e72131..8e64adf8e4d5 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -39,6 +39,7 @@
 #include <asm/unaligned.h>
 #include <linux/platform_device.h>
 #include <linux/workqueue.h>
+#include <linux/pm_runtime.h>
 
 #include <linux/usb.h>
 #include <linux/usb/hcd.h>
@@ -1025,6 +1026,49 @@ static int register_root_hub(struct usb_hcd *hcd)
         return retval;
 }
 
+/*
+ * usb_hcd_start_port_resume - a root-hub port is sending a resume signal
+ * @bus: the bus which the root hub belongs to
+ * @portnum: the port which is being resumed
+ *
+ * HCDs should call this function when they know that a resume signal is
+ * being sent to a root-hub port.  The root hub will be prevented from
+ * going into autosuspend until usb_hcd_end_port_resume() is called.
+ *
+ * The bus's private lock must be held by the caller.
+ */
+void usb_hcd_start_port_resume(struct usb_bus *bus, int portnum)
+{
+        unsigned bit = 1 << portnum;
+
+        if (!(bus->resuming_ports & bit)) {
+                bus->resuming_ports |= bit;
+                pm_runtime_get_noresume(&bus->root_hub->dev);
+        }
+}
+EXPORT_SYMBOL_GPL(usb_hcd_start_port_resume);
+
+/*
+ * usb_hcd_end_port_resume - a root-hub port has stopped sending a resume signal
+ * @bus: the bus which the root hub belongs to
+ * @portnum: the port which is being resumed
+ *
+ * HCDs should call this function when they know that a resume signal has
+ * stopped being sent to a root-hub port.  The root hub will be allowed to
+ * autosuspend again.
+ *
+ * The bus's private lock must be held by the caller.
+ */
+void usb_hcd_end_port_resume(struct usb_bus *bus, int portnum)
+{
+        unsigned bit = 1 << portnum;
+
+        if (bus->resuming_ports & bit) {
+                bus->resuming_ports &= ~bit;
+                pm_runtime_put_noidle(&bus->root_hub->dev);
+        }
+}
+EXPORT_SYMBOL_GPL(usb_hcd_end_port_resume);
 
 /*-------------------------------------------------------------------------*/
 
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index a815fd2cc5e7..cbf7168e3ce7 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -877,6 +877,60 @@ static int hub_hub_status(struct usb_hub *hub,
         return ret;
 }
 
+static int hub_set_port_link_state(struct usb_hub *hub, int port1,
+                        unsigned int link_status)
+{
+        return set_port_feature(hub->hdev,
+                        port1 | (link_status << 3),
+                        USB_PORT_FEAT_LINK_STATE);
+}
+
+/*
+ * If USB 3.0 ports are placed into the Disabled state, they will no longer
+ * detect any device connects or disconnects.  This is generally not what the
+ * USB core wants, since it expects a disabled port to produce a port status
+ * change event when a new device connects.
+ *
+ * Instead, set the link state to Disabled, wait for the link to settle into
+ * that state, clear any change bits, and then put the port into the RxDetect
+ * state.
+ */
+static int hub_usb3_port_disable(struct usb_hub *hub, int port1)
+{
+        int ret;
+        int total_time;
+        u16 portchange, portstatus;
+
+        if (!hub_is_superspeed(hub->hdev))
+                return -EINVAL;
+
+        ret = hub_set_port_link_state(hub, port1, USB_SS_PORT_LS_SS_DISABLED);
+        if (ret) {
+                dev_err(hub->intfdev, "cannot disable port %d (err = %d)\n",
+                                port1, ret);
+                return ret;
+        }
+
+        /* Wait for the link to enter the disabled state. */
+        for (total_time = 0; ; total_time += HUB_DEBOUNCE_STEP) {
+                ret = hub_port_status(hub, port1, &portstatus, &portchange);
+                if (ret < 0)
+                        return ret;
+
+                if ((portstatus & USB_PORT_STAT_LINK_STATE) ==
+                                USB_SS_PORT_LS_SS_DISABLED)
+                        break;
+                if (total_time >= HUB_DEBOUNCE_TIMEOUT)
+                        break;
+                msleep(HUB_DEBOUNCE_STEP);
+        }
+        if (total_time >= HUB_DEBOUNCE_TIMEOUT)
+                dev_warn(hub->intfdev, "Could not disable port %d after %d ms\n",
+                                port1, total_time);
+
+        return hub_set_port_link_state(hub, port1, USB_SS_PORT_LS_RX_DETECT);
+}
+
 static int hub_port_disable(struct usb_hub *hub, int port1, int set_state)
 {
         struct usb_device *hdev = hub->hdev;
@@ -885,8 +939,13 @@ static int hub_port_disable(struct usb_hub *hub, int port1, int set_state)
         if (hub->ports[port1 - 1]->child && set_state)
                 usb_set_device_state(hub->ports[port1 - 1]->child,
                                 USB_STATE_NOTATTACHED);
-        if (!hub->error && !hub_is_superspeed(hub->hdev))
-                ret = clear_port_feature(hdev, port1, USB_PORT_FEAT_ENABLE);
+        if (!hub->error) {
+                if (hub_is_superspeed(hub->hdev))
+                        ret = hub_usb3_port_disable(hub, port1);
+                else
+                        ret = clear_port_feature(hdev, port1,
+                                        USB_PORT_FEAT_ENABLE);
+        }
         if (ret)
                 dev_err(hub->intfdev, "cannot disable port %d (err = %d)\n",
                                 port1, ret);
@@ -2440,7 +2499,7 @@ static unsigned hub_is_wusb(struct usb_hub *hub)
 #define HUB_SHORT_RESET_TIME    10
 #define HUB_BH_RESET_TIME       50
 #define HUB_LONG_RESET_TIME     200
-#define HUB_RESET_TIMEOUT       500
+#define HUB_RESET_TIMEOUT       800
 
 static int hub_port_reset(struct usb_hub *hub, int port1,
                         struct usb_device *udev, unsigned int delay, bool warm);
@@ -2475,6 +2534,10 @@ static int hub_port_wait_reset(struct usb_hub *hub, int port1,
                 if (ret < 0)
                         return ret;
 
+                /* The port state is unknown until the reset completes. */
+                if ((portstatus & USB_PORT_STAT_RESET))
+                        goto delay;
+
                 /*
                  * Some buggy devices require a warm reset to be issued even
                  * when the port appears not to be connected.
@@ -2520,11 +2583,7 @@ static int hub_port_wait_reset(struct usb_hub *hub, int port1,
                         if ((portchange & USB_PORT_STAT_C_CONNECTION))
                                 return -ENOTCONN;
 
-                        /* if we`ve finished resetting, then break out of
-                         * the loop
-                         */
-                        if (!(portstatus & USB_PORT_STAT_RESET) &&
-                            (portstatus & USB_PORT_STAT_ENABLE)) {
+                        if ((portstatus & USB_PORT_STAT_ENABLE)) {
                                 if (hub_is_wusb(hub))
                                         udev->speed = USB_SPEED_WIRELESS;
                                 else if (hub_is_superspeed(hub->hdev))
@@ -2538,10 +2597,15 @@ static int hub_port_wait_reset(struct usb_hub *hub, int port1,
                                 return 0;
                         }
                 } else {
-                        if (portchange & USB_PORT_STAT_C_BH_RESET)
-                                return 0;
+                        if (!(portstatus & USB_PORT_STAT_CONNECTION) ||
+                                        hub_port_warm_reset_required(hub,
+                                                portstatus))
+                                return -ENOTCONN;
+
+                        return 0;
                 }
 
+delay:
                 /* switch to the long delay after two short delay failures */
                 if (delay_time >= 2 * HUB_SHORT_RESET_TIME)
                         delay = HUB_LONG_RESET_TIME;
@@ -2565,14 +2629,11 @@ static void hub_port_finish_reset(struct usb_hub *hub, int port1,
                         msleep(10 + 40);
                         update_devnum(udev, 0);
                         hcd = bus_to_hcd(udev->bus);
-                        if (hcd->driver->reset_device) {
-                                *status = hcd->driver->reset_device(hcd, udev);
-                                if (*status < 0) {
-                                        dev_err(&udev->dev, "Cannot reset "
-                                                        "HCD device state\n");
-                                        break;
-                                }
-                        }
+                        /* The xHC may think the device is already reset,
+                         * so ignore the status.
+                         */
+                        if (hcd->driver->reset_device)
+                                hcd->driver->reset_device(hcd, udev);
                 }
                 /* FALL THROUGH */
         case -ENOTCONN:
@@ -2580,16 +2641,16 @@ static void hub_port_finish_reset(struct usb_hub *hub, int port1,
                 clear_port_feature(hub->hdev,
                                 port1, USB_PORT_FEAT_C_RESET);
                 /* FIXME need disconnect() for NOTATTACHED device */
-                if (warm) {
+                if (hub_is_superspeed(hub->hdev)) {
                         clear_port_feature(hub->hdev, port1,
                                         USB_PORT_FEAT_C_BH_PORT_RESET);
                         clear_port_feature(hub->hdev, port1,
                                         USB_PORT_FEAT_C_PORT_LINK_STATE);
-                } else {
+                }
+                if (!warm)
                         usb_set_device_state(udev, *status
                                         ? USB_STATE_NOTATTACHED
                                         : USB_STATE_DEFAULT);
-                }
                 break;
         }
 }
@@ -2777,6 +2838,23 @@ void usb_enable_ltm(struct usb_device *udev)
 EXPORT_SYMBOL_GPL(usb_enable_ltm);
 
 #ifdef  CONFIG_USB_SUSPEND
+/*
+ * usb_disable_function_remotewakeup - disable usb3.0
+ * device's function remote wakeup
+ * @udev: target device
+ *
+ * Assume there's only one function on the USB 3.0
+ * device and disable remote wake for the first
+ * interface. FIXME if the interface association
+ * descriptor shows there's more than one function.
+ */
+static int usb_disable_function_remotewakeup(struct usb_device *udev)
+{
+        return usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
+                                USB_REQ_CLEAR_FEATURE, USB_RECIP_INTERFACE,
+                                USB_INTRF_FUNC_SUSPEND, 0, NULL, 0,
+                                USB_CTRL_SET_TIMEOUT);
+}
 
 /*
  * usb_port_suspend - suspend a usb device's upstream port
@@ -2894,12 +2972,19 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
                 dev_dbg(hub->intfdev, "can't suspend port %d, status %d\n",
                                 port1, status);
                 /* paranoia:  "should not happen" */
-                if (udev->do_remote_wakeup)
-                        (void) usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
-                                USB_REQ_CLEAR_FEATURE, USB_RECIP_DEVICE,
-                                USB_DEVICE_REMOTE_WAKEUP, 0,
-                                NULL, 0,
-                                USB_CTRL_SET_TIMEOUT);
+                if (udev->do_remote_wakeup) {
+                        if (!hub_is_superspeed(hub->hdev)) {
+                                (void) usb_control_msg(udev,
+                                                usb_sndctrlpipe(udev, 0),
+                                                USB_REQ_CLEAR_FEATURE,
+                                                USB_RECIP_DEVICE,
+                                                USB_DEVICE_REMOTE_WAKEUP, 0,
+                                                NULL, 0,
+                                                USB_CTRL_SET_TIMEOUT);
+                        } else
+                                (void) usb_disable_function_remotewakeup(udev);
+
+                }
 
                 /* Try to enable USB2 hardware LPM again */
                 if (udev->usb2_hw_lpm_capable == 1)
@@ -2939,7 +3024,7 @@ int usb_port_suspend(struct usb_device *udev, pm_message_t msg)
 static int finish_port_resume(struct usb_device *udev)
 {
         int     status = 0;
-        u16     devstatus;
+        u16     devstatus = 0;
 
         /* caller owns the udev device lock */
         dev_dbg(&udev->dev, "%s\n",
@@ -2984,21 +3069,37 @@ static int finish_port_resume(struct usb_device *udev)
         if (status) {
                 dev_dbg(&udev->dev, "gone after usb resume? status %d\n",
                                 status);
-        } else if (udev->actconfig) {
-                le16_to_cpus(&devstatus);
-                if (devstatus & (1 << USB_DEVICE_REMOTE_WAKEUP)) {
-                        status = usb_control_msg(udev,
-                                        usb_sndctrlpipe(udev, 0),
-                                        USB_REQ_CLEAR_FEATURE,
+        /*
+         * There are a few quirky devices which violate the standard
+         * by claiming to have remote wakeup enabled after a reset,
+         * which crash if the feature is cleared, hence check for
+         * udev->reset_resume
+         */
+        } else if (udev->actconfig && !udev->reset_resume) {
+                if (!hub_is_superspeed(udev->parent)) {
+                        le16_to_cpus(&devstatus);
+                        if (devstatus & (1 << USB_DEVICE_REMOTE_WAKEUP))
+                                status = usb_control_msg(udev,
+                                                usb_sndctrlpipe(udev, 0),
+                                                USB_REQ_CLEAR_FEATURE,
                                                 USB_RECIP_DEVICE,
-                                        USB_DEVICE_REMOTE_WAKEUP, 0,
-                                        NULL, 0,
-                                        USB_CTRL_SET_TIMEOUT);
-                        if (status)
-                                dev_dbg(&udev->dev,
-                                        "disable remote wakeup, status %d\n",
-                                        status);
+                                                USB_DEVICE_REMOTE_WAKEUP, 0,
+                                                NULL, 0,
+                                                USB_CTRL_SET_TIMEOUT);
+                } else {
+                        status = usb_get_status(udev, USB_RECIP_INTERFACE, 0,
+                                        &devstatus);
+                        le16_to_cpus(&devstatus);
+                        if (!status && devstatus & (USB_INTRF_STAT_FUNC_RW_CAP
+                                        | USB_INTRF_STAT_FUNC_RW))
+                                status =
+                                        usb_disable_function_remotewakeup(udev);
                 }
+
+                if (status)
+                        dev_dbg(&udev->dev,
+                                "disable remote wakeup, status %d\n",
+                                status);
                 status = 0;
         }
         return status;
@@ -4638,9 +4739,14 @@ static void hub_events(void)
                          * SS.Inactive state.
                          */
                         if (hub_port_warm_reset_required(hub, portstatus)) {
+                                int status;
+
                                 dev_dbg(hub_dev, "warm reset port %d\n", i);
-                                hub_port_reset(hub, i, NULL,
+                                status = hub_port_reset(hub, i, NULL,
                                                 HUB_BH_RESET_TIME, true);
+                                if (status < 0)
+                                        hub_port_disable(hub, i, 1);
+                                connect_change = 0;
                         }
 
                         if (connect_change)
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index fdefd9c7f7af..3113c1d71442 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -43,6 +43,9 @@ static const struct usb_device_id usb_quirk_list[] = {
         /* Creative SB Audigy 2 NX */
         { USB_DEVICE(0x041e, 0x3020), .driver_info = USB_QUIRK_RESET_RESUME },
 
+        /* Microsoft LifeCam-VX700 v2.0 */
+        { USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME },
+
         /* Logitech Quickcam Fusion */
         { USB_DEVICE(0x046d, 0x08c1), .driver_info = USB_QUIRK_RESET_RESUME },
 
diff --git a/drivers/usb/dwc3/debugfs.c b/drivers/usb/dwc3/debugfs.c
index 92604b4f9712..5945aadaa1c9 100644
--- a/drivers/usb/dwc3/debugfs.c
+++ b/drivers/usb/dwc3/debugfs.c
@@ -56,7 +56,7 @@
 #define dump_register(nm)                               \
 {                                                       \
         .name   = __stringify(nm),                      \
-        .offset = DWC3_ ##nm,                           \
+        .offset = DWC3_ ##nm - DWC3_GLOBALS_REGS_START, \
 }
 
 static const struct debugfs_reg32 dwc3_regs[] = {
diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
index 2e43b332aae8..2fdd767f8fe8 100644
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -1605,6 +1605,7 @@ static int dwc3_gadget_init_endpoints(struct dwc3 *dwc)
 
                 if (epnum == 0 || epnum == 1) {
                         dep->endpoint.maxpacket = 512;
+                        dep->endpoint.maxburst = 1;
                         dep->endpoint.ops = &dwc3_gadget_ep0_ops;
                         if (!epnum)
                                 dwc->gadget.ep0 = &dep->endpoint;
diff --git a/drivers/usb/gadget/amd5536udc.c b/drivers/usb/gadget/amd5536udc.c
index fc0ec5e0d58e..d9f6b9372491 100644
--- a/drivers/usb/gadget/amd5536udc.c
+++ b/drivers/usb/gadget/amd5536udc.c
@@ -3231,7 +3231,7 @@ static int udc_pci_probe(
         }
 
         if (!pdev->irq) {
-                dev_err(&dev->pdev->dev, "irq not set\n");
+                dev_err(&pdev->dev, "irq not set\n");
                 kfree(dev);
                 dev = NULL;
                 retval = -ENODEV;
@@ -3250,7 +3250,7 @@ static int udc_pci_probe(
         dev->txfifo = (u32 __iomem *)(dev->virt_addr + UDC_TXFIFO_ADDR);
 
         if (request_irq(pdev->irq, udc_irq, IRQF_SHARED, name, dev) != 0) {
-                dev_dbg(&dev->pdev->dev, "request_irq(%d) fail\n", pdev->irq);
+                dev_dbg(&pdev->dev, "request_irq(%d) fail\n", pdev->irq);
                 kfree(dev);
                 dev = NULL;
                 retval = -EBUSY;
diff --git a/drivers/usb/gadget/dummy_hcd.c b/drivers/usb/gadget/dummy_hcd.c
index 95d584dbed13..8cf0c0f6fa1f 100644
--- a/drivers/usb/gadget/dummy_hcd.c
+++ b/drivers/usb/gadget/dummy_hcd.c
@@ -130,10 +130,7 @@ static const char ep0name[] = "ep0";
 static const char *const ep_name[] = {
         ep0name,                                /* everyone has ep0 */
 
-        /* act like a net2280: high speed, six configurable endpoints */
-        "ep-a", "ep-b", "ep-c", "ep-d", "ep-e", "ep-f",
-
-        /* or like pxa250: fifteen fixed function endpoints */
+        /* act like a pxa250: fifteen fixed function endpoints */
         "ep1in-bulk", "ep2out-bulk", "ep3in-iso", "ep4out-iso", "ep5in-int",
         "ep6in-bulk", "ep7out-bulk", "ep8in-iso", "ep9out-iso", "ep10in-int",
         "ep11in-bulk", "ep12out-bulk", "ep13in-iso", "ep14out-iso",
@@ -141,6 +138,10 @@ static const char *const ep_name[] = {
 
         /* or like sa1100: two fixed function endpoints */
         "ep1out-bulk", "ep2in-bulk",
+
+        /* and now some generic EPs so we have enough in multi config */
+        "ep3out", "ep4in", "ep5out", "ep6out", "ep7in", "ep8out", "ep9in",
+        "ep10out", "ep11out", "ep12in", "ep13out", "ep14in", "ep15out",
 };
 #define DUMMY_ENDPOINTS ARRAY_SIZE(ep_name)
 
diff --git a/drivers/usb/gadget/f_fs.c b/drivers/usb/gadget/f_fs.c
index 4a6961c517f2..8c2f25121149 100644
--- a/drivers/usb/gadget/f_fs.c
+++ b/drivers/usb/gadget/f_fs.c
@@ -1153,15 +1153,15 @@ static int ffs_fs_parse_opts(struct ffs_sb_fill_data *data, char *opts)
                                         pr_err("%s: unmapped value: %lu\n", opts, value);
                                         return -EINVAL;
                                 }
-                        }
-                        else if (!memcmp(opts, "gid", 3))
+                        } else if (!memcmp(opts, "gid", 3)) {
                                 data->perms.gid = make_kgid(current_user_ns(), value);
                                 if (!gid_valid(data->perms.gid)) {
                                         pr_err("%s: unmapped value: %lu\n", opts, value);
                                         return -EINVAL;
                                 }
-                        else
+                        } else {
                                 goto invalid;
+                        }
                         break;
 
                 default:
diff --git a/drivers/usb/gadget/fsl_mxc_udc.c b/drivers/usb/gadget/fsl_mxc_udc.c
index 1b0f086426bd..d3bd7b095ba3 100644
--- a/drivers/usb/gadget/fsl_mxc_udc.c
+++ b/drivers/usb/gadget/fsl_mxc_udc.c
@@ -18,14 +18,13 @@
 #include <linux/platform_device.h>
 #include <linux/io.h>
 
-#include <mach/hardware.h>
-
 static struct clk *mxc_ahb_clk;
 static struct clk *mxc_per_clk;
 static struct clk *mxc_ipg_clk;
 
 /* workaround ENGcm09152 for i.MX35 */
-#define USBPHYCTRL_OTGBASE_OFFSET       0x608
+#define MX35_USBPHYCTRL_OFFSET          0x600
+#define USBPHYCTRL_OTGBASE_OFFSET       0x8
 #define USBPHYCTRL_EVDO                 (1 << 23)
 
 int fsl_udc_clk_init(struct platform_device *pdev)
@@ -59,7 +58,7 @@ int fsl_udc_clk_init(struct platform_device *pdev)
         clk_prepare_enable(mxc_per_clk);
 
         /* make sure USB_CLK is running at 60 MHz +/- 1000 Hz */
-        if (!cpu_is_mx51()) {
+        if (!strcmp(pdev->id_entry->name, "imx-udc-mx27")) {
                 freq = clk_get_rate(mxc_per_clk);
                 if (pdata->phy_mode != FSL_USB2_PHY_ULPI &&
                     (freq < 59999000 || freq > 60001000)) {
@@ -79,27 +78,40 @@ eclkrate:
         return ret;
 }
 
-void fsl_udc_clk_finalize(struct platform_device *pdev)
+int fsl_udc_clk_finalize(struct platform_device *pdev)
 {
         struct fsl_usb2_platform_data *pdata = pdev->dev.platform_data;
-        if (cpu_is_mx35()) {
-                unsigned int v;
+        int ret = 0;
 
-                /* workaround ENGcm09152 for i.MX35 */
-                if (pdata->workaround & FLS_USB2_WORKAROUND_ENGCM09152) {
-                        v = readl(MX35_IO_ADDRESS(MX35_USB_BASE_ADDR +
-                                        USBPHYCTRL_OTGBASE_OFFSET));
-                        writel(v | USBPHYCTRL_EVDO,
-                                MX35_IO_ADDRESS(MX35_USB_BASE_ADDR +
-                                        USBPHYCTRL_OTGBASE_OFFSET));
+        /* workaround ENGcm09152 for i.MX35 */
+        if (pdata->workaround & FLS_USB2_WORKAROUND_ENGCM09152) {
+                unsigned int v;
+                struct resource *res = platform_get_resource
+                        (pdev, IORESOURCE_MEM, 0);
+                void __iomem *phy_regs = ioremap(res->start +
+                                                MX35_USBPHYCTRL_OFFSET, 512);
+                if (!phy_regs) {
+                        dev_err(&pdev->dev, "ioremap for phy address fails\n");
+                        ret = -EINVAL;
+                        goto ioremap_err;
                 }
+
+                v = readl(phy_regs + USBPHYCTRL_OTGBASE_OFFSET);
+                writel(v | USBPHYCTRL_EVDO,
+                        phy_regs + USBPHYCTRL_OTGBASE_OFFSET);
+
+                iounmap(phy_regs);
         }
 
+
+ioremap_err:
         /* ULPI transceivers don't need usbpll */
         if (pdata->phy_mode == FSL_USB2_PHY_ULPI) {
                 clk_disable_unprepare(mxc_per_clk);
                 mxc_per_clk = NULL;
         }
+
+        return ret;
 }
 
 void fsl_udc_clk_release(void)
diff --git a/drivers/usb/gadget/fsl_udc_core.c b/drivers/usb/gadget/fsl_udc_core.c
index c19f7f13790b..667275cb7bad 100644
--- a/drivers/usb/gadget/fsl_udc_core.c
+++ b/drivers/usb/gadget/fsl_udc_core.c
@@ -41,6 +41,7 @@
 #include <linux/fsl_devices.h>
 #include <linux/dmapool.h>
 #include <linux/delay.h>
+#include <linux/of_device.h>
 
 #include <asm/byteorder.h>
 #include <asm/io.h>
@@ -2438,11 +2439,6 @@ static int __init fsl_udc_probe(struct platform_device *pdev)
         unsigned int i;
         u32 dccparams;
 
-        if (strcmp(pdev->name, driver_name)) {
-                VDBG("Wrong device");
-                return -ENODEV;
-        }
-
         udc_controller = kzalloc(sizeof(struct fsl_udc), GFP_KERNEL);
         if (udc_controller == NULL) {
                 ERR("malloc udc failed\n");
@@ -2547,7 +2543,9 @@ static int __init fsl_udc_probe(struct platform_device *pdev)
                 dr_controller_setup(udc_controller);
         }
 
-        fsl_udc_clk_finalize(pdev);
+        ret = fsl_udc_clk_finalize(pdev);
+        if (ret)
+                goto err_free_irq;
 
         /* Setup gadget structure */
         udc_controller->gadget.ops = &fsl_gadget_ops;
@@ -2756,22 +2754,32 @@ static int fsl_udc_otg_resume(struct device *dev)
 
         return fsl_udc_resume(NULL);
 }
-
 /*-------------------------------------------------------------------------
         Register entry point for the peripheral controller driver
 --------------------------------------------------------------------------*/
-
+static const struct platform_device_id fsl_udc_devtype[] = {
+        {
+                .name = "imx-udc-mx27",
+        }, {
+                .name = "imx-udc-mx51",
+        }, {
+                /* sentinel */
+        }
+};
+MODULE_DEVICE_TABLE(platform, fsl_udc_devtype);
 static struct platform_driver udc_driver = {
-        .remove  = __exit_p(fsl_udc_remove),
+        .remove         = __exit_p(fsl_udc_remove),
+        /* Just for FSL i.mx SoC currently */
+        .id_table       = fsl_udc_devtype,
         /* these suspend and resume are not usb suspend and resume */
-        .suspend = fsl_udc_suspend,
-        .resume  = fsl_udc_resume,
-        .driver  = {
-                .name = (char *)driver_name,
-                .owner = THIS_MODULE,
-                /* udc suspend/resume called from OTG driver */
-                .suspend = fsl_udc_otg_suspend,
-                .resume  = fsl_udc_otg_resume,
+        .suspend        = fsl_udc_suspend,
+        .resume         = fsl_udc_resume,
+        .driver         = {
+                        .name = (char *)driver_name,
+                        .owner = THIS_MODULE,
+                        /* udc suspend/resume called from OTG driver */
+                        .suspend = fsl_udc_otg_suspend,
+                        .resume  = fsl_udc_otg_resume,
         },
 };
 
diff --git a/drivers/usb/gadget/fsl_usb2_udc.h b/drivers/usb/gadget/fsl_usb2_udc.h
index f61a967f7082..c6703bb07b23 100644
--- a/drivers/usb/gadget/fsl_usb2_udc.h
+++ b/drivers/usb/gadget/fsl_usb2_udc.h
@@ -592,15 +592,16 @@ static inline struct ep_queue_head *get_qh_by_ep(struct fsl_ep *ep)
 struct platform_device;
 #ifdef CONFIG_ARCH_MXC
 int fsl_udc_clk_init(struct platform_device *pdev);
-void fsl_udc_clk_finalize(struct platform_device *pdev);
+int fsl_udc_clk_finalize(struct platform_device *pdev);
 void fsl_udc_clk_release(void);
 #else
 static inline int fsl_udc_clk_init(struct platform_device *pdev)
 {
         return 0;
 }
-static inline void fsl_udc_clk_finalize(struct platform_device *pdev)
+static inline int fsl_udc_clk_finalize(struct platform_device *pdev)
 {
+        return 0;
 }
 static inline void fsl_udc_clk_release(void)
 {
diff --git a/drivers/usb/gadget/mv_udc_core.c b/drivers/usb/gadget/mv_udc_core.c
index 379aac7b82fc..6e8b1272ebce 100644
--- a/drivers/usb/gadget/mv_udc_core.c
+++ b/drivers/usb/gadget/mv_udc_core.c
@@ -1012,7 +1012,7 @@ static void udc_clock_enable(struct mv_udc *udc)
         unsigned int i;
 
         for (i = 0; i < udc->clknum; i++)
-                clk_enable(udc->clk[i]);
+                clk_prepare_enable(udc->clk[i]);
 }
 
 static void udc_clock_disable(struct mv_udc *udc)
@@ -1020,7 +1020,7 @@ static void udc_clock_disable(struct mv_udc *udc)
         unsigned int i;
 
         for (i = 0; i < udc->clknum; i++)
-                clk_disable(udc->clk[i]);
+                clk_disable_unprepare(udc->clk[i]);
 }
 
 static void udc_stop(struct mv_udc *udc)
diff --git a/drivers/usb/gadget/s3c-hsotg.c b/drivers/usb/gadget/s3c-hsotg.c
index 141971d9051e..439c3f972f8c 100644
--- a/drivers/usb/gadget/s3c-hsotg.c
+++ b/drivers/usb/gadget/s3c-hsotg.c
@@ -3477,12 +3477,11 @@ static void s3c_hsotg_delete_debug(struct s3c_hsotg *hsotg)
 /**
  * s3c_hsotg_release - release callback for hsotg device
  * @dev: Device to for which release is called
+ *
+ * Nothing to do as the resource is allocated using devm_ API.
  */
 static void s3c_hsotg_release(struct device *dev)
 {
-        struct s3c_hsotg *hsotg = dev_get_drvdata(dev);
-
-        kfree(hsotg);
 }
 
 /**
diff --git a/drivers/usb/gadget/tcm_usb_gadget.c b/drivers/usb/gadget/tcm_usb_gadget.c
index 4f7f76f00c74..7cacd6ae818e 100644
--- a/drivers/usb/gadget/tcm_usb_gadget.c
+++ b/drivers/usb/gadget/tcm_usb_gadget.c
@@ -1794,9 +1794,10 @@ static int tcm_usbg_drop_nexus(struct usbg_tpg *tpg)
         tpg->tpg_nexus = NULL;
 
         kfree(tv_nexus);
+        ret = 0;
 out:
         mutex_unlock(&tpg->tpg_mutex);
-        return 0;
+        return ret;
 }
 
 static ssize_t tcm_usbg_tpg_store_nexus(
diff --git a/drivers/usb/gadget/u_serial.c b/drivers/usb/gadget/u_serial.c
index d0f95482f40e..598dcc1212f0 100644
--- a/drivers/usb/gadget/u_serial.c
+++ b/drivers/usb/gadget/u_serial.c
@@ -887,7 +887,7 @@ static void gs_close(struct tty_struct *tty, struct file *file)
         pr_debug("gs_close: ttyGS%d (%p,%p) done!\n",
                         port->port_num, tty, file);
 
-        wake_up_interruptible(&port->port.close_wait);
+        wake_up(&port->port.close_wait);
 exit:
         spin_unlock_irq(&port->port_lock);
 }
diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig
index d6bb128ce21e..3a21c5d683c0 100644
--- a/drivers/usb/host/Kconfig
+++ b/drivers/usb/host/Kconfig
@@ -148,7 +148,7 @@ config USB_EHCI_FSL
           Variation of ARC USB block used in some Freescale chips.
 
 config USB_EHCI_MXC
-        bool "Support for Freescale i.MX on-chip EHCI USB controller"
+        tristate "Support for Freescale i.MX on-chip EHCI USB controller"
         depends on USB_EHCI_HCD && ARCH_MXC
         select USB_EHCI_ROOT_HUB_TT
         ---help---
diff --git a/drivers/usb/host/Makefile b/drivers/usb/host/Makefile
index 1eb4c3006e9e..001fbff2fdef 100644
--- a/drivers/usb/host/Makefile
+++ b/drivers/usb/host/Makefile
@@ -26,6 +26,7 @@ obj-$(CONFIG_PCI)		+= pci-quirks.o
 obj-$(CONFIG_USB_EHCI_HCD)      += ehci-hcd.o
 obj-$(CONFIG_USB_EHCI_PCI)      += ehci-pci.o
 obj-$(CONFIG_USB_EHCI_HCD_PLATFORM)     += ehci-platform.o
+obj-$(CONFIG_USB_EHCI_MXC)      += ehci-mxc.o
 
 obj-$(CONFIG_USB_OXU210HP_HCD)  += oxu210hp-hcd.o
 obj-$(CONFIG_USB_ISP116X_HCD)   += isp116x-hcd.o
diff --git a/drivers/usb/host/ehci-fsl.c b/drivers/usb/host/ehci-fsl.c
index fd9b5424b860..d81d2fcbff18 100644
--- a/drivers/usb/host/ehci-fsl.c
+++ b/drivers/usb/host/ehci-fsl.c
@@ -230,7 +230,7 @@ static int ehci_fsl_setup_phy(struct usb_hcd *hcd,
 
         switch (phy_mode) {
         case FSL_USB2_PHY_ULPI:
-                if (pdata->controller_ver) {
+                if (pdata->have_sysif_regs && pdata->controller_ver) {
                         /* controller version 1.6 or above */
                         setbits32(non_ehci + FSL_SOC_USB_CTRL,
                                         ULPI_PHY_CLK_SEL);
@@ -251,7 +251,7 @@ static int ehci_fsl_setup_phy(struct usb_hcd *hcd,
                 portsc |= PORT_PTS_PTW;
                 /* fall through */
         case FSL_USB2_PHY_UTMI:
-                if (pdata->controller_ver) {
+                if (pdata->have_sysif_regs && pdata->controller_ver) {
                         /* controller version 1.6 or above */
                         setbits32(non_ehci + FSL_SOC_USB_CTRL, UTMI_PHY_EN);
                         mdelay(FSL_UTMI_PHY_DLY);  /* Delay for UTMI PHY CLK to
@@ -267,7 +267,8 @@ static int ehci_fsl_setup_phy(struct usb_hcd *hcd,
                 break;
         }
 
-        if (pdata->controller_ver && (phy_mode == FSL_USB2_PHY_ULPI)) {
+        if (pdata->have_sysif_regs && pdata->controller_ver &&
+            (phy_mode == FSL_USB2_PHY_ULPI)) {
                 /* check PHY_CLK_VALID to get phy clk valid */
                 if (!spin_event_timeout(in_be32(non_ehci + FSL_SOC_USB_CTRL) &
                                 PHY_CLK_VALID, FSL_USB_PHY_CLK_TIMEOUT, 0)) {
@@ -278,7 +279,7 @@ static int ehci_fsl_setup_phy(struct usb_hcd *hcd,
 
         ehci_writel(ehci, portsc, &ehci->regs->port_status[port_offset]);
 
-        if (phy_mode != FSL_USB2_PHY_ULPI)
+        if (phy_mode != FSL_USB2_PHY_ULPI && pdata->have_sysif_regs)
                 setbits32(non_ehci + FSL_SOC_USB_CTRL, USB_CTRL_USB_EN);
 
         return 0;
diff --git a/drivers/usb/host/ehci-hcd.c b/drivers/usb/host/ehci-hcd.c
index c97503bb0b0e..b416a3fc9959 100644
--- a/drivers/usb/host/ehci-hcd.c
+++ b/drivers/usb/host/ehci-hcd.c
@@ -74,10 +74,6 @@ static const char	hcd_name [] = "ehci_hcd";
 #undef VERBOSE_DEBUG
 #undef EHCI_URB_TRACE
 
-#ifdef DEBUG
-#define EHCI_STATS
-#endif
-
 /* magic numbers that can affect system performance */
 #define EHCI_TUNE_CERR          3       /* 0-3 qtd retries; 0 == don't stop */
 #define EHCI_TUNE_RL_HS         4       /* nak throttle; see 4.9 */
@@ -801,6 +797,7 @@ static irqreturn_t ehci_irq (struct usb_hcd *hcd)
                         ehci->reset_done[i] = jiffies + msecs_to_jiffies(25);
                         set_bit(i, &ehci->resuming_ports);
                         ehci_dbg (ehci, "port %d remote wakeup\n", i + 1);
+                        usb_hcd_start_port_resume(&hcd->self, i);
                         mod_timer(&hcd->rh_timer, ehci->reset_done[i]);
                 }
         }
@@ -1250,11 +1247,6 @@ MODULE_LICENSE ("GPL");
 #define PLATFORM_DRIVER         ehci_fsl_driver
 #endif
 
-#ifdef CONFIG_USB_EHCI_MXC
-#include "ehci-mxc.c"
-#define PLATFORM_DRIVER         ehci_mxc_driver
-#endif
-
 #ifdef CONFIG_USB_EHCI_SH
 #include "ehci-sh.c"
 #define PLATFORM_DRIVER         ehci_hcd_sh_driver
@@ -1352,7 +1344,8 @@ MODULE_LICENSE ("GPL");
 
 #if !IS_ENABLED(CONFIG_USB_EHCI_PCI) && \
         !IS_ENABLED(CONFIG_USB_EHCI_HCD_PLATFORM) && \
-        !defined(CONFIG_USB_CHIPIDEA_HOST) && \
+        !IS_ENABLED(CONFIG_USB_CHIPIDEA_HOST) && \
+        !IS_ENABLED(CONFIG_USB_EHCI_MXC) && \
         !defined(PLATFORM_DRIVER) && \
         !defined(PS3_SYSTEM_BUS_DRIVER) && \
         !defined(OF_PLATFORM_DRIVER) && \
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index 4ccb97c0678f..4d3b294f203e 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -649,7 +649,11 @@ ehci_hub_status_data (struct usb_hcd *hcd, char *buf)
                         status = STS_PCD;
                 }
         }
-        /* FIXME autosuspend idle root hubs */
+
+        /* If a resume is in progress, make sure it can finish */
+        if (ehci->resuming_ports)
+                mod_timer(&hcd->rh_timer, jiffies + msecs_to_jiffies(25));
+
         spin_unlock_irqrestore (&ehci->lock, flags);
         return status ? retval : 0;
 }
@@ -851,6 +855,7 @@ static int ehci_hub_control (
                                 /* resume signaling for 20 msec */
                                 ehci->reset_done[wIndex] = jiffies
                                                 + msecs_to_jiffies(20);
+                                usb_hcd_start_port_resume(&hcd->self, wIndex);
                                 /* check the port again */
                                 mod_timer(&ehci_to_hcd(ehci)->rh_timer,
                                                 ehci->reset_done[wIndex]);
@@ -862,6 +867,7 @@ static int ehci_hub_control (
                                 clear_bit(wIndex, &ehci->suspended_ports);
                                 set_bit(wIndex, &ehci->port_c_suspend);
                                 ehci->reset_done[wIndex] = 0;
+                                usb_hcd_end_port_resume(&hcd->self, wIndex);
 
                                 /* stop resume signaling */
                                 temp = ehci_readl(ehci, status_reg);
@@ -950,6 +956,7 @@ static int ehci_hub_control (
                         ehci->reset_done[wIndex] = 0;
                         if (temp & PORT_PE)
                                 set_bit(wIndex, &ehci->port_c_suspend);
+                        usb_hcd_end_port_resume(&hcd->self, wIndex);
                 }
 
                 if (temp & PORT_OC)
diff --git a/drivers/usb/host/ehci-mv.c b/drivers/usb/host/ehci-mv.c
index f7bfc0b898b9..6c56297ea16b 100644
--- a/drivers/usb/host/ehci-mv.c
+++ b/drivers/usb/host/ehci-mv.c
@@ -43,7 +43,7 @@ static void ehci_clock_enable(struct ehci_hcd_mv *ehci_mv)
         unsigned int i;
 
         for (i = 0; i < ehci_mv->clknum; i++)
-                clk_enable(ehci_mv->clk[i]);
+                clk_prepare_enable(ehci_mv->clk[i]);
 }
 
 static void ehci_clock_disable(struct ehci_hcd_mv *ehci_mv)
@@ -51,7 +51,7 @@ static void ehci_clock_disable(struct ehci_hcd_mv *ehci_mv)
         unsigned int i;
 
         for (i = 0; i < ehci_mv->clknum; i++)
-                clk_disable(ehci_mv->clk[i]);
+                clk_disable_unprepare(ehci_mv->clk[i]);
 }
 
 static int mv_ehci_enable(struct ehci_hcd_mv *ehci_mv)
diff --git a/drivers/usb/host/ehci-mxc.c b/drivers/usb/host/ehci-mxc.c
index ec7f5d2c90de..dedb80bb8d40 100644
--- a/drivers/usb/host/ehci-mxc.c
+++ b/drivers/usb/host/ehci-mxc.c
@@ -17,75 +17,38 @@
  * Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/io.h>
 #include <linux/platform_device.h>
 #include <linux/clk.h>
 #include <linux/delay.h>
 #include <linux/usb/otg.h>
 #include <linux/usb/ulpi.h>
 #include <linux/slab.h>
+#include <linux/usb.h>
+#include <linux/usb/hcd.h>
 
 #include <linux/platform_data/usb-ehci-mxc.h>
 
 #include <asm/mach-types.h>
 
+#include "ehci.h"
+
+#define DRIVER_DESC "Freescale On-Chip EHCI Host driver"
+
+static const char hcd_name[] = "ehci-mxc";
+
 #define ULPI_VIEWPORT_OFFSET    0x170
 
 struct ehci_mxc_priv {
         struct clk *usbclk, *ahbclk, *phyclk;
-        struct usb_hcd *hcd;
 };
 
-/* called during probe() after chip reset completes */
-static int ehci_mxc_setup(struct usb_hcd *hcd)
-{
-        hcd->has_tt = 1;
-
-        return ehci_setup(hcd);
-}
+static struct hc_driver __read_mostly ehci_mxc_hc_driver;
 
-static const struct hc_driver ehci_mxc_hc_driver = {
-        .description = hcd_name,
-        .product_desc = "Freescale On-Chip EHCI Host Controller",
-        .hcd_priv_size = sizeof(struct ehci_hcd),
-
-        /*
-         * generic hardware linkage
-         */
-        .irq = ehci_irq,
-        .flags = HCD_USB2 | HCD_MEMORY,
-
-        /*
-         * basic lifecycle operations
-         */
-        .reset = ehci_mxc_setup,
-        .start = ehci_run,
-        .stop = ehci_stop,
-        .shutdown = ehci_shutdown,
-
-        /*
-         * managing i/o requests and associated device resources
-         */
-        .urb_enqueue = ehci_urb_enqueue,
-        .urb_dequeue = ehci_urb_dequeue,
-        .endpoint_disable = ehci_endpoint_disable,
-        .endpoint_reset = ehci_endpoint_reset,
-
-        /*
-         * scheduling support
-         */
-        .get_frame_number = ehci_get_frame,
-
-        /*
-         * root hub support
-         */
-        .hub_status_data = ehci_hub_status_data,
-        .hub_control = ehci_hub_control,
-        .bus_suspend = ehci_bus_suspend,
-        .bus_resume = ehci_bus_resume,
-        .relinquish_port = ehci_relinquish_port,
-        .port_handed_over = ehci_port_handed_over,
-
-        .clear_tt_buffer_complete = ehci_clear_tt_buffer_complete,
+static const struct ehci_driver_overrides ehci_mxc_overrides __initdata = {
+        .extra_priv_size =      sizeof(struct ehci_mxc_priv),
 };
 
 static int ehci_mxc_drv_probe(struct platform_device *pdev)
@@ -112,12 +75,6 @@ static int ehci_mxc_drv_probe(struct platform_device *pdev)
         if (!hcd)
                 return -ENOMEM;
 
-        priv = devm_kzalloc(&pdev->dev, sizeof(*priv), GFP_KERNEL);
-        if (!priv) {
-                ret = -ENOMEM;
-                goto err_alloc;
-        }
-
         res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
         if (!res) {
                 dev_err(dev, "Found HC with no register addr. Check setup!\n");
@@ -135,6 +92,10 @@ static int ehci_mxc_drv_probe(struct platform_device *pdev)
                 goto err_alloc;
         }
 
+        hcd->has_tt = 1;
+        ehci = hcd_to_ehci(hcd);
+        priv = (struct ehci_mxc_priv *) ehci->priv;
+
         /* enable clocks */
         priv->usbclk = devm_clk_get(&pdev->dev, "ipg");
         if (IS_ERR(priv->usbclk)) {
@@ -169,8 +130,6 @@ static int ehci_mxc_drv_probe(struct platform_device *pdev)
                 mdelay(10);
         }
 
-        ehci = hcd_to_ehci(hcd);
-
         /* EHCI registers start at offset 0x100 */
         ehci->caps = hcd->regs + 0x100;
         ehci->regs = hcd->regs + 0x100 +
@@ -198,8 +157,7 @@ static int ehci_mxc_drv_probe(struct platform_device *pdev)
                 }
         }
 
-        priv->hcd = hcd;
-        platform_set_drvdata(pdev, priv);
+        platform_set_drvdata(pdev, hcd);
 
         ret = usb_add_hcd(hcd, irq, IRQF_SHARED);
         if (ret)
@@ -244,8 +202,11 @@ err_alloc:
 static int __exit ehci_mxc_drv_remove(struct platform_device *pdev)
 {
         struct mxc_usbh_platform_data *pdata = pdev->dev.platform_data;
-        struct ehci_mxc_priv *priv = platform_get_drvdata(pdev);
-        struct usb_hcd *hcd = priv->hcd;
+        struct usb_hcd *hcd = platform_get_drvdata(pdev);
+        struct ehci_hcd *ehci = hcd_to_ehci(hcd);
+        struct ehci_mxc_priv *priv = (struct ehci_mxc_priv *) ehci->priv;
+
+        usb_remove_hcd(hcd);
 
         if (pdata && pdata->exit)
                 pdata->exit(pdev);
@@ -253,23 +214,20 @@ static int __exit ehci_mxc_drv_remove(struct platform_device *pdev)
         if (pdata->otg)
                 usb_phy_shutdown(pdata->otg);
 
-        usb_remove_hcd(hcd);
-        usb_put_hcd(hcd);
-        platform_set_drvdata(pdev, NULL);
-
         clk_disable_unprepare(priv->usbclk);
         clk_disable_unprepare(priv->ahbclk);
 
         if (priv->phyclk)
                 clk_disable_unprepare(priv->phyclk);
 
+        usb_put_hcd(hcd);
+        platform_set_drvdata(pdev, NULL);
         return 0;
 }
 
 static void ehci_mxc_drv_shutdown(struct platform_device *pdev)
 {
-        struct ehci_mxc_priv *priv = platform_get_drvdata(pdev);
-        struct usb_hcd *hcd = priv->hcd;
+        struct usb_hcd *hcd = platform_get_drvdata(pdev);
 
         if (hcd->driver->shutdown)
                 hcd->driver->shutdown(hcd);
@@ -279,9 +237,31 @@ MODULE_ALIAS("platform:mxc-ehci");
 
 static struct platform_driver ehci_mxc_driver = {
         .probe = ehci_mxc_drv_probe,
-        .remove = __exit_p(ehci_mxc_drv_remove),
+        .remove = ehci_mxc_drv_remove,
         .shutdown = ehci_mxc_drv_shutdown,
         .driver = {
                    .name = "mxc-ehci",
         },
 };
+
+static int __init ehci_mxc_init(void)
+{
+        if (usb_disabled())
+                return -ENODEV;
+
+        pr_info("%s: " DRIVER_DESC "\n", hcd_name);
+
+        ehci_init_driver(&ehci_mxc_hc_driver, &ehci_mxc_overrides);
+        return platform_driver_register(&ehci_mxc_driver);
+}
+module_init(ehci_mxc_init);
+
+static void __exit ehci_mxc_cleanup(void)
+{
+        platform_driver_unregister(&ehci_mxc_driver);
+}
+module_exit(ehci_mxc_cleanup);
+
+MODULE_DESCRIPTION(DRIVER_DESC);
+MODULE_AUTHOR("Sascha Hauer");
+MODULE_LICENSE("GPL");
diff --git a/drivers/usb/host/ehci-pci.c b/drivers/usb/host/ehci-pci.c
index dabb20494826..170b9399e09f 100644
--- a/drivers/usb/host/ehci-pci.c
+++ b/drivers/usb/host/ehci-pci.c
@@ -200,6 +200,26 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
                 break;
         }
 
+        /* optional debug port, normally in the first BAR */
+        temp = pci_find_capability(pdev, PCI_CAP_ID_DBG);
+        if (temp) {
+                pci_read_config_dword(pdev, temp, &temp);
+                temp >>= 16;
+                if (((temp >> 13) & 7) == 1) {
+                        u32 hcs_params = ehci_readl(ehci,
+                                                    &ehci->caps->hcs_params);
+
+                        temp &= 0x1fff;
+                        ehci->debug = hcd->regs + temp;
+                        temp = ehci_readl(ehci, &ehci->debug->control);
+                        ehci_info(ehci, "debug port %d%s\n",
+                                  HCS_DEBUG_PORT(hcs_params),
+                                  (temp & DBGP_ENABLED) ? " IN USE" : "");
+                        if (!(temp & DBGP_ENABLED))
+                                ehci->debug = NULL;
+                }
+        }
+
         retval = ehci_setup(hcd);
         if (retval)
                 return retval;
@@ -228,25 +248,6 @@ static int ehci_pci_setup(struct usb_hcd *hcd)
                 break;
         }
 
-        /* optional debug port, normally in the first BAR */
-        temp = pci_find_capability(pdev, 0x0a);
-        if (temp) {
-                pci_read_config_dword(pdev, temp, &temp);
-                temp >>= 16;
-                if ((temp & (3 << 13)) == (1 << 13)) {
-                        temp &= 0x1fff;
-                        ehci->debug = hcd->regs + temp;
-                        temp = ehci_readl(ehci, &ehci->debug->control);
-                        ehci_info(ehci, "debug port %d%s\n",
-                                HCS_DEBUG_PORT(ehci->hcs_params),
-                                (temp & DBGP_ENABLED)
-                                        ? " IN USE"
-                                        : "");
-                        if (!(temp & DBGP_ENABLED))
-                                ehci->debug = NULL;
-                }
-        }
-
         /* at least the Genesys GL880S needs fixup here */
         temp = HCS_N_CC(ehci->hcs_params) * HCS_N_PCC(ehci->hcs_params);
         temp &= 0x0f;
diff --git a/drivers/usb/host/ehci-q.c b/drivers/usb/host/ehci-q.c
index 3d989028c836..fd252f0cfb3a 100644
--- a/drivers/usb/host/ehci-q.c
+++ b/drivers/usb/host/ehci-q.c
@@ -1197,17 +1197,26 @@ static void start_iaa_cycle(struct ehci_hcd *ehci, bool nested)
         if (ehci->async_iaa || ehci->async_unlinking)
                 return;
 
-        /* Do all the waiting QHs at once */
-        ehci->async_iaa = ehci->async_unlink;
-        ehci->async_unlink = NULL;
-
         /* If the controller isn't running, we don't have to wait for it */
         if (unlikely(ehci->rh_state < EHCI_RH_RUNNING)) {
+
+                /* Do all the waiting QHs */
+                ehci->async_iaa = ehci->async_unlink;
+                ehci->async_unlink = NULL;
+
                 if (!nested)            /* Avoid recursion */
                         end_unlink_async(ehci);
 
         /* Otherwise start a new IAA cycle */
         } else if (likely(ehci->rh_state == EHCI_RH_RUNNING)) {
+                struct ehci_qh          *qh;
+
+                /* Do only the first waiting QH (nVidia bug?) */
+                qh = ehci->async_unlink;
+                ehci->async_iaa = qh;
+                ehci->async_unlink = qh->unlink_next;
+                qh->unlink_next = NULL;
+
                 /* Make sure the unlinks are all visible to the hardware */
                 wmb();
 
@@ -1255,34 +1264,35 @@ static void end_unlink_async(struct ehci_hcd *ehci)
         }
 }
 
+static void start_unlink_async(struct ehci_hcd *ehci, struct ehci_qh *qh);
+
 static void unlink_empty_async(struct ehci_hcd *ehci)
 {
-        struct ehci_qh          *qh, *next;
-        bool                    stopped = (ehci->rh_state < EHCI_RH_RUNNING);
+        struct ehci_qh          *qh;
+        struct ehci_qh          *qh_to_unlink = NULL;
         bool                    check_unlinks_later = false;
+        int                     count = 0;
 
-        /* Unlink all the async QHs that have been empty for a timer cycle */
-        next = ehci->async->qh_next.qh;
-        while (next) {
-                qh = next;
-                next = qh->qh_next.qh;
-
+        /* Find the last async QH which has been empty for a timer cycle */
+        for (qh = ehci->async->qh_next.qh; qh; qh = qh->qh_next.qh) {
                 if (list_empty(&qh->qtd_list) &&
                                 qh->qh_state == QH_STATE_LINKED) {
-                        if (!stopped && qh->unlink_cycle ==
-                                        ehci->async_unlink_cycle)
+                        ++count;
+                        if (qh->unlink_cycle == ehci->async_unlink_cycle)
                                 check_unlinks_later = true;
                         else
-                                single_unlink_async(ehci, qh);
+                                qh_to_unlink = qh;
                 }
         }
 
-        /* Start a new IAA cycle if any QHs are waiting for it */
-        if (ehci->async_unlink)
-                start_iaa_cycle(ehci, false);
+        /* If nothing else is being unlinked, unlink the last empty QH */
+        if (!ehci->async_iaa && !ehci->async_unlink && qh_to_unlink) {
+                start_unlink_async(ehci, qh_to_unlink);
+                --count;
+        }
 
-        /* QHs that haven't been empty for long enough will be handled later */
-        if (check_unlinks_later) {
+        /* Other QHs will be handled later */
+        if (count > 0) {
                 ehci_enable_event(ehci, EHCI_HRTIMER_ASYNC_UNLINKS, true);
                 ++ehci->async_unlink_cycle;
         }
diff --git a/drivers/usb/host/ehci-sched.c b/drivers/usb/host/ehci-sched.c
index 69ebee73c0c1..b476daf49f6f 100644
--- a/drivers/usb/host/ehci-sched.c
+++ b/drivers/usb/host/ehci-sched.c
@@ -213,7 +213,7 @@ static inline unsigned char tt_start_uframe(struct ehci_hcd *ehci, __hc32 mask)
 }
 
 static const unsigned char
-max_tt_usecs[] = { 125, 125, 125, 125, 125, 125, 30, 0 };
+max_tt_usecs[] = { 125, 125, 125, 125, 125, 125, 125, 25 };
 
 /* carryover low/fullspeed bandwidth that crosses uframe boundries */
 static inline void carryover_tt_bandwidth(unsigned short tt_usecs[8])
@@ -2212,11 +2212,11 @@ static void scan_isoc(struct ehci_hcd *ehci)
         }
         ehci->now_frame = now_frame;
 
+        frame = ehci->last_iso_frame;
         for (;;) {
                 union ehci_shadow       q, *q_p;
                 __hc32                  type, *hw_p;
 
-                frame = ehci->last_iso_frame;
 restart:
                 /* scan each element in frame's queue for completions */
                 q_p = &ehci->pshadow [frame];
@@ -2321,6 +2321,9 @@ restart:
                 /* Stop when we have reached the current frame */
                 if (frame == now_frame)
                         break;
-                ehci->last_iso_frame = (frame + 1) & fmask;
+
+                /* The last frame may still have active siTDs */
+                ehci->last_iso_frame = frame;
+                frame = (frame + 1) & fmask;
         }
 }
diff --git a/drivers/usb/host/ehci-timer.c b/drivers/usb/host/ehci-timer.c
index 20dbdcbe9b0f..f904071d70df 100644
--- a/drivers/usb/host/ehci-timer.c
+++ b/drivers/usb/host/ehci-timer.c
@@ -113,14 +113,15 @@ static void ehci_poll_ASS(struct ehci_hcd *ehci)
 
         if (want != actual) {
 
-                /* Poll again later, but give up after about 20 ms */
-                if (ehci->ASS_poll_count++ < 20) {
-                        ehci_enable_event(ehci, EHCI_HRTIMER_POLL_ASS, true);
-                        return;
-                }
-                ehci_dbg(ehci, "Waited too long for the async schedule status (%x/%x), giving up\n",
-                                want, actual);
+                /* Poll again later */
+                ehci_enable_event(ehci, EHCI_HRTIMER_POLL_ASS, true);
+                ++ehci->ASS_poll_count;
+                return;
         }
+
+        if (ehci->ASS_poll_count > 20)
+                ehci_dbg(ehci, "ASS poll count reached %d\n",
+                                ehci->ASS_poll_count);
         ehci->ASS_poll_count = 0;
 
         /* The status is up-to-date; restart or stop the schedule as needed */
@@ -159,14 +160,14 @@ static void ehci_poll_PSS(struct ehci_hcd *ehci)
 
         if (want != actual) {
 
-                /* Poll again later, but give up after about 20 ms */
-                if (ehci->PSS_poll_count++ < 20) {
-                        ehci_enable_event(ehci, EHCI_HRTIMER_POLL_PSS, true);
-                        return;
-                }
-                ehci_dbg(ehci, "Waited too long for the periodic schedule status (%x/%x), giving up\n",
-                                want, actual);
+                /* Poll again later */
+                ehci_enable_event(ehci, EHCI_HRTIMER_POLL_PSS, true);
+                return;
         }
+
+        if (ehci->PSS_poll_count > 20)
+                ehci_dbg(ehci, "PSS poll count reached %d\n",
+                                ehci->PSS_poll_count);
         ehci->PSS_poll_count = 0;
 
         /* The status is up-to-date; restart or stop the schedule as needed */
diff --git a/drivers/usb/host/ehci.h b/drivers/usb/host/ehci.h
index 9dadc7118d68..36c3a8210595 100644
--- a/drivers/usb/host/ehci.h
+++ b/drivers/usb/host/ehci.h
@@ -38,6 +38,10 @@ typedef __u16 __bitwise __hc16;
 #endif
 
 /* statistics can be kept for tuning/monitoring */
+#ifdef DEBUG
+#define EHCI_STATS
+#endif
+
 struct ehci_stats {
         /* irq usage */
         unsigned long           normal;
@@ -221,6 +225,9 @@ struct ehci_hcd {			/* one per controller */
 #ifdef DEBUG
         struct dentry           *debug_dir;
 #endif
+
+        /* platform-specific data -- must come last */
+        unsigned long           priv[0] __aligned(sizeof(s64));
 };
 
 /* convert between an HCD pointer and the corresponding EHCI_HCD */
diff --git a/drivers/usb/host/fsl-mph-dr-of.c b/drivers/usb/host/fsl-mph-dr-of.c
index 5105127c1d4b..11e0b79ff9d5 100644
--- a/drivers/usb/host/fsl-mph-dr-of.c
+++ b/drivers/usb/host/fsl-mph-dr-of.c
@@ -142,6 +142,9 @@ static int usb_get_ver_info(struct device_node *np)
                         return ver;
         }
 
+        if (of_device_is_compatible(np, "fsl,mpc5121-usb2-dr"))
+                return FSL_USB_VER_OLD;
+
         if (of_device_is_compatible(np, "fsl-usb2-mph")) {
                 if (of_device_is_compatible(np, "fsl-usb2-mph-v1.6"))
                         ver = FSL_USB_VER_1_6;
diff --git a/drivers/usb/host/imx21-hcd.c b/drivers/usb/host/imx21-hcd.c
index bd6a7447ccc9..f0ebe8e7c58b 100644
--- a/drivers/usb/host/imx21-hcd.c
+++ b/drivers/usb/host/imx21-hcd.c
@@ -58,6 +58,7 @@
 #include <linux/usb.h>
 #include <linux/usb/hcd.h>
 #include <linux/dma-mapping.h>
+#include <linux/module.h>
 
 #include "imx21-hcd.h"
 
diff --git a/drivers/usb/host/ohci-tmio.c b/drivers/usb/host/ohci-tmio.c
index d370245a4ee2..5e3a6deb62b1 100644
--- a/drivers/usb/host/ohci-tmio.c
+++ b/drivers/usb/host/ohci-tmio.c
@@ -128,7 +128,8 @@ static void tmio_start_hc(struct platform_device *dev)
         tmio_iowrite8(2, tmio->ccr + CCR_INTC);
 
         dev_info(&dev->dev, "revision %d @ 0x%08llx, irq %d\n",
-                        tmio_ioread8(tmio->ccr + CCR_REVID), hcd->rsrc_start, hcd->irq);
+                        tmio_ioread8(tmio->ccr + CCR_REVID),
+                        (u64) hcd->rsrc_start, hcd->irq);
 }
 
 static int ohci_tmio_start(struct usb_hcd *hcd)
diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
index a3b6d7104ae2..4c338ec03a07 100644
--- a/drivers/usb/host/pci-quirks.c
+++ b/drivers/usb/host/pci-quirks.c
@@ -780,6 +780,7 @@ void usb_enable_xhci_ports(struct pci_dev *xhci_pdev)
                                 "defaulting to EHCI.\n");
                 dev_warn(&xhci_pdev->dev,
                                 "USB 3.0 devices will work at USB 2.0 speeds.\n");
+                usb_disable_xhci_ports(xhci_pdev);
                 return;
         }
 
diff --git a/drivers/usb/host/uhci-hcd.c b/drivers/usb/host/uhci-hcd.c
index 4b9e9aba2665..4f64d24eebc8 100644
--- a/drivers/usb/host/uhci-hcd.c
+++ b/drivers/usb/host/uhci-hcd.c
@@ -447,6 +447,10 @@ static irqreturn_t uhci_irq(struct usb_hcd *hcd)
                 return IRQ_NONE;
         uhci_writew(uhci, status, USBSTS);              /* Clear it */
 
+        spin_lock(&uhci->lock);
+        if (unlikely(!uhci->is_initialized))    /* not yet configured */
+                goto done;
+
         if (status & ~(USBSTS_USBINT | USBSTS_ERROR | USBSTS_RD)) {
                 if (status & USBSTS_HSE)
                         dev_err(uhci_dev(uhci), "host system error, "
@@ -455,7 +459,6 @@ static irqreturn_t uhci_irq(struct usb_hcd *hcd)
                         dev_err(uhci_dev(uhci), "host controller process "
                                         "error, something bad happened!\n");
                 if (status & USBSTS_HCH) {
-                        spin_lock(&uhci->lock);
                         if (uhci->rh_state >= UHCI_RH_RUNNING) {
                                 dev_err(uhci_dev(uhci),
                                         "host controller halted, "
@@ -473,15 +476,15 @@ static irqreturn_t uhci_irq(struct usb_hcd *hcd)
                                  * pending unlinks */
                                 mod_timer(&hcd->rh_timer, jiffies);
                         }
-                        spin_unlock(&uhci->lock);
                 }
         }
 
-        if (status & USBSTS_RD)
+        if (status & USBSTS_RD) {
+                spin_unlock(&uhci->lock);
                 usb_hcd_poll_rh_status(hcd);
-        else {
-                spin_lock(&uhci->lock);
+        } else {
                 uhci_scan_schedule(uhci);
+ done:
                 spin_unlock(&uhci->lock);
         }
 
@@ -662,9 +665,9 @@ static int uhci_start(struct usb_hcd *hcd)
          */
         mb();
 
+        spin_lock_irq(&uhci->lock);
         configure_hc(uhci);
         uhci->is_initialized = 1;
-        spin_lock_irq(&uhci->lock);
         start_rh(uhci);
         spin_unlock_irq(&uhci->lock);
         return 0;
diff --git a/drivers/usb/host/uhci-hub.c b/drivers/usb/host/uhci-hub.c
index 768d54295a20..15d13229ddbb 100644
--- a/drivers/usb/host/uhci-hub.c
+++ b/drivers/usb/host/uhci-hub.c
@@ -116,6 +116,7 @@ static void uhci_finish_suspend(struct uhci_hcd *uhci, int port,
                 }
         }
         clear_bit(port, &uhci->resuming_ports);
+        usb_hcd_end_port_resume(&uhci_to_hcd(uhci)->self, port);
 }
 
 /* Wait for the UHCI controller in HP's iLO2 server management chip.
@@ -167,6 +168,8 @@ static void uhci_check_ports(struct uhci_hcd *uhci)
                                 set_bit(port, &uhci->resuming_ports);
                                 uhci->ports_timeout = jiffies +
                                                 msecs_to_jiffies(25);
+                                usb_hcd_start_port_resume(
+                                                &uhci_to_hcd(uhci)->self, port);
 
                                 /* Make sure we see the port again
                                  * after the resuming period is over. */
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index a686cf4905bb..68914429482f 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -761,12 +761,39 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
                         break;
                 case USB_PORT_FEAT_LINK_STATE:
                         temp = xhci_readl(xhci, port_array[wIndex]);
+
+                        /* Disable port */
+                        if (link_state == USB_SS_PORT_LS_SS_DISABLED) {
+                                xhci_dbg(xhci, "Disable port %d\n", wIndex);
+                                temp = xhci_port_state_to_neutral(temp);
+                                /*
+                                 * Clear all change bits, so that we get a new
+                                 * connection event.
+                                 */
+                                temp |= PORT_CSC | PORT_PEC | PORT_WRC |
+                                        PORT_OCC | PORT_RC | PORT_PLC |
+                                        PORT_CEC;
+                                xhci_writel(xhci, temp | PORT_PE,
+                                        port_array[wIndex]);
+                                temp = xhci_readl(xhci, port_array[wIndex]);
+                                break;
+                        }
+
+                        /* Put link in RxDetect (enable port) */
+                        if (link_state == USB_SS_PORT_LS_RX_DETECT) {
+                                xhci_dbg(xhci, "Enable port %d\n", wIndex);
+                                xhci_set_link_state(xhci, port_array, wIndex,
+                                                link_state);
+                                temp = xhci_readl(xhci, port_array[wIndex]);
+                                break;
+                        }
+
                         /* Software should not attempt to set
-                         * port link state above '5' (Rx.Detect) and the port
+                         * port link state above '3' (U3) and the port
                          * must be enabled.
                          */
                         if ((temp & PORT_PE) == 0 ||
-                                (link_state > USB_SS_PORT_LS_RX_DETECT)) {
+                                (link_state > USB_SS_PORT_LS_U3)) {
                                 xhci_warn(xhci, "Cannot set link state.\n");
                                 goto error;
                         }
@@ -957,6 +984,7 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)
         int max_ports;
         __le32 __iomem **port_array;
         struct xhci_bus_state *bus_state;
+        bool reset_change = false;
 
         max_ports = xhci_get_ports(hcd, &port_array);
         bus_state = &xhci->bus_state[hcd_index(hcd)];
@@ -988,6 +1016,12 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)
                         buf[(i + 1) / 8] |= 1 << (i + 1) % 8;
                         status = 1;
                 }
+                if ((temp & PORT_RC))
+                        reset_change = true;
+        }
+        if (!status && !reset_change) {
+                xhci_dbg(xhci, "%s: stopping port polling.\n", __func__);
+                clear_bit(HCD_FLAG_POLL_RH, &hcd->flags);
         }
         spin_unlock_irqrestore(&xhci->lock, flags);
         return status ? retval : 0;
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index fb51c7085ad0..35616ffbe3ae 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1250,6 +1250,8 @@ static unsigned int xhci_microframes_to_exponent(struct usb_device *udev,
 static unsigned int xhci_parse_microframe_interval(struct usb_device *udev,
                 struct usb_host_endpoint *ep)
 {
+        if (ep->desc.bInterval == 0)
+                return 0;
         return xhci_microframes_to_exponent(udev, ep,
                         ep->desc.bInterval, 0, 15);
 }
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index cbb44b7b9d65..7f76a49e90d3 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1698,7 +1698,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
                                 faked_port_index + 1);
                 if (slot_id && xhci->devs[slot_id])
                         xhci_ring_device(xhci, slot_id);
-                if (bus_state->port_remote_wakeup && (1 << faked_port_index)) {
+                if (bus_state->port_remote_wakeup & (1 << faked_port_index)) {
                         bus_state->port_remote_wakeup &=
                                 ~(1 << faked_port_index);
                         xhci_test_and_clear_bit(xhci, port_array,
@@ -1725,6 +1725,15 @@ cleanup:
         if (bogus_port_status)
                 return;
 
+        /*
+         * xHCI port-status-change events occur when the "or" of all the
+         * status-change bits in the portsc register changes from 0 to 1.
+         * New status changes won't cause an event if any other change
+         * bits are still set.  When an event occurs, switch over to
+         * polling to avoid losing status changes.
+         */
+        xhci_dbg(xhci, "%s: starting port polling.\n", __func__);
+        set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
         spin_unlock(&xhci->lock);
         /* Pass this up to the core */
         usb_hcd_poll_rh_status(hcd);
@@ -2580,6 +2589,8 @@ cleanup:
                                 (trb_comp_code != COMP_STALL &&
                                         trb_comp_code != COMP_BABBLE))
                                 xhci_urb_free_priv(xhci, urb_priv);
+                        else
+                                kfree(urb_priv);
 
                         usb_hcd_unlink_urb_from_ep(bus_to_hcd(urb->dev->bus), urb);
                         if ((urb->actual_length != urb->transfer_buffer_length &&
@@ -3099,7 +3110,7 @@ static u32 xhci_v1_0_td_remainder(int running_total, int trb_buff_len,
          * running_total.
          */
         packets_transferred = (running_total + trb_buff_len) /
-                usb_endpoint_maxp(&urb->ep->desc);
+                GET_MAX_PACKET(usb_endpoint_maxp(&urb->ep->desc));
 
         if ((total_packet_count - packets_transferred) > 31)
                 return 31 << 17;
@@ -3633,7 +3644,8 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                 td_len = urb->iso_frame_desc[i].length;
                 td_remain_len = td_len;
                 total_packet_count = DIV_ROUND_UP(td_len,
-                                usb_endpoint_maxp(&urb->ep->desc));
+                                GET_MAX_PACKET(
+                                        usb_endpoint_maxp(&urb->ep->desc)));
                 /* A zero-length transfer still involves at least one packet. */
                 if (total_packet_count == 0)
                         total_packet_count++;
@@ -3655,9 +3667,11 @@ static int xhci_queue_isoc_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
                 td = urb_priv->td[i];
                 for (j = 0; j < trbs_per_td; j++) {
                         u32 remainder = 0;
-                        field = TRB_TBC(burst_count) | TRB_TLBPC(residue);
+                        field = 0;
 
                         if (first_trb) {
+                                field = TRB_TBC(burst_count) |
+                                        TRB_TLBPC(residue);
                                 /* Queue the isoc TRB */
                                 field |= TRB_TYPE(TRB_ISOC);
                                 /* Assume URB_ISO_ASAP is set */
diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
index 5c72c431bab1..f1f01a834ba7 100644
--- a/drivers/usb/host/xhci.c
+++ b/drivers/usb/host/xhci.c
@@ -884,6 +884,11 @@ int xhci_suspend(struct xhci_hcd *xhci)
                         xhci->shared_hcd->state != HC_STATE_SUSPENDED)
                 return -EINVAL;
 
+        /* Don't poll the roothubs on bus suspend. */
+        xhci_dbg(xhci, "%s: stopping port polling.\n", __func__);
+        clear_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+        del_timer_sync(&hcd->rh_timer);
+
         spin_lock_irq(&xhci->lock);
         clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags);
         clear_bit(HCD_FLAG_HW_ACCESSIBLE, &xhci->shared_hcd->flags);
@@ -1069,6 +1074,11 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
         if (xhci->quirks & XHCI_COMP_MODE_QUIRK)
                 compliance_mode_recovery_timer_init(xhci);
 
+        /* Re-enable port polling. */
+        xhci_dbg(xhci, "%s: starting port polling.\n", __func__);
+        set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
+        usb_hcd_poll_rh_status(hcd);
+
         return retval;
 }
 #endif  /* CONFIG_PM */
diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
index 7667b12f2ff5..268148de9714 100644
--- a/drivers/usb/misc/usbtest.c
+++ b/drivers/usb/misc/usbtest.c
@@ -2179,7 +2179,7 @@ usbtest_ioctl(struct usb_interface *intf, unsigned int code, void *buf)
                 if (dev->out_pipe == 0 || !param->length || param->sglen < 4)
                         break;
                 retval = 0;
-                dev_info(&intf->dev, "TEST 17:  unlink from %d queues of "
+                dev_info(&intf->dev, "TEST 24:  unlink from %d queues of "
                                 "%d %d-byte writes\n",
                                 param->iterations, param->sglen, param->length);
                 for (i = param->iterations; retval == 0 && i > 0; --i) {
diff --git a/drivers/usb/musb/cppi_dma.c b/drivers/usb/musb/cppi_dma.c
index 0968dd7a859d..f522000e8f06 100644
--- a/drivers/usb/musb/cppi_dma.c
+++ b/drivers/usb/musb/cppi_dma.c
@@ -105,7 +105,7 @@ static void cppi_reset_tx(struct cppi_tx_stateram __iomem *tx, u32 ptr)
         musb_writel(&tx->tx_complete, 0, ptr);
 }
 
-static void __init cppi_pool_init(struct cppi *cppi, struct cppi_channel *c)
+static void cppi_pool_init(struct cppi *cppi, struct cppi_channel *c)
 {
         int     j;
 
@@ -150,7 +150,7 @@ static void cppi_pool_free(struct cppi_channel *c)
         c->last_processed = NULL;
 }
 
-static int __init cppi_controller_start(struct dma_controller *c)
+static int cppi_controller_start(struct dma_controller *c)
 {
         struct cppi     *controller;
         void __iomem    *tibase;
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index f1c6c5470b92..fd3486745e64 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -2298,10 +2298,7 @@ static int __init musb_init(void)
         if (usb_disabled())
                 return 0;
 
-        pr_info("%s: version " MUSB_VERSION ", "
-                "?dma?"
-                ", "
-                "otg (peripheral+host)",
+        pr_info("%s: version " MUSB_VERSION ", ?dma?, otg (peripheral+host)\n",
                 musb_driver_name);
         return platform_driver_register(&musb_driver);
 }
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index e6f2ae8368bb..f7d764de6fda 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -134,6 +134,11 @@ static const resource_size_t dsps_control_module_phys[] = {
         DSPS_AM33XX_CONTROL_MODULE_PHYS_1,
 };
 
+#define USBPHY_CM_PWRDN         (1 << 0)
+#define USBPHY_OTG_PWRDN        (1 << 1)
+#define USBPHY_OTGVDET_EN       (1 << 19)
+#define USBPHY_OTGSESSEND_EN    (1 << 20)
+
 /**
  * musb_dsps_phy_control - phy on/off
  * @glue: struct dsps_glue *
diff --git a/drivers/usb/otg/Kconfig b/drivers/usb/otg/Kconfig
index 6223062d5d1b..37962c99ff1e 100644
--- a/drivers/usb/otg/Kconfig
+++ b/drivers/usb/otg/Kconfig
@@ -110,7 +110,7 @@ config AB8500_USB
 
 config FSL_USB2_OTG
         bool "Freescale USB OTG Transceiver Driver"
-        depends on USB_EHCI_FSL && USB_GADGET_FSL_USB2 && USB_SUSPEND
+        depends on USB_EHCI_FSL && USB_FSL_USB2 && USB_SUSPEND
         select USB_OTG
         select USB_OTG_UTILS
         help
diff --git a/drivers/usb/otg/mv_otg.c b/drivers/usb/otg/mv_otg.c
index 1dd57504186d..eace975991a8 100644
--- a/drivers/usb/otg/mv_otg.c
+++ b/drivers/usb/otg/mv_otg.c
@@ -240,7 +240,7 @@ static void otg_clock_enable(struct mv_otg *mvotg)
         unsigned int i;
 
         for (i = 0; i < mvotg->clknum; i++)
-                clk_enable(mvotg->clk[i]);
+                clk_prepare_enable(mvotg->clk[i]);
 }
 
 static void otg_clock_disable(struct mv_otg *mvotg)
@@ -248,7 +248,7 @@ static void otg_clock_disable(struct mv_otg *mvotg)
         unsigned int i;
 
         for (i = 0; i < mvotg->clknum; i++)
-                clk_disable(mvotg->clk[i]);
+                clk_disable_unprepare(mvotg->clk[i]);
 }
 
 static int mv_otg_enable_internal(struct mv_otg *mvotg)
diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
index dd41f61893ef..f2985cd88021 100644
--- a/drivers/usb/renesas_usbhs/mod_gadget.c
+++ b/drivers/usb/renesas_usbhs/mod_gadget.c
@@ -545,15 +545,6 @@ static int usbhsg_pipe_disable(struct usbhsg_uep *uep)
         return 0;
 }
 
-static void usbhsg_uep_init(struct usbhsg_gpriv *gpriv)
-{
-        int i;
-        struct usbhsg_uep *uep;
-
-        usbhsg_for_each_uep_with_dcp(uep, gpriv, i)
-                uep->pipe = NULL;
-}
-
 /*
  *
  *              usb_ep_ops
@@ -610,7 +601,12 @@ static int usbhsg_ep_disable(struct usb_ep *ep)
 {
         struct usbhsg_uep *uep = usbhsg_ep_to_uep(ep);
 
-        return usbhsg_pipe_disable(uep);
+        usbhsg_pipe_disable(uep);
+
+        uep->pipe->mod_private  = NULL;
+        uep->pipe               = NULL;
+
+        return 0;
 }
 
 static struct usb_request *usbhsg_ep_alloc_request(struct usb_ep *ep,
@@ -761,9 +757,8 @@ static int usbhsg_try_start(struct usbhs_priv *priv, u32 status)
         usbhs_pipe_init(priv,
                         usbhsg_dma_map_ctrl);
         usbhs_fifo_init(priv);
-        usbhsg_uep_init(gpriv);
 
-        /* dcp init */
+        /* dcp init instead of usbhsg_ep_enable() */
         dcp->pipe               = usbhs_dcp_malloc(priv);
         dcp->pipe->mod_private  = dcp;
         usbhs_pipe_config_update(dcp->pipe, 0, 0, 64);
@@ -825,7 +820,7 @@ static int usbhsg_try_stop(struct usbhs_priv *priv, u32 status)
         usbhs_sys_set_test_mode(priv, 0);
         usbhs_sys_function_ctrl(priv, 0);
 
-        usbhsg_pipe_disable(dcp);
+        usbhsg_ep_disable(&dcp->ep);
 
         dev_dbg(dev, "stop gadget\n");
 
@@ -998,6 +993,7 @@ int usbhs_mod_gadget_probe(struct usbhs_priv *priv)
          */
         usbhsg_for_each_uep_with_dcp(uep, gpriv, i) {
                 uep->gpriv      = gpriv;
+                uep->pipe       = NULL;
                 snprintf(uep->ep_name, EP_NAME_SIZE, "ep%d", i);
 
                 uep->ep.name            = uep->ep_name;
diff --git a/drivers/usb/renesas_usbhs/mod_host.c b/drivers/usb/renesas_usbhs/mod_host.c
index 3d3cd6ca2689..b86815421c8d 100644
--- a/drivers/usb/renesas_usbhs/mod_host.c
+++ b/drivers/usb/renesas_usbhs/mod_host.c
@@ -661,9 +661,10 @@ static void usbhsh_queue_done(struct usbhs_priv *priv, struct usbhs_pkt *pkt)
                 status = -ESHUTDOWN;
 
         urb->actual_length = pkt->actual;
-        usbhsh_ureq_free(hpriv, ureq);
 
         usbhsh_endpoint_sequence_save(hpriv, urb, pkt);
+        usbhsh_ureq_free(hpriv, ureq);
+
         usbhsh_pipe_detach(hpriv, usbhsh_ep_to_uep(urb->ep));
 
         usb_hcd_unlink_urb_from_ep(hcd, urb);
diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
index f14736f647ff..edc0f0dcad83 100644
--- a/drivers/usb/serial/cp210x.c
+++ b/drivers/usb/serial/cp210x.c
@@ -60,6 +60,7 @@ static const struct usb_device_id id_table[] = {
         { USB_DEVICE(0x0FCF, 0x1003) }, /* Dynastream ANT development board */
         { USB_DEVICE(0x0FCF, 0x1004) }, /* Dynastream ANT2USB */
         { USB_DEVICE(0x0FCF, 0x1006) }, /* Dynastream ANT development board */
+        { USB_DEVICE(0x0FDE, 0xCA05) }, /* OWL Wireless Electricity Monitor CM-160 */
         { USB_DEVICE(0x10A6, 0xAA26) }, /* Knock-off DCU-11 cable */
         { USB_DEVICE(0x10AB, 0x10C5) }, /* Siemens MC60 Cable */
         { USB_DEVICE(0x10B5, 0xAC70) }, /* Nokia CA-42 USB */
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 0a373b3ae96a..90ceef1776c3 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -584,6 +584,7 @@ static struct usb_device_id id_table_combined [] = {
         /*
          * ELV devices:
          */
+        { USB_DEVICE(FTDI_ELV_VID, FTDI_ELV_WS300_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_USR_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_MSM1_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_KL100_PID) },
@@ -670,6 +671,7 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_5_PID) },
         { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_6_PID) },
         { USB_DEVICE(FTDI_VID, XSENS_CONVERTER_7_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_OMNI1509) },
         { USB_DEVICE(MOBILITY_VID, MOBILITY_USB_SERIAL_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ACTIVE_ROBOTS_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_MHAM_KW_PID) },
@@ -875,6 +877,8 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_DISTORTEC_JTAG_LOCK_PICK_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
         { USB_DEVICE(FTDI_VID, FTDI_LUMEL_PD12_PID) },
+        /* Crucible Devices */
+        { USB_DEVICE(FTDI_VID, FTDI_CT_COMET_PID) },
         { },                                    /* Optional parameter entry */
         { }                                     /* Terminating entry */
 };
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 049b6e715fa4..9d359e189a64 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -147,6 +147,11 @@
 #define XSENS_CONVERTER_6_PID   0xD38E
 #define XSENS_CONVERTER_7_PID   0xD38F
 
+/**
+ * Zolix (www.zolix.com.cb) product ids
+ */
+#define FTDI_OMNI1509                   0xD491  /* Omni1509 embedded USB-serial */
+
 /*
  * NDI (www.ndigital.com) product ids
  */
@@ -204,7 +209,7 @@
 
 /*
  * ELV USB devices submitted by Christian Abt of ELV (www.elv.de).
- * All of these devices use FTDI's vendor ID (0x0403).
+ * Almost all of these devices use FTDI's vendor ID (0x0403).
  * Further IDs taken from ELV Windows .inf file.
  *
  * The previously included PID for the UO 100 module was incorrect.
@@ -212,6 +217,8 @@
  *
  * Armin Laeuger originally sent the PID for the UM 100 module.
  */
+#define FTDI_ELV_VID    0x1B1F  /* ELV AG */
+#define FTDI_ELV_WS300_PID      0xC006  /* eQ3 WS 300 PC II */
 #define FTDI_ELV_USR_PID        0xE000  /* ELV Universal-Sound-Recorder */
 #define FTDI_ELV_MSM1_PID       0xE001  /* ELV Mini-Sound-Modul */
 #define FTDI_ELV_KL100_PID      0xE002  /* ELV Kfz-Leistungsmesser KL 100 */
@@ -1259,3 +1266,9 @@
  * ATI command output: Cinterion MC55i
  */
 #define FTDI_CINTERION_MC55I_PID        0xA951
+
+/*
+ * Product: Comet Caller ID decoder
+ * Manufacturer: Crucible Technologies
+ */
+#define FTDI_CT_COMET_PID       0x8e08
diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
index 58184f3de686..82afc4d6a327 100644
--- a/drivers/usb/serial/io_ti.c
+++ b/drivers/usb/serial/io_ti.c
@@ -530,6 +530,9 @@ static void chase_port(struct edgeport_port *port, unsigned long timeout,
         wait_queue_t wait;
         unsigned long flags;
 
+        if (!tty)
+                return;
+
         if (!timeout)
                 timeout = (HZ * EDGE_CLOSING_WAIT)/100;
 
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index e6f87b76c715..567bc77d6397 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -242,6 +242,7 @@ static void option_instat_callback(struct urb *urb);
 #define TELIT_PRODUCT_CC864_DUAL                0x1005
 #define TELIT_PRODUCT_CC864_SINGLE              0x1006
 #define TELIT_PRODUCT_DE910_DUAL                0x1010
+#define TELIT_PRODUCT_LE920                     0x1200
 
 /* ZTE PRODUCTS */
 #define ZTE_VENDOR_ID                           0x19d2
@@ -288,6 +289,7 @@ static void option_instat_callback(struct urb *urb);
 #define ALCATEL_VENDOR_ID                       0x1bbb
 #define ALCATEL_PRODUCT_X060S_X200              0x0000
 #define ALCATEL_PRODUCT_X220_X500D              0x0017
+#define ALCATEL_PRODUCT_L100V                   0x011e
 
 #define PIRELLI_VENDOR_ID                       0x1266
 #define PIRELLI_PRODUCT_C100_1                  0x1002
@@ -429,9 +431,12 @@ static void option_instat_callback(struct urb *urb);
 #define MEDIATEK_VENDOR_ID                      0x0e8d
 #define MEDIATEK_PRODUCT_DC_1COM                0x00a0
 #define MEDIATEK_PRODUCT_DC_4COM                0x00a5
+#define MEDIATEK_PRODUCT_DC_4COM2               0x00a7
 #define MEDIATEK_PRODUCT_DC_5COM                0x00a4
 #define MEDIATEK_PRODUCT_7208_1COM              0x7101
 #define MEDIATEK_PRODUCT_7208_2COM              0x7102
+#define MEDIATEK_PRODUCT_7103_2COM              0x7103
+#define MEDIATEK_PRODUCT_7106_2COM              0x7106
 #define MEDIATEK_PRODUCT_FP_1COM                0x0003
 #define MEDIATEK_PRODUCT_FP_2COM                0x0023
 #define MEDIATEK_PRODUCT_FPDC_1COM              0x0043
@@ -441,6 +446,18 @@ static void option_instat_callback(struct urb *urb);
 #define CELLIENT_VENDOR_ID                      0x2692
 #define CELLIENT_PRODUCT_MEN200                 0x9005
 
+/* Hyundai Petatel Inc. products */
+#define PETATEL_VENDOR_ID                       0x1ff4
+#define PETATEL_PRODUCT_NP10T                   0x600e
+
+/* TP-LINK Incorporated products */
+#define TPLINK_VENDOR_ID                        0x2357
+#define TPLINK_PRODUCT_MA180                    0x0201
+
+/* Changhong products */
+#define CHANGHONG_VENDOR_ID                     0x2077
+#define CHANGHONG_PRODUCT_CH690                 0x7001
+
 /* some devices interfaces need special handling due to a number of reasons */
 enum option_blacklist_reason {
                 OPTION_BLACKLIST_NONE = 0,
@@ -522,6 +539,11 @@ static const struct option_blacklist_info zte_1255_blacklist = {
         .reserved = BIT(3) | BIT(4),
 };
 
+static const struct option_blacklist_info telit_le920_blacklist = {
+        .sendsetup = BIT(0),
+        .reserved = BIT(1) | BIT(5),
+};
+
 static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
@@ -772,6 +794,8 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_DUAL) },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) },
         { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) },
+        { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
+                .driver_info = (kernel_ulong_t)&telit_le920_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff),
                 .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
@@ -922,8 +946,10 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0254, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0257, 0xff, 0xff, 0xff), /* ZTE MF821 */
           .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0265, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0284, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0265, 0xff, 0xff, 0xff), /* ONDA MT8205 */
+          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0284, 0xff, 0xff, 0xff), /* ZTE MF880 */
+          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0317, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0326, 0xff, 0xff, 0xff),
           .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
@@ -1190,6 +1216,8 @@ static const struct usb_device_id option_ids[] = {
           .driver_info = (kernel_ulong_t)&alcatel_x200_blacklist
         },
         { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X220_X500D) },
+        { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_L100V),
+          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) },
         { USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) },
         { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14),
@@ -1294,7 +1322,15 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_FP_2COM, 0x0a, 0x00, 0x00) },
         { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_FPDC_1COM, 0x0a, 0x00, 0x00) },
         { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_FPDC_2COM, 0x0a, 0x00, 0x00) },
+        { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_7103_2COM, 0xff, 0x00, 0x00) },
+        { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_7106_2COM, 0x02, 0x02, 0x01) },
+        { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x02, 0x01) },
+        { USB_DEVICE_AND_INTERFACE_INFO(MEDIATEK_VENDOR_ID, MEDIATEK_PRODUCT_DC_4COM2, 0xff, 0x00, 0x00) },
         { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) },
+        { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T) },
+        { USB_DEVICE(TPLINK_VENDOR_ID, TPLINK_PRODUCT_MA180),
+          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        { USB_DEVICE(CHANGHONG_VENDOR_ID, CHANGHONG_PRODUCT_CH690) },
         { } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
index aa148c21ea40..24662547dc5b 100644
--- a/drivers/usb/serial/qcserial.c
+++ b/drivers/usb/serial/qcserial.c
@@ -53,6 +53,7 @@ static const struct usb_device_id id_table[] = {
         {DEVICE_G1K(0x05c6, 0x9221)},   /* Generic Gobi QDL device */
         {DEVICE_G1K(0x05c6, 0x9231)},   /* Generic Gobi QDL device */
         {DEVICE_G1K(0x1f45, 0x0001)},   /* Unknown Gobi QDL device */
+        {DEVICE_G1K(0x1bc7, 0x900e)},   /* Telit Gobi QDL device */
 
         /* Gobi 2000 devices */
         {USB_DEVICE(0x1410, 0xa010)},   /* Novatel Gobi 2000 QDL device */
diff --git a/drivers/usb/storage/initializers.c b/drivers/usb/storage/initializers.c
index 105d900150c1..16b0bf055eeb 100644
--- a/drivers/usb/storage/initializers.c
+++ b/drivers/usb/storage/initializers.c
@@ -92,8 +92,8 @@ int usb_stor_ucr61s2b_init(struct us_data *us)
         return 0;
 }
 
-/* This places the HUAWEI E220 devices in multi-port mode */
-int usb_stor_huawei_e220_init(struct us_data *us)
+/* This places the HUAWEI usb dongles in multi-port mode */
+static int usb_stor_huawei_feature_init(struct us_data *us)
 {
         int result;
 
@@ -104,3 +104,75 @@ int usb_stor_huawei_e220_init(struct us_data *us)
         US_DEBUGP("Huawei mode set result is %d\n", result);
         return 0;
 }
+
+/*
+ * It will send a scsi switch command called rewind' to huawei dongle.
+ * When the dongle receives this command at the first time,
+ * it will reboot immediately. After rebooted, it will ignore this command.
+ * So it is  unnecessary to read its response.
+ */
+static int usb_stor_huawei_scsi_init(struct us_data *us)
+{
+        int result = 0;
+        int act_len = 0;
+        struct bulk_cb_wrap *bcbw = (struct bulk_cb_wrap *) us->iobuf;
+        char rewind_cmd[] = {0x11, 0x06, 0x20, 0x00, 0x00, 0x01, 0x01, 0x00,
+                        0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+
+        bcbw->Signature = cpu_to_le32(US_BULK_CB_SIGN);
+        bcbw->Tag = 0;
+        bcbw->DataTransferLength = 0;
+        bcbw->Flags = bcbw->Lun = 0;
+        bcbw->Length = sizeof(rewind_cmd);
+        memset(bcbw->CDB, 0, sizeof(bcbw->CDB));
+        memcpy(bcbw->CDB, rewind_cmd, sizeof(rewind_cmd));
+
+        result = usb_stor_bulk_transfer_buf(us, us->send_bulk_pipe, bcbw,
+                                        US_BULK_CB_WRAP_LEN, &act_len);
+        US_DEBUGP("transfer actual length=%d, result=%d\n", act_len, result);
+        return result;
+}
+
+/*
+ * It tries to find the supported Huawei USB dongles.
+ * In Huawei, they assign the following product IDs
+ * for all of their mobile broadband dongles,
+ * including the new dongles in the future.
+ * So if the product ID is not included in this list,
+ * it means it is not Huawei's mobile broadband dongles.
+ */
+static int usb_stor_huawei_dongles_pid(struct us_data *us)
+{
+        struct usb_interface_descriptor *idesc;
+        int idProduct;
+
+        idesc = &us->pusb_intf->cur_altsetting->desc;
+        idProduct = us->pusb_dev->descriptor.idProduct;
+        /* The first port is CDROM,
+         * means the dongle in the single port mode,
+         * and a switch command is required to be sent. */
+        if (idesc && idesc->bInterfaceNumber == 0) {
+                if ((idProduct == 0x1001)
+                        || (idProduct == 0x1003)
+                        || (idProduct == 0x1004)
+                        || (idProduct >= 0x1401 && idProduct <= 0x1500)
+                        || (idProduct >= 0x1505 && idProduct <= 0x1600)
+                        || (idProduct >= 0x1c02 && idProduct <= 0x2202)) {
+                        return 1;
+                }
+        }
+        return 0;
+}
+
+int usb_stor_huawei_init(struct us_data *us)
+{
+        int result = 0;
+
+        if (usb_stor_huawei_dongles_pid(us)) {
+                if (us->pusb_dev->descriptor.idProduct >= 0x1446)
+                        result = usb_stor_huawei_scsi_init(us);
+                else
+                        result = usb_stor_huawei_feature_init(us);
+        }
+        return result;
+}
diff --git a/drivers/usb/storage/initializers.h b/drivers/usb/storage/initializers.h
index 529327fbb06b..5376d4fc76f0 100644
--- a/drivers/usb/storage/initializers.h
+++ b/drivers/usb/storage/initializers.h
@@ -46,5 +46,5 @@ int usb_stor_euscsi_init(struct us_data *us);
  * flash reader */
 int usb_stor_ucr61s2b_init(struct us_data *us);
 
-/* This places the HUAWEI E220 devices in multi-port mode */
-int usb_stor_huawei_e220_init(struct us_data *us);
+/* This places the HUAWEI usb dongles in multi-port mode */
+int usb_stor_huawei_init(struct us_data *us);
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index d305a5aa3a5d..72923b56bbf6 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1527,335 +1527,10 @@ UNUSUAL_DEV(  0x1210, 0x0003, 0x0100, 0x0100,
 /* Reported by fangxiaozhi <huananhu@huawei.com>
  * This brings the HUAWEI data card devices into multi-port mode
  */
-UNUSUAL_DEV(  0x12d1, 0x1001, 0x0000, 0x0000,
+UNUSUAL_VENDOR_INTF(0x12d1, 0x08, 0x06, 0x50,
                 "HUAWEI MOBILE",
                 "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1003, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1004, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1401, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1402, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1403, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1404, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1405, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1406, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1407, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1408, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1409, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x140A, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x140B, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x140C, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x140D, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x140E, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x140F, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1410, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1411, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1412, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1413, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1414, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1415, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1416, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1417, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1418, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1419, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x141A, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x141B, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x141C, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x141D, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x141E, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x141F, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1420, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1421, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1422, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1423, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1424, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1425, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1426, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1427, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1428, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1429, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x142A, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x142B, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x142C, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x142D, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x142E, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x142F, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1430, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1431, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1432, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1433, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1434, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1435, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1436, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1437, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1438, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x1439, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x143A, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x143B, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x143C, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x143D, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x143E, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
-                0),
-UNUSUAL_DEV(  0x12d1, 0x143F, 0x0000, 0x0000,
-                "HUAWEI MOBILE",
-                "Mass Storage",
-                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_e220_init,
+                USB_SC_DEVICE, USB_PR_DEVICE, usb_stor_huawei_init,
                 0),
 
 /* Reported by Vilius Bilinkevicius <vilisas AT xxx DOT lt) */
diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
index 31b3e1a61bbd..cf09b6ba71ff 100644
--- a/drivers/usb/storage/usb.c
+++ b/drivers/usb/storage/usb.c
@@ -120,6 +120,17 @@ MODULE_PARM_DESC(quirks, "supplemental list of device IDs and their quirks");
         .useTransport = use_transport,  \
 }
 
+#define UNUSUAL_VENDOR_INTF(idVendor, cl, sc, pr, \
+                vendor_name, product_name, use_protocol, use_transport, \
+                init_function, Flags) \
+{ \
+        .vendorName = vendor_name,      \
+        .productName = product_name,    \
+        .useProtocol = use_protocol,    \
+        .useTransport = use_transport,  \
+        .initFunction = init_function,  \
+}
+
 static struct us_unusual_dev us_unusual_dev_list[] = {
 #       include "unusual_devs.h"
         { }             /* Terminating entry */
@@ -131,6 +142,7 @@ static struct us_unusual_dev for_dynamic_ids =
 #undef UNUSUAL_DEV
 #undef COMPLIANT_DEV
 #undef USUAL_DEV
+#undef UNUSUAL_VENDOR_INTF
 
 #ifdef CONFIG_LOCKDEP
 
diff --git a/drivers/usb/storage/usual-tables.c b/drivers/usb/storage/usual-tables.c
index b78a526910fb..5ef8ce74aae4 100644
--- a/drivers/usb/storage/usual-tables.c
+++ b/drivers/usb/storage/usual-tables.c
@@ -41,6 +41,20 @@
 #define USUAL_DEV(useProto, useTrans) \
 { USB_INTERFACE_INFO(USB_CLASS_MASS_STORAGE, useProto, useTrans) }
 
+/* Define the device is matched with Vendor ID and interface descriptors */
+#define UNUSUAL_VENDOR_INTF(id_vendor, cl, sc, pr, \
+                        vendorName, productName, useProtocol, useTransport, \
+                        initFunction, flags) \
+{ \
+        .match_flags = USB_DEVICE_ID_MATCH_INT_INFO \
+                                | USB_DEVICE_ID_MATCH_VENDOR, \
+        .idVendor    = (id_vendor), \
+        .bInterfaceClass = (cl), \
+        .bInterfaceSubClass = (sc), \
+        .bInterfaceProtocol = (pr), \
+        .driver_info = (flags) \
+}
+
 struct usb_device_id usb_storage_usb_ids[] = {
 #       include "unusual_devs.h"
         { }             /* Terminating entry */
@@ -50,6 +64,7 @@ MODULE_DEVICE_TABLE(usb, usb_storage_usb_ids);
 #undef UNUSUAL_DEV
 #undef COMPLIANT_DEV
 #undef USUAL_DEV
+#undef UNUSUAL_VENDOR_INTF
 
 /*
  * The table of devices to ignore
diff --git a/drivers/vfio/pci/vfio_pci_rdwr.c b/drivers/vfio/pci/vfio_pci_rdwr.c
index 4362d9e7baa3..f72323ef618f 100644
--- a/drivers/vfio/pci/vfio_pci_rdwr.c
+++ b/drivers/vfio/pci/vfio_pci_rdwr.c
@@ -240,17 +240,17 @@ ssize_t vfio_pci_mem_readwrite(struct vfio_pci_device *vdev, char __user *buf,
                         filled = 1;
                 } else {
                         /* Drop writes, fill reads with FF */
+                        filled = min((size_t)(x_end - pos), count);
                         if (!iswrite) {
                                 char val = 0xFF;
                                 size_t i;
 
-                                for (i = 0; i < x_end - pos; i++) {
+                                for (i = 0; i < filled; i++) {
                                         if (put_user(val, buf + i))
                                                 goto out;
                                 }
                         }
 
-                        filled = x_end - pos;
                 }
 
                 count -= filled;
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index ebd08b21b234..959b1cd89e6a 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -165,12 +165,16 @@ static void tx_poll_stop(struct vhost_net *net)
 }
 
 /* Caller must have TX VQ lock */
-static void tx_poll_start(struct vhost_net *net, struct socket *sock)
+static int tx_poll_start(struct vhost_net *net, struct socket *sock)
 {
+        int ret;
+
         if (unlikely(net->tx_poll_state != VHOST_NET_POLL_STOPPED))
-                return;
-        vhost_poll_start(net->poll + VHOST_NET_VQ_TX, sock->file);
-        net->tx_poll_state = VHOST_NET_POLL_STARTED;
+                return 0;
+        ret = vhost_poll_start(net->poll + VHOST_NET_VQ_TX, sock->file);
+        if (!ret)
+                net->tx_poll_state = VHOST_NET_POLL_STARTED;
+        return ret;
 }
 
 /* In case of DMA done not in order in lower device driver for some reason.
@@ -642,20 +646,23 @@ static void vhost_net_disable_vq(struct vhost_net *n,
                 vhost_poll_stop(n->poll + VHOST_NET_VQ_RX);
 }
 
-static void vhost_net_enable_vq(struct vhost_net *n,
+static int vhost_net_enable_vq(struct vhost_net *n,
                                 struct vhost_virtqueue *vq)
 {
         struct socket *sock;
+        int ret;
 
         sock = rcu_dereference_protected(vq->private_data,
                                          lockdep_is_held(&vq->mutex));
         if (!sock)
-                return;
+                return 0;
         if (vq == n->vqs + VHOST_NET_VQ_TX) {
                 n->tx_poll_state = VHOST_NET_POLL_STOPPED;
-                tx_poll_start(n, sock);
+                ret = tx_poll_start(n, sock);
         } else
-                vhost_poll_start(n->poll + VHOST_NET_VQ_RX, sock->file);
+                ret = vhost_poll_start(n->poll + VHOST_NET_VQ_RX, sock->file);
+
+        return ret;
 }
 
 static struct socket *vhost_net_stop_vq(struct vhost_net *n,
@@ -827,15 +834,18 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd)
                         r = PTR_ERR(ubufs);
                         goto err_ubufs;
                 }
-                oldubufs = vq->ubufs;
-                vq->ubufs = ubufs;
+
                 vhost_net_disable_vq(n, vq);
                 rcu_assign_pointer(vq->private_data, sock);
-                vhost_net_enable_vq(n, vq);
-
                 r = vhost_init_used(vq);
                 if (r)
-                        goto err_vq;
+                        goto err_used;
+                r = vhost_net_enable_vq(n, vq);
+                if (r)
+                        goto err_used;
+
+                oldubufs = vq->ubufs;
+                vq->ubufs = ubufs;
 
                 n->tx_packets = 0;
                 n->tx_zcopy_err = 0;
@@ -859,6 +869,11 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd)
         mutex_unlock(&n->dev.mutex);
         return 0;
 
+err_used:
+        rcu_assign_pointer(vq->private_data, oldsock);
+        vhost_net_enable_vq(n, vq);
+        if (ubufs)
+                vhost_ubuf_put_and_wait(ubufs);
 err_ubufs:
         fput(sock->file);
 err_vq:
diff --git a/drivers/vhost/tcm_vhost.c b/drivers/vhost/tcm_vhost.c
index b20df5c829f5..22321cf84fbe 100644
--- a/drivers/vhost/tcm_vhost.c
+++ b/drivers/vhost/tcm_vhost.c
@@ -575,10 +575,8 @@ static void vhost_scsi_handle_vq(struct vhost_scsi *vs)
 
         /* Must use ioctl VHOST_SCSI_SET_ENDPOINT */
         tv_tpg = vs->vs_tpg;
-        if (unlikely(!tv_tpg)) {
-                pr_err("%s endpoint not set\n", __func__);
+        if (unlikely(!tv_tpg))
                 return;
-        }
 
         mutex_lock(&vq->mutex);
         vhost_disable_notify(&vs->dev, vq);
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 34389f75fe65..9759249e6d90 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -77,26 +77,38 @@ void vhost_poll_init(struct vhost_poll *poll, vhost_work_fn_t fn,
         init_poll_funcptr(&poll->table, vhost_poll_func);
         poll->mask = mask;
         poll->dev = dev;
+        poll->wqh = NULL;
 
         vhost_work_init(&poll->work, fn);
 }
 
 /* Start polling a file. We add ourselves to file's wait queue. The caller must
  * keep a reference to a file until after vhost_poll_stop is called. */
-void vhost_poll_start(struct vhost_poll *poll, struct file *file)
+int vhost_poll_start(struct vhost_poll *poll, struct file *file)
 {
         unsigned long mask;
+        int ret = 0;
 
         mask = file->f_op->poll(file, &poll->table);
         if (mask)
                 vhost_poll_wakeup(&poll->wait, 0, 0, (void *)mask);
+        if (mask & POLLERR) {
+                if (poll->wqh)
+                        remove_wait_queue(poll->wqh, &poll->wait);
+                ret = -EINVAL;
+        }
+
+        return ret;
 }
 
 /* Stop polling a file. After this function returns, it becomes safe to drop the
  * file reference. You must also flush afterwards. */
 void vhost_poll_stop(struct vhost_poll *poll)
 {
-        remove_wait_queue(poll->wqh, &poll->wait);
+        if (poll->wqh) {
+                remove_wait_queue(poll->wqh, &poll->wait);
+                poll->wqh = NULL;
+        }
 }
 
 static bool vhost_work_seq_done(struct vhost_dev *dev, struct vhost_work *work,
@@ -792,7 +804,7 @@ long vhost_vring_ioctl(struct vhost_dev *d, int ioctl, void __user *argp)
                 fput(filep);
 
         if (pollstart && vq->handle_kick)
-                vhost_poll_start(&vq->poll, vq->kick);
+                r = vhost_poll_start(&vq->poll, vq->kick);
 
         mutex_unlock(&vq->mutex);
 
diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
index 2639c58b23ab..17261e277c02 100644
--- a/drivers/vhost/vhost.h
+++ b/drivers/vhost/vhost.h
@@ -42,7 +42,7 @@ void vhost_work_queue(struct vhost_dev *dev, struct vhost_work *work);
 
 void vhost_poll_init(struct vhost_poll *poll, vhost_work_fn_t fn,
                      unsigned long mask, struct vhost_dev *dev);
-void vhost_poll_start(struct vhost_poll *poll, struct file *file);
+int vhost_poll_start(struct vhost_poll *poll, struct file *file);
 void vhost_poll_stop(struct vhost_poll *poll);
 void vhost_poll_flush(struct vhost_poll *poll);
 void vhost_poll_queue(struct vhost_poll *poll);
diff --git a/drivers/video/exynos/exynos_dp_core.c b/drivers/video/exynos/exynos_dp_core.c
index 4ef18e2e90cc..2d0d144add1b 100644
--- a/drivers/video/exynos/exynos_dp_core.c
+++ b/drivers/video/exynos/exynos_dp_core.c
@@ -1121,8 +1121,7 @@ static int exynos_dp_remove(struct platform_device *pdev)
 
         disable_irq(dp->irq);
 
-        if (work_pending(&dp->hotplug_work))
-                flush_work(&dp->hotplug_work);
+        flush_work(&dp->hotplug_work);
 
         if (pdev->dev.of_node) {
                 if (dp->phy_addr)
@@ -1144,8 +1143,7 @@ static int exynos_dp_suspend(struct device *dev)
         struct exynos_dp_platdata *pdata = dev->platform_data;
         struct exynos_dp_device *dp = dev_get_drvdata(dev);
 
-        if (work_pending(&dp->hotplug_work))
-                flush_work(&dp->hotplug_work);
+        flush_work(&dp->hotplug_work);
 
         if (dev->of_node) {
                 if (dp->phy_addr)
diff --git a/drivers/video/imxfb.c b/drivers/video/imxfb.c
index 12526787a7c7..0abf2bf20836 100644
--- a/drivers/video/imxfb.c
+++ b/drivers/video/imxfb.c
@@ -139,6 +139,7 @@ struct imxfb_info {
         struct clk              *clk_ahb;
         struct clk              *clk_per;
         enum imxfb_type         devtype;
+        bool                    enabled;
 
         /*
          * These are the addresses we mapped
@@ -536,6 +537,10 @@ static void imxfb_exit_backlight(struct imxfb_info *fbi)
 
 static void imxfb_enable_controller(struct imxfb_info *fbi)
 {
+
+        if (fbi->enabled)
+                return;
+
         pr_debug("Enabling LCD controller\n");
 
         writel(fbi->screen_dma, fbi->regs + LCDC_SSA);
@@ -556,6 +561,7 @@ static void imxfb_enable_controller(struct imxfb_info *fbi)
         clk_prepare_enable(fbi->clk_ipg);
         clk_prepare_enable(fbi->clk_ahb);
         clk_prepare_enable(fbi->clk_per);
+        fbi->enabled = true;
 
         if (fbi->backlight_power)
                 fbi->backlight_power(1);
@@ -565,6 +571,9 @@ static void imxfb_enable_controller(struct imxfb_info *fbi)
 
 static void imxfb_disable_controller(struct imxfb_info *fbi)
 {
+        if (!fbi->enabled)
+                return;
+
         pr_debug("Disabling LCD controller\n");
 
         if (fbi->backlight_power)
@@ -575,6 +584,7 @@ static void imxfb_disable_controller(struct imxfb_info *fbi)
         clk_disable_unprepare(fbi->clk_per);
         clk_disable_unprepare(fbi->clk_ipg);
         clk_disable_unprepare(fbi->clk_ahb);
+        fbi->enabled = false;
 
         writel(0, fbi->regs + LCDC_RMCR);
 }
@@ -729,6 +739,8 @@ static int __init imxfb_init_fbinfo(struct platform_device *pdev)
 
         memset(fbi, 0, sizeof(struct imxfb_info));
 
+        fbi->devtype = pdev->id_entry->driver_data;
+
         strlcpy(info->fix.id, IMX_NAME, sizeof(info->fix.id));
 
         info->fix.type                  = FB_TYPE_PACKED_PIXELS;
@@ -789,7 +801,6 @@ static int __init imxfb_probe(struct platform_device *pdev)
                 return -ENOMEM;
 
         fbi = info->par;
-        fbi->devtype = pdev->id_entry->driver_data;
 
         if (!fb_mode)
                 fb_mode = pdata->mode[0].mode.name;
diff --git a/drivers/video/omap2/dss/dss_features.c b/drivers/video/omap2/dss/dss_features.c
index 18688c12e30d..d7d66ef5cb58 100644
--- a/drivers/video/omap2/dss/dss_features.c
+++ b/drivers/video/omap2/dss/dss_features.c
@@ -538,6 +538,7 @@ static const enum dss_feat_id omap3630_dss_feat_list[] = {
         FEAT_ALPHA_FIXED_ZORDER,
         FEAT_FIFO_MERGE,
         FEAT_OMAP3_DSI_FIFO_BUG,
+        FEAT_DPI_USES_VDDS_DSI,
 };
 
 static const enum dss_feat_id omap4430_es1_0_dss_feat_list[] = {
diff --git a/drivers/video/ssd1307fb.c b/drivers/video/ssd1307fb.c
index 4d99dd7a6831..395cb6a8d8f3 100644
--- a/drivers/video/ssd1307fb.c
+++ b/drivers/video/ssd1307fb.c
@@ -145,8 +145,8 @@ static void ssd1307fb_update_display(struct ssd1307fb_par *par)
                                 u32 page_length = SSD1307FB_WIDTH * i;
                                 u32 index = page_length + (SSD1307FB_WIDTH * k + j) / 8;
                                 u8 byte = *(vmem + index);
-                                u8 bit = byte & (1 << (7 - (j % 8)));
-                                bit = bit >> (7 - (j % 8));
+                                u8 bit = byte & (1 << (j % 8));
+                                bit = bit >> (j % 8);
                                 buf |= bit << k;
                         }
                         ssd1307fb_write_data(par->client, buf);
diff --git a/drivers/xen/cpu_hotplug.c b/drivers/xen/cpu_hotplug.c
index 4dcfced107f5..084041d42c9a 100644
--- a/drivers/xen/cpu_hotplug.c
+++ b/drivers/xen/cpu_hotplug.c
@@ -25,10 +25,10 @@ static void disable_hotplug_cpu(int cpu)
 static int vcpu_online(unsigned int cpu)
 {
         int err;
-        char dir[32], state[32];
+        char dir[16], state[16];
 
         sprintf(dir, "cpu/%u", cpu);
-        err = xenbus_scanf(XBT_NIL, dir, "availability", "%s", state);
+        err = xenbus_scanf(XBT_NIL, dir, "availability", "%15s", state);
         if (err != 1) {
                 if (!xen_initial_domain())
                         printk(KERN_ERR "XENBUS: Unable to read cpu state\n");
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
index 0be4df39e953..22f77c5f6012 100644
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
@@ -840,7 +840,7 @@ int bind_evtchn_to_irq(unsigned int evtchn)
 
         if (irq == -1) {
                 irq = xen_allocate_irq_dynamic();
-                if (irq == -1)
+                if (irq < 0)
                         goto out;
 
                 irq_set_chip_and_handler_name(irq, &xen_dynamic_chip,
@@ -944,7 +944,7 @@ int bind_virq_to_irq(unsigned int virq, unsigned int cpu)
 
         if (irq == -1) {
                 irq = xen_allocate_irq_dynamic();
-                if (irq == -1)
+                if (irq < 0)
                         goto out;
 
                 irq_set_chip_and_handler_name(irq, &xen_percpu_chip,
@@ -1787,7 +1787,7 @@ void xen_callback_vector(void)
         int rc;
         uint64_t callback_via;
         if (xen_have_vector_callback) {
-                callback_via = HVM_CALLBACK_VECTOR(XEN_HVM_EVTCHN_CALLBACK);
+                callback_via = HVM_CALLBACK_VECTOR(HYPERVISOR_CALLBACK_VECTOR);
                 rc = xen_set_callback_via(callback_via);
                 if (rc) {
                         printk(KERN_ERR "Request for Xen HVM callback vector"
@@ -1798,8 +1798,9 @@ void xen_callback_vector(void)
                 printk(KERN_INFO "Xen HVM callback vector for event delivery is "
                                 "enabled\n");
                 /* in the restore case the vector has already been allocated */
-                if (!test_bit(XEN_HVM_EVTCHN_CALLBACK, used_vectors))
-                        alloc_intr_gate(XEN_HVM_EVTCHN_CALLBACK, xen_hvm_callback_vector);
+                if (!test_bit(HYPERVISOR_CALLBACK_VECTOR, used_vectors))
+                        alloc_intr_gate(HYPERVISOR_CALLBACK_VECTOR,
+                                        xen_hvm_callback_vector);
         }
 }
 #else
diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c
index 2e22df2f7a3f..3c8803feba26 100644
--- a/drivers/xen/gntdev.c
+++ b/drivers/xen/gntdev.c
@@ -56,10 +56,15 @@ MODULE_PARM_DESC(limit, "Maximum number of grants that may be mapped by "
 static atomic_t pages_mapped = ATOMIC_INIT(0);
 
 static int use_ptemod;
+#define populate_freeable_maps use_ptemod
 
 struct gntdev_priv {
+        /* maps with visible offsets in the file descriptor */
         struct list_head maps;
-        /* lock protects maps from concurrent changes */
+        /* maps that are not visible; will be freed on munmap.
+         * Only populated if populate_freeable_maps == 1 */
+        struct list_head freeable_maps;
+        /* lock protects maps and freeable_maps */
         spinlock_t lock;
         struct mm_struct *mm;
         struct mmu_notifier mn;
@@ -193,7 +198,7 @@ static struct grant_map *gntdev_find_map_index(struct gntdev_priv *priv,
         return NULL;
 }
 
-static void gntdev_put_map(struct grant_map *map)
+static void gntdev_put_map(struct gntdev_priv *priv, struct grant_map *map)
 {
         if (!map)
                 return;
@@ -208,6 +213,12 @@ static void gntdev_put_map(struct grant_map *map)
                 evtchn_put(map->notify.event);
         }
 
+        if (populate_freeable_maps && priv) {
+                spin_lock(&priv->lock);
+                list_del(&map->next);
+                spin_unlock(&priv->lock);
+        }
+
         if (map->pages && !use_ptemod)
                 unmap_grant_pages(map, 0, map->count);
         gntdev_free_map(map);
@@ -301,17 +312,10 @@ static int __unmap_grant_pages(struct grant_map *map, int offset, int pages)
 
         if (map->notify.flags & UNMAP_NOTIFY_CLEAR_BYTE) {
                 int pgno = (map->notify.addr >> PAGE_SHIFT);
-                if (pgno >= offset && pgno < offset + pages && use_ptemod) {
-                        void __user *tmp = (void __user *)
-                                map->vma->vm_start + map->notify.addr;
-                        err = copy_to_user(tmp, &err, 1);
-                        if (err)
-                                return -EFAULT;
-                        map->notify.flags &= ~UNMAP_NOTIFY_CLEAR_BYTE;
-                } else if (pgno >= offset && pgno < offset + pages) {
-                        uint8_t *tmp = kmap(map->pages[pgno]);
+                if (pgno >= offset && pgno < offset + pages) {
+                        /* No need for kmap, pages are in lowmem */
+                        uint8_t *tmp = pfn_to_kaddr(page_to_pfn(map->pages[pgno]));
                         tmp[map->notify.addr & (PAGE_SIZE-1)] = 0;
-                        kunmap(map->pages[pgno]);
                         map->notify.flags &= ~UNMAP_NOTIFY_CLEAR_BYTE;
                 }
         }
@@ -376,11 +380,24 @@ static void gntdev_vma_open(struct vm_area_struct *vma)
 static void gntdev_vma_close(struct vm_area_struct *vma)
 {
         struct grant_map *map = vma->vm_private_data;
+        struct file *file = vma->vm_file;
+        struct gntdev_priv *priv = file->private_data;
 
         pr_debug("gntdev_vma_close %p\n", vma);
-        map->vma = NULL;
+        if (use_ptemod) {
+                /* It is possible that an mmu notifier could be running
+                 * concurrently, so take priv->lock to ensure that the vma won't
+                 * vanishing during the unmap_grant_pages call, since we will
+                 * spin here until that completes. Such a concurrent call will
+                 * not do any unmapping, since that has been done prior to
+                 * closing the vma, but it may still iterate the unmap_ops list.
+                 */
+                spin_lock(&priv->lock);
+                map->vma = NULL;
+                spin_unlock(&priv->lock);
+        }
         vma->vm_private_data = NULL;
-        gntdev_put_map(map);
+        gntdev_put_map(priv, map);
 }
 
 static struct vm_operations_struct gntdev_vmops = {
@@ -390,33 +407,43 @@ static struct vm_operations_struct gntdev_vmops = {
 
 /* ------------------------------------------------------------------ */
 
+static void unmap_if_in_range(struct grant_map *map,
+                              unsigned long start, unsigned long end)
+{
+        unsigned long mstart, mend;
+        int err;
+
+        if (!map->vma)
+                return;
+        if (map->vma->vm_start >= end)
+                return;
+        if (map->vma->vm_end <= start)
+                return;
+        mstart = max(start, map->vma->vm_start);
+        mend   = min(end,   map->vma->vm_end);
+        pr_debug("map %d+%d (%lx %lx), range %lx %lx, mrange %lx %lx\n",
+                        map->index, map->count,
+                        map->vma->vm_start, map->vma->vm_end,
+                        start, end, mstart, mend);
+        err = unmap_grant_pages(map,
+                                (mstart - map->vma->vm_start) >> PAGE_SHIFT,
+                                (mend - mstart) >> PAGE_SHIFT);
+        WARN_ON(err);
+}
+
 static void mn_invl_range_start(struct mmu_notifier *mn,
                                 struct mm_struct *mm,
                                 unsigned long start, unsigned long end)
 {
         struct gntdev_priv *priv = container_of(mn, struct gntdev_priv, mn);
         struct grant_map *map;
-        unsigned long mstart, mend;
-        int err;
 
         spin_lock(&priv->lock);
         list_for_each_entry(map, &priv->maps, next) {
-                if (!map->vma)
-                        continue;
-                if (map->vma->vm_start >= end)
-                        continue;
-                if (map->vma->vm_end <= start)
-                        continue;
-                mstart = max(start, map->vma->vm_start);
-                mend   = min(end,   map->vma->vm_end);
-                pr_debug("map %d+%d (%lx %lx), range %lx %lx, mrange %lx %lx\n",
-                                map->index, map->count,
-                                map->vma->vm_start, map->vma->vm_end,
-                                start, end, mstart, mend);
-                err = unmap_grant_pages(map,
-                                        (mstart - map->vma->vm_start) >> PAGE_SHIFT,
-                                        (mend - mstart) >> PAGE_SHIFT);
-                WARN_ON(err);
+                unmap_if_in_range(map, start, end);
+        }
+        list_for_each_entry(map, &priv->freeable_maps, next) {
+                unmap_if_in_range(map, start, end);
         }
         spin_unlock(&priv->lock);
 }
@@ -445,6 +472,15 @@ static void mn_release(struct mmu_notifier *mn,
                 err = unmap_grant_pages(map, /* offset */ 0, map->count);
                 WARN_ON(err);
         }
+        list_for_each_entry(map, &priv->freeable_maps, next) {
+                if (!map->vma)
+                        continue;
+                pr_debug("map %d+%d (%lx %lx)\n",
+                                map->index, map->count,
+                                map->vma->vm_start, map->vma->vm_end);
+                err = unmap_grant_pages(map, /* offset */ 0, map->count);
+                WARN_ON(err);
+        }
         spin_unlock(&priv->lock);
 }
 
@@ -466,6 +502,7 @@ static int gntdev_open(struct inode *inode, struct file *flip)
                 return -ENOMEM;
 
         INIT_LIST_HEAD(&priv->maps);
+        INIT_LIST_HEAD(&priv->freeable_maps);
         spin_lock_init(&priv->lock);
 
         if (use_ptemod) {
@@ -500,8 +537,9 @@ static int gntdev_release(struct inode *inode, struct file *flip)
         while (!list_empty(&priv->maps)) {
                 map = list_entry(priv->maps.next, struct grant_map, next);
                 list_del(&map->next);
-                gntdev_put_map(map);
+                gntdev_put_map(NULL /* already removed */, map);
         }
+        WARN_ON(!list_empty(&priv->freeable_maps));
 
         if (use_ptemod)
                 mmu_notifier_unregister(&priv->mn, priv->mm);
@@ -529,14 +567,14 @@ static long gntdev_ioctl_map_grant_ref(struct gntdev_priv *priv,
 
         if (unlikely(atomic_add_return(op.count, &pages_mapped) > limit)) {
                 pr_debug("can't map: over limit\n");
-                gntdev_put_map(map);
+                gntdev_put_map(NULL, map);
                 return err;
         }
 
         if (copy_from_user(map->grants, &u->refs,
                            sizeof(map->grants[0]) * op.count) != 0) {
-                gntdev_put_map(map);
-                return err;
+                gntdev_put_map(NULL, map);
+                return -EFAULT;
         }
 
         spin_lock(&priv->lock);
@@ -565,11 +603,13 @@ static long gntdev_ioctl_unmap_grant_ref(struct gntdev_priv *priv,
         map = gntdev_find_map_index(priv, op.index >> PAGE_SHIFT, op.count);
         if (map) {
                 list_del(&map->next);
+                if (populate_freeable_maps)
+                        list_add_tail(&map->next, &priv->freeable_maps);
                 err = 0;
         }
         spin_unlock(&priv->lock);
         if (map)
-                gntdev_put_map(map);
+                gntdev_put_map(priv, map);
         return err;
 }
 
@@ -579,25 +619,31 @@ static long gntdev_ioctl_get_offset_for_vaddr(struct gntdev_priv *priv,
         struct ioctl_gntdev_get_offset_for_vaddr op;
         struct vm_area_struct *vma;
         struct grant_map *map;
+        int rv = -EINVAL;
 
         if (copy_from_user(&op, u, sizeof(op)) != 0)
                 return -EFAULT;
         pr_debug("priv %p, offset for vaddr %lx\n", priv, (unsigned long)op.vaddr);
 
+        down_read(&current->mm->mmap_sem);
         vma = find_vma(current->mm, op.vaddr);
         if (!vma || vma->vm_ops != &gntdev_vmops)
-                return -EINVAL;
+                goto out_unlock;
 
         map = vma->vm_private_data;
         if (!map)
-                return -EINVAL;
+                goto out_unlock;
 
         op.offset = map->index << PAGE_SHIFT;
         op.count = map->count;
+        rv = 0;
 
-        if (copy_to_user(u, &op, sizeof(op)) != 0)
+ out_unlock:
+        up_read(&current->mm->mmap_sem);
+
+        if (rv == 0 && copy_to_user(u, &op, sizeof(op)) != 0)
                 return -EFAULT;
-        return 0;
+        return rv;
 }
 
 static long gntdev_ioctl_notify(struct gntdev_priv *priv, void __user *u)
@@ -778,7 +824,7 @@ out_unlock_put:
 out_put_map:
         if (use_ptemod)
                 map->vma = NULL;
-        gntdev_put_map(map);
+        gntdev_put_map(priv, map);
         return err;
 }
 
diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
index 7038de53652b..157c0ccda3ef 100644
--- a/drivers/xen/grant-table.c
+++ b/drivers/xen/grant-table.c
@@ -56,10 +56,6 @@
 /* External tools reserve first few grant table entries. */
 #define NR_RESERVED_ENTRIES 8
 #define GNTTAB_LIST_END 0xffffffff
-#define GREFS_PER_GRANT_FRAME \
-(grant_table_version == 1 ?                      \
-(PAGE_SIZE / sizeof(struct grant_entry_v1)) :   \
-(PAGE_SIZE / sizeof(union grant_entry_v2)))
 
 static grant_ref_t **gnttab_list;
 static unsigned int nr_grant_frames;
@@ -154,6 +150,7 @@ static struct gnttab_ops *gnttab_interface;
 static grant_status_t *grstatus;
 
 static int grant_table_version;
+static int grefs_per_grant_frame;
 
 static struct gnttab_free_callback *gnttab_free_callback_list;
 
@@ -767,12 +764,14 @@ static int grow_gnttab_list(unsigned int more_frames)
         unsigned int new_nr_grant_frames, extra_entries, i;
         unsigned int nr_glist_frames, new_nr_glist_frames;
 
+        BUG_ON(grefs_per_grant_frame == 0);
+
         new_nr_grant_frames = nr_grant_frames + more_frames;
-        extra_entries       = more_frames * GREFS_PER_GRANT_FRAME;
+        extra_entries       = more_frames * grefs_per_grant_frame;
 
-        nr_glist_frames = (nr_grant_frames * GREFS_PER_GRANT_FRAME + RPP - 1) / RPP;
+        nr_glist_frames = (nr_grant_frames * grefs_per_grant_frame + RPP - 1) / RPP;
         new_nr_glist_frames =
-                (new_nr_grant_frames * GREFS_PER_GRANT_FRAME + RPP - 1) / RPP;
+                (new_nr_grant_frames * grefs_per_grant_frame + RPP - 1) / RPP;
         for (i = nr_glist_frames; i < new_nr_glist_frames; i++) {
                 gnttab_list[i] = (grant_ref_t *)__get_free_page(GFP_ATOMIC);
                 if (!gnttab_list[i])
@@ -780,12 +779,12 @@ static int grow_gnttab_list(unsigned int more_frames)
         }
 
 
-        for (i = GREFS_PER_GRANT_FRAME * nr_grant_frames;
-             i < GREFS_PER_GRANT_FRAME * new_nr_grant_frames - 1; i++)
+        for (i = grefs_per_grant_frame * nr_grant_frames;
+             i < grefs_per_grant_frame * new_nr_grant_frames - 1; i++)
                 gnttab_entry(i) = i + 1;
 
         gnttab_entry(i) = gnttab_free_head;
-        gnttab_free_head = GREFS_PER_GRANT_FRAME * nr_grant_frames;
+        gnttab_free_head = grefs_per_grant_frame * nr_grant_frames;
         gnttab_free_count += extra_entries;
 
         nr_grant_frames = new_nr_grant_frames;
@@ -957,7 +956,8 @@ EXPORT_SYMBOL_GPL(gnttab_unmap_refs);
 
 static unsigned nr_status_frames(unsigned nr_grant_frames)
 {
-        return (nr_grant_frames * GREFS_PER_GRANT_FRAME + SPP - 1) / SPP;
+        BUG_ON(grefs_per_grant_frame == 0);
+        return (nr_grant_frames * grefs_per_grant_frame + SPP - 1) / SPP;
 }
 
 static int gnttab_map_frames_v1(xen_pfn_t *frames, unsigned int nr_gframes)
@@ -1115,6 +1115,7 @@ static void gnttab_request_version(void)
         rc = HYPERVISOR_grant_table_op(GNTTABOP_set_version, &gsv, 1);
         if (rc == 0 && gsv.version == 2) {
                 grant_table_version = 2;
+                grefs_per_grant_frame = PAGE_SIZE / sizeof(union grant_entry_v2);
                 gnttab_interface = &gnttab_v2_ops;
         } else if (grant_table_version == 2) {
                 /*
@@ -1127,17 +1128,17 @@ static void gnttab_request_version(void)
                 panic("we need grant tables version 2, but only version 1 is available");
         } else {
                 grant_table_version = 1;
+                grefs_per_grant_frame = PAGE_SIZE / sizeof(struct grant_entry_v1);
                 gnttab_interface = &gnttab_v1_ops;
         }
         printk(KERN_INFO "Grant tables using version %d layout.\n",
                 grant_table_version);
 }
 
-int gnttab_resume(void)
+static int gnttab_setup(void)
 {
         unsigned int max_nr_gframes;
 
-        gnttab_request_version();
         max_nr_gframes = gnttab_max_grant_frames();
         if (max_nr_gframes < nr_grant_frames)
                 return -ENOSYS;
@@ -1160,6 +1161,12 @@ int gnttab_resume(void)
         return 0;
 }
 
+int gnttab_resume(void)
+{
+        gnttab_request_version();
+        return gnttab_setup();
+}
+
 int gnttab_suspend(void)
 {
         gnttab_interface->unmap_frames();
@@ -1171,9 +1178,10 @@ static int gnttab_expand(unsigned int req_entries)
         int rc;
         unsigned int cur, extra;
 
+        BUG_ON(grefs_per_grant_frame == 0);
         cur = nr_grant_frames;
-        extra = ((req_entries + (GREFS_PER_GRANT_FRAME-1)) /
-                 GREFS_PER_GRANT_FRAME);
+        extra = ((req_entries + (grefs_per_grant_frame-1)) /
+                 grefs_per_grant_frame);
         if (cur + extra > gnttab_max_grant_frames())
                 return -ENOSPC;
 
@@ -1191,21 +1199,23 @@ int gnttab_init(void)
         unsigned int nr_init_grefs;
         int ret;
 
+        gnttab_request_version();
         nr_grant_frames = 1;
         boot_max_nr_grant_frames = __max_nr_grant_frames();
 
         /* Determine the maximum number of frames required for the
          * grant reference free list on the current hypervisor.
          */
+        BUG_ON(grefs_per_grant_frame == 0);
         max_nr_glist_frames = (boot_max_nr_grant_frames *
-                               GREFS_PER_GRANT_FRAME / RPP);
+                               grefs_per_grant_frame / RPP);
 
         gnttab_list = kmalloc(max_nr_glist_frames * sizeof(grant_ref_t *),
                               GFP_KERNEL);
         if (gnttab_list == NULL)
                 return -ENOMEM;
 
-        nr_glist_frames = (nr_grant_frames * GREFS_PER_GRANT_FRAME + RPP - 1) / RPP;
+        nr_glist_frames = (nr_grant_frames * grefs_per_grant_frame + RPP - 1) / RPP;
         for (i = 0; i < nr_glist_frames; i++) {
                 gnttab_list[i] = (grant_ref_t *)__get_free_page(GFP_KERNEL);
                 if (gnttab_list[i] == NULL) {
@@ -1214,12 +1224,12 @@ int gnttab_init(void)
                 }
         }
 
-        if (gnttab_resume() < 0) {
+        if (gnttab_setup() < 0) {
                 ret = -ENODEV;
                 goto ini_nomem;
         }
 
-        nr_init_grefs = nr_grant_frames * GREFS_PER_GRANT_FRAME;
+        nr_init_grefs = nr_grant_frames * grefs_per_grant_frame;
 
         for (i = NR_RESERVED_ENTRIES; i < nr_init_grefs - 1; i++)
                 gnttab_entry(i) = i + 1;
diff --git a/drivers/xen/pcpu.c b/drivers/xen/pcpu.c
index 067fcfa1723e..5a27a4599a4a 100644
--- a/drivers/xen/pcpu.c
+++ b/drivers/xen/pcpu.c
@@ -278,8 +278,7 @@ static int sync_pcpu(uint32_t cpu, uint32_t *max_cpu)
          * Only those at cpu present map has its sys interface.
          */
         if (info->flags & XEN_PCPU_FLAGS_INVALID) {
-                if (pcpu)
-                        unregister_and_remove_pcpu(pcpu);
+                unregister_and_remove_pcpu(pcpu);
                 return 0;
         }
 
diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
index 0bbbccbb1f12..ca2b00e9d558 100644
--- a/drivers/xen/privcmd.c
+++ b/drivers/xen/privcmd.c
@@ -199,9 +199,6 @@ static long privcmd_ioctl_mmap(void __user *udata)
         LIST_HEAD(pagelist);
         struct mmap_mfn_state state;
 
-        if (!xen_initial_domain())
-                return -EPERM;
-
         /* We only support privcmd_ioctl_mmap_batch for auto translated. */
         if (xen_feature(XENFEAT_auto_translated_physmap))
                 return -ENOSYS;
@@ -261,11 +258,12 @@ struct mmap_batch_state {
          *      -ENOENT if at least 1 -ENOENT has happened.
          */
         int global_error;
-        /* An array for individual errors */
-        int *err;
+        int version;
 
         /* User-space mfn array to store errors in the second pass for V1. */
         xen_pfn_t __user *user_mfn;
+        /* User-space int array to store errors in the second pass for V2. */
+        int __user *user_err;
 };
 
 /* auto translated dom0 note: if domU being created is PV, then mfn is
@@ -288,7 +286,19 @@ static int mmap_batch_fn(void *data, void *state)
                                          &cur_page);
 
         /* Store error code for second pass. */
-        *(st->err++) = ret;
+        if (st->version == 1) {
+                if (ret < 0) {
+                        /*
+                         * V1 encodes the error codes in the 32bit top nibble of the
+                         * mfn (with its known limitations vis-a-vis 64 bit callers).
+                         */
+                        *mfnp |= (ret == -ENOENT) ?
+                                                PRIVCMD_MMAPBATCH_PAGED_ERROR :
+                                                PRIVCMD_MMAPBATCH_MFN_ERROR;
+                }
+        } else { /* st->version == 2 */
+                *((int *) mfnp) = ret;
+        }
 
         /* And see if it affects the global_error. */
         if (ret < 0) {
@@ -305,20 +315,25 @@ static int mmap_batch_fn(void *data, void *state)
         return 0;
 }
 
-static int mmap_return_errors_v1(void *data, void *state)
+static int mmap_return_errors(void *data, void *state)
 {
-        xen_pfn_t *mfnp = data;
         struct mmap_batch_state *st = state;
-        int err = *(st->err++);
 
-        /*
-         * V1 encodes the error codes in the 32bit top nibble of the
-         * mfn (with its known limitations vis-a-vis 64 bit callers).
-         */
-        *mfnp |= (err == -ENOENT) ?
-                                PRIVCMD_MMAPBATCH_PAGED_ERROR :
-                                PRIVCMD_MMAPBATCH_MFN_ERROR;
-        return __put_user(*mfnp, st->user_mfn++);
+        if (st->version == 1) {
+                xen_pfn_t mfnp = *((xen_pfn_t *) data);
+                if (mfnp & PRIVCMD_MMAPBATCH_MFN_ERROR)
+                        return __put_user(mfnp, st->user_mfn++);
+                else
+                        st->user_mfn++;
+        } else { /* st->version == 2 */
+                int err = *((int *) data);
+                if (err)
+                        return __put_user(err, st->user_err++);
+                else
+                        st->user_err++;
+        }
+
+        return 0;
 }
 
 /* Allocate pfns that are then mapped with gmfns from foreign domid. Update
@@ -357,12 +372,8 @@ static long privcmd_ioctl_mmap_batch(void __user *udata, int version)
         struct vm_area_struct *vma;
         unsigned long nr_pages;
         LIST_HEAD(pagelist);
-        int *err_array = NULL;
         struct mmap_batch_state state;
 
-        if (!xen_initial_domain())
-                return -EPERM;
-
         switch (version) {
         case 1:
                 if (copy_from_user(&m, udata, sizeof(struct privcmd_mmapbatch)))
@@ -396,10 +407,12 @@ static long privcmd_ioctl_mmap_batch(void __user *udata, int version)
                 goto out;
         }
 
-        err_array = kcalloc(m.num, sizeof(int), GFP_KERNEL);
-        if (err_array == NULL) {
-                ret = -ENOMEM;
-                goto out;
+        if (version == 2) {
+                /* Zero error array now to only copy back actual errors. */
+                if (clear_user(m.err, sizeof(int) * m.num)) {
+                        ret = -EFAULT;
+                        goto out;
+                }
         }
 
         down_write(&mm->mmap_sem);
@@ -427,7 +440,7 @@ static long privcmd_ioctl_mmap_batch(void __user *udata, int version)
         state.va            = m.addr;
         state.index         = 0;
         state.global_error  = 0;
-        state.err           = err_array;
+        state.version       = version;
 
         /* mmap_batch_fn guarantees ret == 0 */
         BUG_ON(traverse_pages(m.num, sizeof(xen_pfn_t),
@@ -435,21 +448,14 @@ static long privcmd_ioctl_mmap_batch(void __user *udata, int version)
 
         up_write(&mm->mmap_sem);
 
-        if (version == 1) {
-                if (state.global_error) {
-                        /* Write back errors in second pass. */
-                        state.user_mfn = (xen_pfn_t *)m.arr;
-                        state.err      = err_array;
-                        ret = traverse_pages(m.num, sizeof(xen_pfn_t),
-                                             &pagelist, mmap_return_errors_v1, &state);
-                } else
-                        ret = 0;
-
-        } else if (version == 2) {
-                ret = __copy_to_user(m.err, err_array, m.num * sizeof(int));
-                if (ret)
-                        ret = -EFAULT;
-        }
+        if (state.global_error) {
+                /* Write back errors in second pass. */
+                state.user_mfn = (xen_pfn_t *)m.arr;
+                state.user_err = m.err;
+                ret = traverse_pages(m.num, sizeof(xen_pfn_t),
+                                                         &pagelist, mmap_return_errors, &state);
+        } else
+                ret = 0;
 
         /* If we have not had any EFAULT-like global errors then set the global
          * error to -ENOENT if necessary. */
@@ -457,7 +463,6 @@ static long privcmd_ioctl_mmap_batch(void __user *udata, int version)
                 ret = -ENOENT;
 
 out:
-        kfree(err_array);
         free_page_list(&pagelist);
 
         return ret;
diff --git a/drivers/xen/xen-pciback/pciback.h b/drivers/xen/xen-pciback/pciback.h
index a7def010eba3..f72af87640e0 100644
--- a/drivers/xen/xen-pciback/pciback.h
+++ b/drivers/xen/xen-pciback/pciback.h
@@ -124,7 +124,7 @@ static inline int xen_pcibk_add_pci_dev(struct xen_pcibk_device *pdev,
 static inline void xen_pcibk_release_pci_dev(struct xen_pcibk_device *pdev,
                                              struct pci_dev *dev)
 {
-        if (xen_pcibk_backend && xen_pcibk_backend->free)
+        if (xen_pcibk_backend && xen_pcibk_backend->release)
                 return xen_pcibk_backend->release(pdev, dev);
 }
 
diff --git a/drivers/xen/xen-pciback/pciback_ops.c b/drivers/xen/xen-pciback/pciback_ops.c
index 97f5d264c31e..37c1f825f513 100644
--- a/drivers/xen/xen-pciback/pciback_ops.c
+++ b/drivers/xen/xen-pciback/pciback_ops.c
@@ -135,7 +135,6 @@ int xen_pcibk_enable_msi(struct xen_pcibk_device *pdev,
                          struct pci_dev *dev, struct xen_pci_op *op)
 {
         struct xen_pcibk_dev_data *dev_data;
-        int otherend = pdev->xdev->otherend_id;
         int status;
 
         if (unlikely(verbose_request))
@@ -144,8 +143,9 @@ int xen_pcibk_enable_msi(struct xen_pcibk_device *pdev,
         status = pci_enable_msi(dev);
 
         if (status) {
-                printk(KERN_ERR "error enable msi for guest %x status %x\n",
-                        otherend, status);
+                pr_warn_ratelimited(DRV_NAME ": %s: error enabling MSI for guest %u: err %d\n",
+                                    pci_name(dev), pdev->xdev->otherend_id,
+                                    status);
                 op->value = 0;
                 return XEN_PCI_ERR_op_failed;
         }
@@ -223,10 +223,10 @@ int xen_pcibk_enable_msix(struct xen_pcibk_device *pdev,
                                                 pci_name(dev), i,
                                                 op->msix_entries[i].vector);
                 }
-        } else {
-                printk(KERN_WARNING DRV_NAME ": %s: failed to enable MSI-X: err %d!\n",
-                        pci_name(dev), result);
-        }
+        } else
+                pr_warn_ratelimited(DRV_NAME ": %s: error enabling MSI-X for guest %u: err %d!\n",
+                                    pci_name(dev), pdev->xdev->otherend_id,
+                                    result);
         kfree(entries);
 
         op->value = result;