Merge commit 'v2.6.33' into perf/core

Merge reason:
	__percpu annotations need the corresponding sparse address
space definition upstream.

Conflicts:
	tools/perf/util/probe-event.c (trivial)

290 files changed, 3204 insertions, 1776 deletions

diff --git a/drivers/acpi/dock.c b/drivers/acpi/dock.c
index bbc2c1315c47..b2586f57e1f5 100644
--- a/drivers/acpi/dock.c
+++ b/drivers/acpi/dock.c
@@ -935,6 +935,7 @@ static int dock_add(acpi_handle handle)
         struct platform_device *dd;
 
         id = dock_station_count;
+        memset(&ds, 0, sizeof(ds));
         dd = platform_device_register_data(NULL, "dock", id, &ds, sizeof(ds));
         if (IS_ERR(dd))
                 return PTR_ERR(dd);
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 7c0441f63b39..cc978a8c00b7 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -110,6 +110,14 @@ static struct dmi_system_id __cpuinitdata processor_power_dmi_table[] = {
           DMI_MATCH(DMI_BIOS_VENDOR,"Phoenix Technologies LTD"),
           DMI_MATCH(DMI_BIOS_VERSION,"SHE845M0.86C.0013.D.0302131307")},
          (void *)2},
+        { set_max_cstate, "Pavilion zv5000", {
+          DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+          DMI_MATCH(DMI_PRODUCT_NAME,"Pavilion zv5000 (DS502A#ABA)")},
+         (void *)1},
+        { set_max_cstate, "Asus L8400B", {
+          DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer Inc."),
+          DMI_MATCH(DMI_PRODUCT_NAME,"L8400B series Notebook PC")},
+         (void *)1},
         {},
 };
 
@@ -872,12 +880,14 @@ static int acpi_idle_enter_simple(struct cpuidle_device *dev,
                 return(acpi_idle_enter_c1(dev, state));
 
         local_irq_disable();
-        current_thread_info()->status &= ~TS_POLLING;
-        /*
-         * TS_POLLING-cleared state must be visible before we test
-         * NEED_RESCHED:
-         */
-        smp_mb();
+        if (cx->entry_method != ACPI_CSTATE_FFH) {
+                current_thread_info()->status &= ~TS_POLLING;
+                /*
+                 * TS_POLLING-cleared state must be visible before we test
+                 * NEED_RESCHED:
+                 */
+                smp_mb();
+        }
 
         if (unlikely(need_resched())) {
                 current_thread_info()->status |= TS_POLLING;
@@ -957,12 +967,14 @@ static int acpi_idle_enter_bm(struct cpuidle_device *dev,
         }
 
         local_irq_disable();
-        current_thread_info()->status &= ~TS_POLLING;
-        /*
-         * TS_POLLING-cleared state must be visible before we test
-         * NEED_RESCHED:
-         */
-        smp_mb();
+        if (cx->entry_method != ACPI_CSTATE_FFH) {
+                current_thread_info()->status &= ~TS_POLLING;
+                /*
+                 * TS_POLLING-cleared state must be visible before we test
+                 * NEED_RESCHED:
+                 */
+                smp_mb();
+        }
 
         if (unlikely(need_resched())) {
                 current_thread_info()->status |= TS_POLLING;
diff --git a/drivers/acpi/processor_pdc.c b/drivers/acpi/processor_pdc.c
index 7247819dbd80..e306ba9aa34e 100644
--- a/drivers/acpi/processor_pdc.c
+++ b/drivers/acpi/processor_pdc.c
@@ -125,6 +125,8 @@ acpi_processor_eval_pdc(acpi_handle handle, struct acpi_object_list *pdc_in)
         return status;
 }
 
+static int early_pdc_done;
+
 void acpi_processor_set_pdc(acpi_handle handle)
 {
         struct acpi_object_list *obj_list;
@@ -132,6 +134,9 @@ void acpi_processor_set_pdc(acpi_handle handle)
         if (arch_has_acpi_pdc() == false)
                 return;
 
+        if (early_pdc_done)
+                return;
+
         obj_list = acpi_processor_alloc_pdc();
         if (!obj_list)
                 return;
@@ -151,6 +156,13 @@ static int set_early_pdc_optin(const struct dmi_system_id *id)
         return 0;
 }
 
+static int param_early_pdc_optin(char *s)
+{
+        early_pdc_optin = 1;
+        return 1;
+}
+__setup("acpi_early_pdc_eval", param_early_pdc_optin);
+
 static struct dmi_system_id __cpuinitdata early_pdc_optin_table[] = {
         {
         set_early_pdc_optin, "HP Envy", {
@@ -192,4 +204,6 @@ void __init acpi_early_processor_set_pdc(void)
         acpi_walk_namespace(ACPI_TYPE_PROCESSOR, ACPI_ROOT_OBJECT,
                             ACPI_UINT32_MAX,
                             early_init_pdc, NULL, NULL, NULL);
+
+        early_pdc_done = 1;
 }
diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
index 2cabadcc4d8c..a959f6a07508 100644
--- a/drivers/acpi/processor_perflib.c
+++ b/drivers/acpi/processor_perflib.c
@@ -413,7 +413,11 @@ static int acpi_processor_get_performance_info(struct acpi_processor *pr)
         if (result)
                 goto update_bios;
 
-        return 0;
+        /* We need to call _PPC once when cpufreq starts */
+        if (ignore_ppc != 1)
+                result = acpi_processor_get_platform_limit(pr);
+
+        return result;
 
         /*
          * Having _PPC but missing frequencies (_PSS, _PCT) is a very good hint that
diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c
index ff9f6226085d..3e009674f333 100644
--- a/drivers/acpi/scan.c
+++ b/drivers/acpi/scan.c
@@ -1336,9 +1336,25 @@ static int acpi_bus_scan(acpi_handle handle, struct acpi_bus_ops *ops,
 
         if (child)
                 *child = device;
-        return 0;
+
+        if (device)
+                return 0;
+        else
+                return -ENODEV;
 }
 
+/*
+ * acpi_bus_add and acpi_bus_start
+ *
+ * scan a given ACPI tree and (probably recently hot-plugged)
+ * create and add or starts found devices.
+ *
+ * If no devices were found -ENODEV is returned which does not
+ * mean that this is a real error, there just have been no suitable
+ * ACPI objects in the table trunk from which the kernel could create
+ * a device and add/start an appropriate driver.
+ */
+
 int
 acpi_bus_add(struct acpi_device **child,
              struct acpi_device *parent, acpi_handle handle, int type)
@@ -1348,8 +1364,7 @@ acpi_bus_add(struct acpi_device **child,
         memset(&ops, 0, sizeof(ops));
         ops.acpi_op_add = 1;
 
-        acpi_bus_scan(handle, &ops, child);
-        return 0;
+        return acpi_bus_scan(handle, &ops, child);
 }
 EXPORT_SYMBOL(acpi_bus_add);
 
@@ -1357,11 +1372,13 @@ int acpi_bus_start(struct acpi_device *device)
 {
         struct acpi_bus_ops ops;
 
+        if (!device)
+                return -EINVAL;
+
         memset(&ops, 0, sizeof(ops));
         ops.acpi_op_start = 1;
 
-        acpi_bus_scan(device->handle, &ops, NULL);
-        return 0;
+        return acpi_bus_scan(device->handle, &ops, NULL);
 }
 EXPORT_SYMBOL(acpi_bus_start);
 
diff --git a/drivers/acpi/tables.c b/drivers/acpi/tables.c
index f336bca7c450..8a0ed2800e63 100644
--- a/drivers/acpi/tables.c
+++ b/drivers/acpi/tables.c
@@ -213,7 +213,7 @@ acpi_table_parse_entries(char *id,
         unsigned long table_end;
         acpi_size tbl_size;
 
-        if (acpi_disabled)
+        if (acpi_disabled && !acpi_ht)
                 return -ENODEV;
 
         if (!handler)
@@ -280,7 +280,7 @@ int __init acpi_table_parse(char *id, acpi_table_handler handler)
         struct acpi_table_header *table = NULL;
         acpi_size tbl_size;
 
-        if (acpi_disabled)
+        if (acpi_disabled && !acpi_ht)
                 return -ENODEV;
 
         if (!handler)
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index b8bea100a160..b34390347c16 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -2868,6 +2868,21 @@ static bool ahci_broken_suspend(struct pci_dev *pdev)
                         },
                         .driver_data = "F.23",  /* cutoff BIOS version */
                 },
+                /*
+                 * Acer eMachines G725 has the same problem.  BIOS
+                 * V1.03 is known to be broken.  V3.04 is known to
+                 * work.  Inbetween, there are V1.06, V2.06 and V3.03
+                 * that we don't have much idea about.  For now,
+                 * blacklist anything older than V3.04.
+                 */
+                {
+                        .ident = "G725",
+                        .matches = {
+                                DMI_MATCH(DMI_SYS_VENDOR, "eMachines"),
+                                DMI_MATCH(DMI_PRODUCT_NAME, "eMachines G725"),
+                        },
+                        .driver_data = "V3.04", /* cutoff BIOS version */
+                },
                 { }     /* terminate list */
         };
         const struct dmi_system_id *dmi = dmi_first_match(sysids);
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index f4ea5a8c325b..d096fbcbc771 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -2875,7 +2875,7 @@ static unsigned int ata_scsi_pass_thru(struct ata_queued_cmd *qc)
          * write indication (used for PIO/DMA setup), result TF is
          * copied back and we don't whine too much about its failure.
          */
-        tf->flags = ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE;
+        tf->flags |= ATA_TFLAG_ISADDR | ATA_TFLAG_DEVICE;
         if (scmd->sc_data_direction == DMA_TO_DEVICE)
                 tf->flags |= ATA_TFLAG_WRITE;
 
diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c
index 741065c9da67..730ef3c384ca 100644
--- a/drivers/ata/libata-sff.c
+++ b/drivers/ata/libata-sff.c
@@ -893,6 +893,9 @@ static void ata_pio_sector(struct ata_queued_cmd *qc)
                                        do_write);
         }
 
+        if (!do_write)
+                flush_dcache_page(page);
+
         qc->curbytes += qc->sect_size;
         qc->cursg_ofs += qc->sect_size;
 
diff --git a/drivers/base/class.c b/drivers/base/class.c
index 161746deab4b..6e2c3b064f53 100644
--- a/drivers/base/class.c
+++ b/drivers/base/class.c
@@ -59,6 +59,8 @@ static void class_release(struct kobject *kobj)
         else
                 pr_debug("class '%s' does not have a release() function, "
                          "be careful\n", class->name);
+
+        kfree(cp);
 }
 
 static struct sysfs_ops class_sysfs_ops = {
diff --git a/drivers/block/cciss.c b/drivers/block/cciss.c
index 873e594860d3..9291614ac6b7 100644
--- a/drivers/block/cciss.c
+++ b/drivers/block/cciss.c
@@ -337,6 +337,9 @@ static int cciss_seq_show(struct seq_file *seq, void *v)
         if (*pos > h->highest_lun)
                 return 0;
 
+        if (drv == NULL) /* it's possible for h->drv[] to have holes. */
+                return 0;
+
         if (drv->heads == 0)
                 return 0;
 
diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
index e898ad9eb1c3..ab871e00ffc5 100644
--- a/drivers/block/drbd/drbd_main.c
+++ b/drivers/block/drbd/drbd_main.c
@@ -2973,7 +2973,6 @@ struct drbd_conf *drbd_new_device(unsigned int minor)
                 goto out_no_q;
         mdev->rq_queue = q;
         q->queuedata   = mdev;
-        blk_queue_max_segment_size(q, DRBD_MAX_SEGMENT_SIZE);
 
         disk = alloc_disk(1);
         if (!disk)
@@ -2997,6 +2996,7 @@ struct drbd_conf *drbd_new_device(unsigned int minor)
         q->backing_dev_info.congested_data = mdev;
 
         blk_queue_make_request(q, drbd_make_request_26);
+        blk_queue_max_segment_size(q, DRBD_MAX_SEGMENT_SIZE);
         blk_queue_bounce_limit(q, BLK_BOUNCE_ANY);
         blk_queue_merge_bvec(q, drbd_merge_bvec);
         q->queue_lock = &mdev->req_lock; /* needed since we use */
diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
index f22a5283128a..d065c646b35a 100644
--- a/drivers/block/drbd/drbd_receiver.c
+++ b/drivers/block/drbd/drbd_receiver.c
@@ -1224,7 +1224,7 @@ static int receive_Barrier(struct drbd_conf *mdev, struct p_header *h)
         epoch = kmalloc(sizeof(struct drbd_epoch), GFP_NOIO);
         if (!epoch) {
                 dev_warn(DEV, "Allocation of an epoch failed, slowing down\n");
-                issue_flush = !test_and_set_bit(DE_BARRIER_IN_NEXT_EPOCH_ISSUED, &epoch->flags);
+                issue_flush = !test_and_set_bit(DE_BARRIER_IN_NEXT_EPOCH_ISSUED, &mdev->current_epoch->flags);
                 drbd_wait_ee_list_empty(mdev, &mdev->active_ee);
                 if (issue_flush) {
                         rv = drbd_flush_after_epoch(mdev, mdev->current_epoch);
diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c
index 2ddf03ae034e..68b5957f107c 100644
--- a/drivers/block/pktcdvd.c
+++ b/drivers/block/pktcdvd.c
@@ -322,7 +322,7 @@ static void pkt_sysfs_dev_remove(struct pktcdvd_device *pd)
         pkt_kobj_remove(pd->kobj_stat);
         pkt_kobj_remove(pd->kobj_wqueue);
         if (class_pktcdvd)
-                device_destroy(class_pktcdvd, pd->pkt_dev);
+                device_unregister(pd->dev);
 }
 
 
diff --git a/drivers/bluetooth/Kconfig b/drivers/bluetooth/Kconfig
index 652367aa6546..058fbccf2f52 100644
--- a/drivers/bluetooth/Kconfig
+++ b/drivers/bluetooth/Kconfig
@@ -195,5 +195,16 @@ config BT_MRVL_SDIO
           Say Y here to compile support for Marvell BT-over-SDIO driver
           into the kernel or say M to compile it as module.
 
-endmenu
+config BT_ATH3K
+        tristate "Atheros firmware download driver"
+        depends on BT_HCIBTUSB
+        select FW_LOADER
+        help
+          Bluetooth firmware download driver.
+          This driver loads the firmware into the Atheros Bluetooth
+          chipset.
 
+          Say Y here to compile support for "Atheros firmware download driver"
+          into the kernel or say M to compile it as module (ath3k).
+
+endmenu
diff --git a/drivers/bluetooth/Makefile b/drivers/bluetooth/Makefile
index b3f57d2d4eb0..7e5aed598121 100644
--- a/drivers/bluetooth/Makefile
+++ b/drivers/bluetooth/Makefile
@@ -15,6 +15,7 @@ obj-$(CONFIG_BT_HCIBTUART)	+= btuart_cs.o
 obj-$(CONFIG_BT_HCIBTUSB)       += btusb.o
 obj-$(CONFIG_BT_HCIBTSDIO)      += btsdio.o
 
+obj-$(CONFIG_BT_ATH3K)          += ath3k.o
 obj-$(CONFIG_BT_MRVL)           += btmrvl.o
 obj-$(CONFIG_BT_MRVL_SDIO)      += btmrvl_sdio.o
 
diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
new file mode 100644
index 000000000000..add9485ca5b6
--- /dev/null
+++ b/drivers/bluetooth/ath3k.c
@@ -0,0 +1,187 @@
+/*
+ * Copyright (c) 2008-2009 Atheros Communications Inc.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU General Public License for more details.
+ *
+ *  You should have received a copy of the GNU General Public License
+ *  along with this program; if not, write to the Free Software
+ *  Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ */
+
+
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/slab.h>
+#include <linux/types.h>
+#include <linux/errno.h>
+#include <linux/device.h>
+#include <linux/firmware.h>
+#include <linux/usb.h>
+#include <net/bluetooth/bluetooth.h>
+
+#define VERSION "1.0"
+
+
+static struct usb_device_id ath3k_table[] = {
+        /* Atheros AR3011 */
+        { USB_DEVICE(0x0CF3, 0x3000) },
+        { }     /* Terminating entry */
+};
+
+MODULE_DEVICE_TABLE(usb, ath3k_table);
+
+#define USB_REQ_DFU_DNLOAD      1
+#define BULK_SIZE               4096
+
+struct ath3k_data {
+        struct usb_device *udev;
+        u8 *fw_data;
+        u32 fw_size;
+        u32 fw_sent;
+};
+
+static int ath3k_load_firmware(struct ath3k_data *data,
+                                unsigned char *firmware,
+                                int count)
+{
+        u8 *send_buf;
+        int err, pipe, len, size, sent = 0;
+
+        BT_DBG("ath3k %p udev %p", data, data->udev);
+
+        pipe = usb_sndctrlpipe(data->udev, 0);
+
+        if ((usb_control_msg(data->udev, pipe,
+                                USB_REQ_DFU_DNLOAD,
+                                USB_TYPE_VENDOR, 0, 0,
+                                firmware, 20, USB_CTRL_SET_TIMEOUT)) < 0) {
+                BT_ERR("Can't change to loading configuration err");
+                return -EBUSY;
+        }
+        sent += 20;
+        count -= 20;
+
+        send_buf = kmalloc(BULK_SIZE, GFP_ATOMIC);
+        if (!send_buf) {
+                BT_ERR("Can't allocate memory chunk for firmware");
+                return -ENOMEM;
+        }
+
+        while (count) {
+                size = min_t(uint, count, BULK_SIZE);
+                pipe = usb_sndbulkpipe(data->udev, 0x02);
+                memcpy(send_buf, firmware + sent, size);
+
+                err = usb_bulk_msg(data->udev, pipe, send_buf, size,
+                                        &len, 3000);
+
+                if (err || (len != size)) {
+                        BT_ERR("Error in firmware loading err = %d,"
+                                "len = %d, size = %d", err, len, size);
+                        goto error;
+                }
+
+                sent  += size;
+                count -= size;
+        }
+
+        kfree(send_buf);
+        return 0;
+
+error:
+        kfree(send_buf);
+        return err;
+}
+
+static int ath3k_probe(struct usb_interface *intf,
+                        const struct usb_device_id *id)
+{
+        const struct firmware *firmware;
+        struct usb_device *udev = interface_to_usbdev(intf);
+        struct ath3k_data *data;
+        int size;
+
+        BT_DBG("intf %p id %p", intf, id);
+
+        if (intf->cur_altsetting->desc.bInterfaceNumber != 0)
+                return -ENODEV;
+
+        data = kzalloc(sizeof(*data), GFP_KERNEL);
+        if (!data)
+                return -ENOMEM;
+
+        data->udev = udev;
+
+        if (request_firmware(&firmware, "ath3k-1.fw", &udev->dev) < 0) {
+                kfree(data);
+                return -EIO;
+        }
+
+        size = max_t(uint, firmware->size, 4096);
+        data->fw_data = kmalloc(size, GFP_KERNEL);
+        if (!data->fw_data) {
+                release_firmware(firmware);
+                kfree(data);
+                return -ENOMEM;
+        }
+
+        memcpy(data->fw_data, firmware->data, firmware->size);
+        data->fw_size = firmware->size;
+        data->fw_sent = 0;
+        release_firmware(firmware);
+
+        usb_set_intfdata(intf, data);
+        if (ath3k_load_firmware(data, data->fw_data, data->fw_size)) {
+                usb_set_intfdata(intf, NULL);
+                return -EIO;
+        }
+
+        return 0;
+}
+
+static void ath3k_disconnect(struct usb_interface *intf)
+{
+        struct ath3k_data *data = usb_get_intfdata(intf);
+
+        BT_DBG("ath3k_disconnect intf %p", intf);
+
+        kfree(data->fw_data);
+        kfree(data);
+}
+
+static struct usb_driver ath3k_driver = {
+        .name           = "ath3k",
+        .probe          = ath3k_probe,
+        .disconnect     = ath3k_disconnect,
+        .id_table       = ath3k_table,
+};
+
+static int __init ath3k_init(void)
+{
+        BT_INFO("Atheros AR30xx firmware driver ver %s", VERSION);
+        return usb_register(&ath3k_driver);
+}
+
+static void __exit ath3k_exit(void)
+{
+        usb_deregister(&ath3k_driver);
+}
+
+module_init(ath3k_init);
+module_exit(ath3k_exit);
+
+MODULE_AUTHOR("Atheros Communications");
+MODULE_DESCRIPTION("Atheros AR30xx firmware driver");
+MODULE_VERSION(VERSION);
+MODULE_LICENSE("GPL");
+MODULE_FIRMWARE("ath3k-1.fw");
diff --git a/drivers/bluetooth/bluecard_cs.c b/drivers/bluetooth/bluecard_cs.c
index 2acdc605cb4b..c2cf81144715 100644
--- a/drivers/bluetooth/bluecard_cs.c
+++ b/drivers/bluetooth/bluecard_cs.c
@@ -503,7 +503,9 @@ static irqreturn_t bluecard_interrupt(int irq, void *dev_inst)
         unsigned int iobase;
         unsigned char reg;
 
-        BUG_ON(!info->hdev);
+        if (!info || !info->hdev)
+                /* our irq handler is shared */
+                return IRQ_NONE;
 
         if (!test_bit(CARD_READY, &(info->hw_state)))
                 return IRQ_HANDLED;
diff --git a/drivers/bluetooth/bt3c_cs.c b/drivers/bluetooth/bt3c_cs.c
index d814a2755ccb..9f5926aaf57f 100644
--- a/drivers/bluetooth/bt3c_cs.c
+++ b/drivers/bluetooth/bt3c_cs.c
@@ -345,7 +345,9 @@ static irqreturn_t bt3c_interrupt(int irq, void *dev_inst)
         int iir;
         irqreturn_t r = IRQ_NONE;
 
-        BUG_ON(!info->hdev);
+        if (!info || !info->hdev)
+                /* our irq handler is shared */
+                return IRQ_NONE;
 
         iobase = info->p_dev->io.BasePort1;
 
diff --git a/drivers/bluetooth/btmrvl_sdio.c b/drivers/bluetooth/btmrvl_sdio.c
index f36defa37764..57d965b7f521 100644
--- a/drivers/bluetooth/btmrvl_sdio.c
+++ b/drivers/bluetooth/btmrvl_sdio.c
@@ -808,6 +808,7 @@ static int btmrvl_sdio_host_to_card(struct btmrvl_private *priv,
 
 exit:
         sdio_release_host(card->func);
+        kfree(tmpbuf);
 
         return ret;
 }
diff --git a/drivers/bluetooth/btuart_cs.c b/drivers/bluetooth/btuart_cs.c
index d339464dc15e..91c523099804 100644
--- a/drivers/bluetooth/btuart_cs.c
+++ b/drivers/bluetooth/btuart_cs.c
@@ -295,7 +295,9 @@ static irqreturn_t btuart_interrupt(int irq, void *dev_inst)
         int iir, lsr;
         irqreturn_t r = IRQ_NONE;
 
-        BUG_ON(!info->hdev);
+        if (!info || !info->hdev)
+                /* our irq handler is shared */
+                return IRQ_NONE;
 
         iobase = info->p_dev->io.BasePort1;
 
diff --git a/drivers/bluetooth/dtl1_cs.c b/drivers/bluetooth/dtl1_cs.c
index 4f02a6f3c980..697591941e17 100644
--- a/drivers/bluetooth/dtl1_cs.c
+++ b/drivers/bluetooth/dtl1_cs.c
@@ -299,7 +299,9 @@ static irqreturn_t dtl1_interrupt(int irq, void *dev_inst)
         int iir, lsr;
         irqreturn_t r = IRQ_NONE;
 
-        BUG_ON(!info->hdev);
+        if (!info || !info->hdev)
+                /* our irq handler is shared */
+                return IRQ_NONE;
 
         iobase = info->p_dev->io.BasePort1;
 
diff --git a/drivers/char/agp/amd64-agp.c b/drivers/char/agp/amd64-agp.c
index 1afb8968a342..fd50ead59c79 100644
--- a/drivers/char/agp/amd64-agp.c
+++ b/drivers/char/agp/amd64-agp.c
@@ -729,9 +729,6 @@ int __init agp_amd64_init(void)
         if (agp_off)
                 return -EINVAL;
 
-        if (gart_iommu_aperture)
-                return agp_bridges_found ? 0 : -ENODEV;
-
         err = pci_register_driver(&agp_amd64_pci_driver);
         if (err < 0)
                 return err;
@@ -768,16 +765,27 @@ int __init agp_amd64_init(void)
         return err;
 }
 
+static int __init agp_amd64_mod_init(void)
+{
+#ifndef MODULE
+        if (gart_iommu_aperture)
+                return agp_bridges_found ? 0 : -ENODEV;
+#endif
+        return agp_amd64_init();
+}
+
 static void __exit agp_amd64_cleanup(void)
 {
+#ifndef MODULE
         if (gart_iommu_aperture)
                 return;
+#endif
         if (aperture_resource)
                 release_resource(aperture_resource);
         pci_unregister_driver(&agp_amd64_pci_driver);
 }
 
-module_init(agp_amd64_init);
+module_init(agp_amd64_mod_init);
 module_exit(agp_amd64_cleanup);
 
 MODULE_AUTHOR("Dave Jones <davej@redhat.com>, Andi Kleen");
diff --git a/drivers/char/mem.c b/drivers/char/mem.c
index be832b6f8279..48788db4e280 100644
--- a/drivers/char/mem.c
+++ b/drivers/char/mem.c
@@ -395,6 +395,7 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
         unsigned long p = *ppos;
         ssize_t low_count, read, sz;
         char * kbuf; /* k-addr because vread() takes vmlist_lock rwlock */
+        int err = 0;
 
         read = 0;
         if (p < (unsigned long) high_memory) {
@@ -441,12 +442,16 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
                         return -ENOMEM;
                 while (count > 0) {
                         sz = size_inside_page(p, count);
+                        if (!is_vmalloc_or_module_addr((void *)p)) {
+                                err = -ENXIO;
+                                break;
+                        }
                         sz = vread(kbuf, (char *)p, sz);
                         if (!sz)
                                 break;
                         if (copy_to_user(buf, kbuf, sz)) {
-                                free_page((unsigned long)kbuf);
-                                return -EFAULT;
+                                err = -EFAULT;
+                                break;
                         }
                         count -= sz;
                         buf += sz;
@@ -455,8 +460,8 @@ static ssize_t read_kmem(struct file *file, char __user *buf,
                 }
                 free_page((unsigned long)kbuf);
         }
-        *ppos = p;
-        return read;
+        *ppos = p;
+        return read ? read : err;
 }
 
 
@@ -520,6 +525,7 @@ static ssize_t write_kmem(struct file * file, const char __user * buf,
         ssize_t wrote = 0;
         ssize_t virtr = 0;
         char * kbuf; /* k-addr because vwrite() takes vmlist_lock rwlock */
+        int err = 0;
 
         if (p < (unsigned long) high_memory) {
                 unsigned long to_write = min_t(unsigned long, count,
@@ -540,14 +546,16 @@ static ssize_t write_kmem(struct file * file, const char __user * buf,
                         unsigned long sz = size_inside_page(p, count);
                         unsigned long n;
 
+                        if (!is_vmalloc_or_module_addr((void *)p)) {
+                                err = -ENXIO;
+                                break;
+                        }
                         n = copy_from_user(kbuf, buf, sz);
                         if (n) {
-                                if (wrote + virtr)
-                                        break;
-                                free_page((unsigned long)kbuf);
-                                return -EFAULT;
+                                err = -EFAULT;
+                                break;
                         }
-                        sz = vwrite(kbuf, (char *)p, sz);
+                        vwrite(kbuf, (char *)p, sz);
                         count -= sz;
                         buf += sz;
                         virtr += sz;
@@ -556,8 +564,8 @@ static ssize_t write_kmem(struct file * file, const char __user * buf,
                 free_page((unsigned long)kbuf);
         }
 
-        *ppos = p;
-        return virtr + wrote;
+        *ppos = p;
+        return virtr + wrote ? : err;
 }
 #endif
 
diff --git a/drivers/char/random.c b/drivers/char/random.c
index 8258982b49ec..2849713d2231 100644
--- a/drivers/char/random.c
+++ b/drivers/char/random.c
@@ -1051,12 +1051,6 @@ random_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos)
                                 /* like a named pipe */
         }
 
-        /*
-         * If we gave the user some bytes, update the access time.
-         */
-        if (count)
-                file_accessed(file);
-
         return (count ? count : retval);
 }
 
@@ -1107,7 +1101,6 @@ static ssize_t random_write(struct file *file, const char __user *buffer,
                             size_t count, loff_t *ppos)
 {
         size_t ret;
-        struct inode *inode = file->f_path.dentry->d_inode;
 
         ret = write_pool(&blocking_pool, buffer, count);
         if (ret)
@@ -1116,8 +1109,6 @@ static ssize_t random_write(struct file *file, const char __user *buffer,
         if (ret)
                 return ret;
 
-        inode->i_mtime = current_fs_time(inode->i_sb);
-        mark_inode_dirty(inode);
         return (ssize_t)count;
 }
 
diff --git a/drivers/char/tpm/tpm_infineon.c b/drivers/char/tpm/tpm_infineon.c
index ecba4942fc8e..f58440791e65 100644
--- a/drivers/char/tpm/tpm_infineon.c
+++ b/drivers/char/tpm/tpm_infineon.c
@@ -39,12 +39,12 @@
 struct tpm_inf_dev {
         int iotype;
 
-        void __iomem *mem_base;         /* MMIO ioremap'd addr */
-        unsigned long map_base;         /* phys MMIO base */
-        unsigned long map_size;         /* MMIO region size */
-        unsigned int index_off;         /* index register offset */
+        void __iomem *mem_base; /* MMIO ioremap'd addr */
+        unsigned long map_base; /* phys MMIO base */
+        unsigned long map_size; /* MMIO region size */
+        unsigned int index_off; /* index register offset */
 
-        unsigned int data_regs;         /* Data registers */
+        unsigned int data_regs; /* Data registers */
         unsigned int data_size;
 
         unsigned int config_port;       /* IO Port config index reg */
@@ -406,14 +406,14 @@ static const struct tpm_vendor_specific tpm_inf = {
         .miscdev = {.fops = &inf_ops,},
 };
 
-static const struct pnp_device_id tpm_pnp_tbl[] = {
+static const struct pnp_device_id tpm_inf_pnp_tbl[] = {
         /* Infineon TPMs */
         {"IFX0101", 0},
         {"IFX0102", 0},
         {"", 0}
 };
 
-MODULE_DEVICE_TABLE(pnp, tpm_pnp_tbl);
+MODULE_DEVICE_TABLE(pnp, tpm_inf_pnp_tbl);
 
 static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                                        const struct pnp_device_id *dev_id)
@@ -430,7 +430,7 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
         if (pnp_port_valid(dev, 0) && pnp_port_valid(dev, 1) &&
             !(pnp_port_flags(dev, 0) & IORESOURCE_DISABLED)) {
 
-                tpm_dev.iotype = TPM_INF_IO_PORT;
+                tpm_dev.iotype = TPM_INF_IO_PORT;
 
                 tpm_dev.config_port = pnp_port_start(dev, 0);
                 tpm_dev.config_size = pnp_port_len(dev, 0);
@@ -459,9 +459,9 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                         goto err_last;
                 }
         } else if (pnp_mem_valid(dev, 0) &&
-                   !(pnp_mem_flags(dev, 0) & IORESOURCE_DISABLED)) {
+                   !(pnp_mem_flags(dev, 0) & IORESOURCE_DISABLED)) {
 
-                tpm_dev.iotype = TPM_INF_IO_MEM;
+                tpm_dev.iotype = TPM_INF_IO_MEM;
 
                 tpm_dev.map_base = pnp_mem_start(dev, 0);
                 tpm_dev.map_size = pnp_mem_len(dev, 0);
@@ -563,11 +563,11 @@ static int __devinit tpm_inf_pnp_probe(struct pnp_dev *dev,
                          "product id 0x%02x%02x"
                          "%s\n",
                          tpm_dev.iotype == TPM_INF_IO_PORT ?
-                                tpm_dev.config_port :
-                                tpm_dev.map_base + tpm_dev.index_off,
+                         tpm_dev.config_port :
+                         tpm_dev.map_base + tpm_dev.index_off,
                          tpm_dev.iotype == TPM_INF_IO_PORT ?
-                                tpm_dev.data_regs :
-                                tpm_dev.map_base + tpm_dev.data_regs,
+                         tpm_dev.data_regs :
+                         tpm_dev.map_base + tpm_dev.data_regs,
                          version[0], version[1],
                          vendorid[0], vendorid[1],
                          productid[0], productid[1], chipname);
@@ -607,20 +607,55 @@ static __devexit void tpm_inf_pnp_remove(struct pnp_dev *dev)
                         iounmap(tpm_dev.mem_base);
                         release_mem_region(tpm_dev.map_base, tpm_dev.map_size);
                 }
+                tpm_dev_vendor_release(chip);
                 tpm_remove_hardware(chip->dev);
         }
 }
 
+static int tpm_inf_pnp_suspend(struct pnp_dev *dev, pm_message_t pm_state)
+{
+        struct tpm_chip *chip = pnp_get_drvdata(dev);
+        int rc;
+        if (chip) {
+                u8 savestate[] = {
+                        0, 193, /* TPM_TAG_RQU_COMMAND */
+                        0, 0, 0, 10,    /* blob length (in bytes) */
+                        0, 0, 0, 152    /* TPM_ORD_SaveState */
+                };
+                dev_info(&dev->dev, "saving TPM state\n");
+                rc = tpm_inf_send(chip, savestate, sizeof(savestate));
+                if (rc < 0) {
+                        dev_err(&dev->dev, "error while saving TPM state\n");
+                        return rc;
+                }
+        }
+        return 0;
+}
+
+static int tpm_inf_pnp_resume(struct pnp_dev *dev)
+{
+        /* Re-configure TPM after suspending */
+        tpm_config_out(ENABLE_REGISTER_PAIR, TPM_INF_ADDR);
+        tpm_config_out(IOLIMH, TPM_INF_ADDR);
+        tpm_config_out((tpm_dev.data_regs >> 8) & 0xff, TPM_INF_DATA);
+        tpm_config_out(IOLIML, TPM_INF_ADDR);
+        tpm_config_out((tpm_dev.data_regs & 0xff), TPM_INF_DATA);
+        /* activate register */
+        tpm_config_out(TPM_DAR, TPM_INF_ADDR);
+        tpm_config_out(0x01, TPM_INF_DATA);
+        tpm_config_out(DISABLE_REGISTER_PAIR, TPM_INF_ADDR);
+        /* disable RESET, LP and IRQC */
+        tpm_data_out(RESET_LP_IRQC_DISABLE, CMD);
+        return tpm_pm_resume(&dev->dev);
+}
+
 static struct pnp_driver tpm_inf_pnp_driver = {
         .name = "tpm_inf_pnp",
-        .driver = {
-                .owner = THIS_MODULE,
-                .suspend = tpm_pm_suspend,
-                .resume = tpm_pm_resume,
-        },
-        .id_table = tpm_pnp_tbl,
+        .id_table = tpm_inf_pnp_tbl,
         .probe = tpm_inf_pnp_probe,
-        .remove = __devexit_p(tpm_inf_pnp_remove),
+        .suspend = tpm_inf_pnp_suspend,
+        .resume = tpm_inf_pnp_resume,
+        .remove = __devexit_p(tpm_inf_pnp_remove)
 };
 
 static int __init init_inf(void)
@@ -638,5 +673,5 @@ module_exit(cleanup_inf);
 
 MODULE_AUTHOR("Marcel Selhorst <m.selhorst@sirrix.com>");
 MODULE_DESCRIPTION("Driver for Infineon TPM SLD 9630 TT 1.1 / SLB 9635 TT 1.2");
-MODULE_VERSION("1.9");
+MODULE_VERSION("1.9.2");
 MODULE_LICENSE("GPL");
diff --git a/drivers/char/tty_io.c b/drivers/char/tty_io.c
index c6f3b48be9dd..dcb9083ecde0 100644
--- a/drivers/char/tty_io.c
+++ b/drivers/char/tty_io.c
@@ -1951,8 +1951,10 @@ static int tty_fasync(int fd, struct file *filp, int on)
                         pid = task_pid(current);
                         type = PIDTYPE_PID;
                 }
-                retval = __f_setown(filp, pid, type, 0);
+                get_pid(pid);
                 spin_unlock_irqrestore(&tty->ctrl_lock, flags);
+                retval = __f_setown(filp, pid, type, 0);
+                put_pid(pid);
                 if (retval)
                         goto out;
         } else {
diff --git a/drivers/char/uv_mmtimer.c b/drivers/char/uv_mmtimer.c
index 867b67be9f0a..c7072ba14f48 100644
--- a/drivers/char/uv_mmtimer.c
+++ b/drivers/char/uv_mmtimer.c
@@ -89,13 +89,17 @@ static long uv_mmtimer_ioctl(struct file *file, unsigned int cmd,
         switch (cmd) {
         case MMTIMER_GETOFFSET: /* offset of the counter */
                 /*
-                 * UV RTC register is on its own page
+                 * Starting with HUB rev 2.0, the UV RTC register is
+                 * replicated across all cachelines of it's own page.
+                 * This allows faster simultaneous reads from a given socket.
+                 *
+                 * The offset returned is in 64 bit units.
                  */
-                if (PAGE_SIZE <= (1 << 16))
-                        ret = ((UV_LOCAL_MMR_BASE | UVH_RTC) & (PAGE_SIZE-1))
-                                / 8;
+                if (uv_get_min_hub_revision_id() == 1)
+                        ret = 0;
                 else
-                        ret = -ENOSYS;
+                        ret = ((uv_blade_processor_id() * L1_CACHE_BYTES) %
+                                        PAGE_SIZE) / 8;
                 break;
 
         case MMTIMER_GETRES: /* resolution of the clock in 10^-15 s */
@@ -115,8 +119,8 @@ static long uv_mmtimer_ioctl(struct file *file, unsigned int cmd,
                 ret = hweight64(UVH_RTC_REAL_TIME_CLOCK_MASK);
                 break;
 
-        case MMTIMER_MMAPAVAIL: /* can we mmap the clock into userspace? */
-                ret = (PAGE_SIZE <= (1 << 16)) ? 1 : 0;
+        case MMTIMER_MMAPAVAIL:
+                ret = 1;
                 break;
 
         case MMTIMER_GETCOUNTER:
diff --git a/drivers/clocksource/cs5535-clockevt.c b/drivers/clocksource/cs5535-clockevt.c
index 27d20fac19d1..b314a999aabe 100644
--- a/drivers/clocksource/cs5535-clockevt.c
+++ b/drivers/clocksource/cs5535-clockevt.c
@@ -21,7 +21,7 @@
 
 #define DRV_NAME "cs5535-clockevt"
 
-static int timer_irq = CONFIG_CS5535_MFGPT_DEFAULT_IRQ;
+static int timer_irq;
 module_param_named(irq, timer_irq, int, 0644);
 MODULE_PARM_DESC(irq, "Which IRQ to use for the clock source MFGPT ticks.");
 
diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c
index f06024668f99..537c29ac4487 100644
--- a/drivers/connector/connector.c
+++ b/drivers/connector/connector.c
@@ -36,17 +36,6 @@ MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Evgeniy Polyakov <zbr@ioremap.net>");
 MODULE_DESCRIPTION("Generic userspace <-> kernelspace connector.");
 
-static u32 cn_idx = CN_IDX_CONNECTOR;
-static u32 cn_val = CN_VAL_CONNECTOR;
-
-module_param(cn_idx, uint, 0);
-module_param(cn_val, uint, 0);
-MODULE_PARM_DESC(cn_idx, "Connector's main device idx.");
-MODULE_PARM_DESC(cn_val, "Connector's main device val.");
-
-static DEFINE_MUTEX(notify_lock);
-static LIST_HEAD(notify_list);
-
 static struct cn_dev cdev;
 
 static int cn_already_initialized;
@@ -210,54 +199,6 @@ static void cn_rx_skb(struct sk_buff *__skb)
 }
 
 /*
- * Notification routing.
- *
- * Gets id and checks if there are notification request for it's idx
- * and val.  If there are such requests notify the listeners with the
- * given notify event.
- *
- */
-static void cn_notify(struct cb_id *id, u32 notify_event)
-{
-        struct cn_ctl_entry *ent;
-
-        mutex_lock(&notify_lock);
-        list_for_each_entry(ent, &notify_list, notify_entry) {
-                int i;
-                struct cn_notify_req *req;
-                struct cn_ctl_msg *ctl = ent->msg;
-                int idx_found, val_found;
-
-                idx_found = val_found = 0;
-
-                req = (struct cn_notify_req *)ctl->data;
-                for (i = 0; i < ctl->idx_notify_num; ++i, ++req) {
-                        if (id->idx >= req->first &&
-                                        id->idx < req->first + req->range) {
-                                idx_found = 1;
-                                break;
-                        }
-                }
-
-                for (i = 0; i < ctl->val_notify_num; ++i, ++req) {
-                        if (id->val >= req->first &&
-                                        id->val < req->first + req->range) {
-                                val_found = 1;
-                                break;
-                        }
-                }
-
-                if (idx_found && val_found) {
-                        struct cn_msg m = { .ack = notify_event, };
-
-                        memcpy(&m.id, id, sizeof(m.id));
-                        cn_netlink_send(&m, ctl->group, GFP_KERNEL);
-                }
-        }
-        mutex_unlock(&notify_lock);
-}
-
-/*
  * Callback add routing - adds callback with given ID and name.
  * If there is registered callback with the same ID it will not be added.
  *
@@ -276,8 +217,6 @@ int cn_add_callback(struct cb_id *id, char *name,
         if (err)
                 return err;
 
-        cn_notify(id, 0);
-
         return 0;
 }
 EXPORT_SYMBOL_GPL(cn_add_callback);
@@ -295,111 +234,9 @@ void cn_del_callback(struct cb_id *id)
         struct cn_dev *dev = &cdev;
 
         cn_queue_del_callback(dev->cbdev, id);
-        cn_notify(id, 1);
 }
 EXPORT_SYMBOL_GPL(cn_del_callback);
 
-/*
- * Checks two connector's control messages to be the same.
- * Returns 1 if they are the same or if the first one is corrupted.
- */
-static int cn_ctl_msg_equals(struct cn_ctl_msg *m1, struct cn_ctl_msg *m2)
-{
-        int i;
-        struct cn_notify_req *req1, *req2;
-
-        if (m1->idx_notify_num != m2->idx_notify_num)
-                return 0;
-
-        if (m1->val_notify_num != m2->val_notify_num)
-                return 0;
-
-        if (m1->len != m2->len)
-                return 0;
-
-        if ((m1->idx_notify_num + m1->val_notify_num) * sizeof(*req1) !=
-            m1->len)
-                return 1;
-
-        req1 = (struct cn_notify_req *)m1->data;
-        req2 = (struct cn_notify_req *)m2->data;
-
-        for (i = 0; i < m1->idx_notify_num; ++i) {
-                if (req1->first != req2->first || req1->range != req2->range)
-                        return 0;
-                req1++;
-                req2++;
-        }
-
-        for (i = 0; i < m1->val_notify_num; ++i) {
-                if (req1->first != req2->first || req1->range != req2->range)
-                        return 0;
-                req1++;
-                req2++;
-        }
-
-        return 1;
-}
-
-/*
- * Main connector device's callback.
- *
- * Used for notification of a request's processing.
- */
-static void cn_callback(struct cn_msg *msg, struct netlink_skb_parms *nsp)
-{
-        struct cn_ctl_msg *ctl;
-        struct cn_ctl_entry *ent;
-        u32 size;
-
-        if (msg->len < sizeof(*ctl))
-                return;
-
-        ctl = (struct cn_ctl_msg *)msg->data;
-
-        size = (sizeof(*ctl) + ((ctl->idx_notify_num +
-                                 ctl->val_notify_num) *
-                                sizeof(struct cn_notify_req)));
-
-        if (msg->len != size)
-                return;
-
-        if (ctl->len + sizeof(*ctl) != msg->len)
-                return;
-
-        /*
-         * Remove notification.
-         */
-        if (ctl->group == 0) {
-                struct cn_ctl_entry *n;
-
-                mutex_lock(&notify_lock);
-                list_for_each_entry_safe(ent, n, &notify_list, notify_entry) {
-                        if (cn_ctl_msg_equals(ent->msg, ctl)) {
-                                list_del(&ent->notify_entry);
-                                kfree(ent);
-                        }
-                }
-                mutex_unlock(&notify_lock);
-
-                return;
-        }
-
-        size += sizeof(*ent);
-
-        ent = kzalloc(size, GFP_KERNEL);
-        if (!ent)
-                return;
-
-        ent->msg = (struct cn_ctl_msg *)(ent + 1);
-
-        memcpy(ent->msg, ctl, size - sizeof(*ent));
-
-        mutex_lock(&notify_lock);
-        list_add(&ent->notify_entry, &notify_list);
-        mutex_unlock(&notify_lock);
-}
-
 static int cn_proc_show(struct seq_file *m, void *v)
 {
         struct cn_queue_dev *dev = cdev.cbdev;
@@ -437,11 +274,8 @@ static const struct file_operations cn_file_ops = {
 static int __devinit cn_init(void)
 {
         struct cn_dev *dev = &cdev;
-        int err;
 
         dev->input = cn_rx_skb;
-        dev->id.idx = cn_idx;
-        dev->id.val = cn_val;
 
         dev->nls = netlink_kernel_create(&init_net, NETLINK_CONNECTOR,
                                          CN_NETLINK_USERS + 0xf,
@@ -457,14 +291,6 @@ static int __devinit cn_init(void)
 
         cn_already_initialized = 1;
 
-        err = cn_add_callback(&dev->id, "connector", &cn_callback);
-        if (err) {
-                cn_already_initialized = 0;
-                cn_queue_free_dev(dev->cbdev);
-                netlink_kernel_release(dev->nls);
-                return -EINVAL;
-        }
-
         proc_net_fops_create(&init_net, "connector", S_IRUGO, &cn_file_ops);
 
         return 0;
@@ -478,7 +304,6 @@ static void __devexit cn_fini(void)
 
         proc_net_remove(&init_net, "connector");
 
-        cn_del_callback(&dev->id);
         cn_queue_free_dev(dev->cbdev);
         netlink_kernel_release(dev->nls);
 }
diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c
index 4b34ade2332b..bd444dc93cf2 100644
--- a/drivers/cpufreq/cpufreq_ondemand.c
+++ b/drivers/cpufreq/cpufreq_ondemand.c
@@ -554,6 +554,9 @@ static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
                                 (dbs_tuners_ins.up_threshold -
                                  dbs_tuners_ins.down_differential);
 
+                if (freq_next < policy->min)
+                        freq_next = policy->min;
+
                 if (!dbs_tuners_ins.powersave_bias) {
                         __cpufreq_driver_target(policy, freq_next,
                                         CPUFREQ_RELATION_L);
diff --git a/drivers/crypto/padlock-sha.c b/drivers/crypto/padlock-sha.c
index 0af80577dc7b..d3a27e0119bc 100644
--- a/drivers/crypto/padlock-sha.c
+++ b/drivers/crypto/padlock-sha.c
@@ -57,6 +57,23 @@ static int padlock_sha_update(struct shash_desc *desc,
         return crypto_shash_update(&dctx->fallback, data, length);
 }
 
+static int padlock_sha_export(struct shash_desc *desc, void *out)
+{
+        struct padlock_sha_desc *dctx = shash_desc_ctx(desc);
+
+        return crypto_shash_export(&dctx->fallback, out);
+}
+
+static int padlock_sha_import(struct shash_desc *desc, const void *in)
+{
+        struct padlock_sha_desc *dctx = shash_desc_ctx(desc);
+        struct padlock_sha_ctx *ctx = crypto_shash_ctx(desc->tfm);
+
+        dctx->fallback.tfm = ctx->fallback;
+        dctx->fallback.flags = desc->flags & CRYPTO_TFM_REQ_MAY_SLEEP;
+        return crypto_shash_import(&dctx->fallback, in);
+}
+
 static inline void padlock_output_block(uint32_t *src,
                         uint32_t *dst, size_t count)
 {
@@ -235,7 +252,10 @@ static struct shash_alg sha1_alg = {
         .update         =       padlock_sha_update,
         .finup          =       padlock_sha1_finup,
         .final          =       padlock_sha1_final,
+        .export         =       padlock_sha_export,
+        .import         =       padlock_sha_import,
         .descsize       =       sizeof(struct padlock_sha_desc),
+        .statesize      =       sizeof(struct sha1_state),
         .base           =       {
                 .cra_name               =       "sha1",
                 .cra_driver_name        =       "sha1-padlock",
@@ -256,7 +276,10 @@ static struct shash_alg sha256_alg = {
         .update         =       padlock_sha_update,
         .finup          =       padlock_sha256_finup,
         .final          =       padlock_sha256_final,
+        .export         =       padlock_sha_export,
+        .import         =       padlock_sha_import,
         .descsize       =       sizeof(struct padlock_sha_desc),
+        .statesize      =       sizeof(struct sha256_state),
         .base           =       {
                 .cra_name               =       "sha256",
                 .cra_driver_name        =       "sha256-padlock",
diff --git a/drivers/dma/coh901318.c b/drivers/dma/coh901318.c
index b5f2ee0f8e2c..64a937262a40 100644
--- a/drivers/dma/coh901318.c
+++ b/drivers/dma/coh901318.c
@@ -613,8 +613,6 @@ static void dma_tasklet(unsigned long data)
         cohd_fin->pending_irqs--;
         cohc->completed = cohd_fin->desc.cookie;
 
-        BUG_ON(cohc->nbr_active_done && cohd_fin == NULL);
-
         if (cohc->nbr_active_done == 0)
                 return;
 
diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c
index 6f51a0a7a8bb..e7a3230fb7d5 100644
--- a/drivers/dma/dmaengine.c
+++ b/drivers/dma/dmaengine.c
@@ -826,6 +826,7 @@ void dma_async_device_unregister(struct dma_device *device)
                 chan->dev->chan = NULL;
                 mutex_unlock(&dma_list_mutex);
                 device_unregister(&chan->dev->device);
+                free_percpu(chan->local);
         }
 }
 EXPORT_SYMBOL(dma_async_device_unregister);
diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c
index 8b905161fbf4..948d563941c9 100644
--- a/drivers/dma/dmatest.c
+++ b/drivers/dma/dmatest.c
@@ -467,7 +467,7 @@ err_srcs:
 
         if (iterations > 0)
                 while (!kthread_should_stop()) {
-                        DECLARE_WAIT_QUEUE_HEAD(wait_dmatest_exit);
+                        DECLARE_WAIT_QUEUE_HEAD_ONSTACK(wait_dmatest_exit);
                         interruptible_sleep_on(&wait_dmatest_exit);
                 }
 
diff --git a/drivers/dma/ioat/dma_v2.c b/drivers/dma/ioat/dma_v2.c
index 5f7a500e18d0..5cc37afe2bc1 100644
--- a/drivers/dma/ioat/dma_v2.c
+++ b/drivers/dma/ioat/dma_v2.c
@@ -249,7 +249,7 @@ int ioat2_quiesce(struct ioat_chan_common *chan, unsigned long tmo)
         if (is_ioat_active(status) || is_ioat_idle(status))
                 ioat_suspend(chan);
         while (is_ioat_active(status) || is_ioat_idle(status)) {
-                if (end && time_after(jiffies, end)) {
+                if (tmo && time_after(jiffies, end)) {
                         err = -ETIMEDOUT;
                         break;
                 }
diff --git a/drivers/dma/ipu/ipu_idmac.c b/drivers/dma/ipu/ipu_idmac.c
index 9a5bc1a7389e..e80bae1673fa 100644
--- a/drivers/dma/ipu/ipu_idmac.c
+++ b/drivers/dma/ipu/ipu_idmac.c
@@ -761,12 +761,10 @@ static void ipu_select_buffer(enum ipu_channel channel, int buffer_n)
  * @buffer_n:   buffer number to update.
  *              0 or 1 are the only valid values.
  * @phyaddr:    buffer physical address.
- * @return:     Returns 0 on success or negative error code on failure. This
- *              function will fail if the buffer is set to ready.
  */
 /* Called under spin_lock(_irqsave)(&ichan->lock) */
-static int ipu_update_channel_buffer(struct idmac_channel *ichan,
-                                     int buffer_n, dma_addr_t phyaddr)
+static void ipu_update_channel_buffer(struct idmac_channel *ichan,
+                                      int buffer_n, dma_addr_t phyaddr)
 {
         enum ipu_channel channel = ichan->dma_chan.chan_id;
         uint32_t reg;
@@ -806,8 +804,6 @@ static int ipu_update_channel_buffer(struct idmac_channel *ichan,
         }
 
         spin_unlock_irqrestore(&ipu_data.lock, flags);
-
-        return 0;
 }
 
 /* Called under spin_lock_irqsave(&ichan->lock) */
@@ -816,7 +812,6 @@ static int ipu_submit_buffer(struct idmac_channel *ichan,
 {
         unsigned int chan_id = ichan->dma_chan.chan_id;
         struct device *dev = &ichan->dma_chan.dev->device;
-        int ret;
 
         if (async_tx_test_ack(&desc->txd))
                 return -EINTR;
@@ -827,14 +822,7 @@ static int ipu_submit_buffer(struct idmac_channel *ichan,
          * could make it conditional on status >= IPU_CHANNEL_ENABLED, but
          * doing it again shouldn't hurt either.
          */
-        ret = ipu_update_channel_buffer(ichan, buf_idx,
-                                        sg_dma_address(sg));
-
-        if (ret < 0) {
-                dev_err(dev, "Updating sg %p on channel 0x%x buffer %d failed!\n",
-                        sg, chan_id, buf_idx);
-                return ret;
-        }
+        ipu_update_channel_buffer(ichan, buf_idx, sg_dma_address(sg));
 
         ipu_select_buffer(chan_id, buf_idx);
         dev_dbg(dev, "Updated sg %p on channel 0x%x buffer %d\n",
@@ -1379,10 +1367,11 @@ static irqreturn_t idmac_interrupt(int irq, void *dev_id)
 
         if (likely(sgnew) &&
             ipu_submit_buffer(ichan, descnew, sgnew, ichan->active_buffer) < 0) {
-                callback = desc->txd.callback;
-                callback_param = desc->txd.callback_param;
+                callback = descnew->txd.callback;
+                callback_param = descnew->txd.callback_param;
                 spin_unlock(&ichan->lock);
-                callback(callback_param);
+                if (callback)
+                        callback(callback_param);
                 spin_lock(&ichan->lock);
         }
 
diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c
index 000dc67b85b7..3391e6739d06 100644
--- a/drivers/edac/amd64_edac.c
+++ b/drivers/edac/amd64_edac.c
@@ -2658,10 +2658,11 @@ static void amd64_restore_ecc_error_reporting(struct amd64_pvt *pvt)
  * the memory system completely. A command line option allows to force-enable
  * hardware ECC later in amd64_enable_ecc_error_reporting().
  */
-static const char *ecc_warning =
-        "WARNING: ECC is disabled by BIOS. Module will NOT be loaded.\n"
-        " Either Enable ECC in the BIOS, or set 'ecc_enable_override'.\n"
-        " Also, use of the override can cause unknown side effects.\n";
+static const char *ecc_msg =
+        "ECC disabled in the BIOS or no ECC capability, module will not load.\n"
+        " Either enable ECC checking or force module loading by setting "
+        "'ecc_enable_override'.\n"
+        " (Note that use of the override may cause unknown side effects.)\n";
 
 static int amd64_check_ecc_enabled(struct amd64_pvt *pvt)
 {
@@ -2673,7 +2674,7 @@ static int amd64_check_ecc_enabled(struct amd64_pvt *pvt)
 
         ecc_enabled = !!(value & K8_NBCFG_ECC_ENABLE);
         if (!ecc_enabled)
-                amd64_printk(KERN_WARNING, "This node reports that Memory ECC "
+                amd64_printk(KERN_NOTICE, "This node reports that Memory ECC "
                              "is currently disabled, set F3x%x[22] (%s).\n",
                              K8_NBCFG, pci_name(pvt->misc_f3_ctl));
         else
@@ -2681,13 +2682,13 @@ static int amd64_check_ecc_enabled(struct amd64_pvt *pvt)
 
         nb_mce_en = amd64_nb_mce_bank_enabled_on_node(pvt->mc_node_id);
         if (!nb_mce_en)
-                amd64_printk(KERN_WARNING, "NB MCE bank disabled, set MSR "
+                amd64_printk(KERN_NOTICE, "NB MCE bank disabled, set MSR "
                              "0x%08x[4] on node %d to enable.\n",
                              MSR_IA32_MCG_CTL, pvt->mc_node_id);
 
         if (!ecc_enabled || !nb_mce_en) {
                 if (!ecc_enable_override) {
-                        amd64_printk(KERN_WARNING, "%s", ecc_warning);
+                        amd64_printk(KERN_NOTICE, "%s", ecc_msg);
                         return -ENODEV;
                 }
                 ecc_enable_override = 0;
diff --git a/drivers/edac/mpc85xx_edac.c b/drivers/edac/mpc85xx_edac.c
index cf27402af97b..ecd5928d7110 100644
--- a/drivers/edac/mpc85xx_edac.c
+++ b/drivers/edac/mpc85xx_edac.c
@@ -804,8 +804,8 @@ static void __devinit mpc85xx_init_csrows(struct mem_ctl_info *mci)
                 end   <<= (24 - PAGE_SHIFT);
                 end    |= (1 << (24 - PAGE_SHIFT)) - 1;
 
-                csrow->first_page = start >> PAGE_SHIFT;
-                csrow->last_page = end >> PAGE_SHIFT;
+                csrow->first_page = start;
+                csrow->last_page = end;
                 csrow->nr_pages = end + 1 - start;
                 csrow->grain = 8;
                 csrow->mtype = mtype;
@@ -892,10 +892,6 @@ static int __devinit mpc85xx_mc_err_probe(struct of_device *op,
 
         mpc85xx_init_csrows(mci);
 
-#ifdef CONFIG_EDAC_DEBUG
-        edac_mc_register_mcidev_debug((struct attribute **)debug_attr);
-#endif
-
         /* store the original error disable bits */
         orig_ddr_err_disable =
             in_be32(pdata->mc_vbase + MPC85XX_MC_ERR_DISABLE);
diff --git a/drivers/firewire/core-card.c b/drivers/firewire/core-card.c
index 7083bcc1b9c7..5045156c5313 100644
--- a/drivers/firewire/core-card.c
+++ b/drivers/firewire/core-card.c
@@ -57,6 +57,8 @@ static LIST_HEAD(descriptor_list);
 static int descriptor_count;
 
 static __be32 tmp_config_rom[256];
+/* ROM header, bus info block, root dir header, capabilities = 7 quadlets */
+static size_t config_rom_length = 1 + 4 + 1 + 1;
 
 #define BIB_CRC(v)              ((v) <<  0)
 #define BIB_CRC_LENGTH(v)       ((v) << 16)
@@ -73,7 +75,7 @@ static __be32 tmp_config_rom[256];
 #define BIB_CMC                 ((1) << 30)
 #define BIB_IMC                 ((1) << 31)
 
-static size_t generate_config_rom(struct fw_card *card, __be32 *config_rom)
+static void generate_config_rom(struct fw_card *card, __be32 *config_rom)
 {
         struct fw_descriptor *desc;
         int i, j, k, length;
@@ -130,23 +132,30 @@ static size_t generate_config_rom(struct fw_card *card, __be32 *config_rom)
         for (i = 0; i < j; i += length + 1)
                 length = fw_compute_block_crc(config_rom + i);
 
-        return j;
+        WARN_ON(j != config_rom_length);
 }
 
 static void update_config_roms(void)
 {
         struct fw_card *card;
-        size_t length;
 
         list_for_each_entry (card, &card_list, link) {
-                length = generate_config_rom(card, tmp_config_rom);
-                card->driver->set_config_rom(card, tmp_config_rom, length);
+                generate_config_rom(card, tmp_config_rom);
+                card->driver->set_config_rom(card, tmp_config_rom,
+                                             config_rom_length);
         }
 }
 
+static size_t required_space(struct fw_descriptor *desc)
+{
+        /* descriptor + entry into root dir + optional immediate entry */
+        return desc->length + 1 + (desc->immediate > 0 ? 1 : 0);
+}
+
 int fw_core_add_descriptor(struct fw_descriptor *desc)
 {
         size_t i;
+        int ret;
 
         /*
          * Check descriptor is valid; the length of all blocks in the
@@ -162,15 +171,21 @@ int fw_core_add_descriptor(struct fw_descriptor *desc)
 
         mutex_lock(&card_mutex);
 
-        list_add_tail(&desc->link, &descriptor_list);
-        descriptor_count++;
-        if (desc->immediate > 0)
+        if (config_rom_length + required_space(desc) > 256) {
+                ret = -EBUSY;
+        } else {
+                list_add_tail(&desc->link, &descriptor_list);
+                config_rom_length += required_space(desc);
                 descriptor_count++;
-        update_config_roms();
+                if (desc->immediate > 0)
+                        descriptor_count++;
+                update_config_roms();
+                ret = 0;
+        }
 
         mutex_unlock(&card_mutex);
 
-        return 0;
+        return ret;
 }
 EXPORT_SYMBOL(fw_core_add_descriptor);
 
@@ -179,6 +194,7 @@ void fw_core_remove_descriptor(struct fw_descriptor *desc)
         mutex_lock(&card_mutex);
 
         list_del(&desc->link);
+        config_rom_length -= required_space(desc);
         descriptor_count--;
         if (desc->immediate > 0)
                 descriptor_count--;
@@ -428,7 +444,6 @@ EXPORT_SYMBOL(fw_card_initialize);
 int fw_card_add(struct fw_card *card,
                 u32 max_receive, u32 link_speed, u64 guid)
 {
-        size_t length;
         int ret;
 
         card->max_receive = max_receive;
@@ -437,8 +452,8 @@ int fw_card_add(struct fw_card *card,
 
         mutex_lock(&card_mutex);
 
-        length = generate_config_rom(card, tmp_config_rom);
-        ret = card->driver->enable(card, tmp_config_rom, length);
+        generate_config_rom(card, tmp_config_rom);
+        ret = card->driver->enable(card, tmp_config_rom, config_rom_length);
         if (ret == 0)
                 list_add_tail(&card->link, &card_list);
 
diff --git a/drivers/firewire/core-cdev.c b/drivers/firewire/core-cdev.c
index e6d63849e78e..4eeaed57e219 100644
--- a/drivers/firewire/core-cdev.c
+++ b/drivers/firewire/core-cdev.c
@@ -35,6 +35,7 @@
 #include <linux/preempt.h>
 #include <linux/sched.h>
 #include <linux/spinlock.h>
+#include <linux/string.h>
 #include <linux/time.h>
 #include <linux/uaccess.h>
 #include <linux/vmalloc.h>
@@ -595,13 +596,20 @@ static int ioctl_send_request(struct client *client, void *buffer)
                             client->device->max_speed);
 }
 
+static inline bool is_fcp_request(struct fw_request *request)
+{
+        return request == NULL;
+}
+
 static void release_request(struct client *client,
                             struct client_resource *resource)
 {
         struct inbound_transaction_resource *r = container_of(resource,
                         struct inbound_transaction_resource, resource);
 
-        if (r->request)
+        if (is_fcp_request(r->request))
+                kfree(r->data);
+        else
                 fw_send_response(client->device->card, r->request,
                                  RCODE_CONFLICT_ERROR);
         kfree(r);
@@ -616,6 +624,7 @@ static void handle_request(struct fw_card *card, struct fw_request *request,
         struct address_handler_resource *handler = callback_data;
         struct inbound_transaction_resource *r;
         struct inbound_transaction_event *e;
+        void *fcp_frame = NULL;
         int ret;
 
         r = kmalloc(sizeof(*r), GFP_ATOMIC);
@@ -627,6 +636,18 @@ static void handle_request(struct fw_card *card, struct fw_request *request,
         r->data    = payload;
         r->length  = length;
 
+        if (is_fcp_request(request)) {
+                /*
+                 * FIXME: Let core-transaction.c manage a
+                 * single reference-counted copy?
+                 */
+                fcp_frame = kmemdup(payload, length, GFP_ATOMIC);
+                if (fcp_frame == NULL)
+                        goto failed;
+
+                r->data = fcp_frame;
+        }
+
         r->resource.release = release_request;
         ret = add_client_resource(handler->client, &r->resource, GFP_ATOMIC);
         if (ret < 0)
@@ -640,13 +661,15 @@ static void handle_request(struct fw_card *card, struct fw_request *request,
         e->request.closure = handler->closure;
 
         queue_event(handler->client, &e->event,
-                    &e->request, sizeof(e->request), payload, length);
+                    &e->request, sizeof(e->request), r->data, length);
         return;
 
  failed:
         kfree(r);
         kfree(e);
-        if (request)
+        kfree(fcp_frame);
+
+        if (!is_fcp_request(request))
                 fw_send_response(card, request, RCODE_CONFLICT_ERROR);
 }
 
@@ -717,18 +740,17 @@ static int ioctl_send_response(struct client *client, void *buffer)
 
         r = container_of(resource, struct inbound_transaction_resource,
                          resource);
-        if (r->request) {
-                if (request->length < r->length)
-                        r->length = request->length;
-                if (copy_from_user(r->data, u64_to_uptr(request->data),
-                                   r->length)) {
-                        ret = -EFAULT;
-                        kfree(r->request);
-                        goto out;
-                }
-                fw_send_response(client->device->card, r->request,
-                                 request->rcode);
+        if (is_fcp_request(r->request))
+                goto out;
+
+        if (request->length < r->length)
+                r->length = request->length;
+        if (copy_from_user(r->data, u64_to_uptr(request->data), r->length)) {
+                ret = -EFAULT;
+                kfree(r->request);
+                goto out;
         }
+        fw_send_response(client->device->card, r->request, request->rcode);
  out:
         kfree(r);
 
diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c
index cbaf420c36c5..2d3dc7ded0a9 100644
--- a/drivers/firewire/net.c
+++ b/drivers/firewire/net.c
@@ -893,20 +893,31 @@ static void fwnet_receive_broadcast(struct fw_iso_context *context,
 
 static struct kmem_cache *fwnet_packet_task_cache;
 
+static void fwnet_free_ptask(struct fwnet_packet_task *ptask)
+{
+        dev_kfree_skb_any(ptask->skb);
+        kmem_cache_free(fwnet_packet_task_cache, ptask);
+}
+
 static int fwnet_send_packet(struct fwnet_packet_task *ptask);
 
 static void fwnet_transmit_packet_done(struct fwnet_packet_task *ptask)
 {
-        struct fwnet_device *dev;
+        struct fwnet_device *dev = ptask->dev;
         unsigned long flags;
-
-        dev = ptask->dev;
+        bool free;
 
         spin_lock_irqsave(&dev->lock, flags);
-        list_del(&ptask->pt_link);
-        spin_unlock_irqrestore(&dev->lock, flags);
 
-        ptask->outstanding_pkts--; /* FIXME access inside lock */
+        ptask->outstanding_pkts--;
+
+        /* Check whether we or the networking TX soft-IRQ is last user. */
+        free = (ptask->outstanding_pkts == 0 && !list_empty(&ptask->pt_link));
+
+        if (ptask->outstanding_pkts == 0)
+                list_del(&ptask->pt_link);
+
+        spin_unlock_irqrestore(&dev->lock, flags);
 
         if (ptask->outstanding_pkts > 0) {
                 u16 dg_size;
@@ -951,10 +962,10 @@ static void fwnet_transmit_packet_done(struct fwnet_packet_task *ptask)
                         ptask->max_payload = skb->len + RFC2374_FRAG_HDR_SIZE;
                 }
                 fwnet_send_packet(ptask);
-        } else {
-                dev_kfree_skb_any(ptask->skb);
-                kmem_cache_free(fwnet_packet_task_cache, ptask);
         }
+
+        if (free)
+                fwnet_free_ptask(ptask);
 }
 
 static void fwnet_write_complete(struct fw_card *card, int rcode,
@@ -977,6 +988,7 @@ static int fwnet_send_packet(struct fwnet_packet_task *ptask)
         unsigned tx_len;
         struct rfc2734_header *bufhdr;
         unsigned long flags;
+        bool free;
 
         dev = ptask->dev;
         tx_len = ptask->max_payload;
@@ -1022,12 +1034,16 @@ static int fwnet_send_packet(struct fwnet_packet_task *ptask)
                                 generation, SCODE_100, 0ULL, ptask->skb->data,
                                 tx_len + 8, fwnet_write_complete, ptask);
 
-                /* FIXME race? */
                 spin_lock_irqsave(&dev->lock, flags);
-                list_add_tail(&ptask->pt_link, &dev->broadcasted_list);
+
+                /* If the AT tasklet already ran, we may be last user. */
+                free = (ptask->outstanding_pkts == 0 && list_empty(&ptask->pt_link));
+                if (!free)
+                        list_add_tail(&ptask->pt_link, &dev->broadcasted_list);
+
                 spin_unlock_irqrestore(&dev->lock, flags);
 
-                return 0;
+                goto out;
         }
 
         fw_send_request(dev->card, &ptask->transaction,
@@ -1035,12 +1051,19 @@ static int fwnet_send_packet(struct fwnet_packet_task *ptask)
                         ptask->generation, ptask->speed, ptask->fifo_addr,
                         ptask->skb->data, tx_len, fwnet_write_complete, ptask);
 
-        /* FIXME race? */
         spin_lock_irqsave(&dev->lock, flags);
-        list_add_tail(&ptask->pt_link, &dev->sent_list);
+
+        /* If the AT tasklet already ran, we may be last user. */
+        free = (ptask->outstanding_pkts == 0 && list_empty(&ptask->pt_link));
+        if (!free)
+                list_add_tail(&ptask->pt_link, &dev->sent_list);
+
         spin_unlock_irqrestore(&dev->lock, flags);
 
         dev->netdev->trans_start = jiffies;
+ out:
+        if (free)
+                fwnet_free_ptask(ptask);
 
         return 0;
 }
@@ -1298,6 +1321,8 @@ static netdev_tx_t fwnet_tx(struct sk_buff *skb, struct net_device *net)
         spin_unlock_irqrestore(&dev->lock, flags);
 
         ptask->max_payload = max_payload;
+        INIT_LIST_HEAD(&ptask->pt_link);
+
         fwnet_send_packet(ptask);
 
         return NETDEV_TX_OK;
diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index a61571c63c59..43ebf337b131 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c
@@ -2101,11 +2101,6 @@ static int ohci_queue_iso_transmit(struct fw_iso_context *base,
         u32 payload_index, payload_end_index, next_page_index;
         int page, end_page, i, length, offset;
 
-        /*
-         * FIXME: Cycle lost behavior should be configurable: lose
-         * packet, retransmit or terminate..
-         */
-
         p = packet;
         payload_index = payload;
 
@@ -2135,6 +2130,14 @@ static int ohci_queue_iso_transmit(struct fw_iso_context *base,
         if (!p->skip) {
                 d[0].control   = cpu_to_le16(DESCRIPTOR_KEY_IMMEDIATE);
                 d[0].req_count = cpu_to_le16(8);
+                /*
+                 * Link the skip address to this descriptor itself.  This causes
+                 * a context to skip a cycle whenever lost cycles or FIFO
+                 * overruns occur, without dropping the data.  The application
+                 * should then decide whether this is an error condition or not.
+                 * FIXME:  Make the context's cycle-lost behaviour configurable?
+                 */
+                d[0].branch_address = cpu_to_le32(d_bus | z);
 
                 header = (__le32 *) &d[1];
                 header[0] = cpu_to_le32(IT_HEADER_SY(p->sy) |
@@ -2420,6 +2423,7 @@ static void ohci_pmac_off(struct pci_dev *dev)
 
 #define PCI_VENDOR_ID_AGERE             PCI_VENDOR_ID_ATT
 #define PCI_DEVICE_ID_AGERE_FW643       0x5901
+#define PCI_DEVICE_ID_TI_TSB43AB23      0x8024
 
 static int __devinit pci_probe(struct pci_dev *dev,
                                const struct pci_device_id *ent)
@@ -2488,7 +2492,8 @@ static int __devinit pci_probe(struct pci_dev *dev,
 #if !defined(CONFIG_X86_32)
         /* dual-buffer mode is broken with descriptor addresses above 2G */
         if (dev->vendor == PCI_VENDOR_ID_TI &&
-            dev->device == PCI_DEVICE_ID_TI_TSB43AB22)
+            (dev->device == PCI_DEVICE_ID_TI_TSB43AB22 ||
+             dev->device == PCI_DEVICE_ID_TI_TSB43AB23))
                 ohci->use_dualbuffer = false;
 #endif
 
diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
index 96eddd17e050..305c59003963 100644
--- a/drivers/gpu/drm/Kconfig
+++ b/drivers/gpu/drm/Kconfig
@@ -66,6 +66,8 @@ config DRM_RADEON
 
           If M is selected, the module will be called radeon.
 
+source "drivers/gpu/drm/radeon/Kconfig"
+
 config DRM_I810
         tristate "Intel I810"
         depends on DRM && AGP && AGP_INTEL
diff --git a/drivers/gpu/drm/ati_pcigart.c b/drivers/gpu/drm/ati_pcigart.c
index a1fce68e3bbe..17be051b7aa3 100644
--- a/drivers/gpu/drm/ati_pcigart.c
+++ b/drivers/gpu/drm/ati_pcigart.c
@@ -113,7 +113,7 @@ int drm_ati_pcigart_init(struct drm_device *dev, struct drm_ati_pcigart_info *ga
 
                 if (pci_set_dma_mask(dev->pdev, gart_info->table_mask)) {
                         DRM_ERROR("fail to set dma mask to 0x%Lx\n",
-                                  gart_info->table_mask);
+                                  (unsigned long long)gart_info->table_mask);
                         ret = 1;
                         goto done;
                 }
diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
index f665b05592f3..ab6c97330412 100644
--- a/drivers/gpu/drm/drm_edid.c
+++ b/drivers/gpu/drm/drm_edid.c
@@ -598,6 +598,50 @@ struct drm_display_mode *drm_mode_std(struct drm_device *dev,
         return mode;
 }
 
+/*
+ * EDID is delightfully ambiguous about how interlaced modes are to be
+ * encoded.  Our internal representation is of frame height, but some
+ * HDTV detailed timings are encoded as field height.
+ *
+ * The format list here is from CEA, in frame size.  Technically we
+ * should be checking refresh rate too.  Whatever.
+ */
+static void
+drm_mode_do_interlace_quirk(struct drm_display_mode *mode,
+                            struct detailed_pixel_timing *pt)
+{
+        int i;
+        static const struct {
+                int w, h;
+        } cea_interlaced[] = {
+                { 1920, 1080 },
+                {  720,  480 },
+                { 1440,  480 },
+                { 2880,  480 },
+                {  720,  576 },
+                { 1440,  576 },
+                { 2880,  576 },
+        };
+        static const int n_sizes =
+                sizeof(cea_interlaced)/sizeof(cea_interlaced[0]);
+
+        if (!(pt->misc & DRM_EDID_PT_INTERLACED))
+                return;
+
+        for (i = 0; i < n_sizes; i++) {
+                if ((mode->hdisplay == cea_interlaced[i].w) &&
+                    (mode->vdisplay == cea_interlaced[i].h / 2)) {
+                        mode->vdisplay *= 2;
+                        mode->vsync_start *= 2;
+                        mode->vsync_end *= 2;
+                        mode->vtotal *= 2;
+                        mode->vtotal |= 1;
+                }
+        }
+
+        mode->flags |= DRM_MODE_FLAG_INTERLACE;
+}
+
 /**
  * drm_mode_detailed - create a new mode from an EDID detailed timing section
  * @dev: DRM device (needed to create new mode)
@@ -680,8 +724,7 @@ static struct drm_display_mode *drm_mode_detailed(struct drm_device *dev,
 
         drm_mode_set_name(mode);
 
-        if (pt->misc & DRM_EDID_PT_INTERLACED)
-                mode->flags |= DRM_MODE_FLAG_INTERLACE;
+        drm_mode_do_interlace_quirk(mode, pt);
 
         if (quirks & EDID_QUIRK_DETAILED_SYNC_PP) {
                 pt->misc |= DRM_EDID_PT_HSYNC_POSITIVE | DRM_EDID_PT_VSYNC_POSITIVE;
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index e9dbb481c469..8bf3770f294e 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -142,19 +142,6 @@ drm_gem_object_alloc(struct drm_device *dev, size_t size)
         if (IS_ERR(obj->filp))
                 goto free;
 
-        /* Basically we want to disable the OOM killer and handle ENOMEM
-         * ourselves by sacrificing pages from cached buffers.
-         * XXX shmem_file_[gs]et_gfp_mask()
-         */
-        mapping_set_gfp_mask(obj->filp->f_path.dentry->d_inode->i_mapping,
-                             GFP_HIGHUSER |
-                             __GFP_COLD |
-                             __GFP_FS |
-                             __GFP_RECLAIMABLE |
-                             __GFP_NORETRY |
-                             __GFP_NOWARN |
-                             __GFP_NOMEMALLOC);
-
         kref_init(&obj->refcount);
         kref_init(&obj->handlecount);
         obj->size = size;
diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
index cdec32977129..2ac074c8f5d2 100644
--- a/drivers/gpu/drm/drm_mm.c
+++ b/drivers/gpu/drm/drm_mm.c
@@ -405,7 +405,8 @@ struct drm_mm_node *drm_mm_search_free_in_range(const struct drm_mm *mm,
                                 wasted += alignment - tmp;
                 }
 
-                if (entry->size >= size + wasted) {
+                if (entry->size >= size + wasted &&
+                    (entry->start + wasted + size) <= end) {
                         if (!best_match)
                                 return entry;
                         if (entry->size < best_size) {
diff --git a/drivers/gpu/drm/i915/i915_debugfs.c b/drivers/gpu/drm/i915/i915_debugfs.c
index 9c9998c4dceb..a894ade03093 100644
--- a/drivers/gpu/drm/i915/i915_debugfs.c
+++ b/drivers/gpu/drm/i915/i915_debugfs.c
@@ -290,7 +290,7 @@ static int i915_batchbuffer_info(struct seq_file *m, void *data)
         list_for_each_entry(obj_priv, &dev_priv->mm.active_list, list) {
                 obj = obj_priv->obj;
                 if (obj->read_domains & I915_GEM_DOMAIN_COMMAND) {
-                    ret = i915_gem_object_get_pages(obj);
+                    ret = i915_gem_object_get_pages(obj, 0);
                     if (ret) {
                             DRM_ERROR("Failed to get pages: %d\n", ret);
                             spin_unlock(&dev_priv->mm.active_list_lock);
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index e660ac07f3b2..2307f98349f7 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -735,8 +735,10 @@ static int i915_cmdbuffer(struct drm_device *dev, void *data,
         if (cmdbuf->num_cliprects) {
                 cliprects = kcalloc(cmdbuf->num_cliprects,
                                     sizeof(struct drm_clip_rect), GFP_KERNEL);
-                if (cliprects == NULL)
+                if (cliprects == NULL) {
+                        ret = -ENOMEM;
                         goto fail_batch_free;
+                }
 
                 ret = copy_from_user(cliprects, cmdbuf->cliprects,
                                      cmdbuf->num_cliprects *
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index 46d88965852a..cf4cb3e9a0c2 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -120,7 +120,7 @@ const static struct intel_device_info intel_gm45_info = {
 
 const static struct intel_device_info intel_pineview_info = {
         .is_g33 = 1, .is_pineview = 1, .is_mobile = 1, .is_i9xx = 1,
-        .has_pipe_cxsr = 1,
+        .need_gfx_hws = 1,
         .has_hotplug = 1,
 };
 
@@ -174,26 +174,20 @@ const static struct pci_device_id pciidlist[] = {
 MODULE_DEVICE_TABLE(pci, pciidlist);
 #endif
 
-static int i915_suspend(struct drm_device *dev, pm_message_t state)
+static int i915_drm_freeze(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
 
-        if (!dev || !dev_priv) {
-                DRM_ERROR("dev: %p, dev_priv: %p\n", dev, dev_priv);
-                DRM_ERROR("DRM not initialized, aborting suspend.\n");
-                return -ENODEV;
-        }
-
-        if (state.event == PM_EVENT_PRETHAW)
-                return 0;
-
         pci_save_state(dev->pdev);
 
         /* If KMS is active, we do the leavevt stuff here */
         if (drm_core_check_feature(dev, DRIVER_MODESET)) {
-                if (i915_gem_idle(dev))
+                int error = i915_gem_idle(dev);
+                if (error) {
                         dev_err(&dev->pdev->dev,
-                                "GEM idle failed, resume may fail\n");
+                                "GEM idle failed, resume might fail\n");
+                        return error;
+                }
                 drm_irq_uninstall(dev);
         }
 
@@ -201,26 +195,42 @@ static int i915_suspend(struct drm_device *dev, pm_message_t state)
 
         intel_opregion_free(dev, 1);
 
+        /* Modeset on resume, not lid events */
+        dev_priv->modeset_on_lid = 0;
+
+        return 0;
+}
+
+static int i915_suspend(struct drm_device *dev, pm_message_t state)
+{
+        int error;
+
+        if (!dev || !dev->dev_private) {
+                DRM_ERROR("dev: %p\n", dev);
+                DRM_ERROR("DRM not initialized, aborting suspend.\n");
+                return -ENODEV;
+        }
+
+        if (state.event == PM_EVENT_PRETHAW)
+                return 0;
+
+        error = i915_drm_freeze(dev);
+        if (error)
+                return error;
+
         if (state.event == PM_EVENT_SUSPEND) {
                 /* Shut down the device */
                 pci_disable_device(dev->pdev);
                 pci_set_power_state(dev->pdev, PCI_D3hot);
         }
 
-        /* Modeset on resume, not lid events */
-        dev_priv->modeset_on_lid = 0;
-
         return 0;
 }
 
-static int i915_resume(struct drm_device *dev)
+static int i915_drm_thaw(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
-        int ret = 0;
-
-        if (pci_enable_device(dev->pdev))
-                return -1;
-        pci_set_master(dev->pdev);
+        int error = 0;
 
         i915_restore_state(dev);
 
@@ -231,21 +241,28 @@ static int i915_resume(struct drm_device *dev)
                 mutex_lock(&dev->struct_mutex);
                 dev_priv->mm.suspended = 0;
 
-                ret = i915_gem_init_ringbuffer(dev);
-                if (ret != 0)
-                        ret = -1;
+                error = i915_gem_init_ringbuffer(dev);
                 mutex_unlock(&dev->struct_mutex);
 
                 drm_irq_install(dev);
-        }
-        if (drm_core_check_feature(dev, DRIVER_MODESET)) {
+
                 /* Resume the modeset for every activated CRTC */
                 drm_helper_resume_force_mode(dev);
         }
 
         dev_priv->modeset_on_lid = 0;
 
-        return ret;
+        return error;
+}
+
+static int i915_resume(struct drm_device *dev)
+{
+        if (pci_enable_device(dev->pdev))
+                return -EIO;
+
+        pci_set_master(dev->pdev);
+
+        return i915_drm_thaw(dev);
 }
 
 /**
@@ -386,57 +403,62 @@ i915_pci_remove(struct pci_dev *pdev)
         drm_put_dev(dev);
 }
 
-static int
-i915_pci_suspend(struct pci_dev *pdev, pm_message_t state)
+static int i915_pm_suspend(struct device *dev)
 {
-        struct drm_device *dev = pci_get_drvdata(pdev);
+        struct pci_dev *pdev = to_pci_dev(dev);
+        struct drm_device *drm_dev = pci_get_drvdata(pdev);
+        int error;
 
-        return i915_suspend(dev, state);
-}
+        if (!drm_dev || !drm_dev->dev_private) {
+                dev_err(dev, "DRM not initialized, aborting suspend.\n");
+                return -ENODEV;
+        }
 
-static int
-i915_pci_resume(struct pci_dev *pdev)
-{
-        struct drm_device *dev = pci_get_drvdata(pdev);
+        error = i915_drm_freeze(drm_dev);
+        if (error)
+                return error;
 
-        return i915_resume(dev);
-}
+        pci_disable_device(pdev);
+        pci_set_power_state(pdev, PCI_D3hot);
 
-static int
-i915_pm_suspend(struct device *dev)
-{
-        return i915_pci_suspend(to_pci_dev(dev), PMSG_SUSPEND);
+        return 0;
 }
 
-static int
-i915_pm_resume(struct device *dev)
+static int i915_pm_resume(struct device *dev)
 {
-        return i915_pci_resume(to_pci_dev(dev));
-}
+        struct pci_dev *pdev = to_pci_dev(dev);
+        struct drm_device *drm_dev = pci_get_drvdata(pdev);
 
-static int
-i915_pm_freeze(struct device *dev)
-{
-        return i915_pci_suspend(to_pci_dev(dev), PMSG_FREEZE);
+        return i915_resume(drm_dev);
 }
 
-static int
-i915_pm_thaw(struct device *dev)
+static int i915_pm_freeze(struct device *dev)
 {
-        /* thaw during hibernate, do nothing! */
-        return 0;
+        struct pci_dev *pdev = to_pci_dev(dev);
+        struct drm_device *drm_dev = pci_get_drvdata(pdev);
+
+        if (!drm_dev || !drm_dev->dev_private) {
+                dev_err(dev, "DRM not initialized, aborting suspend.\n");
+                return -ENODEV;
+        }
+
+        return i915_drm_freeze(drm_dev);
 }
 
-static int
-i915_pm_poweroff(struct device *dev)
+static int i915_pm_thaw(struct device *dev)
 {
-        return i915_pci_suspend(to_pci_dev(dev), PMSG_HIBERNATE);
+        struct pci_dev *pdev = to_pci_dev(dev);
+        struct drm_device *drm_dev = pci_get_drvdata(pdev);
+
+        return i915_drm_thaw(drm_dev);
 }
 
-static int
-i915_pm_restore(struct device *dev)
+static int i915_pm_poweroff(struct device *dev)
 {
-        return i915_pci_resume(to_pci_dev(dev));
+        struct pci_dev *pdev = to_pci_dev(dev);
+        struct drm_device *drm_dev = pci_get_drvdata(pdev);
+
+        return i915_drm_freeze(drm_dev);
 }
 
 const struct dev_pm_ops i915_pm_ops = {
@@ -445,7 +467,7 @@ const struct dev_pm_ops i915_pm_ops = {
      .freeze = i915_pm_freeze,
      .thaw = i915_pm_thaw,
      .poweroff = i915_pm_poweroff,
-     .restore = i915_pm_restore,
+     .restore = i915_pm_resume,
 };
 
 static struct vm_operations_struct i915_gem_vm_ops = {
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index 2c1669488b5a..b99b6a841d95 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -493,6 +493,15 @@ typedef struct drm_i915_private {
                 struct list_head flushing_list;
 
                 /**
+                 * List of objects currently pending a GPU write flush.
+                 *
+                 * All elements on this list will belong to either the
+                 * active_list or flushing_list, last_rendering_seqno can
+                 * be used to differentiate between the two elements.
+                 */
+                struct list_head gpu_write_list;
+
+                /**
                  * LRU list of objects which are not in the ringbuffer and
                  * are ready to unbind, but are still in the GTT.
                  *
@@ -592,6 +601,8 @@ struct drm_i915_gem_object {
 
         /** This object's place on the active/flushing/inactive lists */
         struct list_head list;
+        /** This object's place on GPU write list */
+        struct list_head gpu_write_list;
 
         /** This object's place on the fenced object LRU */
         struct list_head fence_list;
@@ -872,7 +883,7 @@ int i915_gem_attach_phys_object(struct drm_device *dev,
 void i915_gem_detach_phys_object(struct drm_device *dev,
                                  struct drm_gem_object *obj);
 void i915_gem_free_all_phys_object(struct drm_device *dev);
-int i915_gem_object_get_pages(struct drm_gem_object *obj);
+int i915_gem_object_get_pages(struct drm_gem_object *obj, gfp_t gfpmask);
 void i915_gem_object_put_pages(struct drm_gem_object *obj);
 void i915_gem_release(struct drm_device * dev, struct drm_file *file_priv);
 void i915_gem_object_flush_write_domain(struct drm_gem_object *obj);
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 0c67924ca80c..ec8a0d7ffa39 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -277,7 +277,7 @@ i915_gem_shmem_pread_fast(struct drm_device *dev, struct drm_gem_object *obj,
 
         mutex_lock(&dev->struct_mutex);
 
-        ret = i915_gem_object_get_pages(obj);
+        ret = i915_gem_object_get_pages(obj, 0);
         if (ret != 0)
                 goto fail_unlock;
 
@@ -321,40 +321,24 @@ fail_unlock:
         return ret;
 }
 
-static inline gfp_t
-i915_gem_object_get_page_gfp_mask (struct drm_gem_object *obj)
-{
-        return mapping_gfp_mask(obj->filp->f_path.dentry->d_inode->i_mapping);
-}
-
-static inline void
-i915_gem_object_set_page_gfp_mask (struct drm_gem_object *obj, gfp_t gfp)
-{
-        mapping_set_gfp_mask(obj->filp->f_path.dentry->d_inode->i_mapping, gfp);
-}
-
 static int
 i915_gem_object_get_pages_or_evict(struct drm_gem_object *obj)
 {
         int ret;
 
-        ret = i915_gem_object_get_pages(obj);
+        ret = i915_gem_object_get_pages(obj, __GFP_NORETRY | __GFP_NOWARN);
 
         /* If we've insufficient memory to map in the pages, attempt
          * to make some space by throwing out some old buffers.
          */
         if (ret == -ENOMEM) {
                 struct drm_device *dev = obj->dev;
-                gfp_t gfp;
 
                 ret = i915_gem_evict_something(dev, obj->size);
                 if (ret)
                         return ret;
 
-                gfp = i915_gem_object_get_page_gfp_mask(obj);
-                i915_gem_object_set_page_gfp_mask(obj, gfp & ~__GFP_NORETRY);
-                ret = i915_gem_object_get_pages(obj);
-                i915_gem_object_set_page_gfp_mask (obj, gfp);
+                ret = i915_gem_object_get_pages(obj, 0);
         }
 
         return ret;
@@ -790,7 +774,7 @@ i915_gem_shmem_pwrite_fast(struct drm_device *dev, struct drm_gem_object *obj,
 
         mutex_lock(&dev->struct_mutex);
 
-        ret = i915_gem_object_get_pages(obj);
+        ret = i915_gem_object_get_pages(obj, 0);
         if (ret != 0)
                 goto fail_unlock;
 
@@ -1568,6 +1552,8 @@ i915_gem_object_move_to_inactive(struct drm_gem_object *obj)
         else
                 list_move_tail(&obj_priv->list, &dev_priv->mm.inactive_list);
 
+        BUG_ON(!list_empty(&obj_priv->gpu_write_list));
+
         obj_priv->last_rendering_seqno = 0;
         if (obj_priv->active) {
                 obj_priv->active = 0;
@@ -1638,7 +1624,8 @@ i915_add_request(struct drm_device *dev, struct drm_file *file_priv,
                 struct drm_i915_gem_object *obj_priv, *next;
 
                 list_for_each_entry_safe(obj_priv, next,
-                                         &dev_priv->mm.flushing_list, list) {
+                                         &dev_priv->mm.gpu_write_list,
+                                         gpu_write_list) {
                         struct drm_gem_object *obj = obj_priv->obj;
 
                         if ((obj->write_domain & flush_domains) ==
@@ -1646,6 +1633,7 @@ i915_add_request(struct drm_device *dev, struct drm_file *file_priv,
                                 uint32_t old_write_domain = obj->write_domain;
 
                                 obj->write_domain = 0;
+                                list_del_init(&obj_priv->gpu_write_list);
                                 i915_gem_object_move_to_active(obj, seqno);
 
                                 trace_i915_gem_object_change_domain(obj,
@@ -2100,8 +2088,8 @@ static int
 i915_gem_evict_everything(struct drm_device *dev)
 {
         drm_i915_private_t *dev_priv = dev->dev_private;
-        uint32_t seqno;
         int ret;
+        uint32_t seqno;
         bool lists_empty;
 
         spin_lock(&dev_priv->mm.active_list_lock);
@@ -2123,6 +2111,8 @@ i915_gem_evict_everything(struct drm_device *dev)
         if (ret)
                 return ret;
 
+        BUG_ON(!list_empty(&dev_priv->mm.flushing_list));
+
         ret = i915_gem_evict_from_inactive_list(dev);
         if (ret)
                 return ret;
@@ -2230,7 +2220,8 @@ i915_gem_evict_something(struct drm_device *dev, int min_size)
 }
 
 int
-i915_gem_object_get_pages(struct drm_gem_object *obj)
+i915_gem_object_get_pages(struct drm_gem_object *obj,
+                          gfp_t gfpmask)
 {
         struct drm_i915_gem_object *obj_priv = obj->driver_private;
         int page_count, i;
@@ -2256,7 +2247,10 @@ i915_gem_object_get_pages(struct drm_gem_object *obj)
         inode = obj->filp->f_path.dentry->d_inode;
         mapping = inode->i_mapping;
         for (i = 0; i < page_count; i++) {
-                page = read_mapping_page(mapping, i, NULL);
+                page = read_cache_page_gfp(mapping, i,
+                                           mapping_gfp_mask (mapping) |
+                                           __GFP_COLD |
+                                           gfpmask);
                 if (IS_ERR(page)) {
                         ret = PTR_ERR(page);
                         i915_gem_object_put_pages(obj);
@@ -2579,7 +2573,7 @@ i915_gem_object_bind_to_gtt(struct drm_gem_object *obj, unsigned alignment)
         drm_i915_private_t *dev_priv = dev->dev_private;
         struct drm_i915_gem_object *obj_priv = obj->driver_private;
         struct drm_mm_node *free_space;
-        bool retry_alloc = false;
+        gfp_t gfpmask =  __GFP_NORETRY | __GFP_NOWARN;
         int ret;
 
         if (obj_priv->madv != I915_MADV_WILLNEED) {
@@ -2623,15 +2617,7 @@ i915_gem_object_bind_to_gtt(struct drm_gem_object *obj, unsigned alignment)
         DRM_INFO("Binding object of size %zd at 0x%08x\n",
                  obj->size, obj_priv->gtt_offset);
 #endif
-        if (retry_alloc) {
-                i915_gem_object_set_page_gfp_mask (obj,
-                                                   i915_gem_object_get_page_gfp_mask (obj) & ~__GFP_NORETRY);
-        }
-        ret = i915_gem_object_get_pages(obj);
-        if (retry_alloc) {
-                i915_gem_object_set_page_gfp_mask (obj,
-                                                   i915_gem_object_get_page_gfp_mask (obj) | __GFP_NORETRY);
-        }
+        ret = i915_gem_object_get_pages(obj, gfpmask);
         if (ret) {
                 drm_mm_put_block(obj_priv->gtt_space);
                 obj_priv->gtt_space = NULL;
@@ -2641,9 +2627,9 @@ i915_gem_object_bind_to_gtt(struct drm_gem_object *obj, unsigned alignment)
                         ret = i915_gem_evict_something(dev, obj->size);
                         if (ret) {
                                 /* now try to shrink everyone else */
-                                if (! retry_alloc) {
-                                    retry_alloc = true;
-                                    goto search_free;
+                                if (gfpmask) {
+                                        gfpmask = 0;
+                                        goto search_free;
                                 }
 
                                 return ret;
@@ -2721,7 +2707,7 @@ i915_gem_object_flush_gpu_write_domain(struct drm_gem_object *obj)
         old_write_domain = obj->write_domain;
         i915_gem_flush(dev, 0, obj->write_domain);
         seqno = i915_add_request(dev, NULL, obj->write_domain);
-        obj->write_domain = 0;
+        BUG_ON(obj->write_domain);
         i915_gem_object_move_to_active(obj, seqno);
 
         trace_i915_gem_object_change_domain(obj,
@@ -3584,6 +3570,9 @@ i915_gem_put_relocs_to_user(struct drm_i915_gem_exec_object2 *exec_list,
         uint32_t reloc_count = 0, i;
         int ret = 0;
 
+        if (relocs == NULL)
+            return 0;
+
         for (i = 0; i < buffer_count; i++) {
                 struct drm_i915_gem_relocation_entry __user *user_relocs;
                 int unwritten;
@@ -3673,7 +3662,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
         struct drm_gem_object *batch_obj;
         struct drm_i915_gem_object *obj_priv;
         struct drm_clip_rect *cliprects = NULL;
-        struct drm_i915_gem_relocation_entry *relocs;
+        struct drm_i915_gem_relocation_entry *relocs = NULL;
         int ret = 0, ret2, i, pinned = 0;
         uint64_t exec_offset;
         uint32_t seqno, flush_domains, reloc_index;
@@ -3699,8 +3688,10 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
         if (args->num_cliprects != 0) {
                 cliprects = kcalloc(args->num_cliprects, sizeof(*cliprects),
                                     GFP_KERNEL);
-                if (cliprects == NULL)
+                if (cliprects == NULL) {
+                        ret = -ENOMEM;
                         goto pre_mutex_err;
+                }
 
                 ret = copy_from_user(cliprects,
                                      (struct drm_clip_rect __user *)
@@ -3742,6 +3733,8 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
                 if (object_list[i] == NULL) {
                         DRM_ERROR("Invalid object handle %d at index %d\n",
                                    exec_list[i].handle, i);
+                        /* prevent error path from reading uninitialized data */
+                        args->buffer_count = i + 1;
                         ret = -EBADF;
                         goto err;
                 }
@@ -3750,6 +3743,8 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
                 if (obj_priv->in_execbuffer) {
                         DRM_ERROR("Object %p appears more than once in object list\n",
                                    object_list[i]);
+                        /* prevent error path from reading uninitialized data */
+                        args->buffer_count = i + 1;
                         ret = -EBADF;
                         goto err;
                 }
@@ -3863,16 +3858,23 @@ i915_gem_do_execbuffer(struct drm_device *dev, void *data,
                 i915_gem_flush(dev,
                                dev->invalidate_domains,
                                dev->flush_domains);
-                if (dev->flush_domains)
+                if (dev->flush_domains & I915_GEM_GPU_DOMAINS)
                         (void)i915_add_request(dev, file_priv,
                                                dev->flush_domains);
         }
 
         for (i = 0; i < args->buffer_count; i++) {
                 struct drm_gem_object *obj = object_list[i];
+                struct drm_i915_gem_object *obj_priv = obj->driver_private;
                 uint32_t old_write_domain = obj->write_domain;
 
                 obj->write_domain = obj->pending_write_domain;
+                if (obj->write_domain)
+                        list_move_tail(&obj_priv->gpu_write_list,
+                                       &dev_priv->mm.gpu_write_list);
+                else
+                        list_del_init(&obj_priv->gpu_write_list);
+
                 trace_i915_gem_object_change_domain(obj,
                                                     obj->read_domains,
                                                     old_write_domain);
@@ -3946,6 +3948,7 @@ err:
 
         mutex_unlock(&dev->struct_mutex);
 
+pre_mutex_err:
         /* Copy the updated relocations out regardless of current error
          * state.  Failure to update the relocs would mean that the next
          * time userland calls execbuf, it would do so with presumed offset
@@ -3960,7 +3963,6 @@ err:
                         ret = ret2;
         }
 
-pre_mutex_err:
         drm_free_large(object_list);
         kfree(cliprects);
 
@@ -4383,6 +4385,7 @@ int i915_gem_init_object(struct drm_gem_object *obj)
         obj_priv->obj = obj;
         obj_priv->fence_reg = I915_FENCE_REG_NONE;
         INIT_LIST_HEAD(&obj_priv->list);
+        INIT_LIST_HEAD(&obj_priv->gpu_write_list);
         INIT_LIST_HEAD(&obj_priv->fence_list);
         obj_priv->madv = I915_MADV_WILLNEED;
 
@@ -4834,6 +4837,7 @@ i915_gem_load(struct drm_device *dev)
         spin_lock_init(&dev_priv->mm.active_list_lock);
         INIT_LIST_HEAD(&dev_priv->mm.active_list);
         INIT_LIST_HEAD(&dev_priv->mm.flushing_list);
+        INIT_LIST_HEAD(&dev_priv->mm.gpu_write_list);
         INIT_LIST_HEAD(&dev_priv->mm.inactive_list);
         INIT_LIST_HEAD(&dev_priv->mm.request_list);
         INIT_LIST_HEAD(&dev_priv->mm.fence_list);
@@ -4946,7 +4950,7 @@ void i915_gem_detach_phys_object(struct drm_device *dev,
         if (!obj_priv->phys_obj)
                 return;
 
-        ret = i915_gem_object_get_pages(obj);
+        ret = i915_gem_object_get_pages(obj, 0);
         if (ret)
                 goto out;
 
@@ -5004,7 +5008,7 @@ i915_gem_attach_phys_object(struct drm_device *dev,
         obj_priv->phys_obj = dev_priv->mm.phys_objs[id - 1];
         obj_priv->phys_obj->cur_obj = obj;
 
-        ret = i915_gem_object_get_pages(obj);
+        ret = i915_gem_object_get_pages(obj, 0);
         if (ret) {
                 DRM_ERROR("failed to get page list\n");
                 goto out;
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 89a071a3e6fb..a17d6bdfe63e 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -309,6 +309,22 @@ irqreturn_t ironlake_irq_handler(struct drm_device *dev)
         if (de_iir & DE_GSE)
                 ironlake_opregion_gse_intr(dev);
 
+        if (de_iir & DE_PLANEA_FLIP_DONE) {
+                intel_prepare_page_flip(dev, 0);
+                intel_finish_page_flip(dev, 0);
+        }
+
+        if (de_iir & DE_PLANEB_FLIP_DONE) {
+                intel_prepare_page_flip(dev, 1);
+                intel_finish_page_flip(dev, 1);
+        }
+
+        if (de_iir & DE_PIPEA_VBLANK)
+                drm_handle_vblank(dev, 0);
+
+        if (de_iir & DE_PIPEB_VBLANK)
+                drm_handle_vblank(dev, 1);
+
         /* check event from PCH */
         if ((de_iir & DE_PCH_EVENT) &&
             (pch_iir & SDE_HOTPLUG_MASK)) {
@@ -844,11 +860,11 @@ int i915_enable_vblank(struct drm_device *dev, int pipe)
         if (!(pipeconf & PIPEACONF_ENABLE))
                 return -EINVAL;
 
-        if (IS_IRONLAKE(dev))
-                return 0;
-
         spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
-        if (IS_I965G(dev))
+        if (IS_IRONLAKE(dev))
+                ironlake_enable_display_irq(dev_priv, (pipe == 0) ? 
+                                            DE_PIPEA_VBLANK: DE_PIPEB_VBLANK);
+        else if (IS_I965G(dev))
                 i915_enable_pipestat(dev_priv, pipe,
                                      PIPE_START_VBLANK_INTERRUPT_ENABLE);
         else
@@ -866,13 +882,14 @@ void i915_disable_vblank(struct drm_device *dev, int pipe)
         drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
         unsigned long irqflags;
 
-        if (IS_IRONLAKE(dev))
-                return;
-
         spin_lock_irqsave(&dev_priv->user_irq_lock, irqflags);
-        i915_disable_pipestat(dev_priv, pipe,
-                              PIPE_VBLANK_INTERRUPT_ENABLE |
-                              PIPE_START_VBLANK_INTERRUPT_ENABLE);
+        if (IS_IRONLAKE(dev))
+                ironlake_disable_display_irq(dev_priv, (pipe == 0) ? 
+                                             DE_PIPEA_VBLANK: DE_PIPEB_VBLANK);
+        else
+                i915_disable_pipestat(dev_priv, pipe,
+                                      PIPE_VBLANK_INTERRUPT_ENABLE |
+                                      PIPE_START_VBLANK_INTERRUPT_ENABLE);
         spin_unlock_irqrestore(&dev_priv->user_irq_lock, irqflags);
 }
 
@@ -1015,13 +1032,14 @@ static int ironlake_irq_postinstall(struct drm_device *dev)
 {
         drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
         /* enable kind of interrupts always enabled */
-        u32 display_mask = DE_MASTER_IRQ_CONTROL | DE_GSE | DE_PCH_EVENT;
+        u32 display_mask = DE_MASTER_IRQ_CONTROL | DE_GSE | DE_PCH_EVENT |
+                           DE_PLANEA_FLIP_DONE | DE_PLANEB_FLIP_DONE;
         u32 render_mask = GT_USER_INTERRUPT;
         u32 hotplug_mask = SDE_CRT_HOTPLUG | SDE_PORTB_HOTPLUG |
                            SDE_PORTC_HOTPLUG | SDE_PORTD_HOTPLUG;
 
         dev_priv->irq_mask_reg = ~display_mask;
-        dev_priv->de_irq_enable_reg = display_mask;
+        dev_priv->de_irq_enable_reg = display_mask | DE_PIPEA_VBLANK | DE_PIPEB_VBLANK;
 
         /* should always can generate irq */
         I915_WRITE(DEIIR, I915_READ(DEIIR));
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 847006c5218e..ab1bd2d3d3b6 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -338,6 +338,7 @@
 #define   FBC_CTL_PERIODIC      (1<<30)
 #define   FBC_CTL_INTERVAL_SHIFT (16)
 #define   FBC_CTL_UNCOMPRESSIBLE (1<<14)
+#define   FBC_C3_IDLE           (1<<13)
 #define   FBC_CTL_STRIDE_SHIFT  (5)
 #define   FBC_CTL_FENCENO       (1<<0)
 #define FBC_COMMAND             0x0320c
diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c
index ddefc871edfe..79dd4026586f 100644
--- a/drivers/gpu/drm/i915/intel_crt.c
+++ b/drivers/gpu/drm/i915/intel_crt.c
@@ -157,6 +157,9 @@ static bool intel_ironlake_crt_detect_hotplug(struct drm_connector *connector)
         adpa = I915_READ(PCH_ADPA);
 
         adpa &= ~ADPA_CRT_HOTPLUG_MASK;
+        /* disable HPD first */
+        I915_WRITE(PCH_ADPA, adpa);
+        (void)I915_READ(PCH_ADPA);
 
         adpa |= (ADPA_CRT_HOTPLUG_PERIOD_128 |
                         ADPA_CRT_HOTPLUG_WARMUP_10MS |
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 45da78ef4a92..b27202d23ebc 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -240,33 +240,86 @@ struct intel_limit {
 #define IRONLAKE_DOT_MAX         350000
 #define IRONLAKE_VCO_MIN         1760000
 #define IRONLAKE_VCO_MAX         3510000
-#define IRONLAKE_N_MIN           1
-#define IRONLAKE_N_MAX           6
-#define IRONLAKE_M_MIN           79
-#define IRONLAKE_M_MAX           127
 #define IRONLAKE_M1_MIN          12
 #define IRONLAKE_M1_MAX          22
 #define IRONLAKE_M2_MIN          5
 #define IRONLAKE_M2_MAX          9
-#define IRONLAKE_P_SDVO_DAC_MIN  5
-#define IRONLAKE_P_SDVO_DAC_MAX  80
-#define IRONLAKE_P_LVDS_MIN      28
-#define IRONLAKE_P_LVDS_MAX      112
-#define IRONLAKE_P1_MIN          1
-#define IRONLAKE_P1_MAX          8
-#define IRONLAKE_P2_SDVO_DAC_SLOW 10
-#define IRONLAKE_P2_SDVO_DAC_FAST 5
-#define IRONLAKE_P2_LVDS_SLOW    14 /* single channel */
-#define IRONLAKE_P2_LVDS_FAST    7  /* double channel */
 #define IRONLAKE_P2_DOT_LIMIT    225000 /* 225Mhz */
 
-#define IRONLAKE_P_DISPLAY_PORT_MIN     10
-#define IRONLAKE_P_DISPLAY_PORT_MAX     20
-#define IRONLAKE_P2_DISPLAY_PORT_FAST   10
-#define IRONLAKE_P2_DISPLAY_PORT_SLOW   10
-#define IRONLAKE_P2_DISPLAY_PORT_LIMIT  0
-#define IRONLAKE_P1_DISPLAY_PORT_MIN    1
-#define IRONLAKE_P1_DISPLAY_PORT_MAX    2
+/* We have parameter ranges for different type of outputs. */
+
+/* DAC & HDMI Refclk 120Mhz */
+#define IRONLAKE_DAC_N_MIN      1
+#define IRONLAKE_DAC_N_MAX      5
+#define IRONLAKE_DAC_M_MIN      79
+#define IRONLAKE_DAC_M_MAX      127
+#define IRONLAKE_DAC_P_MIN      5
+#define IRONLAKE_DAC_P_MAX      80
+#define IRONLAKE_DAC_P1_MIN     1
+#define IRONLAKE_DAC_P1_MAX     8
+#define IRONLAKE_DAC_P2_SLOW    10
+#define IRONLAKE_DAC_P2_FAST    5
+
+/* LVDS single-channel 120Mhz refclk */
+#define IRONLAKE_LVDS_S_N_MIN   1
+#define IRONLAKE_LVDS_S_N_MAX   3
+#define IRONLAKE_LVDS_S_M_MIN   79
+#define IRONLAKE_LVDS_S_M_MAX   118
+#define IRONLAKE_LVDS_S_P_MIN   28
+#define IRONLAKE_LVDS_S_P_MAX   112
+#define IRONLAKE_LVDS_S_P1_MIN  2
+#define IRONLAKE_LVDS_S_P1_MAX  8
+#define IRONLAKE_LVDS_S_P2_SLOW 14
+#define IRONLAKE_LVDS_S_P2_FAST 14
+
+/* LVDS dual-channel 120Mhz refclk */
+#define IRONLAKE_LVDS_D_N_MIN   1
+#define IRONLAKE_LVDS_D_N_MAX   3
+#define IRONLAKE_LVDS_D_M_MIN   79
+#define IRONLAKE_LVDS_D_M_MAX   127
+#define IRONLAKE_LVDS_D_P_MIN   14
+#define IRONLAKE_LVDS_D_P_MAX   56
+#define IRONLAKE_LVDS_D_P1_MIN  2
+#define IRONLAKE_LVDS_D_P1_MAX  8
+#define IRONLAKE_LVDS_D_P2_SLOW 7
+#define IRONLAKE_LVDS_D_P2_FAST 7
+
+/* LVDS single-channel 100Mhz refclk */
+#define IRONLAKE_LVDS_S_SSC_N_MIN       1
+#define IRONLAKE_LVDS_S_SSC_N_MAX       2
+#define IRONLAKE_LVDS_S_SSC_M_MIN       79
+#define IRONLAKE_LVDS_S_SSC_M_MAX       126
+#define IRONLAKE_LVDS_S_SSC_P_MIN       28
+#define IRONLAKE_LVDS_S_SSC_P_MAX       112
+#define IRONLAKE_LVDS_S_SSC_P1_MIN      2
+#define IRONLAKE_LVDS_S_SSC_P1_MAX      8
+#define IRONLAKE_LVDS_S_SSC_P2_SLOW     14
+#define IRONLAKE_LVDS_S_SSC_P2_FAST     14
+
+/* LVDS dual-channel 100Mhz refclk */
+#define IRONLAKE_LVDS_D_SSC_N_MIN       1
+#define IRONLAKE_LVDS_D_SSC_N_MAX       3
+#define IRONLAKE_LVDS_D_SSC_M_MIN       79
+#define IRONLAKE_LVDS_D_SSC_M_MAX       126
+#define IRONLAKE_LVDS_D_SSC_P_MIN       14
+#define IRONLAKE_LVDS_D_SSC_P_MAX       42
+#define IRONLAKE_LVDS_D_SSC_P1_MIN      2
+#define IRONLAKE_LVDS_D_SSC_P1_MAX      6
+#define IRONLAKE_LVDS_D_SSC_P2_SLOW     7
+#define IRONLAKE_LVDS_D_SSC_P2_FAST     7
+
+/* DisplayPort */
+#define IRONLAKE_DP_N_MIN               1
+#define IRONLAKE_DP_N_MAX               2
+#define IRONLAKE_DP_M_MIN               81
+#define IRONLAKE_DP_M_MAX               90
+#define IRONLAKE_DP_P_MIN               10
+#define IRONLAKE_DP_P_MAX               20
+#define IRONLAKE_DP_P2_FAST             10
+#define IRONLAKE_DP_P2_SLOW             10
+#define IRONLAKE_DP_P2_LIMIT            0
+#define IRONLAKE_DP_P1_MIN              1
+#define IRONLAKE_DP_P1_MAX              2
 
 static bool
 intel_find_best_PLL(const intel_limit_t *limit, struct drm_crtc *crtc,
@@ -474,33 +527,78 @@ static const intel_limit_t intel_limits_pineview_lvds = {
         .find_pll = intel_find_best_PLL,
 };
 
-static const intel_limit_t intel_limits_ironlake_sdvo = {
+static const intel_limit_t intel_limits_ironlake_dac = {
         .dot = { .min = IRONLAKE_DOT_MIN,          .max = IRONLAKE_DOT_MAX },
         .vco = { .min = IRONLAKE_VCO_MIN,          .max = IRONLAKE_VCO_MAX },
-        .n   = { .min = IRONLAKE_N_MIN,            .max = IRONLAKE_N_MAX },
-        .m   = { .min = IRONLAKE_M_MIN,            .max = IRONLAKE_M_MAX },
+        .n   = { .min = IRONLAKE_DAC_N_MIN,        .max = IRONLAKE_DAC_N_MAX },
+        .m   = { .min = IRONLAKE_DAC_M_MIN,        .max = IRONLAKE_DAC_M_MAX },
         .m1  = { .min = IRONLAKE_M1_MIN,           .max = IRONLAKE_M1_MAX },
         .m2  = { .min = IRONLAKE_M2_MIN,           .max = IRONLAKE_M2_MAX },
-        .p   = { .min = IRONLAKE_P_SDVO_DAC_MIN,   .max = IRONLAKE_P_SDVO_DAC_MAX },
-        .p1  = { .min = IRONLAKE_P1_MIN,           .max = IRONLAKE_P1_MAX },
+        .p   = { .min = IRONLAKE_DAC_P_MIN,        .max = IRONLAKE_DAC_P_MAX },
+        .p1  = { .min = IRONLAKE_DAC_P1_MIN,       .max = IRONLAKE_DAC_P1_MAX },
         .p2  = { .dot_limit = IRONLAKE_P2_DOT_LIMIT,
-                 .p2_slow = IRONLAKE_P2_SDVO_DAC_SLOW,
-                 .p2_fast = IRONLAKE_P2_SDVO_DAC_FAST },
+                 .p2_slow = IRONLAKE_DAC_P2_SLOW,
+                 .p2_fast = IRONLAKE_DAC_P2_FAST },
         .find_pll = intel_g4x_find_best_PLL,
 };
 
-static const intel_limit_t intel_limits_ironlake_lvds = {
+static const intel_limit_t intel_limits_ironlake_single_lvds = {
         .dot = { .min = IRONLAKE_DOT_MIN,          .max = IRONLAKE_DOT_MAX },
         .vco = { .min = IRONLAKE_VCO_MIN,          .max = IRONLAKE_VCO_MAX },
-        .n   = { .min = IRONLAKE_N_MIN,            .max = IRONLAKE_N_MAX },
-        .m   = { .min = IRONLAKE_M_MIN,            .max = IRONLAKE_M_MAX },
+        .n   = { .min = IRONLAKE_LVDS_S_N_MIN,     .max = IRONLAKE_LVDS_S_N_MAX },
+        .m   = { .min = IRONLAKE_LVDS_S_M_MIN,     .max = IRONLAKE_LVDS_S_M_MAX },
         .m1  = { .min = IRONLAKE_M1_MIN,           .max = IRONLAKE_M1_MAX },
         .m2  = { .min = IRONLAKE_M2_MIN,           .max = IRONLAKE_M2_MAX },
-        .p   = { .min = IRONLAKE_P_LVDS_MIN,       .max = IRONLAKE_P_LVDS_MAX },
-        .p1  = { .min = IRONLAKE_P1_MIN,           .max = IRONLAKE_P1_MAX },
+        .p   = { .min = IRONLAKE_LVDS_S_P_MIN,     .max = IRONLAKE_LVDS_S_P_MAX },
+        .p1  = { .min = IRONLAKE_LVDS_S_P1_MIN,    .max = IRONLAKE_LVDS_S_P1_MAX },
         .p2  = { .dot_limit = IRONLAKE_P2_DOT_LIMIT,
-                 .p2_slow = IRONLAKE_P2_LVDS_SLOW,
-                 .p2_fast = IRONLAKE_P2_LVDS_FAST },
+                 .p2_slow = IRONLAKE_LVDS_S_P2_SLOW,
+                 .p2_fast = IRONLAKE_LVDS_S_P2_FAST },
+        .find_pll = intel_g4x_find_best_PLL,
+};
+
+static const intel_limit_t intel_limits_ironlake_dual_lvds = {
+        .dot = { .min = IRONLAKE_DOT_MIN,          .max = IRONLAKE_DOT_MAX },
+        .vco = { .min = IRONLAKE_VCO_MIN,          .max = IRONLAKE_VCO_MAX },
+        .n   = { .min = IRONLAKE_LVDS_D_N_MIN,     .max = IRONLAKE_LVDS_D_N_MAX },
+        .m   = { .min = IRONLAKE_LVDS_D_M_MIN,     .max = IRONLAKE_LVDS_D_M_MAX },
+        .m1  = { .min = IRONLAKE_M1_MIN,           .max = IRONLAKE_M1_MAX },
+        .m2  = { .min = IRONLAKE_M2_MIN,           .max = IRONLAKE_M2_MAX },
+        .p   = { .min = IRONLAKE_LVDS_D_P_MIN,     .max = IRONLAKE_LVDS_D_P_MAX },
+        .p1  = { .min = IRONLAKE_LVDS_D_P1_MIN,    .max = IRONLAKE_LVDS_D_P1_MAX },
+        .p2  = { .dot_limit = IRONLAKE_P2_DOT_LIMIT,
+                 .p2_slow = IRONLAKE_LVDS_D_P2_SLOW,
+                 .p2_fast = IRONLAKE_LVDS_D_P2_FAST },
+        .find_pll = intel_g4x_find_best_PLL,
+};
+
+static const intel_limit_t intel_limits_ironlake_single_lvds_100m = {
+        .dot = { .min = IRONLAKE_DOT_MIN,          .max = IRONLAKE_DOT_MAX },
+        .vco = { .min = IRONLAKE_VCO_MIN,          .max = IRONLAKE_VCO_MAX },
+        .n   = { .min = IRONLAKE_LVDS_S_SSC_N_MIN, .max = IRONLAKE_LVDS_S_SSC_N_MAX },
+        .m   = { .min = IRONLAKE_LVDS_S_SSC_M_MIN, .max = IRONLAKE_LVDS_S_SSC_M_MAX },
+        .m1  = { .min = IRONLAKE_M1_MIN,           .max = IRONLAKE_M1_MAX },
+        .m2  = { .min = IRONLAKE_M2_MIN,           .max = IRONLAKE_M2_MAX },
+        .p   = { .min = IRONLAKE_LVDS_S_SSC_P_MIN, .max = IRONLAKE_LVDS_S_SSC_P_MAX },
+        .p1  = { .min = IRONLAKE_LVDS_S_SSC_P1_MIN,.max = IRONLAKE_LVDS_S_SSC_P1_MAX },
+        .p2  = { .dot_limit = IRONLAKE_P2_DOT_LIMIT,
+                 .p2_slow = IRONLAKE_LVDS_S_SSC_P2_SLOW,
+                 .p2_fast = IRONLAKE_LVDS_S_SSC_P2_FAST },
+        .find_pll = intel_g4x_find_best_PLL,
+};
+
+static const intel_limit_t intel_limits_ironlake_dual_lvds_100m = {
+        .dot = { .min = IRONLAKE_DOT_MIN,          .max = IRONLAKE_DOT_MAX },
+        .vco = { .min = IRONLAKE_VCO_MIN,          .max = IRONLAKE_VCO_MAX },
+        .n   = { .min = IRONLAKE_LVDS_D_SSC_N_MIN, .max = IRONLAKE_LVDS_D_SSC_N_MAX },
+        .m   = { .min = IRONLAKE_LVDS_D_SSC_M_MIN, .max = IRONLAKE_LVDS_D_SSC_M_MAX },
+        .m1  = { .min = IRONLAKE_M1_MIN,           .max = IRONLAKE_M1_MAX },
+        .m2  = { .min = IRONLAKE_M2_MIN,           .max = IRONLAKE_M2_MAX },
+        .p   = { .min = IRONLAKE_LVDS_D_SSC_P_MIN, .max = IRONLAKE_LVDS_D_SSC_P_MAX },
+        .p1  = { .min = IRONLAKE_LVDS_D_SSC_P1_MIN,.max = IRONLAKE_LVDS_D_SSC_P1_MAX },
+        .p2  = { .dot_limit = IRONLAKE_P2_DOT_LIMIT,
+                 .p2_slow = IRONLAKE_LVDS_D_SSC_P2_SLOW,
+                 .p2_fast = IRONLAKE_LVDS_D_SSC_P2_FAST },
         .find_pll = intel_g4x_find_best_PLL,
 };
 
@@ -509,34 +607,53 @@ static const intel_limit_t intel_limits_ironlake_display_port = {
                  .max = IRONLAKE_DOT_MAX },
         .vco = { .min = IRONLAKE_VCO_MIN,
                  .max = IRONLAKE_VCO_MAX},
-        .n   = { .min = IRONLAKE_N_MIN,
-                 .max = IRONLAKE_N_MAX },
-        .m   = { .min = IRONLAKE_M_MIN,
-                 .max = IRONLAKE_M_MAX },
+        .n   = { .min = IRONLAKE_DP_N_MIN,
+                 .max = IRONLAKE_DP_N_MAX },
+        .m   = { .min = IRONLAKE_DP_M_MIN,
+                 .max = IRONLAKE_DP_M_MAX },
         .m1  = { .min = IRONLAKE_M1_MIN,
                  .max = IRONLAKE_M1_MAX },
         .m2  = { .min = IRONLAKE_M2_MIN,
                  .max = IRONLAKE_M2_MAX },
-        .p   = { .min = IRONLAKE_P_DISPLAY_PORT_MIN,
-                 .max = IRONLAKE_P_DISPLAY_PORT_MAX },
-        .p1  = { .min = IRONLAKE_P1_DISPLAY_PORT_MIN,
-                 .max = IRONLAKE_P1_DISPLAY_PORT_MAX},
-        .p2  = { .dot_limit = IRONLAKE_P2_DISPLAY_PORT_LIMIT,
-                 .p2_slow = IRONLAKE_P2_DISPLAY_PORT_SLOW,
-                 .p2_fast = IRONLAKE_P2_DISPLAY_PORT_FAST },
+        .p   = { .min = IRONLAKE_DP_P_MIN,
+                 .max = IRONLAKE_DP_P_MAX },
+        .p1  = { .min = IRONLAKE_DP_P1_MIN,
+                 .max = IRONLAKE_DP_P1_MAX},
+        .p2  = { .dot_limit = IRONLAKE_DP_P2_LIMIT,
+                 .p2_slow = IRONLAKE_DP_P2_SLOW,
+                 .p2_fast = IRONLAKE_DP_P2_FAST },
         .find_pll = intel_find_pll_ironlake_dp,
 };
 
 static const intel_limit_t *intel_ironlake_limit(struct drm_crtc *crtc)
 {
+        struct drm_device *dev = crtc->dev;
+        struct drm_i915_private *dev_priv = dev->dev_private;
         const intel_limit_t *limit;
-        if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS))
-                limit = &intel_limits_ironlake_lvds;
-        else if (intel_pipe_has_type(crtc, INTEL_OUTPUT_DISPLAYPORT) ||
+        int refclk = 120;
+
+        if (intel_pipe_has_type(crtc, INTEL_OUTPUT_LVDS)) {
+                if (dev_priv->lvds_use_ssc && dev_priv->lvds_ssc_freq == 100)
+                        refclk = 100;
+
+                if ((I915_READ(PCH_LVDS) & LVDS_CLKB_POWER_MASK) ==
+                    LVDS_CLKB_POWER_UP) {
+                        /* LVDS dual channel */
+                        if (refclk == 100)
+                                limit = &intel_limits_ironlake_dual_lvds_100m;
+                        else
+                                limit = &intel_limits_ironlake_dual_lvds;
+                } else {
+                        if (refclk == 100)
+                                limit = &intel_limits_ironlake_single_lvds_100m;
+                        else
+                                limit = &intel_limits_ironlake_single_lvds;
+                }
+        } else if (intel_pipe_has_type(crtc, INTEL_OUTPUT_DISPLAYPORT) ||
                         HAS_eDP)
                 limit = &intel_limits_ironlake_display_port;
         else
-                limit = &intel_limits_ironlake_sdvo;
+                limit = &intel_limits_ironlake_dac;
 
         return limit;
 }
@@ -914,6 +1031,8 @@ static void i8xx_enable_fbc(struct drm_crtc *crtc, unsigned long interval)
 
         /* enable it... */
         fbc_ctl = FBC_CTL_EN | FBC_CTL_PERIODIC;
+        if (IS_I945GM(dev))
+                fbc_ctl |= FBC_C3_IDLE; /* 945 needs special SR handling */
         fbc_ctl |= (dev_priv->cfb_pitch & 0xff) << FBC_CTL_STRIDE_SHIFT;
         fbc_ctl |= (interval & 0x2fff) << FBC_CTL_INTERVAL_SHIFT;
         if (obj_priv->tiling_mode != I915_TILING_NONE)
@@ -1638,6 +1757,7 @@ static void ironlake_crtc_dpms(struct drm_crtc *crtc, int mode)
         case DRM_MODE_DPMS_OFF:
                 DRM_DEBUG_KMS("crtc %d dpms off\n", pipe);
 
+                drm_vblank_off(dev, pipe);
                 /* Disable display plane */
                 temp = I915_READ(dspcntr_reg);
                 if ((temp & DISPLAY_PLANE_ENABLE) != 0) {
@@ -2519,6 +2639,10 @@ static void g4x_update_wm(struct drm_device *dev,  int planea_clock,
                 sr_entries = roundup(sr_entries / cacheline_size, 1);
                 DRM_DEBUG("self-refresh entries: %d\n", sr_entries);
                 I915_WRITE(FW_BLC_SELF, FW_BLC_SELF_EN);
+        } else {
+                /* Turn off self refresh if both pipes are enabled */
+                I915_WRITE(FW_BLC_SELF, I915_READ(FW_BLC_SELF)
+                                        & ~FW_BLC_SELF_EN);
         }
 
         DRM_DEBUG("Setting FIFO watermarks - A: %d, B: %d, SR %d\n",
@@ -2562,6 +2686,10 @@ static void i965_update_wm(struct drm_device *dev, int planea_clock,
                         srwm = 1;
                 srwm &= 0x3f;
                 I915_WRITE(FW_BLC_SELF, FW_BLC_SELF_EN);
+        } else {
+                /* Turn off self refresh if both pipes are enabled */
+                I915_WRITE(FW_BLC_SELF, I915_READ(FW_BLC_SELF)
+                                        & ~FW_BLC_SELF_EN);
         }
 
         DRM_DEBUG_KMS("Setting FIFO watermarks - A: 8, B: 8, C: 8, SR %d\n",
@@ -2630,6 +2758,10 @@ static void i9xx_update_wm(struct drm_device *dev, int planea_clock,
                 if (srwm < 0)
                         srwm = 1;
                 I915_WRITE(FW_BLC_SELF, FW_BLC_SELF_EN | (srwm & 0x3f));
+        } else {
+                /* Turn off self refresh if both pipes are enabled */
+                I915_WRITE(FW_BLC_SELF, I915_READ(FW_BLC_SELF)
+                                        & ~FW_BLC_SELF_EN);
         }
 
         DRM_DEBUG_KMS("Setting FIFO watermarks - A: %d, B: %d, C: %d, SR %d\n",
@@ -3949,7 +4081,8 @@ static void intel_crtc_destroy(struct drm_crtc *crtc)
 struct intel_unpin_work {
         struct work_struct work;
         struct drm_device *dev;
-        struct drm_gem_object *obj;
+        struct drm_gem_object *old_fb_obj;
+        struct drm_gem_object *pending_flip_obj;
         struct drm_pending_vblank_event *event;
         int pending;
 };
@@ -3960,8 +4093,9 @@ static void intel_unpin_work_fn(struct work_struct *__work)
                 container_of(__work, struct intel_unpin_work, work);
 
         mutex_lock(&work->dev->struct_mutex);
-        i915_gem_object_unpin(work->obj);
-        drm_gem_object_unreference(work->obj);
+        i915_gem_object_unpin(work->old_fb_obj);
+        drm_gem_object_unreference(work->pending_flip_obj);
+        drm_gem_object_unreference(work->old_fb_obj);
         mutex_unlock(&work->dev->struct_mutex);
         kfree(work);
 }
@@ -3984,6 +4118,12 @@ void intel_finish_page_flip(struct drm_device *dev, int pipe)
         spin_lock_irqsave(&dev->event_lock, flags);
         work = intel_crtc->unpin_work;
         if (work == NULL || !work->pending) {
+                if (work && !work->pending) {
+                        obj_priv = work->pending_flip_obj->driver_private;
+                        DRM_DEBUG_DRIVER("flip finish: %p (%d) not pending?\n",
+                                         obj_priv,
+                                         atomic_read(&obj_priv->pending_flip));
+                }
                 spin_unlock_irqrestore(&dev->event_lock, flags);
                 return;
         }
@@ -4004,8 +4144,11 @@ void intel_finish_page_flip(struct drm_device *dev, int pipe)
 
         spin_unlock_irqrestore(&dev->event_lock, flags);
 
-        obj_priv = work->obj->driver_private;
-        if (atomic_dec_and_test(&obj_priv->pending_flip))
+        obj_priv = work->pending_flip_obj->driver_private;
+
+        /* Initial scanout buffer will have a 0 pending flip count */
+        if ((atomic_read(&obj_priv->pending_flip) == 0) ||
+            atomic_dec_and_test(&obj_priv->pending_flip))
                 DRM_WAKEUP(&dev_priv->pending_flip_queue);
         schedule_work(&work->work);
 }
@@ -4018,8 +4161,11 @@ void intel_prepare_page_flip(struct drm_device *dev, int plane)
         unsigned long flags;
 
         spin_lock_irqsave(&dev->event_lock, flags);
-        if (intel_crtc->unpin_work)
+        if (intel_crtc->unpin_work) {
                 intel_crtc->unpin_work->pending = 1;
+        } else {
+                DRM_DEBUG_DRIVER("preparing flip with no unpin work?\n");
+        }
         spin_unlock_irqrestore(&dev->event_lock, flags);
 }
 
@@ -4035,7 +4181,8 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
         struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
         struct intel_unpin_work *work;
         unsigned long flags;
-        int ret;
+        int pipesrc_reg = (intel_crtc->pipe == 0) ? PIPEASRC : PIPEBSRC;
+        int ret, pipesrc;
         RING_LOCALS;
 
         work = kzalloc(sizeof *work, GFP_KERNEL);
@@ -4047,12 +4194,13 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
         work->event = event;
         work->dev = crtc->dev;
         intel_fb = to_intel_framebuffer(crtc->fb);
-        work->obj = intel_fb->obj;
+        work->old_fb_obj = intel_fb->obj;
         INIT_WORK(&work->work, intel_unpin_work_fn);
 
         /* We borrow the event spin lock for protecting unpin_work */
         spin_lock_irqsave(&dev->event_lock, flags);
         if (intel_crtc->unpin_work) {
+                DRM_DEBUG_DRIVER("flip queue: crtc already busy\n");
                 spin_unlock_irqrestore(&dev->event_lock, flags);
                 kfree(work);
                 mutex_unlock(&dev->struct_mutex);
@@ -4066,19 +4214,24 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
 
         ret = intel_pin_and_fence_fb_obj(dev, obj);
         if (ret != 0) {
+                DRM_DEBUG_DRIVER("flip queue: %p pin & fence failed\n",
+                          obj->driver_private);
                 kfree(work);
+                intel_crtc->unpin_work = NULL;
                 mutex_unlock(&dev->struct_mutex);
                 return ret;
         }
 
-        /* Reference the old fb object for the scheduled work. */
-        drm_gem_object_reference(work->obj);
+        /* Reference the objects for the scheduled work. */
+        drm_gem_object_reference(work->old_fb_obj);
+        drm_gem_object_reference(obj);
 
         crtc->fb = fb;
         i915_gem_object_flush_write_domain(obj);
         drm_vblank_get(dev, intel_crtc->pipe);
         obj_priv = obj->driver_private;
         atomic_inc(&obj_priv->pending_flip);
+        work->pending_flip_obj = obj;
 
         BEGIN_LP_RING(4);
         OUT_RING(MI_DISPLAY_FLIP |
@@ -4086,7 +4239,8 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc,
         OUT_RING(fb->pitch);
         if (IS_I965G(dev)) {
                 OUT_RING(obj_priv->gtt_offset | obj_priv->tiling_mode);
-                OUT_RING((fb->width << 16) | fb->height);
+                pipesrc = I915_READ(pipesrc_reg); 
+                OUT_RING(pipesrc & 0x0fff0fff);
         } else {
                 OUT_RING(obj_priv->gtt_offset);
                 OUT_RING(MI_NOOP);
diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
index 371d753e362b..aaabbcbe5905 100644
--- a/drivers/gpu/drm/i915/intel_fb.c
+++ b/drivers/gpu/drm/i915/intel_fb.c
@@ -148,7 +148,7 @@ static int intelfb_create(struct drm_device *dev, uint32_t fb_width,
 
         mutex_lock(&dev->struct_mutex);
 
-        ret = i915_gem_object_pin(fbo, PAGE_SIZE);
+        ret = i915_gem_object_pin(fbo, 64*1024);
         if (ret) {
                 DRM_ERROR("failed to pin fb: %d\n", ret);
                 goto out_unref;
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index aa74e59bec61..c2e8a45780d5 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -611,7 +611,7 @@ static const struct dmi_system_id bad_lid_status[] = {
         {
                 .ident = "Samsung SX20S",
                 .matches = {
-                        DMI_MATCH(DMI_SYS_VENDOR, "Phoenix Technologies LTD"),
+                        DMI_MATCH(DMI_SYS_VENDOR, "Samsung Electronics"),
                         DMI_MATCH(DMI_BOARD_NAME, "SX20S"),
                 },
         },
@@ -623,12 +623,26 @@ static const struct dmi_system_id bad_lid_status[] = {
                 },
         },
         {
+                .ident = "Aspire 1810T",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 1810T"),
+                },
+        },
+        {
                 .ident = "PC-81005",
                 .matches = {
                         DMI_MATCH(DMI_SYS_VENDOR, "MALATA"),
                         DMI_MATCH(DMI_PRODUCT_NAME, "PC-81005"),
                 },
         },
+        {
+                .ident = "Clevo M5x0N",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "CLEVO Co."),
+                        DMI_MATCH(DMI_BOARD_NAME, "M5x0N"),
+                },
+        },
         { }
 };
 
@@ -643,7 +657,7 @@ static enum drm_connector_status intel_lvds_detect(struct drm_connector *connect
 {
         enum drm_connector_status status = connector_status_connected;
 
-        if (!acpi_lid_open() && !dmi_check_system(bad_lid_status))
+        if (!dmi_check_system(bad_lid_status) && !acpi_lid_open())
                 status = connector_status_disconnected;
 
         return status;
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index eaacfd0920df..82678d30ab06 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -2345,6 +2345,14 @@ intel_sdvo_output_setup(struct intel_output *intel_output, uint16_t flags)
                 connector->connector_type = DRM_MODE_CONNECTOR_VGA;
                 intel_output->clone_mask = (1 << INTEL_SDVO_NON_TV_CLONE_BIT) |
                                         (1 << INTEL_ANALOG_CLONE_BIT);
+        } else if (flags & SDVO_OUTPUT_CVBS0) {
+
+                sdvo_priv->controlled_output = SDVO_OUTPUT_CVBS0;
+                encoder->encoder_type = DRM_MODE_ENCODER_TVDAC;
+                connector->connector_type = DRM_MODE_CONNECTOR_SVIDEO;
+                sdvo_priv->is_tv = true;
+                intel_output->needs_tv_clock = true;
+                intel_output->clone_mask = 1 << INTEL_SDVO_TV_CLONE_BIT;
         } else if (flags & SDVO_OUTPUT_LVDS0) {
 
                 sdvo_priv->controlled_output = SDVO_OUTPUT_LVDS0;
diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
index 1cf488247a16..48227e744753 100644
--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
+++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
@@ -90,21 +90,21 @@ int nouveau_hybrid_setup(struct drm_device *dev)
 {
         int result;
 
-        if (nouveau_dsm(dev, NOUVEAU_DSM_ACTIVE, NOUVEAU_DSM_ACTIVE_QUERY,
+        if (nouveau_dsm(dev, NOUVEAU_DSM_POWER, NOUVEAU_DSM_POWER_STATE,
                                                                 &result))
                 return -ENODEV;
 
         NV_INFO(dev, "_DSM hardware status gave 0x%x\n", result);
 
-        if (result & 0x1) {     /* Stamina mode - disable the external GPU */
+        if (result) { /* Ensure that the external GPU is enabled */
+                nouveau_dsm(dev, NOUVEAU_DSM_LED, NOUVEAU_DSM_LED_SPEED, NULL);
+                nouveau_dsm(dev, NOUVEAU_DSM_POWER, NOUVEAU_DSM_POWER_SPEED,
+                                                                        NULL);
+        } else { /* Stamina mode - disable the external GPU */
                 nouveau_dsm(dev, NOUVEAU_DSM_LED, NOUVEAU_DSM_LED_STAMINA,
                                                                         NULL);
                 nouveau_dsm(dev, NOUVEAU_DSM_POWER, NOUVEAU_DSM_POWER_STAMINA,
                                                                         NULL);
-        } else {                /* Ensure that the external GPU is enabled */
-                nouveau_dsm(dev, NOUVEAU_DSM_LED, NOUVEAU_DSM_LED_SPEED, NULL);
-                nouveau_dsm(dev, NOUVEAU_DSM_POWER, NOUVEAU_DSM_POWER_SPEED,
-                                                                        NULL);
         }
 
         return 0;
diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
index d7f8d8b4a4b8..0e9cd1d49130 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bios.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bios.c
@@ -1865,7 +1865,7 @@ init_compute_mem(struct nvbios *bios, uint16_t offset, struct init_exec *iexec)
 
         struct drm_nouveau_private *dev_priv = bios->dev->dev_private;
 
-        if (dev_priv->card_type >= NV_50)
+        if (dev_priv->card_type >= NV_40)
                 return 1;
 
         /*
@@ -3765,7 +3765,6 @@ nouveau_bios_run_display_table(struct drm_device *dev, struct dcb_entry *dcbent,
          */
 
         struct drm_nouveau_private *dev_priv = dev->dev_private;
-        struct init_exec iexec = {true, false};
         struct nvbios *bios = &dev_priv->VBIOS;
         uint8_t *table = &bios->data[bios->display.script_table_ptr];
         uint8_t *otable = NULL;
@@ -3845,8 +3844,6 @@ nouveau_bios_run_display_table(struct drm_device *dev, struct dcb_entry *dcbent,
                 }
         }
 
-        bios->display.output = dcbent;
-
         if (pxclk == 0) {
                 script = ROM16(otable[6]);
                 if (!script) {
@@ -3855,7 +3852,7 @@ nouveau_bios_run_display_table(struct drm_device *dev, struct dcb_entry *dcbent,
                 }
 
                 NV_TRACE(dev, "0x%04X: parsing output script 0\n", script);
-                parse_init_table(bios, script, &iexec);
+                nouveau_bios_run_init_table(dev, script, dcbent);
         } else
         if (pxclk == -1) {
                 script = ROM16(otable[8]);
@@ -3865,7 +3862,7 @@ nouveau_bios_run_display_table(struct drm_device *dev, struct dcb_entry *dcbent,
                 }
 
                 NV_TRACE(dev, "0x%04X: parsing output script 1\n", script);
-                parse_init_table(bios, script, &iexec);
+                nouveau_bios_run_init_table(dev, script, dcbent);
         } else
         if (pxclk == -2) {
                 if (table[4] >= 12)
@@ -3878,7 +3875,7 @@ nouveau_bios_run_display_table(struct drm_device *dev, struct dcb_entry *dcbent,
                 }
 
                 NV_TRACE(dev, "0x%04X: parsing output script 2\n", script);
-                parse_init_table(bios, script, &iexec);
+                nouveau_bios_run_init_table(dev, script, dcbent);
         } else
         if (pxclk > 0) {
                 script = ROM16(otable[table[4] + i*6 + 2]);
@@ -3890,7 +3887,7 @@ nouveau_bios_run_display_table(struct drm_device *dev, struct dcb_entry *dcbent,
                 }
 
                 NV_TRACE(dev, "0x%04X: parsing clock script 0\n", script);
-                parse_init_table(bios, script, &iexec);
+                nouveau_bios_run_init_table(dev, script, dcbent);
         } else
         if (pxclk < 0) {
                 script = ROM16(otable[table[4] + i*6 + 4]);
@@ -3902,7 +3899,7 @@ nouveau_bios_run_display_table(struct drm_device *dev, struct dcb_entry *dcbent,
                 }
 
                 NV_TRACE(dev, "0x%04X: parsing clock script 1\n", script);
-                parse_init_table(bios, script, &iexec);
+                nouveau_bios_run_init_table(dev, script, dcbent);
         }
 
         return 0;
@@ -5865,9 +5862,11 @@ nouveau_bios_run_init_table(struct drm_device *dev, uint16_t table,
         struct nvbios *bios = &dev_priv->VBIOS;
         struct init_exec iexec = { true, false };
 
+        mutex_lock(&bios->lock);
         bios->display.output = dcbent;
         parse_init_table(bios, table, &iexec);
         bios->display.output = NULL;
+        mutex_unlock(&bios->lock);
 }
 
 static bool NVInitVBIOS(struct drm_device *dev)
@@ -5876,6 +5875,7 @@ static bool NVInitVBIOS(struct drm_device *dev)
         struct nvbios *bios = &dev_priv->VBIOS;
 
         memset(bios, 0, sizeof(struct nvbios));
+        mutex_init(&bios->lock);
         bios->dev = dev;
 
         if (!NVShadowVBIOS(dev, bios->data))
diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.h b/drivers/gpu/drm/nouveau/nouveau_bios.h
index 058e98c76d89..fd94bd6dc264 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bios.h
+++ b/drivers/gpu/drm/nouveau/nouveau_bios.h
@@ -205,6 +205,8 @@ struct nvbios {
         struct drm_device *dev;
         struct nouveau_bios_info pub;
 
+        struct mutex lock;
+
         uint8_t data[NV_PROM_SIZE];
         unsigned int length;
         bool execute;
diff --git a/drivers/gpu/drm/nouveau/nouveau_bo.c b/drivers/gpu/drm/nouveau/nouveau_bo.c
index db0ed4c13f98..028719fddf76 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bo.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bo.c
@@ -65,8 +65,10 @@ nouveau_bo_fixup_align(struct drm_device *dev,
 
         /*
          * Some of the tile_flags have a periodic structure of N*4096 bytes,
-         * align to to that as well as the page size. Overallocate memory to
-         * avoid corruption of other buffer objects.
+         * align to to that as well as the page size. Align the size to the
+         * appropriate boundaries. This does imply that sizes are rounded up
+         * 3-7 pages, so be aware of this and do not waste memory by allocating
+         * many small buffers.
          */
         if (dev_priv->card_type == NV_50) {
                 uint32_t block_size = nouveau_mem_fb_amount(dev) >> 15;
@@ -77,22 +79,20 @@ nouveau_bo_fixup_align(struct drm_device *dev,
                 case 0x2800:
                 case 0x4800:
                 case 0x7a00:
-                        *size = roundup(*size, block_size);
                         if (is_power_of_2(block_size)) {
-                                *size += 3 * block_size;
                                 for (i = 1; i < 10; i++) {
                                         *align = 12 * i * block_size;
                                         if (!(*align % 65536))
                                                 break;
                                 }
                         } else {
-                                *size += 6 * block_size;
                                 for (i = 1; i < 10; i++) {
                                         *align = 8 * i * block_size;
                                         if (!(*align % 65536))
                                                 break;
                                 }
                         }
+                        *size = roundup(*size, *align);
                         break;
                 default:
                         break;
diff --git a/drivers/gpu/drm/nouveau/nouveau_channel.c b/drivers/gpu/drm/nouveau/nouveau_channel.c
index 343d718a9667..2281f99da7fc 100644
--- a/drivers/gpu/drm/nouveau/nouveau_channel.c
+++ b/drivers/gpu/drm/nouveau/nouveau_channel.c
@@ -278,12 +278,11 @@ nouveau_channel_free(struct nouveau_channel *chan)
         /* Ensure the channel is no longer active on the GPU */
         pfifo->reassign(dev, false);
 
-        if (pgraph->channel(dev) == chan) {
-                pgraph->fifo_access(dev, false);
+        pgraph->fifo_access(dev, false);
+        if (pgraph->channel(dev) == chan)
                 pgraph->unload_context(dev);
-                pgraph->fifo_access(dev, true);
-        }
         pgraph->destroy_context(chan);
+        pgraph->fifo_access(dev, true);
 
         if (pfifo->channel_id(dev) == chan->id) {
                 pfifo->disable(dev);
diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
index 7e6d673f3a23..d2f63353ea97 100644
--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
@@ -88,13 +88,14 @@ nouveau_connector_destroy(struct drm_connector *drm_connector)
 {
         struct nouveau_connector *nv_connector =
                 nouveau_connector(drm_connector);
-        struct drm_device *dev = nv_connector->base.dev;
-
-        NV_DEBUG_KMS(dev, "\n");
+        struct drm_device *dev;
 
         if (!nv_connector)
                 return;
 
+        dev = nv_connector->base.dev;
+        NV_DEBUG_KMS(dev, "\n");
+
         kfree(nv_connector->edid);
         drm_sysfs_connector_remove(drm_connector);
         drm_connector_cleanup(drm_connector);
diff --git a/drivers/gpu/drm/nouveau/nouveau_dp.c b/drivers/gpu/drm/nouveau/nouveau_dp.c
index dd4937224220..f954ad93e81f 100644
--- a/drivers/gpu/drm/nouveau/nouveau_dp.c
+++ b/drivers/gpu/drm/nouveau/nouveau_dp.c
@@ -502,12 +502,12 @@ nouveau_dp_auxch(struct nouveau_i2c_chan *auxch, int cmd, int addr,
                         break;
         }
 
-        if ((stat & NV50_AUXCH_STAT_COUNT) != data_nr) {
-                ret = -EREMOTEIO;
-                goto out;
-        }
-
         if (cmd & 1) {
+                if ((stat & NV50_AUXCH_STAT_COUNT) != data_nr) {
+                        ret = -EREMOTEIO;
+                        goto out;
+                }
+
                 for (i = 0; i < 4; i++) {
                         data32[i] = nv_rd32(dev, NV50_AUXCH_DATA_IN(index, i));
                         NV_DEBUG_KMS(dev, "rd %d: 0x%08x\n", i, data32[i]);
diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.c b/drivers/gpu/drm/nouveau/nouveau_drv.c
index 343ab7f17ccc..da3b93b84502 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drv.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drv.c
@@ -56,7 +56,7 @@ int nouveau_vram_pushbuf;
 module_param_named(vram_pushbuf, nouveau_vram_pushbuf, int, 0400);
 
 MODULE_PARM_DESC(vram_notify, "Force DMA notifiers to be in VRAM");
-int nouveau_vram_notify;
+int nouveau_vram_notify = 1;
 module_param_named(vram_notify, nouveau_vram_notify, int, 0400);
 
 MODULE_PARM_DESC(duallink, "Allow dual-link TMDS (>=GeForce 8)");
@@ -75,6 +75,14 @@ MODULE_PARM_DESC(ignorelid, "Ignore ACPI lid status");
 int nouveau_ignorelid = 0;
 module_param_named(ignorelid, nouveau_ignorelid, int, 0400);
 
+MODULE_PARM_DESC(noagp, "Disable all acceleration");
+int nouveau_noaccel = 0;
+module_param_named(noaccel, nouveau_noaccel, int, 0400);
+
+MODULE_PARM_DESC(noagp, "Disable fbcon acceleration");
+int nouveau_nofbaccel = 0;
+module_param_named(nofbaccel, nouveau_nofbaccel, int, 0400);
+
 MODULE_PARM_DESC(tv_norm, "Default TV norm.\n"
                  "\t\tSupported: PAL, PAL-M, PAL-N, PAL-Nc, NTSC-M, NTSC-J,\n"
                  "\t\t\thd480i, hd480p, hd576i, hd576p, hd720p, hd1080i.\n"
diff --git a/drivers/gpu/drm/nouveau/nouveau_drv.h b/drivers/gpu/drm/nouveau/nouveau_drv.h
index 6b9690418bc7..1c15ef37b71c 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drv.h
+++ b/drivers/gpu/drm/nouveau/nouveau_drv.h
@@ -583,6 +583,7 @@ struct drm_nouveau_private {
         uint64_t vm_end;
         struct nouveau_gpuobj *vm_vram_pt[NV50_VM_VRAM_NR];
         int vm_vram_pt_nr;
+        uint64_t vram_sys_base;
 
         /* the mtrr covering the FB */
         int fb_mtrr;
@@ -678,6 +679,8 @@ extern int nouveau_reg_debug;
 extern char *nouveau_vbios;
 extern int nouveau_ctxfw;
 extern int nouveau_ignorelid;
+extern int nouveau_nofbaccel;
+extern int nouveau_noaccel;
 
 /* nouveau_state.c */
 extern void nouveau_preclose(struct drm_device *dev, struct drm_file *);
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index 0b05c869e0e7..ea879a2efef3 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -107,6 +107,34 @@ static struct fb_ops nouveau_fbcon_ops = {
         .fb_setcmap = drm_fb_helper_setcmap,
 };
 
+static struct fb_ops nv04_fbcon_ops = {
+        .owner = THIS_MODULE,
+        .fb_check_var = drm_fb_helper_check_var,
+        .fb_set_par = drm_fb_helper_set_par,
+        .fb_setcolreg = drm_fb_helper_setcolreg,
+        .fb_fillrect = nv04_fbcon_fillrect,
+        .fb_copyarea = nv04_fbcon_copyarea,
+        .fb_imageblit = nv04_fbcon_imageblit,
+        .fb_sync = nouveau_fbcon_sync,
+        .fb_pan_display = drm_fb_helper_pan_display,
+        .fb_blank = drm_fb_helper_blank,
+        .fb_setcmap = drm_fb_helper_setcmap,
+};
+
+static struct fb_ops nv50_fbcon_ops = {
+        .owner = THIS_MODULE,
+        .fb_check_var = drm_fb_helper_check_var,
+        .fb_set_par = drm_fb_helper_set_par,
+        .fb_setcolreg = drm_fb_helper_setcolreg,
+        .fb_fillrect = nv50_fbcon_fillrect,
+        .fb_copyarea = nv50_fbcon_copyarea,
+        .fb_imageblit = nv50_fbcon_imageblit,
+        .fb_sync = nouveau_fbcon_sync,
+        .fb_pan_display = drm_fb_helper_pan_display,
+        .fb_blank = drm_fb_helper_blank,
+        .fb_setcmap = drm_fb_helper_setcmap,
+};
+
 static void nouveau_fbcon_gamma_set(struct drm_crtc *crtc, u16 red, u16 green,
                                     u16 blue, int regno)
 {
@@ -267,8 +295,12 @@ nouveau_fbcon_create(struct drm_device *dev, uint32_t fb_width,
         dev_priv->fbdev_info = info;
 
         strcpy(info->fix.id, "nouveaufb");
-        info->flags = FBINFO_DEFAULT | FBINFO_HWACCEL_COPYAREA |
-                      FBINFO_HWACCEL_FILLRECT | FBINFO_HWACCEL_IMAGEBLIT;
+        if (nouveau_nofbaccel)
+                info->flags = FBINFO_DEFAULT | FBINFO_HWACCEL_DISABLED;
+        else
+                info->flags = FBINFO_DEFAULT | FBINFO_HWACCEL_COPYAREA |
+                              FBINFO_HWACCEL_FILLRECT |
+                              FBINFO_HWACCEL_IMAGEBLIT;
         info->fbops = &nouveau_fbcon_ops;
         info->fix.smem_start = dev->mode_config.fb_base + nvbo->bo.offset -
                                dev_priv->vm_vram_base;
@@ -316,13 +348,15 @@ nouveau_fbcon_create(struct drm_device *dev, uint32_t fb_width,
         par->nouveau_fb = nouveau_fb;
         par->dev = dev;
 
-        if (dev_priv->channel) {
+        if (dev_priv->channel && !nouveau_nofbaccel) {
                 switch (dev_priv->card_type) {
                 case NV_50:
                         nv50_fbcon_accel_init(info);
+                        info->fbops = &nv50_fbcon_ops;
                         break;
                 default:
                         nv04_fbcon_accel_init(info);
+                        info->fbops = &nv04_fbcon_ops;
                         break;
                 };
         }
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.h b/drivers/gpu/drm/nouveau/nouveau_fbcon.h
index 462e0b87b4bd..f9c34e1a8c11 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.h
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.h
@@ -40,7 +40,13 @@ int nouveau_fbcon_remove(struct drm_device *dev, struct drm_framebuffer *fb);
 void nouveau_fbcon_restore(void);
 void nouveau_fbcon_zfill(struct drm_device *dev);
 
+void nv04_fbcon_copyarea(struct fb_info *info, const struct fb_copyarea *region);
+void nv04_fbcon_fillrect(struct fb_info *info, const struct fb_fillrect *rect);
+void nv04_fbcon_imageblit(struct fb_info *info, const struct fb_image *image);
 int nv04_fbcon_accel_init(struct fb_info *info);
+void nv50_fbcon_fillrect(struct fb_info *info, const struct fb_fillrect *rect);
+void nv50_fbcon_copyarea(struct fb_info *info, const struct fb_copyarea *region);
+void nv50_fbcon_imageblit(struct fb_info *info, const struct fb_image *image);
 int nv50_fbcon_accel_init(struct fb_info *info);
 
 void nouveau_fbcon_gpu_lockup(struct fb_info *info);
diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
index 6ac804b0c9f9..70cc30803e3b 100644
--- a/drivers/gpu/drm/nouveau/nouveau_gem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
@@ -925,7 +925,9 @@ nouveau_gem_ioctl_cpu_prep(struct drm_device *dev, void *data,
         }
 
         if (req->flags & NOUVEAU_GEM_CPU_PREP_NOBLOCK) {
+                spin_lock(&nvbo->bo.lock);
                 ret = ttm_bo_wait(&nvbo->bo, false, false, no_wait);
+                spin_unlock(&nvbo->bo.lock);
         } else {
                 ret = ttm_bo_synccpu_write_grab(&nvbo->bo, no_wait);
                 if (ret == 0)
diff --git a/drivers/gpu/drm/nouveau/nouveau_grctx.c b/drivers/gpu/drm/nouveau/nouveau_grctx.c
index 419f4c2b3b89..c7ebec696747 100644
--- a/drivers/gpu/drm/nouveau/nouveau_grctx.c
+++ b/drivers/gpu/drm/nouveau/nouveau_grctx.c
@@ -97,8 +97,8 @@ nouveau_grctx_prog_load(struct drm_device *dev)
                 }
 
                 pgraph->ctxvals = kmalloc(fw->size, GFP_KERNEL);
-                if (!pgraph->ctxprog) {
-                        NV_ERROR(dev, "OOM copying ctxprog\n");
+                if (!pgraph->ctxvals) {
+                        NV_ERROR(dev, "OOM copying ctxvals\n");
                         release_firmware(fw);
                         nouveau_grctx_fini(dev);
                         return -ENOMEM;
diff --git a/drivers/gpu/drm/nouveau/nouveau_irq.c b/drivers/gpu/drm/nouveau/nouveau_irq.c
index 3b9bad66162a..447f9f69d6b1 100644
--- a/drivers/gpu/drm/nouveau/nouveau_irq.c
+++ b/drivers/gpu/drm/nouveau/nouveau_irq.c
@@ -211,6 +211,20 @@ nouveau_fifo_irq_handler(struct drm_device *dev)
                                                                 get + 4);
                 }
 
+                if (status & NV_PFIFO_INTR_SEMAPHORE) {
+                        uint32_t sem;
+
+                        status &= ~NV_PFIFO_INTR_SEMAPHORE;
+                        nv_wr32(dev, NV03_PFIFO_INTR_0,
+                                NV_PFIFO_INTR_SEMAPHORE);
+
+                        sem = nv_rd32(dev, NV10_PFIFO_CACHE1_SEMAPHORE);
+                        nv_wr32(dev, NV10_PFIFO_CACHE1_SEMAPHORE, sem | 0x1);
+
+                        nv_wr32(dev, NV03_PFIFO_CACHE1_GET, get + 4);
+                        nv_wr32(dev, NV04_PFIFO_CACHE1_PULL0, 1);
+                }
+
                 if (status) {
                         NV_INFO(dev, "PFIFO_INTR 0x%08x - Ch %d\n",
                                 status, chid);
@@ -566,86 +580,99 @@ nouveau_pgraph_irq_handler(struct drm_device *dev)
 static void
 nv50_pgraph_irq_handler(struct drm_device *dev)
 {
-        uint32_t status, nsource;
+        uint32_t status;
 
-        status = nv_rd32(dev, NV03_PGRAPH_INTR);
-        nsource = nv_rd32(dev, NV03_PGRAPH_NSOURCE);
+        while ((status = nv_rd32(dev, NV03_PGRAPH_INTR))) {
+                uint32_t nsource = nv_rd32(dev, NV03_PGRAPH_NSOURCE);
 
-        if (status & 0x00000001) {
-                nouveau_pgraph_intr_notify(dev, nsource);
-                status &= ~0x00000001;
-                nv_wr32(dev, NV03_PGRAPH_INTR, 0x00000001);
-        }
+                if (status & 0x00000001) {
+                        nouveau_pgraph_intr_notify(dev, nsource);
+                        status &= ~0x00000001;
+                        nv_wr32(dev, NV03_PGRAPH_INTR, 0x00000001);
+                }
 
-        if (status & 0x00000010) {
-                nouveau_pgraph_intr_error(dev, nsource |
-                                          NV03_PGRAPH_NSOURCE_ILLEGAL_MTHD);
+                if (status & 0x00000010) {
+                        nouveau_pgraph_intr_error(dev, nsource |
+                                        NV03_PGRAPH_NSOURCE_ILLEGAL_MTHD);
 
-                status &= ~0x00000010;
-                nv_wr32(dev, NV03_PGRAPH_INTR, 0x00000010);
-        }
+                        status &= ~0x00000010;
+                        nv_wr32(dev, NV03_PGRAPH_INTR, 0x00000010);
+                }
 
-        if (status & 0x00001000) {
-                nv_wr32(dev, 0x400500, 0x00000000);
-                nv_wr32(dev, NV03_PGRAPH_INTR, NV_PGRAPH_INTR_CONTEXT_SWITCH);
-                nv_wr32(dev, NV40_PGRAPH_INTR_EN, nv_rd32(dev,
-                        NV40_PGRAPH_INTR_EN) & ~NV_PGRAPH_INTR_CONTEXT_SWITCH);
-                nv_wr32(dev, 0x400500, 0x00010001);
+                if (status & 0x00001000) {
+                        nv_wr32(dev, 0x400500, 0x00000000);
+                        nv_wr32(dev, NV03_PGRAPH_INTR,
+                                NV_PGRAPH_INTR_CONTEXT_SWITCH);
+                        nv_wr32(dev, NV40_PGRAPH_INTR_EN, nv_rd32(dev,
+                                NV40_PGRAPH_INTR_EN) &
+                                ~NV_PGRAPH_INTR_CONTEXT_SWITCH);
+                        nv_wr32(dev, 0x400500, 0x00010001);
 
-                nv50_graph_context_switch(dev);
+                        nv50_graph_context_switch(dev);
 
-                status &= ~NV_PGRAPH_INTR_CONTEXT_SWITCH;
-        }
+                        status &= ~NV_PGRAPH_INTR_CONTEXT_SWITCH;
+                }
 
-        if (status & 0x00100000) {
-                nouveau_pgraph_intr_error(dev, nsource |
-                                          NV03_PGRAPH_NSOURCE_DATA_ERROR);
+                if (status & 0x00100000) {
+                        nouveau_pgraph_intr_error(dev, nsource |
+                                        NV03_PGRAPH_NSOURCE_DATA_ERROR);
 
-                status &= ~0x00100000;
-                nv_wr32(dev, NV03_PGRAPH_INTR, 0x00100000);
-        }
+                        status &= ~0x00100000;
+                        nv_wr32(dev, NV03_PGRAPH_INTR, 0x00100000);
+                }
 
-        if (status & 0x00200000) {
-                int r;
-
-                nouveau_pgraph_intr_error(dev, nsource |
-                                          NV03_PGRAPH_NSOURCE_PROTECTION_ERROR);
-
-                NV_ERROR(dev, "magic set 1:\n");
-                for (r = 0x408900; r <= 0x408910; r += 4)
-                        NV_ERROR(dev, "\t0x%08x: 0x%08x\n", r, nv_rd32(dev, r));
-                nv_wr32(dev, 0x408900, nv_rd32(dev, 0x408904) | 0xc0000000);
-                for (r = 0x408e08; r <= 0x408e24; r += 4)
-                        NV_ERROR(dev, "\t0x%08x: 0x%08x\n", r, nv_rd32(dev, r));
-                nv_wr32(dev, 0x408e08, nv_rd32(dev, 0x408e08) | 0xc0000000);
-
-                NV_ERROR(dev, "magic set 2:\n");
-                for (r = 0x409900; r <= 0x409910; r += 4)
-                        NV_ERROR(dev, "\t0x%08x: 0x%08x\n", r, nv_rd32(dev, r));
-                nv_wr32(dev, 0x409900, nv_rd32(dev, 0x409904) | 0xc0000000);
-                for (r = 0x409e08; r <= 0x409e24; r += 4)
-                        NV_ERROR(dev, "\t0x%08x: 0x%08x\n", r, nv_rd32(dev, r));
-                nv_wr32(dev, 0x409e08, nv_rd32(dev, 0x409e08) | 0xc0000000);
-
-                status &= ~0x00200000;
-                nv_wr32(dev, NV03_PGRAPH_NSOURCE, nsource);
-                nv_wr32(dev, NV03_PGRAPH_INTR, 0x00200000);
-        }
+                if (status & 0x00200000) {
+                        int r;
+
+                        nouveau_pgraph_intr_error(dev, nsource |
+                                        NV03_PGRAPH_NSOURCE_PROTECTION_ERROR);
+
+                        NV_ERROR(dev, "magic set 1:\n");
+                        for (r = 0x408900; r <= 0x408910; r += 4)
+                                NV_ERROR(dev, "\t0x%08x: 0x%08x\n", r,
+                                        nv_rd32(dev, r));
+                        nv_wr32(dev, 0x408900,
+                                nv_rd32(dev, 0x408904) | 0xc0000000);
+                        for (r = 0x408e08; r <= 0x408e24; r += 4)
+                                NV_ERROR(dev, "\t0x%08x: 0x%08x\n", r,
+                                                        nv_rd32(dev, r));
+                        nv_wr32(dev, 0x408e08,
+                                nv_rd32(dev, 0x408e08) | 0xc0000000);
+
+                        NV_ERROR(dev, "magic set 2:\n");
+                        for (r = 0x409900; r <= 0x409910; r += 4)
+                                NV_ERROR(dev, "\t0x%08x: 0x%08x\n", r,
+                                        nv_rd32(dev, r));
+                        nv_wr32(dev, 0x409900,
+                                nv_rd32(dev, 0x409904) | 0xc0000000);
+                        for (r = 0x409e08; r <= 0x409e24; r += 4)
+                                NV_ERROR(dev, "\t0x%08x: 0x%08x\n", r,
+                                        nv_rd32(dev, r));
+                        nv_wr32(dev, 0x409e08,
+                                nv_rd32(dev, 0x409e08) | 0xc0000000);
+
+                        status &= ~0x00200000;
+                        nv_wr32(dev, NV03_PGRAPH_NSOURCE, nsource);
+                        nv_wr32(dev, NV03_PGRAPH_INTR, 0x00200000);
+                }
 
-        if (status) {
-                NV_INFO(dev, "Unhandled PGRAPH_INTR - 0x%08x\n", status);
-                nv_wr32(dev, NV03_PGRAPH_INTR, status);
-        }
+                if (status) {
+                        NV_INFO(dev, "Unhandled PGRAPH_INTR - 0x%08x\n",
+                                status);
+                        nv_wr32(dev, NV03_PGRAPH_INTR, status);
+                }
 
-        {
-                const int isb = (1 << 16) | (1 << 0);
+                {
+                        const int isb = (1 << 16) | (1 << 0);
 
-                if ((nv_rd32(dev, 0x400500) & isb) != isb)
-                        nv_wr32(dev, 0x400500, nv_rd32(dev, 0x400500) | isb);
-                nv_wr32(dev, 0x400824, nv_rd32(dev, 0x400824) & ~(1 << 31));
+                        if ((nv_rd32(dev, 0x400500) & isb) != isb)
+                                nv_wr32(dev, 0x400500,
+                                        nv_rd32(dev, 0x400500) | isb);
+                }
         }
 
         nv_wr32(dev, NV03_PMC_INTR_0, NV_PMC_INTR_0_PGRAPH_PENDING);
+        nv_wr32(dev, 0x400824, nv_rd32(dev, 0x400824) & ~(1 << 31));
 }
 
 static void
diff --git a/drivers/gpu/drm/nouveau/nouveau_mem.c b/drivers/gpu/drm/nouveau/nouveau_mem.c
index 8f3a12f614ed..2dc09dbd817d 100644
--- a/drivers/gpu/drm/nouveau/nouveau_mem.c
+++ b/drivers/gpu/drm/nouveau/nouveau_mem.c
@@ -285,53 +285,50 @@ nv50_mem_vm_bind_linear(struct drm_device *dev, uint64_t virt, uint32_t size,
                         uint32_t flags, uint64_t phys)
 {
         struct drm_nouveau_private *dev_priv = dev->dev_private;
-        struct nouveau_gpuobj **pgt;
-        unsigned psz, pfl, pages;
-
-        if (virt >= dev_priv->vm_gart_base &&
-            (virt + size) < (dev_priv->vm_gart_base + dev_priv->vm_gart_size)) {
-                psz = 12;
-                pgt = &dev_priv->gart_info.sg_ctxdma;
-                pfl = 0x21;
-                virt -= dev_priv->vm_gart_base;
-        } else
-        if (virt >= dev_priv->vm_vram_base &&
-            (virt + size) < (dev_priv->vm_vram_base + dev_priv->vm_vram_size)) {
-                psz = 16;
-                pgt = dev_priv->vm_vram_pt;
-                pfl = 0x01;
-                virt -= dev_priv->vm_vram_base;
-        } else {
-                NV_ERROR(dev, "Invalid address: 0x%16llx-0x%16llx\n",
-                         virt, virt + size - 1);
-                return -EINVAL;
-        }
+        struct nouveau_gpuobj *pgt;
+        unsigned block;
+        int i;
 
-        pages = size >> psz;
+        virt = ((virt - dev_priv->vm_vram_base) >> 16) << 1;
+        size = (size >> 16) << 1;
+
+        phys |= ((uint64_t)flags << 32);
+        phys |= 1;
+        if (dev_priv->vram_sys_base) {
+                phys += dev_priv->vram_sys_base;
+                phys |= 0x30;
+        }
 
         dev_priv->engine.instmem.prepare_access(dev, true);
-        if (flags & 0x80000000) {
-                while (pages--) {
-                        struct nouveau_gpuobj *pt = pgt[virt >> 29];
-                        unsigned pte = ((virt & 0x1fffffffULL) >> psz) << 1;
+        while (size) {
+                unsigned offset_h = upper_32_bits(phys);
+                unsigned offset_l = lower_32_bits(phys);
+                unsigned pte, end;
+
+                for (i = 7; i >= 0; i--) {
+                        block = 1 << (i + 1);
+                        if (size >= block && !(virt & (block - 1)))
+                                break;
+                }
+                offset_l |= (i << 7);
 
-                        nv_wo32(dev, pt, pte++, 0x00000000);
-                        nv_wo32(dev, pt, pte++, 0x00000000);
+                phys += block << 15;
+                size -= block;
 
-                        virt += (1 << psz);
-                }
-        } else {
-                while (pages--) {
-                        struct nouveau_gpuobj *pt = pgt[virt >> 29];
-                        unsigned pte = ((virt & 0x1fffffffULL) >> psz) << 1;
-                        unsigned offset_h = upper_32_bits(phys) & 0xff;
-                        unsigned offset_l = lower_32_bits(phys);
+                while (block) {
+                        pgt = dev_priv->vm_vram_pt[virt >> 14];
+                        pte = virt & 0x3ffe;
 
-                        nv_wo32(dev, pt, pte++, offset_l | pfl);
-                        nv_wo32(dev, pt, pte++, offset_h | flags);
+                        end = pte + block;
+                        if (end > 16384)
+                                end = 16384;
+                        block -= (end - pte);
+                        virt  += (end - pte);
 
-                        phys += (1 << psz);
-                        virt += (1 << psz);
+                        while (pte < end) {
+                                nv_wo32(dev, pgt, pte++, offset_l);
+                                nv_wo32(dev, pgt, pte++, offset_h);
+                        }
                 }
         }
         dev_priv->engine.instmem.finish_access(dev);
@@ -356,7 +353,41 @@ nv50_mem_vm_bind_linear(struct drm_device *dev, uint64_t virt, uint32_t size,
 void
 nv50_mem_vm_unbind(struct drm_device *dev, uint64_t virt, uint32_t size)
 {
-        nv50_mem_vm_bind_linear(dev, virt, size, 0x80000000, 0);
+        struct drm_nouveau_private *dev_priv = dev->dev_private;
+        struct nouveau_gpuobj *pgt;
+        unsigned pages, pte, end;
+
+        virt -= dev_priv->vm_vram_base;
+        pages = (size >> 16) << 1;
+
+        dev_priv->engine.instmem.prepare_access(dev, true);
+        while (pages) {
+                pgt = dev_priv->vm_vram_pt[virt >> 29];
+                pte = (virt & 0x1ffe0000ULL) >> 15;
+
+                end = pte + pages;
+                if (end > 16384)
+                        end = 16384;
+                pages -= (end - pte);
+                virt  += (end - pte) << 15;
+
+                while (pte < end)
+                        nv_wo32(dev, pgt, pte++, 0);
+        }
+        dev_priv->engine.instmem.finish_access(dev);
+
+        nv_wr32(dev, 0x100c80, 0x00050001);
+        if (!nv_wait(0x100c80, 0x00000001, 0x00000000)) {
+                NV_ERROR(dev, "timeout: (0x100c80 & 1) == 0 (2)\n");
+                NV_ERROR(dev, "0x100c80 = 0x%08x\n", nv_rd32(dev, 0x100c80));
+                return;
+        }
+
+        nv_wr32(dev, 0x100c80, 0x00000001);
+        if (!nv_wait(0x100c80, 0x00000001, 0x00000000)) {
+                NV_ERROR(dev, "timeout: (0x100c80 & 1) == 0 (2)\n");
+                NV_ERROR(dev, "0x100c80 = 0x%08x\n", nv_rd32(dev, 0x100c80));
+        }
 }
 
 /*
diff --git a/drivers/gpu/drm/nouveau/nouveau_notifier.c b/drivers/gpu/drm/nouveau/nouveau_notifier.c
index 6c66a34b6345..d99dc087f9b1 100644
--- a/drivers/gpu/drm/nouveau/nouveau_notifier.c
+++ b/drivers/gpu/drm/nouveau/nouveau_notifier.c
@@ -34,15 +34,20 @@ nouveau_notifier_init_channel(struct nouveau_channel *chan)
 {
         struct drm_device *dev = chan->dev;
         struct nouveau_bo *ntfy = NULL;
+        uint32_t flags;
         int ret;
 
-        ret = nouveau_gem_new(dev, NULL, PAGE_SIZE, 0, nouveau_vram_notify ?
-                              TTM_PL_FLAG_VRAM : TTM_PL_FLAG_TT,
+        if (nouveau_vram_notify)
+                flags = TTM_PL_FLAG_VRAM;
+        else
+                flags = TTM_PL_FLAG_TT;
+
+        ret = nouveau_gem_new(dev, NULL, PAGE_SIZE, 0, flags,
                               0, 0x0000, false, true, &ntfy);
         if (ret)
                 return ret;
 
-        ret = nouveau_bo_pin(ntfy, TTM_PL_FLAG_VRAM);
+        ret = nouveau_bo_pin(ntfy, flags);
         if (ret)
                 goto out_err;
 
@@ -128,6 +133,8 @@ nouveau_notifier_alloc(struct nouveau_channel *chan, uint32_t handle,
                         target = NV_DMA_TARGET_PCI;
                 } else {
                         target = NV_DMA_TARGET_AGP;
+                        if (dev_priv->card_type >= NV_50)
+                                offset += dev_priv->vm_gart_base;
                 }
         } else {
                 NV_ERROR(dev, "Bad DMA target, mem_type %d!\n",
diff --git a/drivers/gpu/drm/nouveau/nouveau_object.c b/drivers/gpu/drm/nouveau/nouveau_object.c
index 6c2cf81716df..e7c100ba63a1 100644
--- a/drivers/gpu/drm/nouveau/nouveau_object.c
+++ b/drivers/gpu/drm/nouveau/nouveau_object.c
@@ -885,11 +885,12 @@ int
 nouveau_gpuobj_sw_new(struct nouveau_channel *chan, int class,
                       struct nouveau_gpuobj **gpuobj_ret)
 {
-        struct drm_nouveau_private *dev_priv = chan->dev->dev_private;
+        struct drm_nouveau_private *dev_priv;
         struct nouveau_gpuobj *gpuobj;
 
         if (!chan || !gpuobj_ret || *gpuobj_ret != NULL)
                 return -EINVAL;
+        dev_priv = chan->dev->dev_private;
 
         gpuobj = kzalloc(sizeof(*gpuobj), GFP_KERNEL);
         if (!gpuobj)
diff --git a/drivers/gpu/drm/nouveau/nouveau_reg.h b/drivers/gpu/drm/nouveau/nouveau_reg.h
index 251f1b3b38b9..aa9b310e41be 100644
--- a/drivers/gpu/drm/nouveau/nouveau_reg.h
+++ b/drivers/gpu/drm/nouveau/nouveau_reg.h
@@ -99,6 +99,7 @@
  * the card will hang early on in the X init process.
  */
 #    define NV_PMC_ENABLE_UNK13                               (1<<13)
+#define NV40_PMC_GRAPH_UNITS                               0x00001540
 #define NV40_PMC_BACKLIGHT                                 0x000015f0
 #       define NV40_PMC_BACKLIGHT_MASK                     0x001f0000
 #define NV40_PMC_1700                                      0x00001700
diff --git a/drivers/gpu/drm/nouveau/nouveau_sgdma.c b/drivers/gpu/drm/nouveau/nouveau_sgdma.c
index 4c7f1e403e80..ed1590577b6c 100644
--- a/drivers/gpu/drm/nouveau/nouveau_sgdma.c
+++ b/drivers/gpu/drm/nouveau/nouveau_sgdma.c
@@ -54,11 +54,12 @@ static void
 nouveau_sgdma_clear(struct ttm_backend *be)
 {
         struct nouveau_sgdma_be *nvbe = (struct nouveau_sgdma_be *)be;
-        struct drm_device *dev = nvbe->dev;
-
-        NV_DEBUG(nvbe->dev, "\n");
+        struct drm_device *dev;
 
         if (nvbe && nvbe->pages) {
+                dev = nvbe->dev;
+                NV_DEBUG(dev, "\n");
+
                 if (nvbe->bound)
                         be->func->unbind(be);
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_state.c b/drivers/gpu/drm/nouveau/nouveau_state.c
index f2d0187ba152..a4851af5b05e 100644
--- a/drivers/gpu/drm/nouveau/nouveau_state.c
+++ b/drivers/gpu/drm/nouveau/nouveau_state.c
@@ -310,6 +310,14 @@ static int nouveau_init_engine_ptrs(struct drm_device *dev)
 static unsigned int
 nouveau_vga_set_decode(void *priv, bool state)
 {
+        struct drm_device *dev = priv;
+        struct drm_nouveau_private *dev_priv = dev->dev_private;
+
+        if (dev_priv->chipset >= 0x40)
+                nv_wr32(dev, 0x88054, state);
+        else
+                nv_wr32(dev, 0x1854, state);
+
         if (state)
                 return VGA_RSRC_LEGACY_IO | VGA_RSRC_LEGACY_MEM |
                        VGA_RSRC_NORMAL_IO | VGA_RSRC_NORMAL_MEM;
@@ -427,15 +435,19 @@ nouveau_card_init(struct drm_device *dev)
         if (ret)
                 goto out_timer;
 
-        /* PGRAPH */
-        ret = engine->graph.init(dev);
-        if (ret)
-                goto out_fb;
+        if (nouveau_noaccel)
+                engine->graph.accel_blocked = true;
+        else {
+                /* PGRAPH */
+                ret = engine->graph.init(dev);
+                if (ret)
+                        goto out_fb;
 
-        /* PFIFO */
-        ret = engine->fifo.init(dev);
-        if (ret)
-                goto out_graph;
+                /* PFIFO */
+                ret = engine->fifo.init(dev);
+                if (ret)
+                        goto out_graph;
+        }
 
         /* this call irq_preinstall, register irq handler and
          * call irq_postinstall
@@ -479,9 +491,11 @@ nouveau_card_init(struct drm_device *dev)
 out_irq:
         drm_irq_uninstall(dev);
 out_fifo:
-        engine->fifo.takedown(dev);
+        if (!nouveau_noaccel)
+                engine->fifo.takedown(dev);
 out_graph:
-        engine->graph.takedown(dev);
+        if (!nouveau_noaccel)
+                engine->graph.takedown(dev);
 out_fb:
         engine->fb.takedown(dev);
 out_timer:
@@ -518,8 +532,10 @@ static void nouveau_card_takedown(struct drm_device *dev)
                         dev_priv->channel = NULL;
                 }
 
-                engine->fifo.takedown(dev);
-                engine->graph.takedown(dev);
+                if (!nouveau_noaccel) {
+                        engine->fifo.takedown(dev);
+                        engine->graph.takedown(dev);
+                }
                 engine->fb.takedown(dev);
                 engine->timer.takedown(dev);
                 engine->mc.takedown(dev);
@@ -817,6 +833,15 @@ int nouveau_ioctl_getparam(struct drm_device *dev, void *data,
         case NOUVEAU_GETPARAM_VM_VRAM_BASE:
                 getparam->value = dev_priv->vm_vram_base;
                 break;
+        case NOUVEAU_GETPARAM_GRAPH_UNITS:
+                /* NV40 and NV50 versions are quite different, but register
+                 * address is the same. User is supposed to know the card
+                 * family anyway... */
+                if (dev_priv->chipset >= 0x40) {
+                        getparam->value = nv_rd32(dev, NV40_PMC_GRAPH_UNITS);
+                        break;
+                }
+                /* FALLTHRU */
         default:
                 NV_ERROR(dev, "unknown parameter %lld\n", getparam->param);
                 return -EINVAL;
diff --git a/drivers/gpu/drm/nouveau/nv04_dac.c b/drivers/gpu/drm/nouveau/nv04_dac.c
index d0e038d28948..1d73b15d70da 100644
--- a/drivers/gpu/drm/nouveau/nv04_dac.c
+++ b/drivers/gpu/drm/nouveau/nv04_dac.c
@@ -119,7 +119,7 @@ static enum drm_connector_status nv04_dac_detect(struct drm_encoder *encoder,
                                                  struct drm_connector *connector)
 {
         struct drm_device *dev = encoder->dev;
-        uint8_t saved_seq1, saved_pi, saved_rpc1;
+        uint8_t saved_seq1, saved_pi, saved_rpc1, saved_cr_mode;
         uint8_t saved_palette0[3], saved_palette_mask;
         uint32_t saved_rtest_ctrl, saved_rgen_ctrl;
         int i;
@@ -135,6 +135,9 @@ static enum drm_connector_status nv04_dac_detect(struct drm_encoder *encoder,
                 /* only implemented for head A for now */
                 NVSetOwner(dev, 0);
 
+        saved_cr_mode = NVReadVgaCrtc(dev, 0, NV_CIO_CR_MODE_INDEX);
+        NVWriteVgaCrtc(dev, 0, NV_CIO_CR_MODE_INDEX, saved_cr_mode | 0x80);
+
         saved_seq1 = NVReadVgaSeq(dev, 0, NV_VIO_SR_CLOCK_INDEX);
         NVWriteVgaSeq(dev, 0, NV_VIO_SR_CLOCK_INDEX, saved_seq1 & ~0x20);
 
@@ -203,6 +206,7 @@ out:
         NVWriteVgaCrtc(dev, 0, NV_CIO_CRE_PIXEL_INDEX, saved_pi);
         NVWriteVgaCrtc(dev, 0, NV_CIO_CRE_RPC1_INDEX, saved_rpc1);
         NVWriteVgaSeq(dev, 0, NV_VIO_SR_CLOCK_INDEX, saved_seq1);
+        NVWriteVgaCrtc(dev, 0, NV_CIO_CR_MODE_INDEX, saved_cr_mode);
 
         if (blue == 0x18) {
                 NV_INFO(dev, "Load detected on head A\n");
diff --git a/drivers/gpu/drm/nouveau/nv04_fbcon.c b/drivers/gpu/drm/nouveau/nv04_fbcon.c
index d910873c1368..fd01caabd5c3 100644
--- a/drivers/gpu/drm/nouveau/nv04_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nv04_fbcon.c
@@ -27,7 +27,7 @@
 #include "nouveau_dma.h"
 #include "nouveau_fbcon.h"
 
-static void
+void
 nv04_fbcon_copyarea(struct fb_info *info, const struct fb_copyarea *region)
 {
         struct nouveau_fbcon_par *par = info->par;
@@ -54,7 +54,7 @@ nv04_fbcon_copyarea(struct fb_info *info, const struct fb_copyarea *region)
         FIRE_RING(chan);
 }
 
-static void
+void
 nv04_fbcon_fillrect(struct fb_info *info, const struct fb_fillrect *rect)
 {
         struct nouveau_fbcon_par *par = info->par;
@@ -88,7 +88,7 @@ nv04_fbcon_fillrect(struct fb_info *info, const struct fb_fillrect *rect)
         FIRE_RING(chan);
 }
 
-static void
+void
 nv04_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
 {
         struct nouveau_fbcon_par *par = info->par;
@@ -307,9 +307,6 @@ nv04_fbcon_accel_init(struct fb_info *info)
 
         FIRE_RING(chan);
 
-        info->fbops->fb_fillrect = nv04_fbcon_fillrect;
-        info->fbops->fb_copyarea = nv04_fbcon_copyarea;
-        info->fbops->fb_imageblit = nv04_fbcon_imageblit;
         return 0;
 }
 
diff --git a/drivers/gpu/drm/nouveau/nv17_tv.c b/drivers/gpu/drm/nouveau/nv17_tv.c
index 58b917c3341b..21ac6e49b6ee 100644
--- a/drivers/gpu/drm/nouveau/nv17_tv.c
+++ b/drivers/gpu/drm/nouveau/nv17_tv.c
@@ -579,6 +579,8 @@ static void nv17_tv_restore(struct drm_encoder *encoder)
                                 nouveau_encoder(encoder)->restore.output);
 
         nv17_tv_state_load(dev, &to_tv_enc(encoder)->saved_state);
+
+        nouveau_encoder(encoder)->last_dpms = NV_DPMS_CLEARED;
 }
 
 static int nv17_tv_create_resources(struct drm_encoder *encoder,
diff --git a/drivers/gpu/drm/nouveau/nv50_crtc.c b/drivers/gpu/drm/nouveau/nv50_crtc.c
index 40b7360841f8..d1a651e3400c 100644
--- a/drivers/gpu/drm/nouveau/nv50_crtc.c
+++ b/drivers/gpu/drm/nouveau/nv50_crtc.c
@@ -298,14 +298,17 @@ nv50_crtc_set_clock(struct drm_device *dev, int head, int pclk)
 static void
 nv50_crtc_destroy(struct drm_crtc *crtc)
 {
-        struct drm_device *dev = crtc->dev;
-        struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc);
-
-        NV_DEBUG_KMS(dev, "\n");
+        struct drm_device *dev;
+        struct nouveau_crtc *nv_crtc;
 
         if (!crtc)
                 return;
 
+        dev = crtc->dev;
+        nv_crtc = nouveau_crtc(crtc);
+
+        NV_DEBUG_KMS(dev, "\n");
+
         drm_crtc_cleanup(&nv_crtc->base);
 
         nv50_cursor_fini(nv_crtc);
diff --git a/drivers/gpu/drm/nouveau/nv50_fbcon.c b/drivers/gpu/drm/nouveau/nv50_fbcon.c
index e4f279ee61cf..0f57cdf7ccb2 100644
--- a/drivers/gpu/drm/nouveau/nv50_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nv50_fbcon.c
@@ -3,7 +3,7 @@
 #include "nouveau_dma.h"
 #include "nouveau_fbcon.h"
 
-static void
+void
 nv50_fbcon_fillrect(struct fb_info *info, const struct fb_fillrect *rect)
 {
         struct nouveau_fbcon_par *par = info->par;
@@ -46,7 +46,7 @@ nv50_fbcon_fillrect(struct fb_info *info, const struct fb_fillrect *rect)
         FIRE_RING(chan);
 }
 
-static void
+void
 nv50_fbcon_copyarea(struct fb_info *info, const struct fb_copyarea *region)
 {
         struct nouveau_fbcon_par *par = info->par;
@@ -81,7 +81,7 @@ nv50_fbcon_copyarea(struct fb_info *info, const struct fb_copyarea *region)
         FIRE_RING(chan);
 }
 
-static void
+void
 nv50_fbcon_imageblit(struct fb_info *info, const struct fb_image *image)
 {
         struct nouveau_fbcon_par *par = info->par;
@@ -262,9 +262,6 @@ nv50_fbcon_accel_init(struct fb_info *info)
         OUT_RING(chan, info->fix.smem_start - dev_priv->fb_phys +
                          dev_priv->vm_vram_base);
 
-        info->fbops->fb_fillrect = nv50_fbcon_fillrect;
-        info->fbops->fb_copyarea = nv50_fbcon_copyarea;
-        info->fbops->fb_imageblit = nv50_fbcon_imageblit;
         return 0;
 }
 
diff --git a/drivers/gpu/drm/nouveau/nv50_fifo.c b/drivers/gpu/drm/nouveau/nv50_fifo.c
index 32b244bcb482..204a79ff10f4 100644
--- a/drivers/gpu/drm/nouveau/nv50_fifo.c
+++ b/drivers/gpu/drm/nouveau/nv50_fifo.c
@@ -317,17 +317,20 @@ void
 nv50_fifo_destroy_context(struct nouveau_channel *chan)
 {
         struct drm_device *dev = chan->dev;
+        struct nouveau_gpuobj_ref *ramfc = chan->ramfc;
 
         NV_DEBUG(dev, "ch%d\n", chan->id);
 
-        nouveau_gpuobj_ref_del(dev, &chan->ramfc);
-        nouveau_gpuobj_ref_del(dev, &chan->cache);
-
+        /* This will ensure the channel is seen as disabled. */
+        chan->ramfc = NULL;
         nv50_fifo_channel_disable(dev, chan->id, false);
 
         /* Dummy channel, also used on ch 127 */
         if (chan->id == 0)
                 nv50_fifo_channel_disable(dev, 127, false);
+
+        nouveau_gpuobj_ref_del(dev, &ramfc);
+        nouveau_gpuobj_ref_del(dev, &chan->cache);
 }
 
 int
diff --git a/drivers/gpu/drm/nouveau/nv50_graph.c b/drivers/gpu/drm/nouveau/nv50_graph.c
index 20319e59d368..6d504801b514 100644
--- a/drivers/gpu/drm/nouveau/nv50_graph.c
+++ b/drivers/gpu/drm/nouveau/nv50_graph.c
@@ -165,6 +165,12 @@ nv50_graph_channel(struct drm_device *dev)
         uint32_t inst;
         int i;
 
+        /* Be sure we're not in the middle of a context switch or bad things
+         * will happen, such as unloading the wrong pgraph context.
+         */
+        if (!nv_wait(0x400300, 0x00000001, 0x00000000))
+                NV_ERROR(dev, "Ctxprog is still running\n");
+
         inst = nv_rd32(dev, NV50_PGRAPH_CTXCTL_CUR);
         if (!(inst & NV50_PGRAPH_CTXCTL_CUR_LOADED))
                 return NULL;
@@ -275,7 +281,7 @@ nv50_graph_load_context(struct nouveau_channel *chan)
 int
 nv50_graph_unload_context(struct drm_device *dev)
 {
-        uint32_t inst, fifo = nv_rd32(dev, 0x400500);
+        uint32_t inst;
 
         inst  = nv_rd32(dev, NV50_PGRAPH_CTXCTL_CUR);
         if (!(inst & NV50_PGRAPH_CTXCTL_CUR_LOADED))
@@ -283,12 +289,10 @@ nv50_graph_unload_context(struct drm_device *dev)
         inst &= NV50_PGRAPH_CTXCTL_CUR_INSTANCE;
 
         nouveau_wait_for_idle(dev);
-        nv_wr32(dev, 0x400500, fifo & ~1);
         nv_wr32(dev, 0x400784, inst);
         nv_wr32(dev, 0x400824, nv_rd32(dev, 0x400824) | 0x20);
         nv_wr32(dev, 0x400304, nv_rd32(dev, 0x400304) | 0x01);
         nouveau_wait_for_idle(dev);
-        nv_wr32(dev, 0x400500, fifo);
 
         nv_wr32(dev, NV50_PGRAPH_CTXCTL_CUR, inst);
         return 0;
diff --git a/drivers/gpu/drm/nouveau/nv50_instmem.c b/drivers/gpu/drm/nouveau/nv50_instmem.c
index 94400f777e7f..f0dc4e36ef05 100644
--- a/drivers/gpu/drm/nouveau/nv50_instmem.c
+++ b/drivers/gpu/drm/nouveau/nv50_instmem.c
@@ -76,6 +76,11 @@ nv50_instmem_init(struct drm_device *dev)
         for (i = 0x1700; i <= 0x1710; i += 4)
                 priv->save1700[(i-0x1700)/4] = nv_rd32(dev, i);
 
+        if (dev_priv->chipset == 0xaa || dev_priv->chipset == 0xac)
+                dev_priv->vram_sys_base = nv_rd32(dev, 0x100e10) << 12;
+        else
+                dev_priv->vram_sys_base = 0;
+
         /* Reserve the last MiB of VRAM, we should probably try to avoid
          * setting up the below tables over the top of the VBIOS image at
          * some point.
@@ -172,16 +177,28 @@ nv50_instmem_init(struct drm_device *dev)
          * We map the entire fake channel into the start of the PRAMIN BAR
          */
         ret = nouveau_gpuobj_new_ref(dev, chan, NULL, 0, pt_size, 0x1000,
-                                                        0, &priv->pramin_pt);
+                                     0, &priv->pramin_pt);
         if (ret)
                 return ret;
 
-        for (i = 0, v = c_offset; i < pt_size; i += 8, v += 0x1000) {
-                if (v < (c_offset + c_size))
-                        BAR0_WI32(priv->pramin_pt->gpuobj, i + 0, v | 1);
-                else
-                        BAR0_WI32(priv->pramin_pt->gpuobj, i + 0, 0x00000009);
+        v = c_offset | 1;
+        if (dev_priv->vram_sys_base) {
+                v += dev_priv->vram_sys_base;
+                v |= 0x30;
+        }
+
+        i = 0;
+        while (v < dev_priv->vram_sys_base + c_offset + c_size) {
+                BAR0_WI32(priv->pramin_pt->gpuobj, i + 0, v);
+                BAR0_WI32(priv->pramin_pt->gpuobj, i + 4, 0x00000000);
+                v += 0x1000;
+                i += 8;
+        }
+
+        while (i < pt_size) {
+                BAR0_WI32(priv->pramin_pt->gpuobj, i + 0, 0x00000000);
                 BAR0_WI32(priv->pramin_pt->gpuobj, i + 4, 0x00000000);
+                i += 8;
         }
 
         BAR0_WI32(chan->vm_pd, 0x00, priv->pramin_pt->instance | 0x63);
@@ -416,7 +433,9 @@ nv50_instmem_bind(struct drm_device *dev, struct nouveau_gpuobj *gpuobj)
 {
         struct drm_nouveau_private *dev_priv = dev->dev_private;
         struct nv50_instmem_priv *priv = dev_priv->engine.instmem.priv;
-        uint32_t pte, pte_end, vram;
+        struct nouveau_gpuobj *pramin_pt = priv->pramin_pt->gpuobj;
+        uint32_t pte, pte_end;
+        uint64_t vram;
 
         if (!gpuobj->im_backing || !gpuobj->im_pramin || gpuobj->im_bound)
                 return -EINVAL;
@@ -424,20 +443,24 @@ nv50_instmem_bind(struct drm_device *dev, struct nouveau_gpuobj *gpuobj)
         NV_DEBUG(dev, "st=0x%0llx sz=0x%0llx\n",
                  gpuobj->im_pramin->start, gpuobj->im_pramin->size);
 
-        pte     = (gpuobj->im_pramin->start >> 12) << 3;
-        pte_end = ((gpuobj->im_pramin->size >> 12) << 3) + pte;
+        pte     = (gpuobj->im_pramin->start >> 12) << 1;
+        pte_end = ((gpuobj->im_pramin->size >> 12) << 1) + pte;
         vram    = gpuobj->im_backing_start;
 
         NV_DEBUG(dev, "pramin=0x%llx, pte=%d, pte_end=%d\n",
                  gpuobj->im_pramin->start, pte, pte_end);
         NV_DEBUG(dev, "first vram page: 0x%08x\n", gpuobj->im_backing_start);
 
+        vram |= 1;
+        if (dev_priv->vram_sys_base) {
+                vram += dev_priv->vram_sys_base;
+                vram |= 0x30;
+        }
+
         dev_priv->engine.instmem.prepare_access(dev, true);
         while (pte < pte_end) {
-                nv_wo32(dev, priv->pramin_pt->gpuobj, (pte + 0)/4, vram | 1);
-                nv_wo32(dev, priv->pramin_pt->gpuobj, (pte + 4)/4, 0x00000000);
-
-                pte += 8;
+                nv_wo32(dev, pramin_pt, pte++, lower_32_bits(vram));
+                nv_wo32(dev, pramin_pt, pte++, upper_32_bits(vram));
                 vram += NV50_INSTMEM_PAGE_SIZE;
         }
         dev_priv->engine.instmem.finish_access(dev);
@@ -470,14 +493,13 @@ nv50_instmem_unbind(struct drm_device *dev, struct nouveau_gpuobj *gpuobj)
         if (gpuobj->im_bound == 0)
                 return -EINVAL;
 
-        pte     = (gpuobj->im_pramin->start >> 12) << 3;
-        pte_end = ((gpuobj->im_pramin->size >> 12) << 3) + pte;
+        pte     = (gpuobj->im_pramin->start >> 12) << 1;
+        pte_end = ((gpuobj->im_pramin->size >> 12) << 1) + pte;
 
         dev_priv->engine.instmem.prepare_access(dev, true);
         while (pte < pte_end) {
-                nv_wo32(dev, priv->pramin_pt->gpuobj, (pte + 0)/4, 0x00000009);
-                nv_wo32(dev, priv->pramin_pt->gpuobj, (pte + 4)/4, 0x00000000);
-                pte += 8;
+                nv_wo32(dev, priv->pramin_pt->gpuobj, pte++, 0x00000000);
+                nv_wo32(dev, priv->pramin_pt->gpuobj, pte++, 0x00000000);
         }
         dev_priv->engine.instmem.finish_access(dev);
 
diff --git a/drivers/gpu/drm/nouveau/nv50_sor.c b/drivers/gpu/drm/nouveau/nv50_sor.c
index ecf1936b8224..c2fff543b06f 100644
--- a/drivers/gpu/drm/nouveau/nv50_sor.c
+++ b/drivers/gpu/drm/nouveau/nv50_sor.c
@@ -101,6 +101,7 @@ nv50_sor_dpms(struct drm_encoder *encoder, int mode)
                 struct nouveau_encoder *nvenc = nouveau_encoder(enc);
 
                 if (nvenc == nv_encoder ||
+                    nvenc->disconnect != nv50_sor_disconnect ||
                     nvenc->dcb->or != nv_encoder->dcb->or)
                         continue;
 
diff --git a/drivers/gpu/drm/radeon/Kconfig b/drivers/gpu/drm/radeon/Kconfig
index 5982321be4d5..1c02d23f6fcc 100644
--- a/drivers/gpu/drm/radeon/Kconfig
+++ b/drivers/gpu/drm/radeon/Kconfig
@@ -1,10 +1,14 @@
 config DRM_RADEON_KMS
-        bool "Enable modesetting on radeon by default"
+        bool "Enable modesetting on radeon by default - NEW DRIVER"
         depends on DRM_RADEON
         help
-          Choose this option if you want kernel modesetting enabled by default,
-          and you have a new enough userspace to support this. Running old
-          userspaces with this enabled will cause pain.
+          Choose this option if you want kernel modesetting enabled by default.
+
+          This is a completely new driver. It's only part of the existing drm
+          for compatibility reasons. It requires an entirely different graphics
+          stack above it and works very differently from the old drm stack.
+          i.e. don't enable this unless you know what you are doing it may
+          cause issues or bugs compared to the previous userspace driver stack.
 
           When kernel modesetting is enabled the IOCTL of radeon/drm
           driver are considered as invalid and an error message is printed
diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
index e3b44562d265..7f152f66f196 100644
--- a/drivers/gpu/drm/radeon/atom.c
+++ b/drivers/gpu/drm/radeon/atom.c
@@ -24,6 +24,7 @@
 
 #include <linux/module.h>
 #include <linux/sched.h>
+#include <asm/unaligned.h>
 
 #define ATOM_DEBUG
 
@@ -212,7 +213,9 @@ static uint32_t atom_get_src_int(atom_exec_context *ctx, uint8_t attr,
         case ATOM_ARG_PS:
                 idx = U8(*ptr);
                 (*ptr)++;
-                val = le32_to_cpu(ctx->ps[idx]);
+                /* get_unaligned_le32 avoids unaligned accesses from atombios
+                 * tables, noticed on a DEC Alpha. */
+                val = get_unaligned_le32((u32 *)&ctx->ps[idx]);
                 if (print)
                         DEBUG("PS[0x%02X,0x%04X]", idx, val);
                 break;
@@ -640,7 +643,7 @@ static void atom_op_delay(atom_exec_context *ctx, int *ptr, int arg)
         uint8_t count = U8((*ptr)++);
         SDEBUG("   count: %d\n", count);
         if (arg == ATOM_UNIT_MICROSEC)
-                schedule_timeout_uninterruptible(usecs_to_jiffies(count));
+                udelay(count);
         else
                 schedule_timeout_uninterruptible(msecs_to_jiffies(count));
 }
diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
index 3eb0ca5b3d73..99915a682d59 100644
--- a/drivers/gpu/drm/radeon/atombios_dp.c
+++ b/drivers/gpu/drm/radeon/atombios_dp.c
@@ -332,11 +332,13 @@ bool radeon_process_aux_ch(struct radeon_i2c_chan *chan, u8 *req_bytes,
         PROCESS_AUX_CHANNEL_TRANSACTION_PS_ALLOCATION args;
         int index = GetIndexIntoMasterTable(COMMAND, ProcessAuxChannelTransaction);
         unsigned char *base;
+        int retry_count = 0;
 
         memset(&args, 0, sizeof(args));
 
         base = (unsigned char *)rdev->mode_info.atom_context->scratch;
 
+retry:
         memcpy(base, req_bytes, num_bytes);
 
         args.lpAuxRequest = 0;
@@ -347,10 +349,12 @@ bool radeon_process_aux_ch(struct radeon_i2c_chan *chan, u8 *req_bytes,
 
         atom_execute_table(rdev->mode_info.atom_context, index, (uint32_t *)&args);
 
-        if (args.ucReplyStatus) {
-                DRM_DEBUG("failed to get auxch %02x%02x %02x %02x 0x%02x %02x\n",
+        if (args.ucReplyStatus && !args.ucDataOutLen) {
+                if (args.ucReplyStatus == 0x20 && retry_count++ < 10)
+                        goto retry;
+                DRM_DEBUG("failed to get auxch %02x%02x %02x %02x 0x%02x %02x after %d retries\n",
                           req_bytes[1], req_bytes[0], req_bytes[2], req_bytes[3],
-                          chan->rec.i2c_id, args.ucReplyStatus);
+                          chan->rec.i2c_id, args.ucReplyStatus, retry_count);
                 return false;
         }
 
@@ -468,7 +472,7 @@ void radeon_dp_set_link_config(struct drm_connector *connector,
         struct radeon_connector *radeon_connector;
         struct radeon_connector_atom_dig *dig_connector;
 
-        if ((connector->connector_type != DRM_MODE_CONNECTOR_DisplayPort) ||
+        if ((connector->connector_type != DRM_MODE_CONNECTOR_DisplayPort) &&
             (connector->connector_type != DRM_MODE_CONNECTOR_eDP))
                 return;
 
@@ -583,7 +587,7 @@ void dp_link_train(struct drm_encoder *encoder,
         u8 train_set[4];
         int i;
 
-        if ((connector->connector_type != DRM_MODE_CONNECTOR_DisplayPort) ||
+        if ((connector->connector_type != DRM_MODE_CONNECTOR_DisplayPort) &&
             (connector->connector_type != DRM_MODE_CONNECTOR_eDP))
                 return;
 
@@ -596,21 +600,14 @@ void dp_link_train(struct drm_encoder *encoder,
                 return;
         dig_connector = radeon_connector->con_priv;
 
-        if (ASIC_IS_DCE32(rdev)) {
-                if (dig->dig_block)
-                        enc_id |= ATOM_DP_CONFIG_DIG2_ENCODER;
-                else
-                        enc_id |= ATOM_DP_CONFIG_DIG1_ENCODER;
-                if (dig_connector->linkb)
-                        enc_id |= ATOM_DP_CONFIG_LINK_B;
-                else
-                        enc_id |= ATOM_DP_CONFIG_LINK_A;
-        } else {
-                if (dig_connector->linkb)
-                        enc_id |= ATOM_DP_CONFIG_DIG2_ENCODER | ATOM_DP_CONFIG_LINK_B;
-                else
-                        enc_id |= ATOM_DP_CONFIG_DIG1_ENCODER | ATOM_DP_CONFIG_LINK_A;
-        }
+        if (dig->dig_encoder)
+                enc_id |= ATOM_DP_CONFIG_DIG2_ENCODER;
+        else
+                enc_id |= ATOM_DP_CONFIG_DIG1_ENCODER;
+        if (dig_connector->linkb)
+                enc_id |= ATOM_DP_CONFIG_LINK_B;
+        else
+                enc_id |= ATOM_DP_CONFIG_LINK_A;
 
         memset(link_configuration, 0, DP_LINK_CONFIGURATION_SIZE);
         if (dig_connector->dp_clock == 270000)
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 11c9a3fe6810..c0d4650cdb79 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -354,11 +354,17 @@ u32 r100_get_vblank_counter(struct radeon_device *rdev, int crtc)
                 return RREG32(RADEON_CRTC2_CRNT_FRAME);
 }
 
+/* Who ever call radeon_fence_emit should call ring_lock and ask
+ * for enough space (today caller are ib schedule and buffer move) */
 void r100_fence_ring_emit(struct radeon_device *rdev,
                           struct radeon_fence *fence)
 {
-        /* Who ever call radeon_fence_emit should call ring_lock and ask
-         * for enough space (today caller are ib schedule and buffer move) */
+        /* We have to make sure that caches are flushed before
+         * CPU might read something from VRAM. */
+        radeon_ring_write(rdev, PACKET0(RADEON_RB3D_DSTCACHE_CTLSTAT, 0));
+        radeon_ring_write(rdev, RADEON_RB3D_DC_FLUSH_ALL);
+        radeon_ring_write(rdev, PACKET0(RADEON_RB3D_ZCACHE_CTLSTAT, 0));
+        radeon_ring_write(rdev, RADEON_RB3D_ZC_FLUSH_ALL);
         /* Wait until IDLE & CLEAN */
         radeon_ring_write(rdev, PACKET0(0x1720, 0));
         radeon_ring_write(rdev, (1 << 16) | (1 << 17));
@@ -3369,7 +3375,6 @@ int r100_suspend(struct radeon_device *rdev)
 
 void r100_fini(struct radeon_device *rdev)
 {
-        r100_suspend(rdev);
         r100_cp_fini(rdev);
         r100_wb_fini(rdev);
         r100_ib_fini(rdev);
@@ -3481,13 +3486,12 @@ int r100_init(struct radeon_device *rdev)
         if (r) {
                 /* Somethings want wront with the accel init stop accel */
                 dev_err(rdev->dev, "Disabling GPU acceleration\n");
-                r100_suspend(rdev);
                 r100_cp_fini(rdev);
                 r100_wb_fini(rdev);
                 r100_ib_fini(rdev);
+                radeon_irq_kms_fini(rdev);
                 if (rdev->flags & RADEON_IS_PCI)
                         r100_pci_gart_fini(rdev);
-                radeon_irq_kms_fini(rdev);
                 rdev->accel_working = false;
         }
         return 0;
diff --git a/drivers/gpu/drm/radeon/r300.c b/drivers/gpu/drm/radeon/r300.c
index 0051d11b907c..43b55a030b4d 100644
--- a/drivers/gpu/drm/radeon/r300.c
+++ b/drivers/gpu/drm/radeon/r300.c
@@ -506,11 +506,14 @@ void r300_vram_info(struct radeon_device *rdev)
 
         /* DDR for all card after R300 & IGP */
         rdev->mc.vram_is_ddr = true;
+
         tmp = RREG32(RADEON_MEM_CNTL);
-        if (tmp & R300_MEM_NUM_CHANNELS_MASK) {
-                rdev->mc.vram_width = 128;
-        } else {
-                rdev->mc.vram_width = 64;
+        tmp &= R300_MEM_NUM_CHANNELS_MASK;
+        switch (tmp) {
+        case 0: rdev->mc.vram_width = 64; break;
+        case 1: rdev->mc.vram_width = 128; break;
+        case 2: rdev->mc.vram_width = 256; break;
+        default:  rdev->mc.vram_width = 128; break;
         }
 
         r100_vram_init_sizes(rdev);
@@ -1327,7 +1330,6 @@ int r300_suspend(struct radeon_device *rdev)
 
 void r300_fini(struct radeon_device *rdev)
 {
-        r300_suspend(rdev);
         r100_cp_fini(rdev);
         r100_wb_fini(rdev);
         r100_ib_fini(rdev);
@@ -1418,15 +1420,15 @@ int r300_init(struct radeon_device *rdev)
         if (r) {
                 /* Somethings want wront with the accel init stop accel */
                 dev_err(rdev->dev, "Disabling GPU acceleration\n");
-                r300_suspend(rdev);
                 r100_cp_fini(rdev);
                 r100_wb_fini(rdev);
                 r100_ib_fini(rdev);
+                radeon_irq_kms_fini(rdev);
                 if (rdev->flags & RADEON_IS_PCIE)
                         rv370_pcie_gart_fini(rdev);
                 if (rdev->flags & RADEON_IS_PCI)
                         r100_pci_gart_fini(rdev);
-                radeon_irq_kms_fini(rdev);
+                radeon_agp_fini(rdev);
                 rdev->accel_working = false;
         }
         return 0;
diff --git a/drivers/gpu/drm/radeon/r420.c b/drivers/gpu/drm/radeon/r420.c
index 4526faaacca8..d9373246c97f 100644
--- a/drivers/gpu/drm/radeon/r420.c
+++ b/drivers/gpu/drm/radeon/r420.c
@@ -389,16 +389,15 @@ int r420_init(struct radeon_device *rdev)
         if (r) {
                 /* Somethings want wront with the accel init stop accel */
                 dev_err(rdev->dev, "Disabling GPU acceleration\n");
-                r420_suspend(rdev);
                 r100_cp_fini(rdev);
                 r100_wb_fini(rdev);
                 r100_ib_fini(rdev);
+                radeon_irq_kms_fini(rdev);
                 if (rdev->flags & RADEON_IS_PCIE)
                         rv370_pcie_gart_fini(rdev);
                 if (rdev->flags & RADEON_IS_PCI)
                         r100_pci_gart_fini(rdev);
                 radeon_agp_fini(rdev);
-                radeon_irq_kms_fini(rdev);
                 rdev->accel_working = false;
         }
         return 0;
diff --git a/drivers/gpu/drm/radeon/r520.c b/drivers/gpu/drm/radeon/r520.c
index 9a189072f2b9..ddf5731eba0d 100644
--- a/drivers/gpu/drm/radeon/r520.c
+++ b/drivers/gpu/drm/radeon/r520.c
@@ -294,13 +294,12 @@ int r520_init(struct radeon_device *rdev)
         if (r) {
                 /* Somethings want wront with the accel init stop accel */
                 dev_err(rdev->dev, "Disabling GPU acceleration\n");
-                rv515_suspend(rdev);
                 r100_cp_fini(rdev);
                 r100_wb_fini(rdev);
                 r100_ib_fini(rdev);
+                radeon_irq_kms_fini(rdev);
                 rv370_pcie_gart_fini(rdev);
                 radeon_agp_fini(rdev);
-                radeon_irq_kms_fini(rdev);
                 rdev->accel_working = false;
         }
         return 0;
diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c
index da9aa3c31bcf..2ffcf5a03551 100644
--- a/drivers/gpu/drm/radeon/r600.c
+++ b/drivers/gpu/drm/radeon/r600.c
@@ -1654,6 +1654,12 @@ void r600_ring_init(struct radeon_device *rdev, unsigned ring_size)
         rdev->cp.align_mask = 16 - 1;
 }
 
+void r600_cp_fini(struct radeon_device *rdev)
+{
+        r600_cp_stop(rdev);
+        radeon_ring_fini(rdev);
+}
+
 
 /*
  * GPU scratch registers helpers function.
@@ -1788,23 +1794,24 @@ void r600_fence_ring_emit(struct radeon_device *rdev,
         radeon_ring_write(rdev, RB_INT_STAT);
 }
 
-int r600_copy_dma(struct radeon_device *rdev,
-                  uint64_t src_offset,
-                  uint64_t dst_offset,
-                  unsigned num_pages,
-                  struct radeon_fence *fence)
-{
-        /* FIXME: implement */
-        return 0;
-}
-
 int r600_copy_blit(struct radeon_device *rdev,
                    uint64_t src_offset, uint64_t dst_offset,
                    unsigned num_pages, struct radeon_fence *fence)
 {
-        r600_blit_prepare_copy(rdev, num_pages * RADEON_GPU_PAGE_SIZE);
+        int r;
+
+        mutex_lock(&rdev->r600_blit.mutex);
+        rdev->r600_blit.vb_ib = NULL;
+        r = r600_blit_prepare_copy(rdev, num_pages * RADEON_GPU_PAGE_SIZE);
+        if (r) {
+                if (rdev->r600_blit.vb_ib)
+                        radeon_ib_free(rdev, &rdev->r600_blit.vb_ib);
+                mutex_unlock(&rdev->r600_blit.mutex);
+                return r;
+        }
         r600_kms_blit_copy(rdev, src_offset, dst_offset, num_pages * RADEON_GPU_PAGE_SIZE);
         r600_blit_done_copy(rdev, fence);
+        mutex_unlock(&rdev->r600_blit.mutex);
         return 0;
 }
 
@@ -1860,26 +1867,25 @@ int r600_startup(struct radeon_device *rdev)
                         return r;
         }
         r600_gpu_init(rdev);
-
-        if (!rdev->r600_blit.shader_obj) {
-                r = r600_blit_init(rdev);
+        r = r600_blit_init(rdev);
+        if (r) {
+                r600_blit_fini(rdev);
+                rdev->asic->copy = NULL;
+                dev_warn(rdev->dev, "failed blitter (%d) falling back to memcpy\n", r);
+        }
+        /* pin copy shader into vram */
+        if (rdev->r600_blit.shader_obj) {
+                r = radeon_bo_reserve(rdev->r600_blit.shader_obj, false);
+                if (unlikely(r != 0))
+                        return r;
+                r = radeon_bo_pin(rdev->r600_blit.shader_obj, RADEON_GEM_DOMAIN_VRAM,
+                                &rdev->r600_blit.shader_gpu_addr);
+                radeon_bo_unreserve(rdev->r600_blit.shader_obj);
                 if (r) {
-                        DRM_ERROR("radeon: failed blitter (%d).\n", r);
+                        dev_err(rdev->dev, "(%d) pin blit object failed\n", r);
                         return r;
                 }
         }
-
-        r = radeon_bo_reserve(rdev->r600_blit.shader_obj, false);
-        if (unlikely(r != 0))
-                return r;
-        r = radeon_bo_pin(rdev->r600_blit.shader_obj, RADEON_GEM_DOMAIN_VRAM,
-                        &rdev->r600_blit.shader_gpu_addr);
-        radeon_bo_unreserve(rdev->r600_blit.shader_obj);
-        if (r) {
-                dev_err(rdev->dev, "(%d) pin blit object failed\n", r);
-                return r;
-        }
-
         /* Enable IRQ */
         r = r600_irq_init(rdev);
         if (r) {
@@ -1944,6 +1950,13 @@ int r600_resume(struct radeon_device *rdev)
                 DRM_ERROR("radeon: failled testing IB (%d).\n", r);
                 return r;
         }
+
+        r = r600_audio_init(rdev);
+        if (r) {
+                DRM_ERROR("radeon: audio resume failed\n");
+                return r;
+        }
+
         return r;
 }
 
@@ -1951,6 +1964,7 @@ int r600_suspend(struct radeon_device *rdev)
 {
         int r;
 
+        r600_audio_fini(rdev);
         /* FIXME: we should wait for ring to be empty */
         r600_cp_stop(rdev);
         rdev->cp.ready = false;
@@ -2055,9 +2069,11 @@ int r600_init(struct radeon_device *rdev)
         rdev->accel_working = true;
         r = r600_startup(rdev);
         if (r) {
-                r600_suspend(rdev);
+                dev_err(rdev->dev, "disabling GPU acceleration\n");
+                r600_cp_fini(rdev);
                 r600_wb_fini(rdev);
-                radeon_ring_fini(rdev);
+                r600_irq_fini(rdev);
+                radeon_irq_kms_fini(rdev);
                 r600_pcie_gart_fini(rdev);
                 rdev->accel_working = false;
         }
@@ -2083,20 +2099,17 @@ int r600_init(struct radeon_device *rdev)
 
 void r600_fini(struct radeon_device *rdev)
 {
-        /* Suspend operations */
-        r600_suspend(rdev);
-
         r600_audio_fini(rdev);
         r600_blit_fini(rdev);
+        r600_cp_fini(rdev);
+        r600_wb_fini(rdev);
         r600_irq_fini(rdev);
         radeon_irq_kms_fini(rdev);
-        radeon_ring_fini(rdev);
-        r600_wb_fini(rdev);
         r600_pcie_gart_fini(rdev);
+        radeon_agp_fini(rdev);
         radeon_gem_fini(rdev);
         radeon_fence_driver_fini(rdev);
         radeon_clocks_fini(rdev);
-        radeon_agp_fini(rdev);
         radeon_bo_fini(rdev);
         radeon_atombios_fini(rdev);
         kfree(rdev->bios);
@@ -2900,3 +2913,18 @@ int r600_debugfs_mc_info_init(struct radeon_device *rdev)
         return 0;
 #endif
 }
+
+/**
+ * r600_ioctl_wait_idle - flush host path cache on wait idle ioctl
+ * rdev: radeon device structure
+ * bo: buffer object struct which userspace is waiting for idle
+ *
+ * Some R6XX/R7XX doesn't seems to take into account HDP flush performed
+ * through ring buffer, this leads to corruption in rendering, see
+ * http://bugzilla.kernel.org/show_bug.cgi?id=15186 to avoid this we
+ * directly perform HDP flush by writing register through MMIO.
+ */
+void r600_ioctl_wait_idle(struct radeon_device *rdev, struct radeon_bo *bo)
+{
+        WREG32(R_005480_HDP_MEM_COHERENCY_FLUSH_CNTL, 0x1);
+}
diff --git a/drivers/gpu/drm/radeon/r600_audio.c b/drivers/gpu/drm/radeon/r600_audio.c
index 99e2c3891a7d..0dcb6904c4ff 100644
--- a/drivers/gpu/drm/radeon/r600_audio.c
+++ b/drivers/gpu/drm/radeon/r600_audio.c
@@ -35,7 +35,7 @@
  */
 static int r600_audio_chipset_supported(struct radeon_device *rdev)
 {
-        return rdev->family >= CHIP_R600
+        return (rdev->family >= CHIP_R600 && rdev->family < CHIP_RV710)
                 || rdev->family == CHIP_RS600
                 || rdev->family == CHIP_RS690
                 || rdev->family == CHIP_RS740;
@@ -261,7 +261,6 @@ void r600_audio_fini(struct radeon_device *rdev)
         if (!r600_audio_chipset_supported(rdev))
                 return;
 
-        WREG32_P(R600_AUDIO_ENABLE, 0x0, ~0x81000000);
-
         del_timer(&rdev->audio_timer);
+        WREG32_P(R600_AUDIO_ENABLE, 0x0, ~0x81000000);
 }
diff --git a/drivers/gpu/drm/radeon/r600_blit_kms.c b/drivers/gpu/drm/radeon/r600_blit_kms.c
index 2bedce477a97..446b765ac72a 100644
--- a/drivers/gpu/drm/radeon/r600_blit_kms.c
+++ b/drivers/gpu/drm/radeon/r600_blit_kms.c
@@ -449,6 +449,7 @@ int r600_blit_init(struct radeon_device *rdev)
         u32 packet2s[16];
         int num_packet2s = 0;
 
+        mutex_init(&rdev->r600_blit.mutex);
         rdev->r600_blit.state_offset = 0;
 
         if (rdev->family >= CHIP_RV770)
@@ -542,9 +543,6 @@ int r600_vb_ib_get(struct radeon_device *rdev)
 void r600_vb_ib_put(struct radeon_device *rdev)
 {
         radeon_fence_emit(rdev, rdev->r600_blit.vb_ib->fence);
-        mutex_lock(&rdev->ib_pool.mutex);
-        list_add_tail(&rdev->r600_blit.vb_ib->list, &rdev->ib_pool.scheduled_ibs);
-        mutex_unlock(&rdev->ib_pool.mutex);
         radeon_ib_free(rdev, &rdev->r600_blit.vb_ib);
 }
 
@@ -557,7 +555,8 @@ int r600_blit_prepare_copy(struct radeon_device *rdev, int size_bytes)
         int dwords_per_loop = 76, num_loops;
 
         r = r600_vb_ib_get(rdev);
-        WARN_ON(r);
+        if (r)
+                return r;
 
         /* set_render_target emits 2 extra dwords on rv6xx */
         if (rdev->family > CHIP_R600 && rdev->family < CHIP_RV770)
@@ -583,7 +582,8 @@ int r600_blit_prepare_copy(struct radeon_device *rdev, int size_bytes)
         ring_size += 5; /* done copy */
         ring_size += 7; /* fence emit for done copy */
         r = radeon_ring_lock(rdev, ring_size);
-        WARN_ON(r);
+        if (r)
+                return r;
 
         set_default_state(rdev); /* 14 */
         set_shaders(rdev); /* 26 */
diff --git a/drivers/gpu/drm/radeon/r600_cp.c b/drivers/gpu/drm/radeon/r600_cp.c
index 6d5a711c2e91..75bcf35a0931 100644
--- a/drivers/gpu/drm/radeon/r600_cp.c
+++ b/drivers/gpu/drm/radeon/r600_cp.c
@@ -1428,9 +1428,12 @@ static void r700_gfx_init(struct drm_device *dev,
 
         gb_tiling_config |= R600_BANK_SWAPS(1);
 
-        backend_map = r700_get_tile_pipe_to_backend_map(dev_priv->r600_max_tile_pipes,
-                                                        dev_priv->r600_max_backends,
-                                                        (0xff << dev_priv->r600_max_backends) & 0xff);
+        if ((dev_priv->flags & RADEON_FAMILY_MASK) == CHIP_RV740)
+                backend_map = 0x28;
+        else
+                backend_map = r700_get_tile_pipe_to_backend_map(dev_priv->r600_max_tile_pipes,
+                                                                dev_priv->r600_max_backends,
+                                                                (0xff << dev_priv->r600_max_backends) & 0xff);
         gb_tiling_config |= R600_BACKEND_MAP(backend_map);
 
         cc_gc_shader_pipe_config =
diff --git a/drivers/gpu/drm/radeon/radeon.h b/drivers/gpu/drm/radeon/radeon.h
index f7df1a7e4413..c0356bb193e5 100644
--- a/drivers/gpu/drm/radeon/radeon.h
+++ b/drivers/gpu/drm/radeon/radeon.h
@@ -96,6 +96,7 @@ extern int radeon_audio;
  * symbol;
  */
 #define RADEON_MAX_USEC_TIMEOUT         100000  /* 100 ms */
+/* RADEON_IB_POOL_SIZE must be a power of 2 */
 #define RADEON_IB_POOL_SIZE             16
 #define RADEON_DEBUGFS_MAX_NUM_FILES    32
 #define RADEONFB_CONN_LIMIT             4
@@ -363,11 +364,12 @@ void radeon_irq_kms_sw_irq_put(struct radeon_device *rdev);
  */
 struct radeon_ib {
         struct list_head        list;
-        unsigned long           idx;
+        unsigned                idx;
         uint64_t                gpu_addr;
         struct radeon_fence     *fence;
-        uint32_t        *ptr;
+        uint32_t                *ptr;
         uint32_t                length_dw;
+        bool                    free;
 };
 
 /*
@@ -377,10 +379,9 @@ struct radeon_ib {
 struct radeon_ib_pool {
         struct mutex            mutex;
         struct radeon_bo        *robj;
-        struct list_head        scheduled_ibs;
         struct radeon_ib        ibs[RADEON_IB_POOL_SIZE];
         bool                    ready;
-        DECLARE_BITMAP(alloc_bm, RADEON_IB_POOL_SIZE);
+        unsigned                head_id;
 };
 
 struct radeon_cp {
@@ -416,6 +417,7 @@ struct r600_ih {
 };
 
 struct r600_blit {
+        struct mutex            mutex;
         struct radeon_bo        *shader_obj;
         u64 shader_gpu_addr;
         u32 vs_offset, ps_offset;
@@ -660,6 +662,13 @@ struct radeon_asic {
         void (*hpd_fini)(struct radeon_device *rdev);
         bool (*hpd_sense)(struct radeon_device *rdev, enum radeon_hpd_id hpd);
         void (*hpd_set_polarity)(struct radeon_device *rdev, enum radeon_hpd_id hpd);
+        /* ioctl hw specific callback. Some hw might want to perform special
+         * operation on specific ioctl. For instance on wait idle some hw
+         * might want to perform and HDP flush through MMIO as it seems that
+         * some R6XX/R7XX hw doesn't take HDP flush into account if programmed
+         * through ring.
+         */
+        void (*ioctl_wait_idle)(struct radeon_device *rdev, struct radeon_bo *bo);
 };
 
 /*
@@ -1142,6 +1151,7 @@ extern bool r600_card_posted(struct radeon_device *rdev);
 extern void r600_cp_stop(struct radeon_device *rdev);
 extern void r600_ring_init(struct radeon_device *rdev, unsigned ring_size);
 extern int r600_cp_resume(struct radeon_device *rdev);
+extern void r600_cp_fini(struct radeon_device *rdev);
 extern int r600_count_pipe_bits(uint32_t val);
 extern int r600_gart_clear_page(struct radeon_device *rdev, int i);
 extern int r600_mc_wait_for_idle(struct radeon_device *rdev);
diff --git a/drivers/gpu/drm/radeon/radeon_agp.c b/drivers/gpu/drm/radeon/radeon_agp.c
index c9ad7f5cc1ac..c0681a5556dc 100644
--- a/drivers/gpu/drm/radeon/radeon_agp.c
+++ b/drivers/gpu/drm/radeon/radeon_agp.c
@@ -133,13 +133,6 @@ int radeon_agp_init(struct radeon_device *rdev)
         bool is_v3;
         int ret;
 
-        if (rdev->ddev->agp->agp_info.aper_size < 32) {
-                dev_warn(rdev->dev, "AGP aperture to small (%dM) "
-                        "need at least 32M, disabling AGP\n",
-                        rdev->ddev->agp->agp_info.aper_size);
-                return -EINVAL;
-        }
-
         /* Acquire AGP. */
         if (!rdev->ddev->agp->acquired) {
                 ret = drm_agp_acquire(rdev->ddev);
@@ -151,9 +144,19 @@ int radeon_agp_init(struct radeon_device *rdev)
 
         ret = drm_agp_info(rdev->ddev, &info);
         if (ret) {
+                drm_agp_release(rdev->ddev);
                 DRM_ERROR("Unable to get AGP info: %d\n", ret);
                 return ret;
         }
+
+        if (rdev->ddev->agp->agp_info.aper_size < 32) {
+                drm_agp_release(rdev->ddev);
+                dev_warn(rdev->dev, "AGP aperture too small (%zuM) "
+                        "need at least 32M, disabling AGP\n",
+                        rdev->ddev->agp->agp_info.aper_size);
+                return -EINVAL;
+        }
+
         mode.mode = info.mode;
         agp_status = (RREG32(RADEON_AGP_STATUS) | RADEON_AGPv3_MODE) & mode.mode;
         is_v3 = !!(agp_status & RADEON_AGPv3_MODE);
@@ -228,6 +231,7 @@ int radeon_agp_init(struct radeon_device *rdev)
         ret = drm_agp_enable(rdev->ddev, mode);
         if (ret) {
                 DRM_ERROR("Unable to enable AGP (mode = 0x%lx)\n", mode.mode);
+                drm_agp_release(rdev->ddev);
                 return ret;
         }
 
diff --git a/drivers/gpu/drm/radeon/radeon_asic.h b/drivers/gpu/drm/radeon/radeon_asic.h
index f2fbd2e4e9df..05ee1aeac3fd 100644
--- a/drivers/gpu/drm/radeon/radeon_asic.h
+++ b/drivers/gpu/drm/radeon/radeon_asic.h
@@ -117,6 +117,7 @@ static struct radeon_asic r100_asic = {
         .hpd_fini = &r100_hpd_fini,
         .hpd_sense = &r100_hpd_sense,
         .hpd_set_polarity = &r100_hpd_set_polarity,
+        .ioctl_wait_idle = NULL,
 };
 
 
@@ -176,6 +177,7 @@ static struct radeon_asic r300_asic = {
         .hpd_fini = &r100_hpd_fini,
         .hpd_sense = &r100_hpd_sense,
         .hpd_set_polarity = &r100_hpd_set_polarity,
+        .ioctl_wait_idle = NULL,
 };
 
 /*
@@ -219,6 +221,7 @@ static struct radeon_asic r420_asic = {
         .hpd_fini = &r100_hpd_fini,
         .hpd_sense = &r100_hpd_sense,
         .hpd_set_polarity = &r100_hpd_set_polarity,
+        .ioctl_wait_idle = NULL,
 };
 
 
@@ -267,6 +270,7 @@ static struct radeon_asic rs400_asic = {
         .hpd_fini = &r100_hpd_fini,
         .hpd_sense = &r100_hpd_sense,
         .hpd_set_polarity = &r100_hpd_set_polarity,
+        .ioctl_wait_idle = NULL,
 };
 
 
@@ -323,6 +327,7 @@ static struct radeon_asic rs600_asic = {
         .hpd_fini = &rs600_hpd_fini,
         .hpd_sense = &rs600_hpd_sense,
         .hpd_set_polarity = &rs600_hpd_set_polarity,
+        .ioctl_wait_idle = NULL,
 };
 
 
@@ -370,6 +375,7 @@ static struct radeon_asic rs690_asic = {
         .hpd_fini = &rs600_hpd_fini,
         .hpd_sense = &rs600_hpd_sense,
         .hpd_set_polarity = &rs600_hpd_set_polarity,
+        .ioctl_wait_idle = NULL,
 };
 
 
@@ -421,6 +427,7 @@ static struct radeon_asic rv515_asic = {
         .hpd_fini = &rs600_hpd_fini,
         .hpd_sense = &rs600_hpd_sense,
         .hpd_set_polarity = &rs600_hpd_set_polarity,
+        .ioctl_wait_idle = NULL,
 };
 
 
@@ -463,6 +470,7 @@ static struct radeon_asic r520_asic = {
         .hpd_fini = &rs600_hpd_fini,
         .hpd_sense = &rs600_hpd_sense,
         .hpd_set_polarity = &rs600_hpd_set_polarity,
+        .ioctl_wait_idle = NULL,
 };
 
 /*
@@ -504,6 +512,7 @@ void r600_hpd_fini(struct radeon_device *rdev);
 bool r600_hpd_sense(struct radeon_device *rdev, enum radeon_hpd_id hpd);
 void r600_hpd_set_polarity(struct radeon_device *rdev,
                            enum radeon_hpd_id hpd);
+extern void r600_ioctl_wait_idle(struct radeon_device *rdev, struct radeon_bo *bo);
 
 static struct radeon_asic r600_asic = {
         .init = &r600_init,
@@ -538,6 +547,7 @@ static struct radeon_asic r600_asic = {
         .hpd_fini = &r600_hpd_fini,
         .hpd_sense = &r600_hpd_sense,
         .hpd_set_polarity = &r600_hpd_set_polarity,
+        .ioctl_wait_idle = r600_ioctl_wait_idle,
 };
 
 /*
@@ -582,6 +592,7 @@ static struct radeon_asic rv770_asic = {
         .hpd_fini = &r600_hpd_fini,
         .hpd_sense = &r600_hpd_sense,
         .hpd_set_polarity = &r600_hpd_set_polarity,
+        .ioctl_wait_idle = r600_ioctl_wait_idle,
 };
 
 #endif
diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
index fa82ca74324e..4d8831548a5f 100644
--- a/drivers/gpu/drm/radeon/radeon_atombios.c
+++ b/drivers/gpu/drm/radeon/radeon_atombios.c
@@ -206,6 +206,15 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
                         *connector_type = DRM_MODE_CONNECTOR_DVID;
         }
 
+        /* Asrock RS600 board lists the DVI port as HDMI */
+        if ((dev->pdev->device == 0x7941) &&
+            (dev->pdev->subsystem_vendor == 0x1849) &&
+            (dev->pdev->subsystem_device == 0x7941)) {
+                if ((*connector_type == DRM_MODE_CONNECTOR_HDMIA) &&
+                    (supported_device == ATOM_DEVICE_DFP3_SUPPORT))
+                        *connector_type = DRM_MODE_CONNECTOR_DVID;
+        }
+
         /* a-bit f-i90hd - ciaranm on #radeonhd - this board has no DVI */
         if ((dev->pdev->device == 0x7941) &&
             (dev->pdev->subsystem_vendor == 0x147b) &&
@@ -287,6 +296,15 @@ static bool radeon_atom_apply_quirks(struct drm_device *dev,
                         *connector_type = DRM_MODE_CONNECTOR_DVID;
         }
 
+        /* XFX Pine Group device rv730 reports no VGA DDC lines
+         * even though they are wired up to record 0x93
+         */
+        if ((dev->pdev->device == 0x9498) &&
+            (dev->pdev->subsystem_vendor == 0x1682) &&
+            (dev->pdev->subsystem_device == 0x2452)) {
+                struct radeon_device *rdev = dev->dev_private;
+                *i2c_bus = radeon_lookup_i2c_gpio(rdev, 0x93);
+        }
         return true;
 }
 
diff --git a/drivers/gpu/drm/radeon/radeon_benchmark.c b/drivers/gpu/drm/radeon/radeon_benchmark.c
index 4ddfd4b5bc51..7932dc4d6b90 100644
--- a/drivers/gpu/drm/radeon/radeon_benchmark.c
+++ b/drivers/gpu/drm/radeon/radeon_benchmark.c
@@ -65,31 +65,42 @@ void radeon_benchmark_move(struct radeon_device *rdev, unsigned bsize,
         if (r) {
                 goto out_cleanup;
         }
-        start_jiffies = jiffies;
-        for (i = 0; i < n; i++) {
-                r = radeon_fence_create(rdev, &fence);
-                if (r) {
-                        goto out_cleanup;
+
+        /* r100 doesn't have dma engine so skip the test */
+        if (rdev->asic->copy_dma) {
+
+                start_jiffies = jiffies;
+                for (i = 0; i < n; i++) {
+                        r = radeon_fence_create(rdev, &fence);
+                        if (r) {
+                                goto out_cleanup;
+                        }
+
+                        r = radeon_copy_dma(rdev, saddr, daddr,
+                                        size / RADEON_GPU_PAGE_SIZE, fence);
+
+                        if (r) {
+                                goto out_cleanup;
+                        }
+                        r = radeon_fence_wait(fence, false);
+                        if (r) {
+                                goto out_cleanup;
+                        }
+                        radeon_fence_unref(&fence);
                 }
-                r = radeon_copy_dma(rdev, saddr, daddr, size / RADEON_GPU_PAGE_SIZE, fence);
-                if (r) {
-                        goto out_cleanup;
+                end_jiffies = jiffies;
+                time = end_jiffies - start_jiffies;
+                time = jiffies_to_msecs(time);
+                if (time > 0) {
+                        i = ((n * size) >> 10) / time;
+                        printk(KERN_INFO "radeon: dma %u bo moves of %ukb from"
+                                        " %d to %d in %lums (%ukb/ms %ukb/s %uM/s)\n",
+                                        n, size >> 10,
+                                        sdomain, ddomain, time,
+                                        i, i * 1000, (i * 1000) / 1024);
                 }
-                r = radeon_fence_wait(fence, false);
-                if (r) {
-                        goto out_cleanup;
-                }
-                radeon_fence_unref(&fence);
-        }
-        end_jiffies = jiffies;
-        time = end_jiffies - start_jiffies;
-        time = jiffies_to_msecs(time);
-        if (time > 0) {
-                i = ((n * size) >> 10) / time;
-                printk(KERN_INFO "radeon: dma %u bo moves of %ukb from %d to %d"
-                       " in %lums (%ukb/ms %ukb/s %uM/s)\n", n, size >> 10,
-                       sdomain, ddomain, time, i, i * 1000, (i * 1000) / 1024);
         }
+
         start_jiffies = jiffies;
         for (i = 0; i < n; i++) {
                 r = radeon_fence_create(rdev, &fence);
diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c
index 579c8920e081..e7b19440102e 100644
--- a/drivers/gpu/drm/radeon/radeon_combios.c
+++ b/drivers/gpu/drm/radeon/radeon_combios.c
@@ -971,8 +971,7 @@ struct radeon_encoder_lvds *radeon_combios_get_lvds_info(struct radeon_encoder
                          lvds->native_mode.vdisplay);
 
                 lvds->panel_vcc_delay = RBIOS16(lcd_info + 0x2c);
-                if (lvds->panel_vcc_delay > 2000 || lvds->panel_vcc_delay < 0)
-                        lvds->panel_vcc_delay = 2000;
+                lvds->panel_vcc_delay = min_t(u16, lvds->panel_vcc_delay, 2000);
 
                 lvds->panel_pwr_delay = RBIOS8(lcd_info + 0x24);
                 lvds->panel_digon_delay = RBIOS16(lcd_info + 0x38) & 0xf;
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index 55266416fa47..65f81942f399 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -580,16 +580,18 @@ static enum drm_connector_status radeon_vga_detect(struct drm_connector *connect
         struct radeon_connector *radeon_connector = to_radeon_connector(connector);
         struct drm_encoder *encoder;
         struct drm_encoder_helper_funcs *encoder_funcs;
-        bool dret;
+        bool dret = false;
         enum drm_connector_status ret = connector_status_disconnected;
 
         encoder = radeon_best_single_encoder(connector);
         if (!encoder)
                 ret = connector_status_disconnected;
 
-        radeon_i2c_do_lock(radeon_connector->ddc_bus, 1);
-        dret = radeon_ddc_probe(radeon_connector);
-        radeon_i2c_do_lock(radeon_connector->ddc_bus, 0);
+        if (radeon_connector->ddc_bus) {
+                radeon_i2c_do_lock(radeon_connector->ddc_bus, 1);
+                dret = radeon_ddc_probe(radeon_connector);
+                radeon_i2c_do_lock(radeon_connector->ddc_bus, 0);
+        }
         if (dret) {
                 if (radeon_connector->edid) {
                         kfree(radeon_connector->edid);
@@ -740,11 +742,13 @@ static enum drm_connector_status radeon_dvi_detect(struct drm_connector *connect
         struct drm_mode_object *obj;
         int i;
         enum drm_connector_status ret = connector_status_disconnected;
-        bool dret;
+        bool dret = false;
 
-        radeon_i2c_do_lock(radeon_connector->ddc_bus, 1);
-        dret = radeon_ddc_probe(radeon_connector);
-        radeon_i2c_do_lock(radeon_connector->ddc_bus, 0);
+        if (radeon_connector->ddc_bus) {
+                radeon_i2c_do_lock(radeon_connector->ddc_bus, 1);
+                dret = radeon_ddc_probe(radeon_connector);
+                radeon_i2c_do_lock(radeon_connector->ddc_bus, 0);
+        }
         if (dret) {
                 if (radeon_connector->edid) {
                         kfree(radeon_connector->edid);
@@ -776,7 +780,7 @@ static enum drm_connector_status radeon_dvi_detect(struct drm_connector *connect
                          * connected and the DVI port disconnected.  If the edid doesn't
                          * say HDMI, vice versa.
                          */
-                        if (radeon_connector->shared_ddc && connector_status_connected) {
+                        if (radeon_connector->shared_ddc && (ret == connector_status_connected)) {
                                 struct drm_device *dev = connector->dev;
                                 struct drm_connector *list_connector;
                                 struct radeon_connector *list_radeon_connector;
@@ -1056,8 +1060,7 @@ radeon_add_atom_connector(struct drm_device *dev,
                         return;
                 }
                 if (radeon_connector->ddc_bus && i2c_bus->valid) {
-                        if (memcmp(&radeon_connector->ddc_bus->rec, i2c_bus,
-                                    sizeof(struct radeon_i2c_bus_rec)) == 0) {
+                        if (radeon_connector->ddc_bus->rec.i2c_id == i2c_bus->i2c_id) {
                                 radeon_connector->shared_ddc = true;
                                 shared_ddc = true;
                         }
@@ -1343,7 +1346,7 @@ radeon_add_legacy_connector(struct drm_device *dev,
                                 radeon_connector->dac_load_detect = false;
                         drm_connector_attach_property(&radeon_connector->base,
                                                       rdev->mode_info.load_detect_property,
-                                                      1);
+                                                      radeon_connector->dac_load_detect);
                         drm_connector_attach_property(&radeon_connector->base,
                                                       rdev->mode_info.tv_std_property,
                                                       radeon_combios_get_tv_info(rdev));
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index 1496cb8658ef..e9d085021c1f 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -86,7 +86,7 @@ int radeon_cs_parser_relocs(struct radeon_cs_parser *p)
                                                 &p->validated);
                 }
         }
-        return radeon_bo_list_validate(&p->validated, p->ib->fence);
+        return radeon_bo_list_validate(&p->validated);
 }
 
 int radeon_cs_parser_init(struct radeon_cs_parser *p, void *data)
@@ -189,12 +189,10 @@ static void radeon_cs_parser_fini(struct radeon_cs_parser *parser, int error)
 {
         unsigned i;
 
-        if (error) {
-                radeon_bo_list_unvalidate(&parser->validated,
-                                                parser->ib->fence);
-        } else {
-                radeon_bo_list_unreserve(&parser->validated);
+        if (!error && parser->ib) {
+                radeon_bo_list_fence(&parser->validated, parser->ib->fence);
         }
+        radeon_bo_list_unreserve(&parser->validated);
         for (i = 0; i < parser->nrelocs; i++) {
                 if (parser->relocs[i].gobj) {
                         mutex_lock(&parser->rdev->ddev->struct_mutex);
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index 6a92f994cc26..7e17a362b54b 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -278,7 +278,7 @@ static void radeon_print_display_setup(struct drm_device *dev)
                 DRM_INFO("  %s\n", connector_names[connector->connector_type]);
                 if (radeon_connector->hpd.hpd != RADEON_HPD_NONE)
                         DRM_INFO("  %s\n", hpd_names[radeon_connector->hpd.hpd]);
-                if (radeon_connector->ddc_bus)
+                if (radeon_connector->ddc_bus) {
                         DRM_INFO("  DDC: 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x 0x%x\n",
                                  radeon_connector->ddc_bus->rec.mask_clk_reg,
                                  radeon_connector->ddc_bus->rec.mask_data_reg,
@@ -288,6 +288,15 @@ static void radeon_print_display_setup(struct drm_device *dev)
                                  radeon_connector->ddc_bus->rec.en_data_reg,
                                  radeon_connector->ddc_bus->rec.y_clk_reg,
                                  radeon_connector->ddc_bus->rec.y_data_reg);
+                } else {
+                        if (connector->connector_type == DRM_MODE_CONNECTOR_VGA ||
+                            connector->connector_type == DRM_MODE_CONNECTOR_DVII ||
+                            connector->connector_type == DRM_MODE_CONNECTOR_DVID ||
+                            connector->connector_type == DRM_MODE_CONNECTOR_DVIA ||
+                            connector->connector_type == DRM_MODE_CONNECTOR_HDMIA ||
+                            connector->connector_type == DRM_MODE_CONNECTOR_HDMIB)
+                                DRM_INFO("  DDC: no ddc bus - possible BIOS bug - please report to xorg-driver-ati@lists.x.org\n");
+                }
                 DRM_INFO("  Encoders:\n");
                 list_for_each_entry(encoder, &dev->mode_config.encoder_list, head) {
                         radeon_encoder = to_radeon_encoder(encoder);
diff --git a/drivers/gpu/drm/radeon/radeon_drv.h b/drivers/gpu/drm/radeon/radeon_drv.h
index e13785282a82..c57ad606504d 100644
--- a/drivers/gpu/drm/radeon/radeon_drv.h
+++ b/drivers/gpu/drm/radeon/radeon_drv.h
@@ -106,9 +106,10 @@
  * 1.29- R500 3D cmd buffer support
  * 1.30- Add support for occlusion queries
  * 1.31- Add support for num Z pipes from GET_PARAM
+ * 1.32- fixes for rv740 setup
  */
 #define DRIVER_MAJOR            1
-#define DRIVER_MINOR            31
+#define DRIVER_MINOR            32
 #define DRIVER_PATCHLEVEL       0
 
 enum radeon_cp_microcode_version {
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index 82eb551970b9..3c91724457ca 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -156,6 +156,26 @@ radeon_get_encoder_id(struct drm_device *dev, uint32_t supported_device, uint8_t
         return ret;
 }
 
+static inline bool radeon_encoder_is_digital(struct drm_encoder *encoder)
+{
+        struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+        switch (radeon_encoder->encoder_id) {
+        case ENCODER_OBJECT_ID_INTERNAL_LVDS:
+        case ENCODER_OBJECT_ID_INTERNAL_TMDS1:
+        case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_TMDS1:
+        case ENCODER_OBJECT_ID_INTERNAL_LVTM1:
+        case ENCODER_OBJECT_ID_INTERNAL_DVO1:
+        case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_DVO1:
+        case ENCODER_OBJECT_ID_INTERNAL_DDI:
+        case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
+        case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
+        case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
+        case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2:
+                return true;
+        default:
+                return false;
+        }
+}
 void
 radeon_link_encoder_connector(struct drm_device *dev)
 {
@@ -202,7 +222,7 @@ radeon_get_connector_for_encoder(struct drm_encoder *encoder)
 
         list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
                 radeon_connector = to_radeon_connector(connector);
-                if (radeon_encoder->devices & radeon_connector->devices)
+                if (radeon_encoder->active_device & radeon_connector->devices)
                         return connector;
         }
         return NULL;
@@ -676,31 +696,11 @@ atombios_dig_encoder_setup(struct drm_encoder *encoder, int action)
 
         memset(&args, 0, sizeof(args));
 
-        if (ASIC_IS_DCE32(rdev)) {
-                if (dig->dig_block)
-                        index = GetIndexIntoMasterTable(COMMAND, DIG2EncoderControl);
-                else
-                        index = GetIndexIntoMasterTable(COMMAND, DIG1EncoderControl);
-                num = dig->dig_block + 1;
-        } else {
-                switch (radeon_encoder->encoder_id) {
-                case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
-                        /* XXX doesn't really matter which dig encoder we pick as long as it's
-                         * not already in use
-                         */
-                        if (dig_connector->linkb)
-                                index = GetIndexIntoMasterTable(COMMAND, DIG2EncoderControl);
-                        else
-                                index = GetIndexIntoMasterTable(COMMAND, DIG1EncoderControl);
-                        num = 1;
-                        break;
-                case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
-                        /* Only dig2 encoder can drive LVTMA */
-                        index = GetIndexIntoMasterTable(COMMAND, DIG2EncoderControl);
-                        num = 2;
-                        break;
-                }
-        }
+        if (dig->dig_encoder)
+                index = GetIndexIntoMasterTable(COMMAND, DIG2EncoderControl);
+        else
+                index = GetIndexIntoMasterTable(COMMAND, DIG1EncoderControl);
+        num = dig->dig_encoder + 1;
 
         atom_parse_cmd_header(rdev->mode_info.atom_context, index, &frev, &crev);
 
@@ -822,7 +822,7 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
                         args.v1.usPixelClock = cpu_to_le16(radeon_encoder->pixel_clock / 10);
         }
         if (ASIC_IS_DCE32(rdev)) {
-                if (dig->dig_block)
+                if (dig->dig_encoder == 1)
                         args.v2.acConfig.ucEncoderSel = 1;
                 if (dig_connector->linkb)
                         args.v2.acConfig.ucLinkSel = 1;
@@ -849,17 +849,16 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
                                 args.v2.acConfig.fCoherentMode = 1;
                 }
         } else {
+
                 args.v1.ucConfig = ATOM_TRANSMITTER_CONFIG_CLKSRC_PPLL;
 
+                if (dig->dig_encoder)
+                        args.v1.ucConfig |= ATOM_TRANSMITTER_CONFIG_DIG2_ENCODER;
+                else
+                        args.v1.ucConfig |= ATOM_TRANSMITTER_CONFIG_DIG1_ENCODER;
+
                 switch (radeon_encoder->encoder_id) {
                 case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
-                        /* XXX doesn't really matter which dig encoder we pick as long as it's
-                         * not already in use
-                         */
-                        if (dig_connector->linkb)
-                                args.v1.ucConfig |= ATOM_TRANSMITTER_CONFIG_DIG2_ENCODER;
-                        else
-                                args.v1.ucConfig |= ATOM_TRANSMITTER_CONFIG_DIG1_ENCODER;
                         if (rdev->flags & RADEON_IS_IGP) {
                                 if (radeon_encoder->pixel_clock > 165000) {
                                         if (dig_connector->igp_lane_info & 0x3)
@@ -878,10 +877,6 @@ atombios_dig_transmitter_setup(struct drm_encoder *encoder, int action, uint8_t
                                 }
                         }
                         break;
-                case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
-                        /* Only dig2 encoder can drive LVTMA */
-                        args.v1.ucConfig |= ATOM_TRANSMITTER_CONFIG_DIG2_ENCODER;
-                        break;
                 }
 
                 if (radeon_encoder->pixel_clock > 165000)
@@ -1046,6 +1041,7 @@ atombios_set_encoder_crtc_source(struct drm_encoder *encoder)
         union crtc_sourc_param args;
         int index = GetIndexIntoMasterTable(COMMAND, SelectCRTC_Source);
         uint8_t frev, crev;
+        struct radeon_encoder_atom_dig *dig;
 
         memset(&args, 0, sizeof(args));
 
@@ -1109,40 +1105,16 @@ atombios_set_encoder_crtc_source(struct drm_encoder *encoder)
                         case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
                         case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
                         case ENCODER_OBJECT_ID_INTERNAL_UNIPHY2:
-                                if (ASIC_IS_DCE32(rdev)) {
-                                        if (radeon_crtc->crtc_id)
-                                                args.v2.ucEncoderID = ASIC_INT_DIG2_ENCODER_ID;
-                                        else
-                                                args.v2.ucEncoderID = ASIC_INT_DIG1_ENCODER_ID;
-                                } else {
-                                        struct drm_connector *connector;
-                                        struct radeon_connector *radeon_connector;
-                                        struct radeon_connector_atom_dig *dig_connector;
-
-                                        connector = radeon_get_connector_for_encoder(encoder);
-                                        if (!connector)
-                                                return;
-                                        radeon_connector = to_radeon_connector(connector);
-                                        if (!radeon_connector->con_priv)
-                                                return;
-                                        dig_connector = radeon_connector->con_priv;
-
-                                        /* XXX doesn't really matter which dig encoder we pick as long as it's
-                                         * not already in use
-                                         */
-                                        if (dig_connector->linkb)
-                                                args.v2.ucEncoderID = ASIC_INT_DIG2_ENCODER_ID;
-                                        else
-                                                args.v2.ucEncoderID = ASIC_INT_DIG1_ENCODER_ID;
-                                }
+                        case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
+                                dig = radeon_encoder->enc_priv;
+                                if (dig->dig_encoder)
+                                        args.v2.ucEncoderID = ASIC_INT_DIG2_ENCODER_ID;
+                                else
+                                        args.v2.ucEncoderID = ASIC_INT_DIG1_ENCODER_ID;
                                 break;
                         case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_DVO1:
                                 args.v2.ucEncoderID = ASIC_INT_DVO_ENCODER_ID;
                                 break;
-                        case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA:
-                                /* Only dig2 encoder can drive LVTMA */
-                                args.v2.ucEncoderID = ASIC_INT_DIG2_ENCODER_ID;
-                                break;
                         case ENCODER_OBJECT_ID_INTERNAL_KLDSCP_DAC1:
                                 if (radeon_encoder->active_device & (ATOM_DEVICE_TV_SUPPORT))
                                         args.v2.ucEncoderID = ASIC_INT_TV_ENCODER_ID;
@@ -1202,6 +1174,47 @@ atombios_apply_encoder_quirks(struct drm_encoder *encoder,
         }
 }
 
+static int radeon_atom_pick_dig_encoder(struct drm_encoder *encoder)
+{
+        struct drm_device *dev = encoder->dev;
+        struct radeon_device *rdev = dev->dev_private;
+        struct radeon_crtc *radeon_crtc = to_radeon_crtc(encoder->crtc);
+        struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+        struct drm_encoder *test_encoder;
+        struct radeon_encoder_atom_dig *dig;
+        uint32_t dig_enc_in_use = 0;
+        /* on DCE32 and encoder can driver any block so just crtc id */
+        if (ASIC_IS_DCE32(rdev)) {
+                return radeon_crtc->crtc_id;
+        }
+
+        /* on DCE3 - LVTMA can only be driven by DIGB */
+        list_for_each_entry(test_encoder, &dev->mode_config.encoder_list, head) {
+                struct radeon_encoder *radeon_test_encoder;
+
+                if (encoder == test_encoder)
+                        continue;
+
+                if (!radeon_encoder_is_digital(test_encoder))
+                        continue;
+
+                radeon_test_encoder = to_radeon_encoder(test_encoder);
+                dig = radeon_test_encoder->enc_priv;
+
+                if (dig->dig_encoder >= 0)
+                        dig_enc_in_use |= (1 << dig->dig_encoder);
+        }
+
+        if (radeon_encoder->encoder_id == ENCODER_OBJECT_ID_INTERNAL_KLDSCP_LVTMA) {
+                if (dig_enc_in_use & 0x2)
+                        DRM_ERROR("LVDS required digital encoder 2 but it was in use - stealing\n");
+                return 1;
+        }
+        if (!(dig_enc_in_use & 1))
+                return 0;
+        return 1;
+}
+
 static void
 radeon_atom_encoder_mode_set(struct drm_encoder *encoder,
                              struct drm_display_mode *mode,
@@ -1214,12 +1227,9 @@ radeon_atom_encoder_mode_set(struct drm_encoder *encoder,
 
         if (radeon_encoder->active_device &
             (ATOM_DEVICE_DFP_SUPPORT | ATOM_DEVICE_LCD_SUPPORT)) {
-                if (radeon_encoder->enc_priv) {
-                        struct radeon_encoder_atom_dig *dig;
-
-                        dig = radeon_encoder->enc_priv;
-                        dig->dig_block = radeon_crtc->crtc_id;
-                }
+                struct radeon_encoder_atom_dig *dig = radeon_encoder->enc_priv;
+                if (dig)
+                        dig->dig_encoder = radeon_atom_pick_dig_encoder(encoder);
         }
         radeon_encoder->pixel_clock = adjusted_mode->clock;
 
@@ -1379,7 +1389,13 @@ static void radeon_atom_encoder_commit(struct drm_encoder *encoder)
 static void radeon_atom_encoder_disable(struct drm_encoder *encoder)
 {
         struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder);
+        struct radeon_encoder_atom_dig *dig;
         radeon_atom_encoder_dpms(encoder, DRM_MODE_DPMS_OFF);
+
+        if (radeon_encoder_is_digital(encoder)) {
+                dig = radeon_encoder->enc_priv;
+                dig->dig_encoder = -1;
+        }
         radeon_encoder->active_device = 0;
 }
 
@@ -1436,6 +1452,7 @@ radeon_atombios_set_dig_info(struct radeon_encoder *radeon_encoder)
 
         /* coherent mode by default */
         dig->coherent_mode = true;
+        dig->dig_encoder = -1;
 
         return dig;
 }
diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c
index 3ba213d1b06c..d71e346e9ab5 100644
--- a/drivers/gpu/drm/radeon/radeon_fb.c
+++ b/drivers/gpu/drm/radeon/radeon_fb.c
@@ -248,7 +248,7 @@ int radeonfb_create(struct drm_device *dev,
         if (ret)
                 goto out_unref;
 
-        memset_io(fbptr, 0xff, aligned_size);
+        memset_io(fbptr, 0x0, aligned_size);
 
         strcpy(info->fix.id, "radeondrmfb");
 
diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c
index 0e1325e18534..db8e9a355a01 100644
--- a/drivers/gpu/drm/radeon/radeon_gem.c
+++ b/drivers/gpu/drm/radeon/radeon_gem.c
@@ -308,6 +308,9 @@ int radeon_gem_wait_idle_ioctl(struct drm_device *dev, void *data,
         }
         robj = gobj->driver_private;
         r = radeon_bo_wait(robj, NULL, false);
+        /* callback hw specific functions if any */
+        if (robj->rdev->asic->ioctl_wait_idle)
+                robj->rdev->asic->ioctl_wait_idle(robj->rdev, robj);
         mutex_lock(&dev->struct_mutex);
         drm_gem_object_unreference(gobj);
         mutex_unlock(&dev->struct_mutex);
diff --git a/drivers/gpu/drm/radeon/radeon_mode.h b/drivers/gpu/drm/radeon/radeon_mode.h
index 96b851f92f4c..e81b2aeb6a8f 100644
--- a/drivers/gpu/drm/radeon/radeon_mode.h
+++ b/drivers/gpu/drm/radeon/radeon_mode.h
@@ -299,7 +299,7 @@ struct radeon_atom_ss {
 struct radeon_encoder_atom_dig {
         /* atom dig */
         bool coherent_mode;
-        int dig_block;
+        int dig_encoder; /* -1 disabled, 0 DIGA, 1 DIGB */
         /* atom lvds */
         uint32_t lvds_misc;
         uint16_t panel_pwr_delay;
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index d72a71bff218..f1da370928eb 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -306,11 +306,10 @@ void radeon_bo_list_unreserve(struct list_head *head)
         }
 }
 
-int radeon_bo_list_validate(struct list_head *head, void *fence)
+int radeon_bo_list_validate(struct list_head *head)
 {
         struct radeon_bo_list *lobj;
         struct radeon_bo *bo;
-        struct radeon_fence *old_fence = NULL;
         int r;
 
         r = radeon_bo_list_reserve(head);
@@ -334,32 +333,27 @@ int radeon_bo_list_validate(struct list_head *head, void *fence)
                 }
                 lobj->gpu_offset = radeon_bo_gpu_offset(bo);
                 lobj->tiling_flags = bo->tiling_flags;
-                if (fence) {
-                        old_fence = (struct radeon_fence *)bo->tbo.sync_obj;
-                        bo->tbo.sync_obj = radeon_fence_ref(fence);
-                        bo->tbo.sync_obj_arg = NULL;
-                }
-                if (old_fence) {
-                        radeon_fence_unref(&old_fence);
-                }
         }
         return 0;
 }
 
-void radeon_bo_list_unvalidate(struct list_head *head, void *fence)
+void radeon_bo_list_fence(struct list_head *head, void *fence)
 {
         struct radeon_bo_list *lobj;
-        struct radeon_fence *old_fence;
-
-        if (fence)
-                list_for_each_entry(lobj, head, list) {
-                        old_fence = to_radeon_fence(lobj->bo->tbo.sync_obj);
-                        if (old_fence == fence) {
-                                lobj->bo->tbo.sync_obj = NULL;
-                                radeon_fence_unref(&old_fence);
-                        }
+        struct radeon_bo *bo;
+        struct radeon_fence *old_fence = NULL;
+
+        list_for_each_entry(lobj, head, list) {
+                bo = lobj->bo;
+                spin_lock(&bo->tbo.lock);
+                old_fence = (struct radeon_fence *)bo->tbo.sync_obj;
+                bo->tbo.sync_obj = radeon_fence_ref(fence);
+                bo->tbo.sync_obj_arg = NULL;
+                spin_unlock(&bo->tbo.lock);
+                if (old_fence) {
+                        radeon_fence_unref(&old_fence);
                 }
-        radeon_bo_list_unreserve(head);
+        }
 }
 
 int radeon_bo_fbdev_mmap(struct radeon_bo *bo,
diff --git a/drivers/gpu/drm/radeon/radeon_object.h b/drivers/gpu/drm/radeon/radeon_object.h
index a02f18011ad1..7ab43de1e244 100644
--- a/drivers/gpu/drm/radeon/radeon_object.h
+++ b/drivers/gpu/drm/radeon/radeon_object.h
@@ -156,8 +156,8 @@ extern void radeon_bo_list_add_object(struct radeon_bo_list *lobj,
                                 struct list_head *head);
 extern int radeon_bo_list_reserve(struct list_head *head);
 extern void radeon_bo_list_unreserve(struct list_head *head);
-extern int radeon_bo_list_validate(struct list_head *head, void *fence);
-extern void radeon_bo_list_unvalidate(struct list_head *head, void *fence);
+extern int radeon_bo_list_validate(struct list_head *head);
+extern void radeon_bo_list_fence(struct list_head *head, void *fence);
 extern int radeon_bo_fbdev_mmap(struct radeon_bo *bo,
                                 struct vm_area_struct *vma);
 extern int radeon_bo_set_tiling_flags(struct radeon_bo *bo,
diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
index 4d12b2d17b4d..6579eb4c1f28 100644
--- a/drivers/gpu/drm/radeon/radeon_ring.c
+++ b/drivers/gpu/drm/radeon/radeon_ring.c
@@ -41,68 +41,55 @@ int radeon_ib_get(struct radeon_device *rdev, struct radeon_ib **ib)
 {
         struct radeon_fence *fence;
         struct radeon_ib *nib;
-        unsigned long i;
-        int r = 0;
+        int r = 0, i, c;
 
         *ib = NULL;
         r = radeon_fence_create(rdev, &fence);
         if (r) {
-                DRM_ERROR("failed to create fence for new IB\n");
+                dev_err(rdev->dev, "failed to create fence for new IB\n");
                 return r;
         }
         mutex_lock(&rdev->ib_pool.mutex);
-        i = find_first_zero_bit(rdev->ib_pool.alloc_bm, RADEON_IB_POOL_SIZE);
-        if (i < RADEON_IB_POOL_SIZE) {
-                set_bit(i, rdev->ib_pool.alloc_bm);
-                rdev->ib_pool.ibs[i].length_dw = 0;
-                *ib = &rdev->ib_pool.ibs[i];
-                mutex_unlock(&rdev->ib_pool.mutex);
-                goto out;
+        for (i = rdev->ib_pool.head_id, c = 0, nib = NULL; c < RADEON_IB_POOL_SIZE; c++, i++) {
+                i &= (RADEON_IB_POOL_SIZE - 1);
+                if (rdev->ib_pool.ibs[i].free) {
+                        nib = &rdev->ib_pool.ibs[i];
+                        break;
+                }
         }
-        if (list_empty(&rdev->ib_pool.scheduled_ibs)) {
-                /* we go do nothings here */
+        if (nib == NULL) {
+                /* This should never happen, it means we allocated all
+                 * IB and haven't scheduled one yet, return EBUSY to
+                 * userspace hoping that on ioctl recall we get better
+                 * luck
+                 */
+                dev_err(rdev->dev, "no free indirect buffer !\n");
                 mutex_unlock(&rdev->ib_pool.mutex);
-                DRM_ERROR("all IB allocated none scheduled.\n");
-                r = -EINVAL;
-                goto out;
+                radeon_fence_unref(&fence);
+                return -EBUSY;
         }
-        /* get the first ib on the scheduled list */
-        nib = list_entry(rdev->ib_pool.scheduled_ibs.next,
-                         struct radeon_ib, list);
-        if (nib->fence == NULL) {
-                /* we go do nothings here */
+        rdev->ib_pool.head_id = (nib->idx + 1) & (RADEON_IB_POOL_SIZE - 1);
+        nib->free = false;
+        if (nib->fence) {
                 mutex_unlock(&rdev->ib_pool.mutex);
-                DRM_ERROR("IB %lu scheduled without a fence.\n", nib->idx);
-                r = -EINVAL;
-                goto out;
-        }
-        mutex_unlock(&rdev->ib_pool.mutex);
-
-        r = radeon_fence_wait(nib->fence, false);
-        if (r) {
-                DRM_ERROR("radeon: IB(%lu:0x%016lX:%u)\n", nib->idx,
-                          (unsigned long)nib->gpu_addr, nib->length_dw);
-                DRM_ERROR("radeon: GPU lockup detected, fail to get a IB\n");
-                goto out;
+                r = radeon_fence_wait(nib->fence, false);
+                if (r) {
+                        dev_err(rdev->dev, "error waiting fence of IB(%u:0x%016lX:%u)\n",
+                                nib->idx, (unsigned long)nib->gpu_addr, nib->length_dw);
+                        mutex_lock(&rdev->ib_pool.mutex);
+                        nib->free = true;
+                        mutex_unlock(&rdev->ib_pool.mutex);
+                        radeon_fence_unref(&fence);
+                        return r;
+                }
+                mutex_lock(&rdev->ib_pool.mutex);
         }
         radeon_fence_unref(&nib->fence);
-
+        nib->fence = fence;
         nib->length_dw = 0;
-
-        /* scheduled list is accessed here */
-        mutex_lock(&rdev->ib_pool.mutex);
-        list_del(&nib->list);
-        INIT_LIST_HEAD(&nib->list);
         mutex_unlock(&rdev->ib_pool.mutex);
-
         *ib = nib;
-out:
-        if (r) {
-                radeon_fence_unref(&fence);
-        } else {
-                (*ib)->fence = fence;
-        }
-        return r;
+        return 0;
 }
 
 void radeon_ib_free(struct radeon_device *rdev, struct radeon_ib **ib)
@@ -113,19 +100,10 @@ void radeon_ib_free(struct radeon_device *rdev, struct radeon_ib **ib)
         if (tmp == NULL) {
                 return;
         }
-        mutex_lock(&rdev->ib_pool.mutex);
-        if (!list_empty(&tmp->list) && !radeon_fence_signaled(tmp->fence)) {
-                /* IB is scheduled & not signaled don't do anythings */
-                mutex_unlock(&rdev->ib_pool.mutex);
-                return;
-        }
-        list_del(&tmp->list);
-        INIT_LIST_HEAD(&tmp->list);
-        if (tmp->fence)
+        if (!tmp->fence->emited)
                 radeon_fence_unref(&tmp->fence);
-
-        tmp->length_dw = 0;
-        clear_bit(tmp->idx, rdev->ib_pool.alloc_bm);
+        mutex_lock(&rdev->ib_pool.mutex);
+        tmp->free = true;
         mutex_unlock(&rdev->ib_pool.mutex);
 }
 
@@ -135,7 +113,7 @@ int radeon_ib_schedule(struct radeon_device *rdev, struct radeon_ib *ib)
 
         if (!ib->length_dw || !rdev->cp.ready) {
                 /* TODO: Nothings in the ib we should report. */
-                DRM_ERROR("radeon: couldn't schedule IB(%lu).\n", ib->idx);
+                DRM_ERROR("radeon: couldn't schedule IB(%u).\n", ib->idx);
                 return -EINVAL;
         }
 
@@ -148,7 +126,8 @@ int radeon_ib_schedule(struct radeon_device *rdev, struct radeon_ib *ib)
         radeon_ring_ib_execute(rdev, ib);
         radeon_fence_emit(rdev, ib->fence);
         mutex_lock(&rdev->ib_pool.mutex);
-        list_add_tail(&ib->list, &rdev->ib_pool.scheduled_ibs);
+        /* once scheduled IB is considered free and protected by the fence */
+        ib->free = true;
         mutex_unlock(&rdev->ib_pool.mutex);
         radeon_ring_unlock_commit(rdev);
         return 0;
@@ -164,7 +143,6 @@ int radeon_ib_pool_init(struct radeon_device *rdev)
         if (rdev->ib_pool.robj)
                 return 0;
         /* Allocate 1M object buffer */
-        INIT_LIST_HEAD(&rdev->ib_pool.scheduled_ibs);
         r = radeon_bo_create(rdev, NULL,  RADEON_IB_POOL_SIZE*64*1024,
                                 true, RADEON_GEM_DOMAIN_GTT,
                                 &rdev->ib_pool.robj);
@@ -195,9 +173,9 @@ int radeon_ib_pool_init(struct radeon_device *rdev)
                 rdev->ib_pool.ibs[i].ptr = ptr + offset;
                 rdev->ib_pool.ibs[i].idx = i;
                 rdev->ib_pool.ibs[i].length_dw = 0;
-                INIT_LIST_HEAD(&rdev->ib_pool.ibs[i].list);
+                rdev->ib_pool.ibs[i].free = true;
         }
-        bitmap_zero(rdev->ib_pool.alloc_bm, RADEON_IB_POOL_SIZE);
+        rdev->ib_pool.head_id = 0;
         rdev->ib_pool.ready = true;
         DRM_INFO("radeon: ib pool ready.\n");
         if (radeon_debugfs_ib_init(rdev)) {
@@ -214,7 +192,6 @@ void radeon_ib_pool_fini(struct radeon_device *rdev)
                 return;
         }
         mutex_lock(&rdev->ib_pool.mutex);
-        bitmap_zero(rdev->ib_pool.alloc_bm, RADEON_IB_POOL_SIZE);
         if (rdev->ib_pool.robj) {
                 r = radeon_bo_reserve(rdev->ib_pool.robj, false);
                 if (likely(r == 0)) {
@@ -363,7 +340,7 @@ static int radeon_debugfs_ib_info(struct seq_file *m, void *data)
         if (ib == NULL) {
                 return 0;
         }
-        seq_printf(m, "IB %04lu\n", ib->idx);
+        seq_printf(m, "IB %04u\n", ib->idx);
         seq_printf(m, "IB fence %p\n", ib->fence);
         seq_printf(m, "IB size %05u dwords\n", ib->length_dw);
         for (i = 0; i < ib->length_dw; i++) {
diff --git a/drivers/gpu/drm/radeon/rs400.c b/drivers/gpu/drm/radeon/rs400.c
index 9f5418983e2a..287fcebfb4e6 100644
--- a/drivers/gpu/drm/radeon/rs400.c
+++ b/drivers/gpu/drm/radeon/rs400.c
@@ -223,15 +223,31 @@ int rs400_gart_set_page(struct radeon_device *rdev, int i, uint64_t addr)
         return 0;
 }
 
+int rs400_mc_wait_for_idle(struct radeon_device *rdev)
+{
+        unsigned i;
+        uint32_t tmp;
+
+        for (i = 0; i < rdev->usec_timeout; i++) {
+                /* read MC_STATUS */
+                tmp = RREG32(0x0150);
+                if (tmp & (1 << 2)) {
+                        return 0;
+                }
+                DRM_UDELAY(1);
+        }
+        return -1;
+}
+
 void rs400_gpu_init(struct radeon_device *rdev)
 {
         /* FIXME: HDP same place on rs400 ? */
         r100_hdp_reset(rdev);
         /* FIXME: is this correct ? */
         r420_pipes_init(rdev);
-        if (r300_mc_wait_for_idle(rdev)) {
-                printk(KERN_WARNING "Failed to wait MC idle while "
-                       "programming pipes. Bad things might happen.\n");
+        if (rs400_mc_wait_for_idle(rdev)) {
+                printk(KERN_WARNING "rs400: Failed to wait MC idle while "
+                       "programming pipes. Bad things might happen. %08x\n", RREG32(0x150));
         }
 }
 
@@ -370,8 +386,8 @@ void rs400_mc_program(struct radeon_device *rdev)
         r100_mc_stop(rdev, &save);
 
         /* Wait for mc idle */
-        if (r300_mc_wait_for_idle(rdev))
-                dev_warn(rdev->dev, "Wait MC idle timeout before updating MC.\n");
+        if (rs400_mc_wait_for_idle(rdev))
+                dev_warn(rdev->dev, "rs400: Wait MC idle timeout before updating MC.\n");
         WREG32(R_000148_MC_FB_LOCATION,
                 S_000148_MC_FB_START(rdev->mc.vram_start >> 16) |
                 S_000148_MC_FB_TOP(rdev->mc.vram_end >> 16));
@@ -448,7 +464,6 @@ int rs400_suspend(struct radeon_device *rdev)
 
 void rs400_fini(struct radeon_device *rdev)
 {
-        rs400_suspend(rdev);
         r100_cp_fini(rdev);
         r100_wb_fini(rdev);
         r100_ib_fini(rdev);
@@ -527,7 +542,6 @@ int rs400_init(struct radeon_device *rdev)
         if (r) {
                 /* Somethings want wront with the accel init stop accel */
                 dev_err(rdev->dev, "Disabling GPU acceleration\n");
-                rs400_suspend(rdev);
                 r100_cp_fini(rdev);
                 r100_wb_fini(rdev);
                 r100_ib_fini(rdev);
diff --git a/drivers/gpu/drm/radeon/rs600.c b/drivers/gpu/drm/radeon/rs600.c
index d5255751e7b3..c3818562a13e 100644
--- a/drivers/gpu/drm/radeon/rs600.c
+++ b/drivers/gpu/drm/radeon/rs600.c
@@ -610,7 +610,6 @@ int rs600_suspend(struct radeon_device *rdev)
 
 void rs600_fini(struct radeon_device *rdev)
 {
-        rs600_suspend(rdev);
         r100_cp_fini(rdev);
         r100_wb_fini(rdev);
         r100_ib_fini(rdev);
@@ -689,7 +688,6 @@ int rs600_init(struct radeon_device *rdev)
         if (r) {
                 /* Somethings want wront with the accel init stop accel */
                 dev_err(rdev->dev, "Disabling GPU acceleration\n");
-                rs600_suspend(rdev);
                 r100_cp_fini(rdev);
                 r100_wb_fini(rdev);
                 r100_ib_fini(rdev);
diff --git a/drivers/gpu/drm/radeon/rs690.c b/drivers/gpu/drm/radeon/rs690.c
index cd31da913771..06e2771aee5a 100644
--- a/drivers/gpu/drm/radeon/rs690.c
+++ b/drivers/gpu/drm/radeon/rs690.c
@@ -676,7 +676,6 @@ int rs690_suspend(struct radeon_device *rdev)
 
 void rs690_fini(struct radeon_device *rdev)
 {
-        rs690_suspend(rdev);
         r100_cp_fini(rdev);
         r100_wb_fini(rdev);
         r100_ib_fini(rdev);
@@ -756,7 +755,6 @@ int rs690_init(struct radeon_device *rdev)
         if (r) {
                 /* Somethings want wront with the accel init stop accel */
                 dev_err(rdev->dev, "Disabling GPU acceleration\n");
-                rs690_suspend(rdev);
                 r100_cp_fini(rdev);
                 r100_wb_fini(rdev);
                 r100_ib_fini(rdev);
diff --git a/drivers/gpu/drm/radeon/rv515.c b/drivers/gpu/drm/radeon/rv515.c
index 62756717b044..0e1e6b8632b8 100644
--- a/drivers/gpu/drm/radeon/rv515.c
+++ b/drivers/gpu/drm/radeon/rv515.c
@@ -537,7 +537,6 @@ void rv515_set_safe_registers(struct radeon_device *rdev)
 
 void rv515_fini(struct radeon_device *rdev)
 {
-        rv515_suspend(rdev);
         r100_cp_fini(rdev);
         r100_wb_fini(rdev);
         r100_ib_fini(rdev);
@@ -615,13 +614,12 @@ int rv515_init(struct radeon_device *rdev)
         if (r) {
                 /* Somethings want wront with the accel init stop accel */
                 dev_err(rdev->dev, "Disabling GPU acceleration\n");
-                rv515_suspend(rdev);
                 r100_cp_fini(rdev);
                 r100_wb_fini(rdev);
                 r100_ib_fini(rdev);
+                radeon_irq_kms_fini(rdev);
                 rv370_pcie_gart_fini(rdev);
                 radeon_agp_fini(rdev);
-                radeon_irq_kms_fini(rdev);
                 rdev->accel_working = false;
         }
         return 0;
diff --git a/drivers/gpu/drm/radeon/rv770.c b/drivers/gpu/drm/radeon/rv770.c
index 55f6ffc4e58b..03021674d097 100644
--- a/drivers/gpu/drm/radeon/rv770.c
+++ b/drivers/gpu/drm/radeon/rv770.c
@@ -549,9 +549,12 @@ static void rv770_gpu_init(struct radeon_device *rdev)
 
         gb_tiling_config |= BANK_SWAPS(1);
 
-        backend_map = r700_get_tile_pipe_to_backend_map(rdev->config.rv770.max_tile_pipes,
-                                                        rdev->config.rv770.max_backends,
-                                                        (0xff << rdev->config.rv770.max_backends) & 0xff);
+        if (rdev->family == CHIP_RV740)
+                backend_map = 0x28;
+        else
+                backend_map = r700_get_tile_pipe_to_backend_map(rdev->config.rv770.max_tile_pipes,
+                                                                rdev->config.rv770.max_backends,
+                                                                (0xff << rdev->config.rv770.max_backends) & 0xff);
         gb_tiling_config |= BACKEND_MAP(backend_map);
 
         cc_gc_shader_pipe_config =
@@ -887,26 +890,25 @@ static int rv770_startup(struct radeon_device *rdev)
                         return r;
         }
         rv770_gpu_init(rdev);
-
-        if (!rdev->r600_blit.shader_obj) {
-                r = r600_blit_init(rdev);
+        r = r600_blit_init(rdev);
+        if (r) {
+                r600_blit_fini(rdev);
+                rdev->asic->copy = NULL;
+                dev_warn(rdev->dev, "failed blitter (%d) falling back to memcpy\n", r);
+        }
+        /* pin copy shader into vram */
+        if (rdev->r600_blit.shader_obj) {
+                r = radeon_bo_reserve(rdev->r600_blit.shader_obj, false);
+                if (unlikely(r != 0))
+                        return r;
+                r = radeon_bo_pin(rdev->r600_blit.shader_obj, RADEON_GEM_DOMAIN_VRAM,
+                                &rdev->r600_blit.shader_gpu_addr);
+                radeon_bo_unreserve(rdev->r600_blit.shader_obj);
                 if (r) {
-                        DRM_ERROR("radeon: failed blitter (%d).\n", r);
+                        DRM_ERROR("failed to pin blit object %d\n", r);
                         return r;
                 }
         }
-
-        r = radeon_bo_reserve(rdev->r600_blit.shader_obj, false);
-        if (unlikely(r != 0))
-                return r;
-        r = radeon_bo_pin(rdev->r600_blit.shader_obj, RADEON_GEM_DOMAIN_VRAM,
-                        &rdev->r600_blit.shader_gpu_addr);
-        radeon_bo_unreserve(rdev->r600_blit.shader_obj);
-        if (r) {
-                DRM_ERROR("failed to pin blit object %d\n", r);
-                return r;
-        }
-
         /* Enable IRQ */
         r = r600_irq_init(rdev);
         if (r) {
@@ -1066,9 +1068,11 @@ int rv770_init(struct radeon_device *rdev)
         rdev->accel_working = true;
         r = rv770_startup(rdev);
         if (r) {
-                rv770_suspend(rdev);
+                dev_err(rdev->dev, "disabling GPU acceleration\n");
+                r600_cp_fini(rdev);
                 r600_wb_fini(rdev);
-                radeon_ring_fini(rdev);
+                r600_irq_fini(rdev);
+                radeon_irq_kms_fini(rdev);
                 rv770_pcie_gart_fini(rdev);
                 rdev->accel_working = false;
         }
@@ -1090,13 +1094,11 @@ int rv770_init(struct radeon_device *rdev)
 
 void rv770_fini(struct radeon_device *rdev)
 {
-        rv770_suspend(rdev);
-
         r600_blit_fini(rdev);
+        r600_cp_fini(rdev);
+        r600_wb_fini(rdev);
         r600_irq_fini(rdev);
         radeon_irq_kms_fini(rdev);
-        radeon_ring_fini(rdev);
-        r600_wb_fini(rdev);
         rv770_pcie_gart_fini(rdev);
         radeon_gem_fini(rdev);
         radeon_fence_driver_fini(rdev);
diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c
index 1a3e909b7bba..c7320ce4567d 100644
--- a/drivers/gpu/drm/ttm/ttm_bo.c
+++ b/drivers/gpu/drm/ttm/ttm_bo.c
@@ -1020,6 +1020,12 @@ static int ttm_bo_mem_compat(struct ttm_placement *placement,
                              struct ttm_mem_reg *mem)
 {
         int i;
+        struct drm_mm_node *node = mem->mm_node;
+
+        if (node && placement->lpfn != 0 &&
+            (node->start < placement->fpfn ||
+             node->start + node->size > placement->lpfn))
+                return -1;
 
         for (i = 0; i < placement->num_placement; i++) {
                 if ((placement->placement[i] & mem->placement &
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index 2ecf7d0c64f6..5ca37a58a98c 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -53,7 +53,6 @@ int ttm_bo_move_ttm(struct ttm_buffer_object *bo,
 {
         struct ttm_tt *ttm = bo->ttm;
         struct ttm_mem_reg *old_mem = &bo->mem;
-        uint32_t save_flags = old_mem->placement;
         int ret;
 
         if (old_mem->mem_type != TTM_PL_SYSTEM) {
@@ -62,7 +61,6 @@ int ttm_bo_move_ttm(struct ttm_buffer_object *bo,
                 ttm_flag_masked(&old_mem->placement, TTM_PL_FLAG_SYSTEM,
                                 TTM_PL_MASK_MEM);
                 old_mem->mem_type = TTM_PL_SYSTEM;
-                save_flags = old_mem->placement;
         }
 
         ret = ttm_tt_set_placement_caching(ttm, new_mem->placement);
@@ -77,7 +75,7 @@ int ttm_bo_move_ttm(struct ttm_buffer_object *bo,
 
         *old_mem = *new_mem;
         new_mem->mm_node = NULL;
-        ttm_flag_masked(&save_flags, new_mem->placement, TTM_PL_MASK_MEMTYPE);
+
         return 0;
 }
 EXPORT_SYMBOL(ttm_bo_move_ttm);
@@ -219,7 +217,6 @@ int ttm_bo_move_memcpy(struct ttm_buffer_object *bo,
         void *old_iomap;
         void *new_iomap;
         int ret;
-        uint32_t save_flags = old_mem->placement;
         unsigned long i;
         unsigned long page;
         unsigned long add = 0;
@@ -270,7 +267,6 @@ out2:
 
         *old_mem = *new_mem;
         new_mem->mm_node = NULL;
-        ttm_flag_masked(&save_flags, new_mem->placement, TTM_PL_MASK_MEMTYPE);
 
         if ((man->flags & TTM_MEMTYPE_FLAG_FIXED) && (ttm != NULL)) {
                 ttm_tt_unbind(ttm);
@@ -537,7 +533,6 @@ int ttm_bo_move_accel_cleanup(struct ttm_buffer_object *bo,
         struct ttm_mem_type_manager *man = &bdev->man[new_mem->mem_type];
         struct ttm_mem_reg *old_mem = &bo->mem;
         int ret;
-        uint32_t save_flags = old_mem->placement;
         struct ttm_buffer_object *ghost_obj;
         void *tmp_obj = NULL;
 
@@ -598,7 +593,7 @@ int ttm_bo_move_accel_cleanup(struct ttm_buffer_object *bo,
 
         *old_mem = *new_mem;
         new_mem->mm_node = NULL;
-        ttm_flag_masked(&save_flags, new_mem->placement, TTM_PL_MASK_MEMTYPE);
+
         return 0;
 }
 EXPORT_SYMBOL(ttm_bo_move_accel_cleanup);
diff --git a/drivers/gpu/drm/ttm/ttm_object.c b/drivers/gpu/drm/ttm/ttm_object.c
index 1099abac824b..75e9d6f86ba4 100644
--- a/drivers/gpu/drm/ttm/ttm_object.c
+++ b/drivers/gpu/drm/ttm/ttm_object.c
@@ -109,8 +109,8 @@ struct ttm_ref_object {
         struct drm_hash_item hash;
         struct list_head head;
         struct kref kref;
-        struct ttm_base_object *obj;
         enum ttm_ref_type ref_type;
+        struct ttm_base_object *obj;
         struct ttm_object_file *tfile;
 };
 
diff --git a/drivers/gpu/drm/ttm/ttm_tt.c b/drivers/gpu/drm/ttm/ttm_tt.c
index 9c2b1cc5dba5..3d47a2c12322 100644
--- a/drivers/gpu/drm/ttm/ttm_tt.c
+++ b/drivers/gpu/drm/ttm/ttm_tt.c
@@ -196,23 +196,34 @@ EXPORT_SYMBOL(ttm_tt_populate);
 
 #ifdef CONFIG_X86
 static inline int ttm_tt_set_page_caching(struct page *p,
-                                          enum ttm_caching_state c_state)
+                                          enum ttm_caching_state c_old,
+                                          enum ttm_caching_state c_new)
 {
+        int ret = 0;
+
         if (PageHighMem(p))
                 return 0;
 
-        switch (c_state) {
-        case tt_cached:
-                return set_pages_wb(p, 1);
-        case tt_wc:
-            return set_memory_wc((unsigned long) page_address(p), 1);
-        default:
-                return set_pages_uc(p, 1);
+        if (c_old != tt_cached) {
+                /* p isn't in the default caching state, set it to
+                 * writeback first to free its current memtype. */
+
+                ret = set_pages_wb(p, 1);
+                if (ret)
+                        return ret;
         }
+
+        if (c_new == tt_wc)
+                ret = set_memory_wc((unsigned long) page_address(p), 1);
+        else if (c_new == tt_uncached)
+                ret = set_pages_uc(p, 1);
+
+        return ret;
 }
 #else /* CONFIG_X86 */
 static inline int ttm_tt_set_page_caching(struct page *p,
-                                          enum ttm_caching_state c_state)
+                                          enum ttm_caching_state c_old,
+                                          enum ttm_caching_state c_new)
 {
         return 0;
 }
@@ -245,7 +256,9 @@ static int ttm_tt_set_caching(struct ttm_tt *ttm,
         for (i = 0; i < ttm->num_pages; ++i) {
                 cur_page = ttm->pages[i];
                 if (likely(cur_page != NULL)) {
-                        ret = ttm_tt_set_page_caching(cur_page, c_state);
+                        ret = ttm_tt_set_page_caching(cur_page,
+                                                      ttm->caching_state,
+                                                      c_state);
                         if (unlikely(ret != 0))
                                 goto out_err;
                 }
@@ -259,7 +272,7 @@ out_err:
         for (j = 0; j < i; ++j) {
                 cur_page = ttm->pages[j];
                 if (likely(cur_page != NULL)) {
-                        (void)ttm_tt_set_page_caching(cur_page,
+                        (void)ttm_tt_set_page_caching(cur_page, c_state,
                                                       ttm->caching_state);
                 }
         }
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
index dedd121d8fe7..0c9c0811f42d 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c
@@ -209,6 +209,7 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
 {
         struct vmw_private *dev_priv;
         int ret;
+        uint32_t svga_id;
 
         dev_priv = kzalloc(sizeof(*dev_priv), GFP_KERNEL);
         if (unlikely(dev_priv == NULL)) {
@@ -239,6 +240,16 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
         dev_priv->mmio_start = pci_resource_start(dev->pdev, 2);
 
         mutex_lock(&dev_priv->hw_mutex);
+
+        vmw_write(dev_priv, SVGA_REG_ID, SVGA_ID_2);
+        svga_id = vmw_read(dev_priv, SVGA_REG_ID);
+        if (svga_id != SVGA_ID_2) {
+                ret = -ENOSYS;
+                DRM_ERROR("Unsuported SVGA ID 0x%x\n", svga_id);
+                mutex_unlock(&dev_priv->hw_mutex);
+                goto out_err0;
+        }
+
         dev_priv->capabilities = vmw_read(dev_priv, SVGA_REG_CAPABILITIES);
 
         if (dev_priv->capabilities & SVGA_CAP_GMR) {
@@ -337,26 +348,25 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset)
                  */
 
                 DRM_INFO("It appears like vesafb is loaded. "
-                         "Ignore above error if any. Entering stealth mode.\n");
+                         "Ignore above error if any.\n");
                 ret = pci_request_region(dev->pdev, 2, "vmwgfx stealth probe");
                 if (unlikely(ret != 0)) {
                         DRM_ERROR("Failed reserving the SVGA MMIO resource.\n");
                         goto out_no_device;
                 }
-                vmw_kms_init(dev_priv);
-                vmw_overlay_init(dev_priv);
-        } else {
-                ret = vmw_request_device(dev_priv);
-                if (unlikely(ret != 0))
-                        goto out_no_device;
-                vmw_kms_init(dev_priv);
-                vmw_overlay_init(dev_priv);
-                vmw_fb_init(dev_priv);
         }
+        ret = vmw_request_device(dev_priv);
+        if (unlikely(ret != 0))
+                goto out_no_device;
+        vmw_kms_init(dev_priv);
+        vmw_overlay_init(dev_priv);
+        vmw_fb_init(dev_priv);
 
         dev_priv->pm_nb.notifier_call = vmwgfx_pm_notifier;
         register_pm_notifier(&dev_priv->pm_nb);
 
+        DRM_INFO("%s", vmw_fifo_have_3d(dev_priv) ? "Have 3D\n" : "No 3D\n");
+
         return 0;
 
 out_no_device:
@@ -393,17 +403,15 @@ static int vmw_driver_unload(struct drm_device *dev)
 
         unregister_pm_notifier(&dev_priv->pm_nb);
 
-        if (!dev_priv->stealth) {
-                vmw_fb_close(dev_priv);
-                vmw_kms_close(dev_priv);
-                vmw_overlay_close(dev_priv);
-                vmw_release_device(dev_priv);
-                pci_release_regions(dev->pdev);
-        } else {
-                vmw_kms_close(dev_priv);
-                vmw_overlay_close(dev_priv);
+        vmw_fb_close(dev_priv);
+        vmw_kms_close(dev_priv);
+        vmw_overlay_close(dev_priv);
+        vmw_release_device(dev_priv);
+        if (dev_priv->stealth)
                 pci_release_region(dev->pdev, 2);
-        }
+        else
+                pci_release_regions(dev->pdev);
+
         if (dev_priv->capabilities & SVGA_CAP_IRQMASK)
                 drm_irq_uninstall(dev_priv->dev);
         if (dev->devname == vmw_devname)
@@ -572,11 +580,6 @@ static int vmw_master_set(struct drm_device *dev,
         int ret = 0;
 
         DRM_INFO("Master set.\n");
-        if (dev_priv->stealth) {
-                ret = vmw_request_device(dev_priv);
-                if (unlikely(ret != 0))
-                        return ret;
-        }
 
         if (active) {
                 BUG_ON(active != &dev_priv->fbdev_master);
@@ -636,18 +639,11 @@ static void vmw_master_drop(struct drm_device *dev,
 
         ttm_lock_set_kill(&vmaster->lock, true, SIGTERM);
 
-        if (dev_priv->stealth) {
-                ret = ttm_bo_evict_mm(&dev_priv->bdev, TTM_PL_VRAM);
-                if (unlikely(ret != 0))
-                        DRM_ERROR("Unable to clean VRAM on master drop.\n");
-                vmw_release_device(dev_priv);
-        }
         dev_priv->active_master = &dev_priv->fbdev_master;
         ttm_lock_set_kill(&dev_priv->fbdev_master.lock, false, SIGTERM);
         ttm_vt_unlock(&dev_priv->fbdev_master.lock);
 
-        if (!dev_priv->stealth)
-                vmw_fb_on(dev_priv);
+        vmw_fb_on(dev_priv);
 }
 
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
index 50529a7f06fb..356dc935ec13 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
@@ -39,10 +39,10 @@
 #include "ttm/ttm_execbuf_util.h"
 #include "ttm/ttm_module.h"
 
-#define VMWGFX_DRIVER_DATE "20090724"
-#define VMWGFX_DRIVER_MAJOR 0
-#define VMWGFX_DRIVER_MINOR 1
-#define VMWGFX_DRIVER_PATCHLEVEL 2
+#define VMWGFX_DRIVER_DATE "20100209"
+#define VMWGFX_DRIVER_MAJOR 1
+#define VMWGFX_DRIVER_MINOR 0
+#define VMWGFX_DRIVER_PATCHLEVEL 0
 #define VMWGFX_FILE_PAGE_OFFSET 0x00100000
 #define VMWGFX_FIFO_STATIC_SIZE (1024*1024)
 #define VMWGFX_MAX_RELOCATIONS 2048
@@ -96,6 +96,8 @@ struct vmw_surface {
         struct drm_vmw_size *sizes;
         uint32_t num_sizes;
 
+        bool scanout;
+
         /* TODO so far just a extra pointer */
         struct vmw_cursor_snooper snooper;
 };
@@ -111,6 +113,7 @@ struct vmw_fifo_state {
         unsigned long static_buffer_size;
         bool using_bounce_buffer;
         uint32_t capabilities;
+        struct mutex fifo_mutex;
         struct rw_semaphore rwsem;
 };
 
@@ -211,7 +214,7 @@ struct vmw_private {
          * Fencing and IRQs.
          */
 
-        uint32_t fence_seq;
+        atomic_t fence_seq;
         wait_queue_head_t fence_queue;
         wait_queue_head_t fifo_queue;
         atomic_t fence_queue_waiters;
@@ -389,6 +392,7 @@ extern int vmw_fifo_send_fence(struct vmw_private *dev_priv,
                                uint32_t *sequence);
 extern void vmw_fifo_ping_host(struct vmw_private *dev_priv, uint32_t reason);
 extern int vmw_fifo_mmap(struct file *filp, struct vm_area_struct *vma);
+extern bool vmw_fifo_have_3d(struct vmw_private *dev_priv);
 
 /**
  * TTM glue - vmwgfx_ttm_glue.c
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index d69caf92ffe7..0897359b3e4e 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -182,25 +182,19 @@ static int vmw_cmd_present_check(struct vmw_private *dev_priv,
         return vmw_cmd_sid_check(dev_priv, sw_context, &cmd->body.sid);
 }
 
-static int vmw_cmd_dma(struct vmw_private *dev_priv,
-                       struct vmw_sw_context *sw_context,
-                       SVGA3dCmdHeader *header)
+static int vmw_translate_guest_ptr(struct vmw_private *dev_priv,
+                                   struct vmw_sw_context *sw_context,
+                                   SVGAGuestPtr *ptr,
+                                   struct vmw_dma_buffer **vmw_bo_p)
 {
-        uint32_t handle;
         struct vmw_dma_buffer *vmw_bo = NULL;
         struct ttm_buffer_object *bo;
-        struct vmw_surface *srf = NULL;
-        struct vmw_dma_cmd {
-                SVGA3dCmdHeader header;
-                SVGA3dCmdSurfaceDMA dma;
-        } *cmd;
+        uint32_t handle = ptr->gmrId;
         struct vmw_relocation *reloc;
-        int ret;
         uint32_t cur_validate_node;
         struct ttm_validate_buffer *val_buf;
+        int ret;
 
-        cmd = container_of(header, struct vmw_dma_cmd, header);
-        handle = cmd->dma.guest.ptr.gmrId;
         ret = vmw_user_dmabuf_lookup(sw_context->tfile, handle, &vmw_bo);
         if (unlikely(ret != 0)) {
                 DRM_ERROR("Could not find or use GMR region.\n");
@@ -209,14 +203,14 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv,
         bo = &vmw_bo->base;
 
         if (unlikely(sw_context->cur_reloc >= VMWGFX_MAX_RELOCATIONS)) {
-                DRM_ERROR("Max number of DMA commands per submission"
+                DRM_ERROR("Max number relocations per submission"
                           " exceeded\n");
                 ret = -EINVAL;
                 goto out_no_reloc;
         }
 
         reloc = &sw_context->relocs[sw_context->cur_reloc++];
-        reloc->location = &cmd->dma.guest.ptr;
+        reloc->location = ptr;
 
         cur_validate_node = vmw_dmabuf_validate_node(bo, sw_context->cur_val_buf);
         if (unlikely(cur_validate_node >= VMWGFX_MAX_GMRS)) {
@@ -234,7 +228,89 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv,
                 list_add_tail(&val_buf->head, &sw_context->validate_nodes);
                 ++sw_context->cur_val_buf;
         }
+        *vmw_bo_p = vmw_bo;
+        return 0;
+
+out_no_reloc:
+        vmw_dmabuf_unreference(&vmw_bo);
+        vmw_bo_p = NULL;
+        return ret;
+}
+
+static int vmw_cmd_end_query(struct vmw_private *dev_priv,
+                             struct vmw_sw_context *sw_context,
+                             SVGA3dCmdHeader *header)
+{
+        struct vmw_dma_buffer *vmw_bo;
+        struct vmw_query_cmd {
+                SVGA3dCmdHeader header;
+                SVGA3dCmdEndQuery q;
+        } *cmd;
+        int ret;
+
+        cmd = container_of(header, struct vmw_query_cmd, header);
+        ret = vmw_cmd_cid_check(dev_priv, sw_context, header);
+        if (unlikely(ret != 0))
+                return ret;
+
+        ret = vmw_translate_guest_ptr(dev_priv, sw_context,
+                                      &cmd->q.guestResult,
+                                      &vmw_bo);
+        if (unlikely(ret != 0))
+                return ret;
+
+        vmw_dmabuf_unreference(&vmw_bo);
+        return 0;
+}
 
+static int vmw_cmd_wait_query(struct vmw_private *dev_priv,
+                              struct vmw_sw_context *sw_context,
+                              SVGA3dCmdHeader *header)
+{
+        struct vmw_dma_buffer *vmw_bo;
+        struct vmw_query_cmd {
+                SVGA3dCmdHeader header;
+                SVGA3dCmdWaitForQuery q;
+        } *cmd;
+        int ret;
+
+        cmd = container_of(header, struct vmw_query_cmd, header);
+        ret = vmw_cmd_cid_check(dev_priv, sw_context, header);
+        if (unlikely(ret != 0))
+                return ret;
+
+        ret = vmw_translate_guest_ptr(dev_priv, sw_context,
+                                      &cmd->q.guestResult,
+                                      &vmw_bo);
+        if (unlikely(ret != 0))
+                return ret;
+
+        vmw_dmabuf_unreference(&vmw_bo);
+        return 0;
+}
+
+
+static int vmw_cmd_dma(struct vmw_private *dev_priv,
+                       struct vmw_sw_context *sw_context,
+                       SVGA3dCmdHeader *header)
+{
+        struct vmw_dma_buffer *vmw_bo = NULL;
+        struct ttm_buffer_object *bo;
+        struct vmw_surface *srf = NULL;
+        struct vmw_dma_cmd {
+                SVGA3dCmdHeader header;
+                SVGA3dCmdSurfaceDMA dma;
+        } *cmd;
+        int ret;
+
+        cmd = container_of(header, struct vmw_dma_cmd, header);
+        ret = vmw_translate_guest_ptr(dev_priv, sw_context,
+                                      &cmd->dma.guest.ptr,
+                                      &vmw_bo);
+        if (unlikely(ret != 0))
+                return ret;
+
+        bo = &vmw_bo->base;
         ret = vmw_user_surface_lookup_handle(dev_priv, sw_context->tfile,
                                              cmd->dma.host.sid, &srf);
         if (ret) {
@@ -379,8 +455,8 @@ static vmw_cmd_func vmw_cmd_funcs[SVGA_3D_CMD_MAX] = {
         VMW_CMD_DEF(SVGA_3D_CMD_DRAW_PRIMITIVES, &vmw_cmd_draw),
         VMW_CMD_DEF(SVGA_3D_CMD_SETSCISSORRECT, &vmw_cmd_cid_check),
         VMW_CMD_DEF(SVGA_3D_CMD_BEGIN_QUERY, &vmw_cmd_cid_check),
-        VMW_CMD_DEF(SVGA_3D_CMD_END_QUERY, &vmw_cmd_cid_check),
-        VMW_CMD_DEF(SVGA_3D_CMD_WAIT_FOR_QUERY, &vmw_cmd_cid_check),
+        VMW_CMD_DEF(SVGA_3D_CMD_END_QUERY, &vmw_cmd_end_query),
+        VMW_CMD_DEF(SVGA_3D_CMD_WAIT_FOR_QUERY, &vmw_cmd_wait_query),
         VMW_CMD_DEF(SVGA_3D_CMD_PRESENT_READBACK, &vmw_cmd_ok),
         VMW_CMD_DEF(SVGA_3D_CMD_BLIT_SURFACE_TO_SCREEN,
                     &vmw_cmd_blt_surf_screen_check)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
index 4f4f6432be8b..a93367041cdc 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
@@ -559,6 +559,9 @@ int vmw_fb_init(struct vmw_private *vmw_priv)
         info->pixmap.scan_align = 1;
 #endif
 
+        info->aperture_base = vmw_priv->vram_start;
+        info->aperture_size = vmw_priv->vram_size;
+
         /*
          * Dirty & Deferred IO
          */
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
index f7d5f70b52dd..39d43a01d846 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
@@ -29,6 +29,25 @@
 #include "drmP.h"
 #include "ttm/ttm_placement.h"
 
+bool vmw_fifo_have_3d(struct vmw_private *dev_priv)
+{
+        __le32 __iomem *fifo_mem = dev_priv->mmio_virt;
+        uint32_t fifo_min, hwversion;
+
+        fifo_min = ioread32(fifo_mem  + SVGA_FIFO_MIN);
+        if (fifo_min <= SVGA_FIFO_3D_HWVERSION * sizeof(unsigned int))
+                return false;
+
+        hwversion = ioread32(fifo_mem + SVGA_FIFO_3D_HWVERSION);
+        if (hwversion == 0)
+                return false;
+
+        if (hwversion < SVGA3D_HWVERSION_WS65_B1)
+                return false;
+
+        return true;
+}
+
 int vmw_fifo_init(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
 {
         __le32 __iomem *fifo_mem = dev_priv->mmio_virt;
@@ -55,6 +74,7 @@ int vmw_fifo_init(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
         fifo->reserved_size = 0;
         fifo->using_bounce_buffer = false;
 
+        mutex_init(&fifo->fifo_mutex);
         init_rwsem(&fifo->rwsem);
 
         /*
@@ -98,7 +118,7 @@ int vmw_fifo_init(struct vmw_private *dev_priv, struct vmw_fifo_state *fifo)
                  (unsigned int) min,
                  (unsigned int) fifo->capabilities);
 
-        dev_priv->fence_seq = dev_priv->last_read_sequence;
+        atomic_set(&dev_priv->fence_seq, dev_priv->last_read_sequence);
         iowrite32(dev_priv->last_read_sequence, fifo_mem + SVGA_FIFO_FENCE);
 
         return vmw_fifo_send_fence(dev_priv, &dummy);
@@ -264,7 +284,7 @@ void *vmw_fifo_reserve(struct vmw_private *dev_priv, uint32_t bytes)
         uint32_t reserveable = fifo_state->capabilities & SVGA_FIFO_CAP_RESERVE;
         int ret;
 
-        down_write(&fifo_state->rwsem);
+        mutex_lock(&fifo_state->fifo_mutex);
         max = ioread32(fifo_mem + SVGA_FIFO_MAX);
         min = ioread32(fifo_mem + SVGA_FIFO_MIN);
         next_cmd = ioread32(fifo_mem + SVGA_FIFO_NEXT_CMD);
@@ -332,7 +352,7 @@ void *vmw_fifo_reserve(struct vmw_private *dev_priv, uint32_t bytes)
         }
 out_err:
         fifo_state->reserved_size = 0;
-        up_write(&fifo_state->rwsem);
+        mutex_unlock(&fifo_state->fifo_mutex);
         return NULL;
 }
 
@@ -407,6 +427,7 @@ void vmw_fifo_commit(struct vmw_private *dev_priv, uint32_t bytes)
 
         }
 
+        down_write(&fifo_state->rwsem);
         if (fifo_state->using_bounce_buffer || reserveable) {
                 next_cmd += bytes;
                 if (next_cmd >= max)
@@ -418,8 +439,9 @@ void vmw_fifo_commit(struct vmw_private *dev_priv, uint32_t bytes)
         if (reserveable)
                 iowrite32(0, fifo_mem + SVGA_FIFO_RESERVED);
         mb();
-        vmw_fifo_ping_host(dev_priv, SVGA_SYNC_GENERIC);
         up_write(&fifo_state->rwsem);
+        vmw_fifo_ping_host(dev_priv, SVGA_SYNC_GENERIC);
+        mutex_unlock(&fifo_state->fifo_mutex);
 }
 
 int vmw_fifo_send_fence(struct vmw_private *dev_priv, uint32_t *sequence)
@@ -432,9 +454,7 @@ int vmw_fifo_send_fence(struct vmw_private *dev_priv, uint32_t *sequence)
 
         fm = vmw_fifo_reserve(dev_priv, bytes);
         if (unlikely(fm == NULL)) {
-                down_write(&fifo_state->rwsem);
-                *sequence = dev_priv->fence_seq;
-                up_write(&fifo_state->rwsem);
+                *sequence = atomic_read(&dev_priv->fence_seq);
                 ret = -ENOMEM;
                 (void)vmw_fallback_wait(dev_priv, false, true, *sequence,
                                         false, 3*HZ);
@@ -442,7 +462,7 @@ int vmw_fifo_send_fence(struct vmw_private *dev_priv, uint32_t *sequence)
         }
 
         do {
-                *sequence = dev_priv->fence_seq++;
+                *sequence = atomic_add_return(1, &dev_priv->fence_seq);
         } while (*sequence == 0);
 
         if (!(fifo_state->capabilities & SVGA_FIFO_CAP_FENCE)) {
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
index 5fa6a4ed238a..1c7a316454d8 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c
@@ -43,11 +43,17 @@ int vmw_getparam_ioctl(struct drm_device *dev, void *data,
                 param->value = vmw_overlay_num_free_overlays(dev_priv);
                 break;
         case DRM_VMW_PARAM_3D:
-                param->value = dev_priv->capabilities & SVGA_CAP_3D ? 1 : 0;
+                param->value = vmw_fifo_have_3d(dev_priv) ? 1 : 0;
                 break;
         case DRM_VMW_PARAM_FIFO_OFFSET:
                 param->value = dev_priv->mmio_start;
                 break;
+        case DRM_VMW_PARAM_HW_CAPS:
+                param->value = dev_priv->capabilities;
+                break;
+        case DRM_VMW_PARAM_FIFO_CAPS:
+                param->value = dev_priv->fifo.capabilities;
+                break;
         default:
                 DRM_ERROR("Illegal vmwgfx get param request: %d\n",
                           param->param);
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c b/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
index d40086fc8647..4d7cb5393860 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
@@ -85,19 +85,12 @@ bool vmw_fence_signaled(struct vmw_private *dev_priv,
                 return true;
 
         /**
-         * Below is to signal stale fences that have wrapped.
-         * First, block fence submission.
-         */
-
-        down_read(&fifo_state->rwsem);
-
-        /**
          * Then check if the sequence is higher than what we've actually
          * emitted. Then the fence is stale and signaled.
          */
 
-        ret = ((dev_priv->fence_seq - sequence) > VMW_FENCE_WRAP);
-        up_read(&fifo_state->rwsem);
+        ret = ((atomic_read(&dev_priv->fence_seq) - sequence)
+               > VMW_FENCE_WRAP);
 
         return ret;
 }
@@ -127,7 +120,7 @@ int vmw_fallback_wait(struct vmw_private *dev_priv,
 
         if (fifo_idle)
                 down_read(&fifo_state->rwsem);
-        signal_seq = dev_priv->fence_seq;
+        signal_seq = atomic_read(&dev_priv->fence_seq);
         ret = 0;
 
         for (;;) {
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
index 686692de209a..31f9afed0a63 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c
@@ -707,6 +707,9 @@ static struct drm_framebuffer *vmw_kms_fb_create(struct drm_device *dev,
         if (ret)
                 goto try_dmabuf;
 
+        if (!surface->scanout)
+                goto err_not_scanout;
+
         ret = vmw_kms_new_framebuffer_surface(dev_priv, surface, &vfb,
                                               mode_cmd->width, mode_cmd->height);
 
@@ -740,6 +743,13 @@ try_dmabuf:
         }
 
         return &vfb->base;
+
+err_not_scanout:
+        DRM_ERROR("surface not marked as scanout\n");
+        /* vmw_user_surface_lookup takes one ref */
+        vmw_surface_unreference(&surface);
+
+        return NULL;
 }
 
 static int vmw_kms_fb_changed(struct drm_device *dev)
@@ -759,10 +769,10 @@ int vmw_kms_init(struct vmw_private *dev_priv)
 
         drm_mode_config_init(dev);
         dev->mode_config.funcs = &vmw_kms_funcs;
-        dev->mode_config.min_width = 640;
-        dev->mode_config.min_height = 480;
-        dev->mode_config.max_width = 2048;
-        dev->mode_config.max_height = 2048;
+        dev->mode_config.min_width = 1;
+        dev->mode_config.min_height = 1;
+        dev->mode_config.max_width = dev_priv->fb_max_width;
+        dev->mode_config.max_height = dev_priv->fb_max_height;
 
         ret = vmw_kms_init_legacy_display_system(dev_priv);
 
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
index e01db120efff..f8fbbc67a406 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c
@@ -574,6 +574,7 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
 
         srf->flags = req->flags;
         srf->format = req->format;
+        srf->scanout = req->scanout;
         memcpy(srf->mip_levels, req->mip_levels, sizeof(srf->mip_levels));
         srf->num_sizes = 0;
         for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i)
@@ -599,8 +600,7 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data,
         if (unlikely(ret != 0))
                 goto out_err1;
 
-
-        if (srf->flags & (1 << 9) &&
+        if (srf->scanout &&
             srf->num_sizes == 1 &&
             srf->sizes[0].width == 64 &&
             srf->sizes[0].height == 64 &&
diff --git a/drivers/gpu/vga/vgaarb.c b/drivers/gpu/vga/vgaarb.c
index 1ac0c93603c9..2f6cf69ecb39 100644
--- a/drivers/gpu/vga/vgaarb.c
+++ b/drivers/gpu/vga/vgaarb.c
@@ -961,7 +961,7 @@ static ssize_t vga_arb_write(struct file *file, const char __user * buf,
                 remaining -= 7;
                 pr_devel("client 0x%p called 'target'\n", priv);
                 /* if target is default */
-                if (!strncmp(buf, "default", 7))
+                if (!strncmp(curr_pos, "default", 7))
                         pdev = pci_dev_get(vga_default_device());
                 else {
                         if (!vga_pci_str_to_vars(curr_pos, remaining,
diff --git a/drivers/hwmon/adt7462.c b/drivers/hwmon/adt7462.c
index a31e77c776ae..b8156b4893bb 100644
--- a/drivers/hwmon/adt7462.c
+++ b/drivers/hwmon/adt7462.c
@@ -179,7 +179,7 @@ static const unsigned short normal_i2c[] = { 0x58, 0x5C, I2C_CLIENT_END };
  *
  * Some, but not all, of these voltages have low/high limits.
  */
-#define ADT7462_VOLT_COUNT      12
+#define ADT7462_VOLT_COUNT      13
 
 #define ADT7462_VENDOR          0x41
 #define ADT7462_DEVICE          0x62
diff --git a/drivers/hwmon/lm78.c b/drivers/hwmon/lm78.c
index cadcbd90ff3b..72ff2c4e757d 100644
--- a/drivers/hwmon/lm78.c
+++ b/drivers/hwmon/lm78.c
@@ -851,17 +851,16 @@ static struct lm78_data *lm78_update_device(struct device *dev)
 static int __init lm78_isa_found(unsigned short address)
 {
         int val, save, found = 0;
-
-        /* We have to request the region in two parts because some
-           boards declare base+4 to base+7 as a PNP device */
-        if (!request_region(address, 4, "lm78")) {
-                pr_debug("lm78: Failed to request low part of region\n");
-                return 0;
-        }
-        if (!request_region(address + 4, 4, "lm78")) {
-                pr_debug("lm78: Failed to request high part of region\n");
-                release_region(address, 4);
-                return 0;
+        int port;
+
+        /* Some boards declare base+0 to base+7 as a PNP device, some base+4
+         * to base+7 and some base+5 to base+6. So we better request each port
+         * individually for the probing phase. */
+        for (port = address; port < address + LM78_EXTENT; port++) {
+                if (!request_region(port, 1, "lm78")) {
+                        pr_debug("lm78: Failed to request port 0x%x\n", port);
+                        goto release;
+                }
         }
 
 #define REALLY_SLOW_IO
@@ -925,8 +924,8 @@ static int __init lm78_isa_found(unsigned short address)
                         val & 0x80 ? "LM79" : "LM78", (int)address);
 
  release:
-        release_region(address + 4, 4);
-        release_region(address, 4);
+        for (port--; port >= address; port--)
+                release_region(port, 1);
         return found;
 }
 
diff --git a/drivers/hwmon/w83781d.c b/drivers/hwmon/w83781d.c
index 05f9225b6f94..32d4adee73db 100644
--- a/drivers/hwmon/w83781d.c
+++ b/drivers/hwmon/w83781d.c
@@ -1793,17 +1793,17 @@ static int __init
 w83781d_isa_found(unsigned short address)
 {
         int val, save, found = 0;
-
-        /* We have to request the region in two parts because some
-           boards declare base+4 to base+7 as a PNP device */
-        if (!request_region(address, 4, "w83781d")) {
-                pr_debug("w83781d: Failed to request low part of region\n");
-                return 0;
-        }
-        if (!request_region(address + 4, 4, "w83781d")) {
-                pr_debug("w83781d: Failed to request high part of region\n");
-                release_region(address, 4);
-                return 0;
+        int port;
+
+        /* Some boards declare base+0 to base+7 as a PNP device, some base+4
+         * to base+7 and some base+5 to base+6. So we better request each port
+         * individually for the probing phase. */
+        for (port = address; port < address + W83781D_EXTENT; port++) {
+                if (!request_region(port, 1, "w83781d")) {
+                        pr_debug("w83781d: Failed to request port 0x%x\n",
+                                 port);
+                        goto release;
+                }
         }
 
 #define REALLY_SLOW_IO
@@ -1877,8 +1877,8 @@ w83781d_isa_found(unsigned short address)
                         val == 0x30 ? "W83782D" : "W83781D", (int)address);
 
  release:
-        release_region(address + 4, 4);
-        release_region(address, 4);
+        for (port--; port >= address; port--)
+                release_region(port, 1);
         return found;
 }
 
diff --git a/drivers/i2c/busses/i2c-tiny-usb.c b/drivers/i2c/busses/i2c-tiny-usb.c
index b1c050ff311d..e29b6d5ba8ef 100644
--- a/drivers/i2c/busses/i2c-tiny-usb.c
+++ b/drivers/i2c/busses/i2c-tiny-usb.c
@@ -13,6 +13,7 @@
 #include <linux/kernel.h>
 #include <linux/errno.h>
 #include <linux/module.h>
+#include <linux/types.h>
 
 /* include interfaces to usb layer */
 #include <linux/usb.h>
@@ -31,8 +32,8 @@
 #define CMD_I2C_IO_END          (1<<1)
 
 /* i2c bit delay, default is 10us -> 100kHz */
-static int delay = 10;
-module_param(delay, int, 0);
+static unsigned short delay = 10;
+module_param(delay, ushort, 0);
 MODULE_PARM_DESC(delay, "bit delay in microseconds, "
                  "e.g. 10 for 100kHz (default is 100kHz)");
 
@@ -109,7 +110,7 @@ static int usb_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs, int num)
 
 static u32 usb_func(struct i2c_adapter *adapter)
 {
-        u32 func;
+        __le32 func;
 
         /* get functionality from adapter */
         if (usb_read(adapter, CMD_GET_FUNC, 0, 0, &func, sizeof(func)) !=
@@ -118,7 +119,7 @@ static u32 usb_func(struct i2c_adapter *adapter)
                 return 0;
         }
 
-        return func;
+        return le32_to_cpu(func);
 }
 
 /* This is the actual algorithm we define */
@@ -216,8 +217,7 @@ static int i2c_tiny_usb_probe(struct usb_interface *interface,
                  "i2c-tiny-usb at bus %03d device %03d",
                  dev->usb_dev->bus->busnum, dev->usb_dev->devnum);
 
-        if (usb_write(&dev->adapter, CMD_SET_DELAY,
-                      cpu_to_le16(delay), 0, NULL, 0) != 0) {
+        if (usb_write(&dev->adapter, CMD_SET_DELAY, delay, 0, NULL, 0) != 0) {
                 dev_err(&dev->adapter.dev,
                         "failure setting delay to %dus\n", delay);
                 retval = -EIO;
diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c
index cc9b5940fa97..875e34e0b235 100644
--- a/drivers/infiniband/core/cma.c
+++ b/drivers/infiniband/core/cma.c
@@ -2115,9 +2115,7 @@ int rdma_bind_addr(struct rdma_cm_id *id, struct sockaddr *addr)
         if (ret)
                 goto err1;
 
-        if (cma_loopback_addr(addr)) {
-                ret = cma_bind_loopback(id_priv);
-        } else if (!cma_zero_addr(addr)) {
+        if (!cma_any_addr(addr)) {
                 ret = rdma_translate_ip(addr, &id->route.addr.dev_addr);
                 if (ret)
                         goto err1;
diff --git a/drivers/infiniband/hw/ipath/ipath_fs.c b/drivers/infiniband/hw/ipath/ipath_fs.c
index b3684060465e..100da8542bba 100644
--- a/drivers/infiniband/hw/ipath/ipath_fs.c
+++ b/drivers/infiniband/hw/ipath/ipath_fs.c
@@ -346,10 +346,8 @@ static int ipathfs_fill_super(struct super_block *sb, void *data,
         list_for_each_entry_safe(dd, tmp, &ipath_dev_list, ipath_list) {
                 spin_unlock_irqrestore(&ipath_devs_lock, flags);
                 ret = create_device_files(sb, dd);
-                if (ret) {
-                        deactivate_locked_super(sb);
+                if (ret)
                         goto bail;
-                }
                 spin_lock_irqsave(&ipath_devs_lock, flags);
         }
 
diff --git a/drivers/input/input-polldev.c b/drivers/input/input-polldev.c
index aa6713b4a988..291d9393d359 100644
--- a/drivers/input/input-polldev.c
+++ b/drivers/input/input-polldev.c
@@ -100,6 +100,12 @@ static void input_close_polled_device(struct input_dev *input)
         struct input_polled_dev *dev = input_get_drvdata(input);
 
         cancel_delayed_work_sync(&dev->work);
+        /*
+         * Clean up work struct to remove references to the workqueue.
+         * It may be destroyed by the next call. This causes problems
+         * at next device open-close in case of poll_interval == 0.
+         */
+        INIT_DELAYED_WORK(&dev->work, dev->work.work.func);
         input_polldev_stop_workqueue();
 
         if (dev->close)
diff --git a/drivers/input/input.c b/drivers/input/input.c
index 30b503b8d67b..86cb2d2196ff 100644
--- a/drivers/input/input.c
+++ b/drivers/input/input.c
@@ -46,6 +46,7 @@ static unsigned int input_abs_bypass_init_data[] __initdata = {
         ABS_MT_TOOL_TYPE,
         ABS_MT_BLOB_ID,
         ABS_MT_TRACKING_ID,
+        ABS_MT_PRESSURE,
         0
 };
 static unsigned long input_abs_bypass[BITS_TO_LONGS(ABS_CNT)];
diff --git a/drivers/input/misc/winbond-cir.c b/drivers/input/misc/winbond-cir.c
index 33309fe44e20..c8f5a9a3fa14 100644
--- a/drivers/input/misc/winbond-cir.c
+++ b/drivers/input/misc/winbond-cir.c
@@ -768,7 +768,7 @@ wbcir_parse_rc6(struct device *dev, struct wbcir_data *data)
                 return;
         }
 
-        dev_info(dev, "IR-RC6 ad 0x%02X cm 0x%02X cu 0x%04X "
+        dev_dbg(dev, "IR-RC6 ad 0x%02X cm 0x%02X cu 0x%04X "
                 "toggle %u mode %u scan 0x%08X\n",
                 address,
                 command,
diff --git a/drivers/input/mouse/lifebook.c b/drivers/input/mouse/lifebook.c
index 6d7aa10d10f0..7c1d7d420ae3 100644
--- a/drivers/input/mouse/lifebook.c
+++ b/drivers/input/mouse/lifebook.c
@@ -53,6 +53,12 @@ static const struct dmi_system_id __initconst lifebook_dmi_table[] = {
         {
                 /* LifeBook B */
                 .matches = {
+                        DMI_MATCH(DMI_PRODUCT_NAME, "Lifebook B Series"),
+                },
+        },
+        {
+                /* LifeBook B */
+                .matches = {
                         DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook B Series"),
                 },
         },
diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c
index 9774bdfaa482..d8c0c8d6992c 100644
--- a/drivers/input/mouse/psmouse-base.c
+++ b/drivers/input/mouse/psmouse-base.c
@@ -1141,7 +1141,14 @@ static void psmouse_cleanup(struct serio *serio)
                 psmouse_deactivate(parent);
         }
 
-        psmouse_deactivate(psmouse);
+        psmouse_set_state(psmouse, PSMOUSE_INITIALIZING);
+
+        /*
+         * Disable stream mode so cleanup routine can proceed undisturbed.
+         */
+        if (ps2_command(&psmouse->ps2dev, NULL, PSMOUSE_CMD_DISABLE))
+                printk(KERN_WARNING "psmouse.c: Failed to disable mouse on %s\n",
+                        psmouse->ps2dev.serio->phys);
 
         if (psmouse->cleanup)
                 psmouse->cleanup(psmouse);
diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
index d84a36e545f6..b54aee7cd9e3 100644
--- a/drivers/input/serio/i8042.c
+++ b/drivers/input/serio/i8042.c
@@ -1161,9 +1161,17 @@ static int i8042_pm_restore(struct device *dev)
         return 0;
 }
 
+static int i8042_pm_thaw(struct device *dev)
+{
+        i8042_interrupt(0, NULL);
+
+        return 0;
+}
+
 static const struct dev_pm_ops i8042_pm_ops = {
         .suspend        = i8042_pm_reset,
         .resume         = i8042_pm_restore,
+        .thaw           = i8042_pm_thaw,
         .poweroff       = i8042_pm_reset,
         .restore        = i8042_pm_restore,
 };
diff --git a/drivers/input/touchscreen/ad7879.c b/drivers/input/touchscreen/ad7879.c
index c21e6d3a8844..794d070c6900 100644
--- a/drivers/input/touchscreen/ad7879.c
+++ b/drivers/input/touchscreen/ad7879.c
@@ -47,6 +47,7 @@
 #include <linux/workqueue.h>
 #include <linux/spi/spi.h>
 #include <linux/i2c.h>
+#include <linux/gpio.h>
 
 #include <linux/spi/ad7879.h>
 
@@ -132,7 +133,9 @@ struct ad7879 {
         struct input_dev        *input;
         struct work_struct      work;
         struct timer_list       timer;
-
+#ifdef CONFIG_GPIOLIB
+        struct gpio_chip        gc;
+#endif
         struct mutex            mutex;
         unsigned                disabled:1;     /* P: mutex */
 
@@ -150,11 +153,9 @@ struct ad7879 {
         u8                      median;
         u16                     x_plate_ohms;
         u16                     pressure_max;
-        u16                     gpio_init;
         u16                     cmd_crtl1;
         u16                     cmd_crtl2;
         u16                     cmd_crtl3;
-        unsigned                gpio:1;
 };
 
 static int ad7879_read(bus_device *, u8);
@@ -237,24 +238,6 @@ static irqreturn_t ad7879_irq(int irq, void *handle)
 
 static void ad7879_setup(struct ad7879 *ts)
 {
-        ts->cmd_crtl3 = AD7879_YPLUS_BIT |
-                        AD7879_XPLUS_BIT |
-                        AD7879_Z2_BIT |
-                        AD7879_Z1_BIT |
-                        AD7879_TEMPMASK_BIT |
-                        AD7879_AUXVBATMASK_BIT |
-                        AD7879_GPIOALERTMASK_BIT;
-
-        ts->cmd_crtl2 = AD7879_PM(AD7879_PM_DYN) | AD7879_DFR |
-                        AD7879_AVG(ts->averaging) |
-                        AD7879_MFS(ts->median) |
-                        AD7879_FCD(ts->first_conversion_delay) |
-                        ts->gpio_init;
-
-        ts->cmd_crtl1 = AD7879_MODE_INT | AD7879_MODE_SEQ1 |
-                        AD7879_ACQ(ts->acquisition_time) |
-                        AD7879_TMR(ts->pen_down_acc_interval);
-
         ad7879_write(ts->bus, AD7879_REG_CTRL2, ts->cmd_crtl2);
         ad7879_write(ts->bus, AD7879_REG_CTRL3, ts->cmd_crtl3);
         ad7879_write(ts->bus, AD7879_REG_CTRL1, ts->cmd_crtl1);
@@ -324,48 +307,132 @@ static ssize_t ad7879_disable_store(struct device *dev,
 
 static DEVICE_ATTR(disable, 0664, ad7879_disable_show, ad7879_disable_store);
 
-static ssize_t ad7879_gpio_show(struct device *dev,
-                                     struct device_attribute *attr, char *buf)
+static struct attribute *ad7879_attributes[] = {
+        &dev_attr_disable.attr,
+        NULL
+};
+
+static const struct attribute_group ad7879_attr_group = {
+        .attrs = ad7879_attributes,
+};
+
+#ifdef CONFIG_GPIOLIB
+static int ad7879_gpio_direction_input(struct gpio_chip *chip,
+                                        unsigned gpio)
 {
-        struct ad7879 *ts = dev_get_drvdata(dev);
+        struct ad7879 *ts = container_of(chip, struct ad7879, gc);
+        int err;
 
-        return sprintf(buf, "%u\n", ts->gpio);
+        mutex_lock(&ts->mutex);
+        ts->cmd_crtl2 |= AD7879_GPIO_EN | AD7879_GPIODIR | AD7879_GPIOPOL;
+        err = ad7879_write(ts->bus, AD7879_REG_CTRL2, ts->cmd_crtl2);
+        mutex_unlock(&ts->mutex);
+
+        return err;
 }
 
-static ssize_t ad7879_gpio_store(struct device *dev,
-                                     struct device_attribute *attr,
-                                     const char *buf, size_t count)
+static int ad7879_gpio_direction_output(struct gpio_chip *chip,
+                                        unsigned gpio, int level)
 {
-        struct ad7879 *ts = dev_get_drvdata(dev);
-        unsigned long val;
-        int error;
+        struct ad7879 *ts = container_of(chip, struct ad7879, gc);
+        int err;
 
-        error = strict_strtoul(buf, 10, &val);
-        if (error)
-                return error;
+        mutex_lock(&ts->mutex);
+        ts->cmd_crtl2 &= ~AD7879_GPIODIR;
+        ts->cmd_crtl2 |= AD7879_GPIO_EN | AD7879_GPIOPOL;
+        if (level)
+                ts->cmd_crtl2 |= AD7879_GPIO_DATA;
+        else
+                ts->cmd_crtl2 &= ~AD7879_GPIO_DATA;
+
+        err = ad7879_write(ts->bus, AD7879_REG_CTRL2, ts->cmd_crtl2);
+        mutex_unlock(&ts->mutex);
+
+        return err;
+}
+
+static int ad7879_gpio_get_value(struct gpio_chip *chip, unsigned gpio)
+{
+        struct ad7879 *ts = container_of(chip, struct ad7879, gc);
+        u16 val;
 
         mutex_lock(&ts->mutex);
-        ts->gpio = !!val;
-        error = ad7879_write(ts->bus, AD7879_REG_CTRL2,
-                           ts->gpio ?
-                                ts->cmd_crtl2 & ~AD7879_GPIO_DATA :
-                                ts->cmd_crtl2 | AD7879_GPIO_DATA);
+        val = ad7879_read(ts->bus, AD7879_REG_CTRL2);
         mutex_unlock(&ts->mutex);
 
-        return error ? : count;
+        return !!(val & AD7879_GPIO_DATA);
 }
 
-static DEVICE_ATTR(gpio, 0664, ad7879_gpio_show, ad7879_gpio_store);
+static void ad7879_gpio_set_value(struct gpio_chip *chip,
+                                  unsigned gpio, int value)
+{
+        struct ad7879 *ts = container_of(chip, struct ad7879, gc);
 
-static struct attribute *ad7879_attributes[] = {
-        &dev_attr_disable.attr,
-        &dev_attr_gpio.attr,
-        NULL
-};
+        mutex_lock(&ts->mutex);
+        if (value)
+                ts->cmd_crtl2 |= AD7879_GPIO_DATA;
+        else
+                ts->cmd_crtl2 &= ~AD7879_GPIO_DATA;
 
-static const struct attribute_group ad7879_attr_group = {
-        .attrs = ad7879_attributes,
-};
+        ad7879_write(ts->bus, AD7879_REG_CTRL2, ts->cmd_crtl2);
+        mutex_unlock(&ts->mutex);
+}
+
+static int __devinit ad7879_gpio_add(struct device *dev)
+{
+        struct ad7879 *ts = dev_get_drvdata(dev);
+        struct ad7879_platform_data *pdata = dev->platform_data;
+        int ret = 0;
+
+        if (pdata->gpio_export) {
+                ts->gc.direction_input = ad7879_gpio_direction_input;
+                ts->gc.direction_output = ad7879_gpio_direction_output;
+                ts->gc.get = ad7879_gpio_get_value;
+                ts->gc.set = ad7879_gpio_set_value;
+                ts->gc.can_sleep = 1;
+                ts->gc.base = pdata->gpio_base;
+                ts->gc.ngpio = 1;
+                ts->gc.label = "AD7879-GPIO";
+                ts->gc.owner = THIS_MODULE;
+                ts->gc.dev = dev;
+
+                ret = gpiochip_add(&ts->gc);
+                if (ret)
+                        dev_err(dev, "failed to register gpio %d\n",
+                                ts->gc.base);
+        }
+
+        return ret;
+}
+
+/*
+ * We mark ad7879_gpio_remove inline so there is a chance the code
+ * gets discarded when not needed. We can't do __devinit/__devexit
+ * markup since it is used in both probe and remove methods.
+ */
+static inline void ad7879_gpio_remove(struct device *dev)
+{
+        struct ad7879 *ts = dev_get_drvdata(dev);
+        struct ad7879_platform_data *pdata = dev->platform_data;
+        int ret;
+
+        if (pdata->gpio_export) {
+                ret = gpiochip_remove(&ts->gc);
+                if (ret)
+                        dev_err(dev, "failed to remove gpio %d\n",
+                                ts->gc.base);
+        }
+}
+#else
+static inline int ad7879_gpio_add(struct device *dev)
+{
+        return 0;
+}
+
+static inline void ad7879_gpio_remove(struct device *dev)
+{
+}
+#endif
 
 static int __devinit ad7879_construct(bus_device *bus, struct ad7879 *ts)
 {
@@ -403,12 +470,6 @@ static int __devinit ad7879_construct(bus_device *bus, struct ad7879 *ts)
         ts->pen_down_acc_interval = pdata->pen_down_acc_interval;
         ts->median = pdata->median;
 
-        if (pdata->gpio_output)
-                ts->gpio_init = AD7879_GPIO_EN |
-                                (pdata->gpio_default ? 0 : AD7879_GPIO_DATA);
-        else
-                ts->gpio_init = AD7879_GPIO_EN | AD7879_GPIODIR;
-
         snprintf(ts->phys, sizeof(ts->phys), "%s/input0", dev_name(&bus->dev));
 
         input_dev->name = "AD7879 Touchscreen";
@@ -446,6 +507,23 @@ static int __devinit ad7879_construct(bus_device *bus, struct ad7879 *ts)
                 goto err_free_mem;
         }
 
+        ts->cmd_crtl3 = AD7879_YPLUS_BIT |
+                        AD7879_XPLUS_BIT |
+                        AD7879_Z2_BIT |
+                        AD7879_Z1_BIT |
+                        AD7879_TEMPMASK_BIT |
+                        AD7879_AUXVBATMASK_BIT |
+                        AD7879_GPIOALERTMASK_BIT;
+
+        ts->cmd_crtl2 = AD7879_PM(AD7879_PM_DYN) | AD7879_DFR |
+                        AD7879_AVG(ts->averaging) |
+                        AD7879_MFS(ts->median) |
+                        AD7879_FCD(ts->first_conversion_delay);
+
+        ts->cmd_crtl1 = AD7879_MODE_INT | AD7879_MODE_SEQ1 |
+                        AD7879_ACQ(ts->acquisition_time) |
+                        AD7879_TMR(ts->pen_down_acc_interval);
+
         ad7879_setup(ts);
 
         err = request_irq(bus->irq, ad7879_irq,
@@ -460,15 +538,21 @@ static int __devinit ad7879_construct(bus_device *bus, struct ad7879 *ts)
         if (err)
                 goto err_free_irq;
 
-        err = input_register_device(input_dev);
+        err = ad7879_gpio_add(&bus->dev);
         if (err)
                 goto err_remove_attr;
 
+        err = input_register_device(input_dev);
+        if (err)
+                goto err_remove_gpio;
+
         dev_info(&bus->dev, "Rev.%d touchscreen, irq %d\n",
                  revid >> 8, bus->irq);
 
         return 0;
 
+err_remove_gpio:
+        ad7879_gpio_remove(&bus->dev);
 err_remove_attr:
         sysfs_remove_group(&bus->dev.kobj, &ad7879_attr_group);
 err_free_irq:
@@ -481,6 +565,7 @@ err_free_mem:
 
 static int __devexit ad7879_destroy(bus_device *bus, struct ad7879 *ts)
 {
+        ad7879_gpio_remove(&bus->dev);
         ad7879_disable(ts);
         sysfs_remove_group(&ts->bus->dev.kobj, &ad7879_attr_group);
         free_irq(ts->bus->irq, ts);
diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
index 09a5e7341bd5..5256123a5228 100644
--- a/drivers/input/touchscreen/usbtouchscreen.c
+++ b/drivers/input/touchscreen/usbtouchscreen.c
@@ -618,8 +618,8 @@ static int idealtek_read_data(struct usbtouch_usb *dev, unsigned char *pkt)
 #ifdef CONFIG_TOUCHSCREEN_USB_GENERAL_TOUCH
 static int general_touch_read_data(struct usbtouch_usb *dev, unsigned char *pkt)
 {
-        dev->x = ((pkt[2] & 0x0F) << 8) | pkt[1] ;
-        dev->y = ((pkt[4] & 0x0F) << 8) | pkt[3] ;
+        dev->x = (pkt[2] << 8) | pkt[1];
+        dev->y = (pkt[4] << 8) | pkt[3];
         dev->press = pkt[5] & 0xff;
         dev->touch = pkt[0] & 0x01;
 
@@ -809,9 +809,9 @@ static struct usbtouch_device_info usbtouch_dev_info[] = {
 #ifdef CONFIG_TOUCHSCREEN_USB_GENERAL_TOUCH
         [DEVTYPE_GENERAL_TOUCH] = {
                 .min_xc         = 0x0,
-                .max_xc         = 0x0500,
+                .max_xc         = 0x7fff,
                 .min_yc         = 0x0,
-                .max_yc         = 0x0500,
+                .max_yc         = 0x7fff,
                 .rept_size      = 7,
                 .read_data      = general_touch_read_data,
         },
diff --git a/drivers/md/dm-log-userspace-transfer.c b/drivers/md/dm-log-userspace-transfer.c
index 54abf9e303b7..f1c8cae70b4b 100644
--- a/drivers/md/dm-log-userspace-transfer.c
+++ b/drivers/md/dm-log-userspace-transfer.c
@@ -172,11 +172,15 @@ int dm_consult_userspace(const char *uuid, uint64_t luid, int request_type,
 {
         int r = 0;
         size_t dummy = 0;
-        int overhead_size =
-                sizeof(struct dm_ulog_request *) + sizeof(struct cn_msg);
+        int overhead_size = sizeof(struct dm_ulog_request) + sizeof(struct cn_msg);
         struct dm_ulog_request *tfr = prealloced_ulog_tfr;
         struct receiving_pkg pkg;
 
+        /*
+         * Given the space needed to hold the 'struct cn_msg' and
+         * 'struct dm_ulog_request' - do we have enough payload
+         * space remaining?
+         */
         if (data_size > (DM_ULOG_PREALLOCED_SIZE - overhead_size)) {
                 DMINFO("Size of tfr exceeds preallocated size");
                 return -EINVAL;
@@ -191,7 +195,7 @@ resend:
          */
         mutex_lock(&dm_ulog_lock);
 
-        memset(tfr, 0, DM_ULOG_PREALLOCED_SIZE - overhead_size);
+        memset(tfr, 0, DM_ULOG_PREALLOCED_SIZE - sizeof(struct cn_msg));
         memcpy(tfr->uuid, uuid, DM_UUID_LEN);
         tfr->luid = luid;
         tfr->seq = dm_ulog_seq++;
diff --git a/drivers/md/dm-raid1.c b/drivers/md/dm-raid1.c
index ad779bd13aec..6c1046df81f6 100644
--- a/drivers/md/dm-raid1.c
+++ b/drivers/md/dm-raid1.c
@@ -724,7 +724,7 @@ static void do_writes(struct mirror_set *ms, struct bio_list *writes)
         /*
          * Dispatch io.
          */
-        if (unlikely(ms->log_failure)) {
+        if (unlikely(ms->log_failure) && errors_handled(ms)) {
                 spin_lock_irq(&ms->lock);
                 bio_list_merge(&ms->failures, &sync);
                 spin_unlock_irq(&ms->lock);
diff --git a/drivers/md/dm-region-hash.c b/drivers/md/dm-region-hash.c
index 5f19ceb6fe91..168bd38f5006 100644
--- a/drivers/md/dm-region-hash.c
+++ b/drivers/md/dm-region-hash.c
@@ -660,10 +660,9 @@ void dm_rh_recovery_end(struct dm_region *reg, int success)
         spin_lock_irq(&rh->region_lock);
         if (success)
                 list_add(&reg->list, &reg->rh->recovered_regions);
-        else {
-                reg->state = DM_RH_NOSYNC;
+        else
                 list_add(&reg->list, &reg->rh->failed_recovered_regions);
-        }
+
         spin_unlock_irq(&rh->region_lock);
 
         rh->wakeup_workers(rh->context);
diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c
index 7d08879689ac..c097d8a4823d 100644
--- a/drivers/md/dm-snap-persistent.c
+++ b/drivers/md/dm-snap-persistent.c
@@ -254,7 +254,7 @@ static int chunk_io(struct pstore *ps, void *area, chunk_t chunk, int rw,
          * Issue the synchronous I/O from a different thread
          * to avoid generic_make_request recursion.
          */
-        INIT_WORK(&req.work, do_metadata);
+        INIT_WORK_ON_STACK(&req.work, do_metadata);
         queue_work(ps->metadata_wq, &req.work);
         flush_workqueue(ps->metadata_wq);
 
diff --git a/drivers/md/dm-stripe.c b/drivers/md/dm-stripe.c
index e0efc1adcaff..bd58703ee8f6 100644
--- a/drivers/md/dm-stripe.c
+++ b/drivers/md/dm-stripe.c
@@ -110,7 +110,7 @@ static int stripe_ctr(struct dm_target *ti, unsigned int argc, char **argv)
         }
 
         stripes = simple_strtoul(argv[0], &end, 10);
-        if (*end) {
+        if (!stripes || *end) {
                 ti->error = "Invalid stripe count";
                 return -EINVAL;
         }
diff --git a/drivers/md/dm-sysfs.c b/drivers/md/dm-sysfs.c
index f53392df7b97..f91b40942e07 100644
--- a/drivers/md/dm-sysfs.c
+++ b/drivers/md/dm-sysfs.c
@@ -80,20 +80,12 @@ static struct sysfs_ops dm_sysfs_ops = {
 };
 
 /*
- * The sysfs structure is embedded in md struct, nothing to do here
- */
-static void dm_sysfs_release(struct kobject *kobj)
-{
-}
-
-/*
  * dm kobject is embedded in mapped_device structure
  * no need to define release function here
  */
 static struct kobj_type dm_ktype = {
         .sysfs_ops      = &dm_sysfs_ops,
         .default_attrs  = dm_attrs,
-        .release        = dm_sysfs_release
 };
 
 /*
diff --git a/drivers/md/dm.c b/drivers/md/dm.c
index 3167480b532c..aa4e2aa86d49 100644
--- a/drivers/md/dm.c
+++ b/drivers/md/dm.c
@@ -1595,10 +1595,15 @@ static int dm_prep_fn(struct request_queue *q, struct request *rq)
         return BLKPREP_OK;
 }
 
-static void map_request(struct dm_target *ti, struct request *clone,
-                        struct mapped_device *md)
+/*
+ * Returns:
+ * 0  : the request has been processed (not requeued)
+ * !0 : the request has been requeued
+ */
+static int map_request(struct dm_target *ti, struct request *clone,
+                       struct mapped_device *md)
 {
-        int r;
+        int r, requeued = 0;
         struct dm_rq_target_io *tio = clone->end_io_data;
 
         /*
@@ -1625,6 +1630,7 @@ static void map_request(struct dm_target *ti, struct request *clone,
         case DM_MAPIO_REQUEUE:
                 /* The target wants to requeue the I/O */
                 dm_requeue_unmapped_request(clone);
+                requeued = 1;
                 break;
         default:
                 if (r > 0) {
@@ -1636,6 +1642,8 @@ static void map_request(struct dm_target *ti, struct request *clone,
                 dm_kill_unmapped_request(clone, r);
                 break;
         }
+
+        return requeued;
 }
 
 /*
@@ -1677,12 +1685,17 @@ static void dm_request_fn(struct request_queue *q)
                 atomic_inc(&md->pending[rq_data_dir(clone)]);
 
                 spin_unlock(q->queue_lock);
-                map_request(ti, clone, md);
+                if (map_request(ti, clone, md))
+                        goto requeued;
+
                 spin_lock_irq(q->queue_lock);
         }
 
         goto out;
 
+requeued:
+        spin_lock_irq(q->queue_lock);
+
 plug_and_out:
         if (!elv_queue_empty(q))
                 /* Some requests still remain, retry later */
diff --git a/drivers/md/md.c b/drivers/md/md.c
index dd3dfe42d5a9..a20a71e5efd3 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -4075,8 +4075,10 @@ static void mddev_delayed_delete(struct work_struct *ws)
 {
         mddev_t *mddev = container_of(ws, mddev_t, del_work);
 
-        if (mddev->private == &md_redundancy_group) {
+        if (mddev->private) {
                 sysfs_remove_group(&mddev->kobj, &md_redundancy_group);
+                if (mddev->private != (void*)1)
+                        sysfs_remove_group(&mddev->kobj, mddev->private);
                 if (mddev->sysfs_action)
                         sysfs_put(mddev->sysfs_action);
                 mddev->sysfs_action = NULL;
@@ -4287,10 +4289,7 @@ static int do_md_run(mddev_t * mddev)
                 sysfs_notify_dirent(rdev->sysfs_state);
         }
 
-        md_probe(mddev->unit, NULL, NULL);
         disk = mddev->gendisk;
-        if (!disk)
-                return -ENOMEM;
 
         spin_lock(&pers_lock);
         pers = find_pers(mddev->level, mddev->clevel);
@@ -4530,8 +4529,8 @@ static int do_md_stop(mddev_t * mddev, int mode, int is_open)
                         mddev->queue->unplug_fn = NULL;
                         mddev->queue->backing_dev_info.congested_fn = NULL;
                         module_put(mddev->pers->owner);
-                        if (mddev->pers->sync_request)
-                                mddev->private = &md_redundancy_group;
+                        if (mddev->pers->sync_request && mddev->private == NULL)
+                                mddev->private = (void*)1;
                         mddev->pers = NULL;
                         /* tell userspace to handle 'inactive' */
                         sysfs_notify_dirent(mddev->sysfs_state);
@@ -4578,9 +4577,6 @@ out:
                 }
                 mddev->bitmap_info.offset = 0;
 
-                /* make sure all md_delayed_delete calls have finished */
-                flush_scheduled_work();
-
                 export_array(mddev);
 
                 mddev->array_sectors = 0;
diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index e84204eb12df..ceb24afdc147 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -5136,9 +5136,8 @@ static int stop(mddev_t *mddev)
         mddev->thread = NULL;
         mddev->queue->backing_dev_info.congested_fn = NULL;
         blk_sync_queue(mddev->queue); /* the unplug fn references 'conf'*/
-        sysfs_remove_group(&mddev->kobj, &raid5_attrs_group);
         free_conf(conf);
-        mddev->private = NULL;
+        mddev->private = &raid5_attrs_group;
         return 0;
 }
 
@@ -5464,11 +5463,11 @@ static int raid5_start_reshape(mddev_t *mddev)
                     !test_bit(Faulty, &rdev->flags)) {
                         if (raid5_add_disk(mddev, rdev) == 0) {
                                 char nm[20];
-                                if (rdev->raid_disk >= conf->previous_raid_disks)
+                                if (rdev->raid_disk >= conf->previous_raid_disks) {
                                         set_bit(In_sync, &rdev->flags);
-                                else
+                                        added_devices++;
+                                } else
                                         rdev->recovery_offset = 0;
-                                added_devices++;
                                 sprintf(nm, "rd%d", rdev->raid_disk);
                                 if (sysfs_create_link(&mddev->kobj,
                                                       &rdev->kobj, nm))
@@ -5480,9 +5479,12 @@ static int raid5_start_reshape(mddev_t *mddev)
                                 break;
                 }
 
+        /* When a reshape changes the number of devices, ->degraded
+         * is measured against the large of the pre and post number of
+         * devices.*/
         if (mddev->delta_disks > 0) {
                 spin_lock_irqsave(&conf->device_lock, flags);
-                mddev->degraded = (conf->raid_disks - conf->previous_raid_disks)
+                mddev->degraded += (conf->raid_disks - conf->previous_raid_disks)
                         - added_devices;
                 spin_unlock_irqrestore(&conf->device_lock, flags);
         }
diff --git a/drivers/media/common/saa7146_video.c b/drivers/media/common/saa7146_video.c
index becbaadb3b77..5ed75263340a 100644
--- a/drivers/media/common/saa7146_video.c
+++ b/drivers/media/common/saa7146_video.c
@@ -1333,9 +1333,9 @@ static void buffer_release(struct videobuf_queue *q, struct videobuf_buffer *vb)
 
         DEB_CAP(("vbuf:%p\n",vb));
 
-        release_all_pagetables(dev, buf);
-
         saa7146_dma_free(dev,q,buf);
+
+        release_all_pagetables(dev, buf);
 }
 
 static struct videobuf_queue_ops video_qops = {
diff --git a/drivers/media/dvb/dvb-core/dmxdev.c b/drivers/media/dvb/dvb-core/dmxdev.c
index c37790ad92d0..9ddc57909d49 100644
--- a/drivers/media/dvb/dvb-core/dmxdev.c
+++ b/drivers/media/dvb/dvb-core/dmxdev.c
@@ -761,7 +761,6 @@ static int dvb_demux_open(struct inode *inode, struct file *file)
         dvb_ringbuffer_init(&dmxdevfilter->buffer, NULL, 8192);
         dmxdevfilter->type = DMXDEV_TYPE_NONE;
         dvb_dmxdev_filter_state_set(dmxdevfilter, DMXDEV_STATE_ALLOCATED);
-        INIT_LIST_HEAD(&dmxdevfilter->feed.ts);
         init_timer(&dmxdevfilter->timer);
 
         dvbdev->users++;
@@ -887,6 +886,7 @@ static int dvb_dmxdev_pes_filter_set(struct dmxdev *dmxdev,
         dmxdevfilter->type = DMXDEV_TYPE_PES;
         memcpy(&dmxdevfilter->params, params,
                sizeof(struct dmx_pes_filter_params));
+        INIT_LIST_HEAD(&dmxdevfilter->feed.ts);
 
         dvb_dmxdev_filter_state_set(dmxdevfilter, DMXDEV_STATE_SET);
 
diff --git a/drivers/media/dvb/dvb-core/dvb_demux.c b/drivers/media/dvb/dvb-core/dvb_demux.c
index b78cfb7d1897..67f189b7aa1f 100644
--- a/drivers/media/dvb/dvb-core/dvb_demux.c
+++ b/drivers/media/dvb/dvb-core/dvb_demux.c
@@ -426,16 +426,7 @@ static void dvb_dmx_swfilter_packet(struct dvb_demux *demux, const u8 *buf)
                 };
         };
 
-        if (dvb_demux_tscheck) {
-                if (!demux->cnt_storage)
-                        demux->cnt_storage = vmalloc(MAX_PID + 1);
-
-                if (!demux->cnt_storage) {
-                        printk(KERN_WARNING "Couldn't allocate memory for TS/TEI check. Disabling it\n");
-                        dvb_demux_tscheck = 0;
-                        goto no_dvb_demux_tscheck;
-                }
-
+        if (demux->cnt_storage) {
                 /* check pkt counter */
                 if (pid < MAX_PID) {
                         if (buf[1] & 0x80)
@@ -454,7 +445,6 @@ static void dvb_dmx_swfilter_packet(struct dvb_demux *demux, const u8 *buf)
                 };
                 /* end check */
         };
-no_dvb_demux_tscheck:
 
         list_for_each_entry(feed, &demux->feed_list, list_head) {
                 if ((feed->pid != pid) && (feed->pid != 0x2000))
@@ -1246,6 +1236,7 @@ int dvb_dmx_init(struct dvb_demux *dvbdemux)
         dvbdemux->feed = vmalloc(dvbdemux->feednum * sizeof(struct dvb_demux_feed));
         if (!dvbdemux->feed) {
                 vfree(dvbdemux->filter);
+                dvbdemux->filter = NULL;
                 return -ENOMEM;
         }
         for (i = 0; i < dvbdemux->filternum; i++) {
@@ -1257,6 +1248,13 @@ int dvb_dmx_init(struct dvb_demux *dvbdemux)
                 dvbdemux->feed[i].index = i;
         }
 
+        if (dvb_demux_tscheck) {
+                dvbdemux->cnt_storage = vmalloc(MAX_PID + 1);
+
+                if (!dvbdemux->cnt_storage)
+                        printk(KERN_WARNING "Couldn't allocate memory for TS/TEI check. Disabling it\n");
+        }
+
         INIT_LIST_HEAD(&dvbdemux->frontend_list);
 
         for (i = 0; i < DMX_TS_PES_OTHER; i++) {
diff --git a/drivers/media/dvb/dvb-usb/Kconfig b/drivers/media/dvb/dvb-usb/Kconfig
index 1b249897c9fb..465295b1d14b 100644
--- a/drivers/media/dvb/dvb-usb/Kconfig
+++ b/drivers/media/dvb/dvb-usb/Kconfig
@@ -112,11 +112,13 @@ config DVB_USB_CXUSB
         select DVB_MT352 if !DVB_FE_CUSTOMISE
         select DVB_ZL10353 if !DVB_FE_CUSTOMISE
         select DVB_DIB7000P if !DVB_FE_CUSTOMISE
-        select DVB_LGS8GL5 if !DVB_FE_CUSTOMISE
         select DVB_TUNER_DIB0070 if !DVB_FE_CUSTOMISE
+        select DVB_ATBM8830 if !DVB_FE_CUSTOMISE
+        select DVB_LGS8GXX if !DVB_FE_CUSTOMISE
         select MEDIA_TUNER_SIMPLE if !MEDIA_TUNER_CUSTOMISE
         select MEDIA_TUNER_XC2028 if !MEDIA_TUNER_CUSTOMISE
         select MEDIA_TUNER_MXL5005S if !MEDIA_TUNER_CUSTOMISE
+        select MEDIA_TUNER_MAX2165 if !MEDIA_TUNER_CUSTOMISE
         help
           Say Y here to support the Conexant USB2.0 hybrid reference design.
           Currently, only DVB and ATSC modes are supported, analog mode
diff --git a/drivers/media/dvb/frontends/l64781.c b/drivers/media/dvb/frontends/l64781.c
index 3051b64aa17c..445fa1068064 100644
--- a/drivers/media/dvb/frontends/l64781.c
+++ b/drivers/media/dvb/frontends/l64781.c
@@ -192,8 +192,8 @@ static int apply_frontend_param (struct dvb_frontend* fe, struct dvb_frontend_pa
         spi_bias *= qam_tab[p->constellation];
         spi_bias /= p->code_rate_HP + 1;
         spi_bias /= (guard_tab[p->guard_interval] + 32);
-        spi_bias *= 1000ULL;
-        spi_bias /= 1000ULL + ppm/1000;
+        spi_bias *= 1000;
+        spi_bias /= 1000 + ppm/1000;
         spi_bias *= p->code_rate_HP;
 
         val0x04 = (p->transmission_mode << 2) | p->guard_interval;
diff --git a/drivers/media/video/bt8xx/bttv-driver.c b/drivers/media/video/bt8xx/bttv-driver.c
index 3182a406bdd1..ae08b077fd04 100644
--- a/drivers/media/video/bt8xx/bttv-driver.c
+++ b/drivers/media/video/bt8xx/bttv-driver.c
@@ -4461,6 +4461,7 @@ static int __devinit bttv_probe(struct pci_dev *dev,
                 request_modules(btv);
         }
 
+        init_bttv_i2c_ir(btv);
         bttv_input_init(btv);
 
         /* everything is fine */
diff --git a/drivers/media/video/bt8xx/bttv-i2c.c b/drivers/media/video/bt8xx/bttv-i2c.c
index 63aa31a041e8..407fa61e4cda 100644
--- a/drivers/media/video/bt8xx/bttv-i2c.c
+++ b/drivers/media/video/bt8xx/bttv-i2c.c
@@ -388,7 +388,12 @@ int __devinit init_bttv_i2c(struct bttv *btv)
         if (0 == btv->i2c_rc && i2c_scan)
                 do_i2c_scan(btv->c.v4l2_dev.name, &btv->i2c_client);
 
-        /* Instantiate the IR receiver device, if present */
+        return btv->i2c_rc;
+}
+
+/* Instantiate the I2C IR receiver device, if present */
+void __devinit init_bttv_i2c_ir(struct bttv *btv)
+{
         if (0 == btv->i2c_rc) {
                 struct i2c_board_info info;
                 /* The external IR receiver is at i2c address 0x34 (0x35 for
@@ -408,7 +413,6 @@ int __devinit init_bttv_i2c(struct bttv *btv)
                 strlcpy(info.type, "ir_video", I2C_NAME_SIZE);
                 i2c_new_probed_device(&btv->c.i2c_adap, &info, addr_list);
         }
-        return btv->i2c_rc;
 }
 
 int __devexit fini_bttv_i2c(struct bttv *btv)
diff --git a/drivers/media/video/bt8xx/bttvp.h b/drivers/media/video/bt8xx/bttvp.h
index a1d0e9c9f286..6cccc2a17eee 100644
--- a/drivers/media/video/bt8xx/bttvp.h
+++ b/drivers/media/video/bt8xx/bttvp.h
@@ -279,6 +279,7 @@ extern unsigned int bttv_debug;
 extern unsigned int bttv_gpio;
 extern void bttv_gpio_tracking(struct bttv *btv, char *comment);
 extern int init_bttv_i2c(struct bttv *btv);
+extern void init_bttv_i2c_ir(struct bttv *btv);
 extern int fini_bttv_i2c(struct bttv *btv);
 
 #define bttv_printk if (bttv_verbose) printk
diff --git a/drivers/media/video/mt9t112.c b/drivers/media/video/mt9t112.c
index fc4dd6045720..7438f8d775ba 100644
--- a/drivers/media/video/mt9t112.c
+++ b/drivers/media/video/mt9t112.c
@@ -514,7 +514,7 @@ static int mt9t112_init_pll(const struct i2c_client *client)
         /* poll to verify out of standby. Must Poll this bit */
         for (i = 0; i < 100; i++) {
                 mt9t112_reg_read(data, client, 0x0018);
-                if (0x4000 & data)
+                if (!(0x4000 & data))
                         break;
 
                 mdelay(10);
diff --git a/drivers/media/video/pwc/pwc-ctrl.c b/drivers/media/video/pwc/pwc-ctrl.c
index 50b415e07eda..f7f7e04cf485 100644
--- a/drivers/media/video/pwc/pwc-ctrl.c
+++ b/drivers/media/video/pwc/pwc-ctrl.c
@@ -753,7 +753,7 @@ int pwc_set_shutter_speed(struct pwc_device *pdev, int mode, int value)
                 buf[0] = 0xff; /* fixed */
 
         ret = send_control_msg(pdev,
-                SET_LUM_CTL, SHUTTER_MODE_FORMATTER, &buf, sizeof(buf));
+                SET_LUM_CTL, SHUTTER_MODE_FORMATTER, &buf, 1);
 
         if (!mode && ret >= 0) {
                 if (value < 0)
diff --git a/drivers/media/video/saa7134/saa7134-empress.c b/drivers/media/video/saa7134/saa7134-empress.c
index 7dfecfc6017c..ee5bff02a92c 100644
--- a/drivers/media/video/saa7134/saa7134-empress.c
+++ b/drivers/media/video/saa7134/saa7134-empress.c
@@ -93,9 +93,9 @@ static int ts_open(struct file *file)
         dprintk("open dev=%s\n", video_device_node_name(vdev));
         err = -EBUSY;
         if (!mutex_trylock(&dev->empress_tsq.vb_lock))
-                goto done;
+                return err;
         if (atomic_read(&dev->empress_users))
-                goto done_up;
+                goto done;
 
         /* Unmute audio */
         saa_writeb(SAA7134_AUDIO_MUTE_CTRL,
@@ -105,10 +105,8 @@ static int ts_open(struct file *file)
         file->private_data = dev;
         err = 0;
 
-done_up:
-        mutex_unlock(&dev->empress_tsq.vb_lock);
 done:
-        unlock_kernel();
+        mutex_unlock(&dev->empress_tsq.vb_lock);
         return err;
 }
 
diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c
index 85bc6a685e36..44d2037e9e56 100644
--- a/drivers/message/fusion/mptbase.c
+++ b/drivers/message/fusion/mptbase.c
@@ -4330,6 +4330,8 @@ initChainBuffers(MPT_ADAPTER *ioc)
 
         if (ioc->bus_type == SPI)
                 num_chain *= MPT_SCSI_CAN_QUEUE;
+        else if (ioc->bus_type == SAS)
+                num_chain *= MPT_SAS_CAN_QUEUE;
         else
                 num_chain *= MPT_FC_CAN_QUEUE;
 
diff --git a/drivers/message/fusion/mptscsih.c b/drivers/message/fusion/mptscsih.c
index 57752751712b..81279b3d694c 100644
--- a/drivers/message/fusion/mptscsih.c
+++ b/drivers/message/fusion/mptscsih.c
@@ -1796,7 +1796,7 @@ mptscsih_abort(struct scsi_cmnd * SCpnt)
                 dtmprintk(ioc, printk(MYIOC_s_DEBUG_FMT "task abort: "
                    "Command not in the active list! (sc=%p)\n", ioc->name,
                    SCpnt));
-                retval = 0;
+                retval = SUCCESS;
                 goto out;
         }
 
diff --git a/drivers/mfd/Makefile b/drivers/mfd/Makefile
index 8f0d18409ede..e09eb4870db6 100644
--- a/drivers/mfd/Makefile
+++ b/drivers/mfd/Makefile
@@ -3,7 +3,7 @@
 #
 
 obj-$(CONFIG_MFD_SM501)         += sm501.o
-obj-$(CONFIG_MFD_ASIC3)         += asic3.o
+obj-$(CONFIG_MFD_ASIC3)         += asic3.o tmio_core.o
 obj-$(CONFIG_MFD_SH_MOBILE_SDHI)                += sh_mobile_sdhi.o
 
 obj-$(CONFIG_HTC_EGPIO)         += htc-egpio.o
diff --git a/drivers/mmc/card/mmc_test.c b/drivers/mmc/card/mmc_test.c
index b9f1e84897cc..e7f8027165e6 100644
--- a/drivers/mmc/card/mmc_test.c
+++ b/drivers/mmc/card/mmc_test.c
@@ -74,6 +74,9 @@ static void mmc_test_prepare_mrq(struct mmc_test_card *test,
         }
 
         mrq->cmd->arg = dev_addr;
+        if (!mmc_card_blockaddr(test->card))
+                mrq->cmd->arg <<= 9;
+
         mrq->cmd->flags = MMC_RSP_R1 | MMC_CMD_ADTC;
 
         if (blocks == 1)
@@ -190,7 +193,7 @@ static int __mmc_test_prepare(struct mmc_test_card *test, int write)
         }
 
         for (i = 0;i < BUFFER_SIZE / 512;i++) {
-                ret = mmc_test_buffer_transfer(test, test->buffer, i * 512, 512, 1);
+                ret = mmc_test_buffer_transfer(test, test->buffer, i, 512, 1);
                 if (ret)
                         return ret;
         }
@@ -219,7 +222,7 @@ static int mmc_test_cleanup(struct mmc_test_card *test)
         memset(test->buffer, 0, 512);
 
         for (i = 0;i < BUFFER_SIZE / 512;i++) {
-                ret = mmc_test_buffer_transfer(test, test->buffer, i * 512, 512, 1);
+                ret = mmc_test_buffer_transfer(test, test->buffer, i, 512, 1);
                 if (ret)
                         return ret;
         }
@@ -426,7 +429,7 @@ static int mmc_test_transfer(struct mmc_test_card *test,
                 for (i = 0;i < sectors;i++) {
                         ret = mmc_test_buffer_transfer(test,
                                 test->buffer + i * 512,
-                                dev_addr + i * 512, 512, 0);
+                                dev_addr + i, 512, 0);
                         if (ret)
                                 return ret;
                 }
diff --git a/drivers/mtd/ubi/cdev.c b/drivers/mtd/ubi/cdev.c
index f237ddbb2713..111ea41c4ecd 100644
--- a/drivers/mtd/ubi/cdev.c
+++ b/drivers/mtd/ubi/cdev.c
@@ -853,7 +853,6 @@ static long ubi_cdev_ioctl(struct file *file, unsigned int cmd,
                         break;
                 }
 
-                req.name[req.name_len] = '\0';
                 err = verify_mkvol_req(ubi, &req);
                 if (err)
                         break;
diff --git a/drivers/net/ax88796.c b/drivers/net/ax88796.c
index 62d9c9cc5671..1dd4403247ca 100644
--- a/drivers/net/ax88796.c
+++ b/drivers/net/ax88796.c
@@ -921,7 +921,7 @@ static int ax_probe(struct platform_device *pdev)
                 size = (res->end - res->start) + 1;
 
                 ax->mem2 = request_mem_region(res->start, size, pdev->name);
-                if (ax->mem == NULL) {
+                if (ax->mem2 == NULL) {
                         dev_err(&pdev->dev, "cannot reserve registers\n");
                         ret = -ENXIO;
                         goto exit_mem1;
diff --git a/drivers/net/benet/be.h b/drivers/net/benet/be.h
index 9fd8e5ecd5d7..5bc74590c73e 100644
--- a/drivers/net/benet/be.h
+++ b/drivers/net/benet/be.h
@@ -276,8 +276,13 @@ struct be_adapter {
         int link_speed;
         u8 port_type;
         u8 transceiver;
+        u8 generation;          /* BladeEngine ASIC generation */
 };
 
+/* BladeEngine Generation numbers */
+#define BE_GEN2 2
+#define BE_GEN3 3
+
 extern const struct ethtool_ops be_ethtool_ops;
 
 #define drvr_stats(adapter)             (&adapter->stats.drvr_stats)
diff --git a/drivers/net/benet/be_cmds.c b/drivers/net/benet/be_cmds.c
index fee6eee7ae5b..006cb2efcd22 100644
--- a/drivers/net/benet/be_cmds.c
+++ b/drivers/net/benet/be_cmds.c
@@ -296,6 +296,7 @@ static void be_cmd_hdr_prepare(struct be_cmd_req_hdr *req_hdr,
         req_hdr->opcode = opcode;
         req_hdr->subsystem = subsystem;
         req_hdr->request_length = cpu_to_le32(cmd_len - sizeof(*req_hdr));
+        req_hdr->version = 0;
 }
 
 static void be_cmd_page_addrs_prepare(struct phys_addr *pages, u32 max_pages,
diff --git a/drivers/net/benet/be_cmds.h b/drivers/net/benet/be_cmds.h
index c002b8391b4d..13b33c841083 100644
--- a/drivers/net/benet/be_cmds.h
+++ b/drivers/net/benet/be_cmds.h
@@ -164,7 +164,8 @@ struct be_cmd_req_hdr {
         u8 domain;              /* dword 0 */
         u32 timeout;            /* dword 1 */
         u32 request_length;     /* dword 2 */
-        u32 rsvd;               /* dword 3 */
+        u8 version;             /* dword 3 */
+        u8 rsvd[3];             /* dword 3 */
 };
 
 #define RESP_HDR_INFO_OPCODE_SHIFT      0       /* bits 0 - 7 */
diff --git a/drivers/net/benet/be_main.c b/drivers/net/benet/be_main.c
index 33ab8c7f14fe..626b76c0ebc7 100644
--- a/drivers/net/benet/be_main.c
+++ b/drivers/net/benet/be_main.c
@@ -1350,7 +1350,7 @@ static irqreturn_t be_intx(int irq, void *dev)
         int isr;
 
         isr = ioread32(adapter->csr + CEV_ISR0_OFFSET +
-                        be_pci_func(adapter) * CEV_ISR_SIZE);
+                (adapter->tx_eq.q.id/ 8) * CEV_ISR_SIZE);
         if (!isr)
                 return IRQ_NONE;
 
@@ -2051,6 +2051,7 @@ static void be_unmap_pci_bars(struct be_adapter *adapter)
 static int be_map_pci_bars(struct be_adapter *adapter)
 {
         u8 __iomem *addr;
+        int pcicfg_reg;
 
         addr = ioremap_nocache(pci_resource_start(adapter->pdev, 2),
                         pci_resource_len(adapter->pdev, 2));
@@ -2064,8 +2065,13 @@ static int be_map_pci_bars(struct be_adapter *adapter)
                 goto pci_map_err;
         adapter->db = addr;
 
-        addr = ioremap_nocache(pci_resource_start(adapter->pdev, 1),
-                        pci_resource_len(adapter->pdev, 1));
+        if (adapter->generation == BE_GEN2)
+                pcicfg_reg = 1;
+        else
+                pcicfg_reg = 0;
+
+        addr = ioremap_nocache(pci_resource_start(adapter->pdev, pcicfg_reg),
+                        pci_resource_len(adapter->pdev, pcicfg_reg));
         if (addr == NULL)
                 goto pci_map_err;
         adapter->pcicfg = addr;
@@ -2162,6 +2168,7 @@ static int be_stats_init(struct be_adapter *adapter)
         cmd->va = pci_alloc_consistent(adapter->pdev, cmd->size, &cmd->dma);
         if (cmd->va == NULL)
                 return -1;
+        memset(cmd->va, 0, cmd->size);
         return 0;
 }
 
@@ -2240,6 +2247,20 @@ static int __devinit be_probe(struct pci_dev *pdev,
                 goto rel_reg;
         }
         adapter = netdev_priv(netdev);
+
+        switch (pdev->device) {
+        case BE_DEVICE_ID1:
+        case OC_DEVICE_ID1:
+                adapter->generation = BE_GEN2;
+                break;
+        case BE_DEVICE_ID2:
+        case OC_DEVICE_ID2:
+                adapter->generation = BE_GEN3;
+                break;
+        default:
+                adapter->generation = 0;
+        }
+
         adapter->pdev = pdev;
         pci_set_drvdata(pdev, adapter);
         adapter->netdev = netdev;
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 3f0071cfe56b..efa0e41bf3ec 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -3639,7 +3639,7 @@ static int bond_open(struct net_device *bond_dev)
                  */
                 if (bond_alb_initialize(bond, (bond->params.mode == BOND_MODE_ALB))) {
                         /* something went wrong - fail the open operation */
-                        return -1;
+                        return -ENOMEM;
                 }
 
                 INIT_DELAYED_WORK(&bond->alb_work, bond_alb_monitor);
diff --git a/drivers/net/cxgb3/sge.c b/drivers/net/cxgb3/sge.c
index bdbd14727e4b..318a018ca7c5 100644
--- a/drivers/net/cxgb3/sge.c
+++ b/drivers/net/cxgb3/sge.c
@@ -2079,6 +2079,7 @@ static void lro_add_page(struct adapter *adap, struct sge_qset *qs,
                          struct sge_fl *fl, int len, int complete)
 {
         struct rx_sw_desc *sd = &fl->sdesc[fl->cidx];
+        struct port_info *pi = netdev_priv(qs->netdev);
         struct sk_buff *skb = NULL;
         struct cpl_rx_pkt *cpl;
         struct skb_frag_struct *rx_frag;
@@ -2116,11 +2117,18 @@ static void lro_add_page(struct adapter *adap, struct sge_qset *qs,
 
         if (!nr_frags) {
                 offset = 2 + sizeof(struct cpl_rx_pkt);
-                qs->lro_va = sd->pg_chunk.va + 2;
-        }
-        len -= offset;
+                cpl = qs->lro_va = sd->pg_chunk.va + 2;
 
-        prefetch(qs->lro_va);
+                if ((pi->rx_offload & T3_RX_CSUM) &&
+                     cpl->csum_valid && cpl->csum == htons(0xffff)) {
+                        skb->ip_summed = CHECKSUM_UNNECESSARY;
+                        qs->port_stats[SGE_PSTAT_RX_CSUM_GOOD]++;
+                } else
+                        skb->ip_summed = CHECKSUM_NONE;
+        } else
+                cpl = qs->lro_va;
+
+        len -= offset;
 
         rx_frag += nr_frags;
         rx_frag->page = sd->pg_chunk.page;
@@ -2136,12 +2144,8 @@ static void lro_add_page(struct adapter *adap, struct sge_qset *qs,
                 return;
 
         skb_record_rx_queue(skb, qs - &adap->sge.qs[0]);
-        skb->ip_summed = CHECKSUM_UNNECESSARY;
-        cpl = qs->lro_va;
 
         if (unlikely(cpl->vlan_valid)) {
-                struct net_device *dev = qs->netdev;
-                struct port_info *pi = netdev_priv(dev);
                 struct vlan_group *grp = pi->vlan_grp;
 
                 if (likely(grp != NULL)) {
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index d29bb532eccf..765543663a4f 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -4006,11 +4006,21 @@ check_page:
                         }
                 }
 
-                if (!buffer_info->dma)
+                if (!buffer_info->dma) {
                         buffer_info->dma = pci_map_page(pdev,
                                                         buffer_info->page, 0,
                                                         buffer_info->length,
                                                         PCI_DMA_FROMDEVICE);
+                        if (pci_dma_mapping_error(pdev, buffer_info->dma)) {
+                                put_page(buffer_info->page);
+                                dev_kfree_skb(skb);
+                                buffer_info->page = NULL;
+                                buffer_info->skb = NULL;
+                                buffer_info->dma = 0;
+                                adapter->alloc_rx_buff_failed++;
+                                break; /* while !buffer_info->skb */
+                        }
+                }
 
                 rx_desc = E1000_RX_DESC(*rx_ring, i);
                 rx_desc->buffer_addr = cpu_to_le64(buffer_info->dma);
@@ -4101,6 +4111,13 @@ map_skb:
                                                   skb->data,
                                                   buffer_info->length,
                                                   PCI_DMA_FROMDEVICE);
+                if (pci_dma_mapping_error(pdev, buffer_info->dma)) {
+                        dev_kfree_skb(skb);
+                        buffer_info->skb = NULL;
+                        buffer_info->dma = 0;
+                        adapter->alloc_rx_buff_failed++;
+                        break; /* while !buffer_info->skb */
+                }
 
                 /*
                  * XXX if it was allocated cleanly it will never map to a
diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
index 997124d2992a..c881347cb26d 100644
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -421,6 +421,8 @@ static void igb_assign_vector(struct igb_q_vector *q_vector, int msix_vector)
                         msixbm = E1000_EICR_RX_QUEUE0 << rx_queue;
                 if (tx_queue > IGB_N0_QUEUE)
                         msixbm |= E1000_EICR_TX_QUEUE0 << tx_queue;
+                if (!adapter->msix_entries && msix_vector == 0)
+                        msixbm |= E1000_EIMS_OTHER;
                 array_wr32(E1000_MSIXBM(0), msix_vector, msixbm);
                 q_vector->eims_value = msixbm;
                 break;
@@ -877,7 +879,6 @@ static int igb_request_irq(struct igb_adapter *adapter)
 {
         struct net_device *netdev = adapter->netdev;
         struct pci_dev *pdev = adapter->pdev;
-        struct e1000_hw *hw = &adapter->hw;
         int err = 0;
 
         if (adapter->msix_entries) {
@@ -909,20 +910,7 @@ static int igb_request_irq(struct igb_adapter *adapter)
                 igb_setup_all_tx_resources(adapter);
                 igb_setup_all_rx_resources(adapter);
         } else {
-                switch (hw->mac.type) {
-                case e1000_82575:
-                        wr32(E1000_MSIXBM(0),
-                             (E1000_EICR_RX_QUEUE0 |
-                              E1000_EICR_TX_QUEUE0 |
-                              E1000_EIMS_OTHER));
-                        break;
-                case e1000_82580:
-                case e1000_82576:
-                        wr32(E1000_IVAR0, E1000_IVAR_VALID);
-                        break;
-                default:
-                        break;
-                }
+                igb_assign_vector(adapter->q_vector[0], 0);
         }
 
         if (adapter->flags & IGB_FLAG_HAS_MSI) {
@@ -1140,6 +1128,8 @@ int igb_up(struct igb_adapter *adapter)
         }
         if (adapter->msix_entries)
                 igb_configure_msix(adapter);
+        else
+                igb_assign_vector(adapter->q_vector[0], 0);
 
         /* Clear any pending interrupts. */
         rd32(E1000_ICR);
diff --git a/drivers/net/igbvf/netdev.c b/drivers/net/igbvf/netdev.c
index 297a5ddd77f0..2aa71a766c35 100644
--- a/drivers/net/igbvf/netdev.c
+++ b/drivers/net/igbvf/netdev.c
@@ -2117,6 +2117,7 @@ static inline int igbvf_tx_map_adv(struct igbvf_adapter *adapter,
         /* set time_stamp *before* dma to help avoid a possible race */
         buffer_info->time_stamp = jiffies;
         buffer_info->next_to_watch = i;
+        buffer_info->mapped_as_page = false;
         buffer_info->dma = pci_map_single(pdev, skb->data, len,
                                           PCI_DMA_TODEVICE);
         if (pci_dma_mapping_error(pdev, buffer_info->dma))
diff --git a/drivers/net/ixgbe/ixgbe_82598.c b/drivers/net/ixgbe/ixgbe_82598.c
index 3103f4165311..35a06b47587b 100644
--- a/drivers/net/ixgbe/ixgbe_82598.c
+++ b/drivers/net/ixgbe/ixgbe_82598.c
@@ -357,12 +357,34 @@ static s32 ixgbe_fc_enable_82598(struct ixgbe_hw *hw, s32 packetbuf_num)
         u32 fctrl_reg;
         u32 rmcs_reg;
         u32 reg;
+        u32 link_speed = 0;
+        bool link_up;
 
 #ifdef CONFIG_DCB
         if (hw->fc.requested_mode == ixgbe_fc_pfc)
                 goto out;
 
 #endif /* CONFIG_DCB */
+        /*
+         * On 82598 having Rx FC on causes resets while doing 1G
+         * so if it's on turn it off once we know link_speed. For
+         * more details see 82598 Specification update.
+         */
+        hw->mac.ops.check_link(hw, &link_speed, &link_up, false);
+        if (link_up && link_speed == IXGBE_LINK_SPEED_1GB_FULL) {
+                switch (hw->fc.requested_mode) {
+                case ixgbe_fc_full:
+                        hw->fc.requested_mode = ixgbe_fc_tx_pause;
+                        break;
+                case ixgbe_fc_rx_pause:
+                        hw->fc.requested_mode = ixgbe_fc_none;
+                        break;
+                default:
+                        /* no change */
+                        break;
+                }
+        }
+
         /* Negotiate the fc mode to use */
         ret_val = ixgbe_fc_autoneg(hw);
         if (ret_val)
diff --git a/drivers/net/ixgbe/ixgbe_dcb_nl.c b/drivers/net/ixgbe/ixgbe_dcb_nl.c
index 56f37f66b696..dd4883f642be 100644
--- a/drivers/net/ixgbe/ixgbe_dcb_nl.c
+++ b/drivers/net/ixgbe/ixgbe_dcb_nl.c
@@ -223,7 +223,7 @@ static void ixgbe_dcbnl_set_pg_bwg_cfg_tx(struct net_device *netdev, int bwg_id,
 
         if (adapter->temp_dcb_cfg.bw_percentage[0][bwg_id] !=
             adapter->dcb_cfg.bw_percentage[0][bwg_id]) {
-                adapter->dcb_set_bitmap |= BIT_PG_RX;
+                adapter->dcb_set_bitmap |= BIT_PG_TX;
                 adapter->dcb_set_bitmap |= BIT_RESETLINK;
         }
 }
@@ -341,6 +341,12 @@ static u8 ixgbe_dcbnl_set_all(struct net_device *netdev)
         if (!adapter->dcb_set_bitmap)
                 return DCB_NO_HW_CHG;
 
+        ret = ixgbe_copy_dcb_cfg(&adapter->temp_dcb_cfg, &adapter->dcb_cfg,
+                                 adapter->ring_feature[RING_F_DCB].indices);
+
+        if (ret)
+                return DCB_NO_HW_CHG;
+
         /*
          * Only take down the adapter if the configuration change
          * requires a reset.
@@ -359,14 +365,6 @@ static u8 ixgbe_dcbnl_set_all(struct net_device *netdev)
                 }
         }
 
-        ret = ixgbe_copy_dcb_cfg(&adapter->temp_dcb_cfg, &adapter->dcb_cfg,
-                                 adapter->ring_feature[RING_F_DCB].indices);
-        if (ret) {
-                if (adapter->dcb_set_bitmap & BIT_RESETLINK)
-                        clear_bit(__IXGBE_RESETTING, &adapter->state);
-                return DCB_NO_HW_CHG;
-        }
-
         if (adapter->dcb_cfg.pfc_mode_enable) {
                 if ((adapter->hw.mac.type != ixgbe_mac_82598EB) &&
                         (adapter->hw.fc.current_mode != ixgbe_fc_pfc))
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index b5f64ad67975..951b73cf5ca2 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -5179,7 +5179,7 @@ dma_error:
                 ixgbe_unmap_and_free_tx_resource(adapter, tx_buffer_info);
         }
 
-        return count;
+        return 0;
 }
 
 static void ixgbe_tx_queue(struct ixgbe_adapter *adapter,
@@ -5329,8 +5329,11 @@ static u16 ixgbe_select_queue(struct net_device *dev, struct sk_buff *skb)
         struct ixgbe_adapter *adapter = netdev_priv(dev);
         int txq = smp_processor_id();
 
-        if (adapter->flags & IXGBE_FLAG_FDIR_HASH_CAPABLE)
+        if (adapter->flags & IXGBE_FLAG_FDIR_HASH_CAPABLE) {
+                while (unlikely(txq >= dev->real_num_tx_queues))
+                        txq -= dev->real_num_tx_queues;
                 return txq;
+        }
 
 #ifdef IXGBE_FCOE
         if ((adapter->flags & IXGBE_FLAG_FCOE_ENABLED) &&
@@ -5760,6 +5763,10 @@ static int __devinit ixgbe_probe(struct pci_dev *pdev,
         if (err)
                 goto err_sw_init;
 
+        /* Make it possible the adapter to be woken up via WOL */
+        if (adapter->hw.mac.type == ixgbe_mac_82599EB)
+                IXGBE_WRITE_REG(&adapter->hw, IXGBE_WUS, ~0);
+
         /*
          * If there is a fan on this device and it has failed log the
          * failure.
diff --git a/drivers/net/ks8851_mll.c b/drivers/net/ks8851_mll.c
index c146304d8d6c..c0ceebccaa49 100644
--- a/drivers/net/ks8851_mll.c
+++ b/drivers/net/ks8851_mll.c
@@ -854,8 +854,8 @@ static void ks_update_link_status(struct net_device *netdev, struct ks_net *ks)
 
 static irqreturn_t ks_irq(int irq, void *pw)
 {
-        struct ks_net *ks = pw;
-        struct net_device *netdev = ks->netdev;
+        struct net_device *netdev = pw;
+        struct ks_net *ks = netdev_priv(netdev);
         u16 status;
 
         /*this should be the first in IRQ handler */
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 9f9d6081959b..24279e6e55f5 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -1941,7 +1941,7 @@ static void netxen_tx_timeout_task(struct work_struct *work)
                 netif_wake_queue(adapter->netdev);
 
                 clear_bit(__NX_RESETTING, &adapter->state);
-
+                return;
         } else {
                 clear_bit(__NX_RESETTING, &adapter->state);
                 if (!netxen_nic_reset_context(adapter)) {
@@ -2240,7 +2240,9 @@ netxen_detach_work(struct work_struct *work)
 
         netxen_nic_down(adapter, netdev);
 
+        rtnl_lock();
         netxen_nic_detach(adapter);
+        rtnl_unlock();
 
         status = NXRD32(adapter, NETXEN_PEG_HALT_STATUS1);
 
diff --git a/drivers/net/sfc/efx.c b/drivers/net/sfc/efx.c
index 103e8b0e2a0d..46997e177ee3 100644
--- a/drivers/net/sfc/efx.c
+++ b/drivers/net/sfc/efx.c
@@ -2284,6 +2284,7 @@ static int __devinit efx_pci_probe(struct pci_dev *pci_dev,
  fail2:
         efx_fini_struct(efx);
  fail1:
+        WARN_ON(rc > 0);
         EFX_LOG(efx, "initialisation failed. rc=%d\n", rc);
         free_netdev(net_dev);
         return rc;
diff --git a/drivers/net/sfc/falcon_boards.c b/drivers/net/sfc/falcon_boards.c
index bf0b96af5334..5712fddd72f2 100644
--- a/drivers/net/sfc/falcon_boards.c
+++ b/drivers/net/sfc/falcon_boards.c
@@ -29,6 +29,15 @@
 #define FALCON_BOARD_SFN4111T 0x51
 #define FALCON_BOARD_SFN4112F 0x52
 
+/* Board temperature is about 15°C above ambient when air flow is
+ * limited. */
+#define FALCON_BOARD_TEMP_BIAS  15
+
+/* SFC4000 datasheet says: 'The maximum permitted junction temperature
+ * is 125°C; the thermal design of the environment for the SFC4000
+ * should aim to keep this well below 100°C.' */
+#define FALCON_JUNC_TEMP_MAX    90
+
 /*****************************************************************************
  * Support for LM87 sensor chip used on several boards
  */
@@ -548,16 +557,16 @@ fail_hwmon:
 static u8 sfe4002_lm87_channel = 0x03; /* use AIN not FAN inputs */
 
 static const u8 sfe4002_lm87_regs[] = {
-        LM87_IN_LIMITS(0, 0x83, 0x91),          /* 2.5V:  1.8V +/- 5% */
-        LM87_IN_LIMITS(1, 0x51, 0x5a),          /* Vccp1: 1.2V +/- 5% */
-        LM87_IN_LIMITS(2, 0xb6, 0xca),          /* 3.3V:  3.3V +/- 5% */
-        LM87_IN_LIMITS(3, 0xb0, 0xc9),          /* 5V:    4.6-5.2V */
-        LM87_IN_LIMITS(4, 0xb0, 0xe0),          /* 12V:   11-14V */
-        LM87_IN_LIMITS(5, 0x44, 0x4b),          /* Vccp2: 1.0V +/- 5% */
-        LM87_AIN_LIMITS(0, 0xa0, 0xb2),         /* AIN1:  1.66V +/- 5% */
-        LM87_AIN_LIMITS(1, 0x91, 0xa1),         /* AIN2:  1.5V +/- 5% */
-        LM87_TEMP_INT_LIMITS(10, 60),           /* board */
-        LM87_TEMP_EXT1_LIMITS(10, 70),          /* Falcon */
+        LM87_IN_LIMITS(0, 0x7c, 0x99),          /* 2.5V:  1.8V +/- 10% */
+        LM87_IN_LIMITS(1, 0x4c, 0x5e),          /* Vccp1: 1.2V +/- 10% */
+        LM87_IN_LIMITS(2, 0xac, 0xd4),          /* 3.3V:  3.3V +/- 10% */
+        LM87_IN_LIMITS(3, 0xac, 0xd4),          /* 5V:    5.0V +/- 10% */
+        LM87_IN_LIMITS(4, 0xac, 0xe0),          /* 12V:   10.8-14V */
+        LM87_IN_LIMITS(5, 0x3f, 0x4f),          /* Vccp2: 1.0V +/- 10% */
+        LM87_AIN_LIMITS(0, 0x98, 0xbb),         /* AIN1:  1.66V +/- 10% */
+        LM87_AIN_LIMITS(1, 0x8a, 0xa9),         /* AIN2:  1.5V +/- 10% */
+        LM87_TEMP_INT_LIMITS(0, 80 + FALCON_BOARD_TEMP_BIAS),
+        LM87_TEMP_EXT1_LIMITS(0, FALCON_JUNC_TEMP_MAX),
         0
 };
 
@@ -619,14 +628,14 @@ static int sfe4002_init(struct efx_nic *efx)
 static u8 sfn4112f_lm87_channel = 0x03; /* use AIN not FAN inputs */
 
 static const u8 sfn4112f_lm87_regs[] = {
-        LM87_IN_LIMITS(0, 0x83, 0x91),          /* 2.5V:  1.8V +/- 5% */
-        LM87_IN_LIMITS(1, 0x51, 0x5a),          /* Vccp1: 1.2V +/- 5% */
-        LM87_IN_LIMITS(2, 0xb6, 0xca),          /* 3.3V:  3.3V +/- 5% */
-        LM87_IN_LIMITS(4, 0xb0, 0xe0),          /* 12V:   11-14V */
-        LM87_IN_LIMITS(5, 0x44, 0x4b),          /* Vccp2: 1.0V +/- 5% */
-        LM87_AIN_LIMITS(1, 0x91, 0xa1),         /* AIN2:  1.5V +/- 5% */
-        LM87_TEMP_INT_LIMITS(10, 60),           /* board */
-        LM87_TEMP_EXT1_LIMITS(10, 70),          /* Falcon */
+        LM87_IN_LIMITS(0, 0x7c, 0x99),          /* 2.5V:  1.8V +/- 10% */
+        LM87_IN_LIMITS(1, 0x4c, 0x5e),          /* Vccp1: 1.2V +/- 10% */
+        LM87_IN_LIMITS(2, 0xac, 0xd4),          /* 3.3V:  3.3V +/- 10% */
+        LM87_IN_LIMITS(4, 0xac, 0xe0),          /* 12V:   10.8-14V */
+        LM87_IN_LIMITS(5, 0x3f, 0x4f),          /* Vccp2: 1.0V +/- 10% */
+        LM87_AIN_LIMITS(1, 0x8a, 0xa9),         /* AIN2:  1.5V +/- 10% */
+        LM87_TEMP_INT_LIMITS(0, 60 + FALCON_BOARD_TEMP_BIAS),
+        LM87_TEMP_EXT1_LIMITS(0, FALCON_JUNC_TEMP_MAX),
         0
 };
 
diff --git a/drivers/net/sfc/mcdi.c b/drivers/net/sfc/mcdi.c
index 9f035b9f0350..f66b3da6ddff 100644
--- a/drivers/net/sfc/mcdi.c
+++ b/drivers/net/sfc/mcdi.c
@@ -127,7 +127,7 @@ static int efx_mcdi_poll(struct efx_nic *efx)
         efx_dword_t reg;
 
         /* Check for a reboot atomically with respect to efx_mcdi_copyout() */
-        rc = efx_mcdi_poll_reboot(efx);
+        rc = -efx_mcdi_poll_reboot(efx);
         if (rc)
                 goto out;
 
diff --git a/drivers/net/sfc/qt202x_phy.c b/drivers/net/sfc/qt202x_phy.c
index e0d13a451019..67eec7a6e487 100644
--- a/drivers/net/sfc/qt202x_phy.c
+++ b/drivers/net/sfc/qt202x_phy.c
@@ -320,7 +320,7 @@ static int qt202x_reset_phy(struct efx_nic *efx)
 
         falcon_board(efx)->type->init_phy(efx);
 
-        return rc;
+        return 0;
 
  fail:
         EFX_ERR(efx, "PHY reset timed out\n");
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index d760650c5c04..67249c3c9f50 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -1025,11 +1025,8 @@ static void sky2_prefetch_init(struct sky2_hw *hw, u32 qaddr,
 static inline struct sky2_tx_le *get_tx_le(struct sky2_port *sky2, u16 *slot)
 {
         struct sky2_tx_le *le = sky2->tx_le + *slot;
-        struct tx_ring_info *re = sky2->tx_ring + *slot;
 
         *slot = RING_NEXT(*slot, sky2->tx_ring_size);
-        re->flags = 0;
-        re->skb = NULL;
         le->ctrl = 0;
         return le;
 }
@@ -1622,8 +1619,7 @@ static unsigned tx_le_req(const struct sk_buff *skb)
         return count;
 }
 
-static void sky2_tx_unmap(struct pci_dev *pdev,
-                          const struct tx_ring_info *re)
+static void sky2_tx_unmap(struct pci_dev *pdev, struct tx_ring_info *re)
 {
         if (re->flags & TX_MAP_SINGLE)
                 pci_unmap_single(pdev, pci_unmap_addr(re, mapaddr),
@@ -1633,6 +1629,7 @@ static void sky2_tx_unmap(struct pci_dev *pdev,
                 pci_unmap_page(pdev, pci_unmap_addr(re, mapaddr),
                                pci_unmap_len(re, maplen),
                                PCI_DMA_TODEVICE);
+        re->flags = 0;
 }
 
 /*
@@ -1839,6 +1836,7 @@ static void sky2_tx_complete(struct sky2_port *sky2, u16 done)
                         dev->stats.tx_packets++;
                         dev->stats.tx_bytes += skb->len;
 
+                        re->skb = NULL;
                         dev_kfree_skb_any(skb);
 
                         sky2->tx_next = RING_NEXT(idx, sky2->tx_ring_size);
diff --git a/drivers/net/starfire.c b/drivers/net/starfire.c
index 95db60adde41..f9521136a869 100644
--- a/drivers/net/starfire.c
+++ b/drivers/net/starfire.c
@@ -1063,7 +1063,7 @@ static int netdev_open(struct net_device *dev)
         if (retval) {
                 printk(KERN_ERR "starfire: Failed to load firmware \"%s\"\n",
                        FIRMWARE_RX);
-                return retval;
+                goto out_init;
         }
         if (fw_rx->size % 4) {
                 printk(KERN_ERR "starfire: bogus length %zu in \"%s\"\n",
@@ -1108,6 +1108,9 @@ out_tx:
         release_firmware(fw_tx);
 out_rx:
         release_firmware(fw_rx);
+out_init:
+        if (retval)
+                netdev_close(dev);
         return retval;
 }
 
diff --git a/drivers/net/tc35815.c b/drivers/net/tc35815.c
index 75a669d48e5e..d71c1976072e 100644
--- a/drivers/net/tc35815.c
+++ b/drivers/net/tc35815.c
@@ -1437,7 +1437,6 @@ static int tc35815_do_interrupt(struct net_device *dev, u32 status, int limit)
                 /* Transmit complete. */
                 lp->lstats.tx_ints++;
                 tc35815_txdone(dev);
-                netif_wake_queue(dev);
                 if (ret < 0)
                         ret = 0;
         }
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 21e183a83b99..5f3b9eaeb04f 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -419,7 +419,7 @@ static int cdc_manage_power(struct usbnet *dev, int on)
 
 static const struct driver_info cdc_info = {
         .description =  "CDC Ethernet Device",
-        .flags =        FLAG_ETHER | FLAG_LINK_INTR,
+        .flags =        FLAG_ETHER,
         // .check_connect = cdc_check_connect,
         .bind =         cdc_bind,
         .unbind =       usbnet_cdc_unbind,
@@ -584,6 +584,11 @@ static const struct usb_device_id	products [] = {
                         USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
         .driver_info = (unsigned long) &mbm_info,
 }, {
+        /* Ericsson C3607w ver 2 */
+        USB_DEVICE_AND_INTERFACE_INFO(0x0bdb, 0x190b, USB_CLASS_COMM,
+                        USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long) &mbm_info,
+}, {
         /* Toshiba F3507g */
         USB_DEVICE_AND_INTERFACE_INFO(0x0930, 0x130b, USB_CLASS_COMM,
                         USB_CDC_SUBCLASS_MDLM, USB_CDC_PROTO_NONE),
diff --git a/drivers/net/via-velocity.c b/drivers/net/via-velocity.c
index c93f58f5c6f2..317aa34b21cf 100644
--- a/drivers/net/via-velocity.c
+++ b/drivers/net/via-velocity.c
@@ -1877,13 +1877,12 @@ static void velocity_error(struct velocity_info *vptr, int status)
 /**
  *      tx_srv          -       transmit interrupt service
  *      @vptr; Velocity
- *      @status:
  *
  *      Scan the queues looking for transmitted packets that
  *      we can complete and clean up. Update any statistics as
  *      necessary/
  */
-static int velocity_tx_srv(struct velocity_info *vptr, u32 status)
+static int velocity_tx_srv(struct velocity_info *vptr)
 {
         struct tx_desc *td;
         int qnum;
@@ -2090,14 +2089,12 @@ static int velocity_receive_frame(struct velocity_info *vptr, int idx)
 /**
  *      velocity_rx_srv         -       service RX interrupt
  *      @vptr: velocity
- *      @status: adapter status (unused)
  *
  *      Walk the receive ring of the velocity adapter and remove
  *      any received packets from the receive queue. Hand the ring
  *      slots back to the adapter for reuse.
  */
-static int velocity_rx_srv(struct velocity_info *vptr, int status,
-                int budget_left)
+static int velocity_rx_srv(struct velocity_info *vptr, int budget_left)
 {
         struct net_device_stats *stats = &vptr->dev->stats;
         int rd_curr = vptr->rx.curr;
@@ -2151,32 +2148,24 @@ static int velocity_poll(struct napi_struct *napi, int budget)
         struct velocity_info *vptr = container_of(napi,
                         struct velocity_info, napi);
         unsigned int rx_done;
-        u32 isr_status;
-
-        spin_lock(&vptr->lock);
-        isr_status = mac_read_isr(vptr->mac_regs);
-
-        /* Ack the interrupt */
-        mac_write_isr(vptr->mac_regs, isr_status);
-        if (isr_status & (~(ISR_PRXI | ISR_PPRXI | ISR_PTXI | ISR_PPTXI)))
-                velocity_error(vptr, isr_status);
+        unsigned long flags;
 
+        spin_lock_irqsave(&vptr->lock, flags);
         /*
          * Do rx and tx twice for performance (taken from the VIA
          * out-of-tree driver).
          */
-        rx_done = velocity_rx_srv(vptr, isr_status, budget / 2);
-        velocity_tx_srv(vptr, isr_status);
-        rx_done += velocity_rx_srv(vptr, isr_status, budget - rx_done);
-        velocity_tx_srv(vptr, isr_status);
-
-        spin_unlock(&vptr->lock);
+        rx_done = velocity_rx_srv(vptr, budget / 2);
+        velocity_tx_srv(vptr);
+        rx_done += velocity_rx_srv(vptr, budget - rx_done);
+        velocity_tx_srv(vptr);
 
         /* If budget not fully consumed, exit the polling mode */
         if (rx_done < budget) {
                 napi_complete(napi);
                 mac_enable_int(vptr->mac_regs);
         }
+        spin_unlock_irqrestore(&vptr->lock, flags);
 
         return rx_done;
 }
@@ -2206,10 +2195,17 @@ static irqreturn_t velocity_intr(int irq, void *dev_instance)
                 return IRQ_NONE;
         }
 
+        /* Ack the interrupt */
+        mac_write_isr(vptr->mac_regs, isr_status);
+
         if (likely(napi_schedule_prep(&vptr->napi))) {
                 mac_disable_int(vptr->mac_regs);
                 __napi_schedule(&vptr->napi);
         }
+
+        if (isr_status & (~(ISR_PRXI | ISR_PPRXI | ISR_PTXI | ISR_PPTXI)))
+                velocity_error(vptr, isr_status);
+
         spin_unlock(&vptr->lock);
 
         return IRQ_HANDLED;
@@ -3100,7 +3096,7 @@ static int velocity_resume(struct pci_dev *pdev)
         velocity_init_registers(vptr, VELOCITY_INIT_WOL);
         mac_disable_int(vptr->mac_regs);
 
-        velocity_tx_srv(vptr, 0);
+        velocity_tx_srv(vptr);
 
         for (i = 0; i < vptr->tx.numq; i++) {
                 if (vptr->tx.used[i])
@@ -3344,6 +3340,7 @@ static int velocity_set_coalesce(struct net_device *dev,
 {
         struct velocity_info *vptr = netdev_priv(dev);
         int max_us = 0x3f * 64;
+        unsigned long flags;
 
         /* 6 bits of  */
         if (ecmd->tx_coalesce_usecs > max_us)
@@ -3365,6 +3362,7 @@ static int velocity_set_coalesce(struct net_device *dev,
                         ecmd->tx_coalesce_usecs);
 
         /* Setup the interrupt suppression and queue timers */
+        spin_lock_irqsave(&vptr->lock, flags);
         mac_disable_int(vptr->mac_regs);
         setup_adaptive_interrupts(vptr);
         setup_queue_timers(vptr);
@@ -3372,6 +3370,7 @@ static int velocity_set_coalesce(struct net_device *dev,
         mac_write_int_mask(vptr->int_mask, vptr->mac_regs);
         mac_clear_isr(vptr->mac_regs);
         mac_enable_int(vptr->mac_regs);
+        spin_unlock_irqrestore(&vptr->lock, flags);
 
         return 0;
 }
diff --git a/drivers/net/wireless/ath/ath9k/hw.c b/drivers/net/wireless/ath/ath9k/hw.c
index 2ec61f08cfdb..ae371448b5a0 100644
--- a/drivers/net/wireless/ath/ath9k/hw.c
+++ b/drivers/net/wireless/ath/ath9k/hw.c
@@ -855,12 +855,11 @@ static void ath9k_hw_init_mode_gain_regs(struct ath_hw *ah)
         }
 }
 
-static void ath9k_hw_init_11a_eeprom_fix(struct ath_hw *ah)
+static void ath9k_hw_init_eeprom_fix(struct ath_hw *ah)
 {
         u32 i, j;
 
-        if ((ah->hw_version.devid == AR9280_DEVID_PCI) &&
-            test_bit(ATH9K_MODE_11A, ah->caps.wireless_modes)) {
+        if (ah->hw_version.devid == AR9280_DEVID_PCI) {
 
                 /* EEPROM Fixup */
                 for (i = 0; i < ah->iniModes.ia_rows; i++) {
@@ -980,7 +979,7 @@ int ath9k_hw_init(struct ath_hw *ah)
         if (r)
                 return r;
 
-        ath9k_hw_init_11a_eeprom_fix(ah);
+        ath9k_hw_init_eeprom_fix(ah);
 
         r = ath9k_hw_init_macaddr(ah);
         if (r) {
diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
index 996eb90263cc..643bea35686f 100644
--- a/drivers/net/wireless/ath/ath9k/main.c
+++ b/drivers/net/wireless/ath/ath9k/main.c
@@ -2655,10 +2655,10 @@ static void ath9k_remove_interface(struct ieee80211_hw *hw,
             (sc->sc_ah->opmode == NL80211_IFTYPE_MESH_POINT)) {
                 ath9k_ps_wakeup(sc);
                 ath9k_hw_stoptxdma(sc->sc_ah, sc->beacon.beaconq);
-                ath_beacon_return(sc, avp);
                 ath9k_ps_restore(sc);
         }
 
+        ath_beacon_return(sc, avp);
         sc->sc_flags &= ~SC_OP_BEACONS;
 
         for (i = 0; i < ARRAY_SIZE(sc->beacon.bslot); i++) {
diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
index fa12b9060b0b..29bf33692f71 100644
--- a/drivers/net/wireless/ath/ath9k/xmit.c
+++ b/drivers/net/wireless/ath/ath9k/xmit.c
@@ -1615,7 +1615,7 @@ static int ath_tx_setup_buffer(struct ieee80211_hw *hw, struct ath_buf *bf,
                 bf->bf_frmlen -= padsize;
         }
 
-        if (conf_is_ht(&hw->conf) && !is_pae(skb))
+        if (conf_is_ht(&hw->conf))
                 bf->bf_state.bf_type |= BUF_HT;
 
         bf->bf_flags = setup_tx_flags(sc, skb, txctl->txq);
@@ -1701,7 +1701,7 @@ static void ath_tx_start_dma(struct ath_softc *sc, struct ath_buf *bf,
                         goto tx_done;
                 }
 
-                if (tx_info->flags & IEEE80211_TX_CTL_AMPDU) {
+                if ((tx_info->flags & IEEE80211_TX_CTL_AMPDU) && !is_pae(skb)) {
                         /*
                          * Try aggregation if it's a unicast data frame
                          * and the destination is HT capable.
diff --git a/drivers/net/wireless/b43/b43.h b/drivers/net/wireless/b43/b43.h
index fe3bf9491997..c484cc253892 100644
--- a/drivers/net/wireless/b43/b43.h
+++ b/drivers/net/wireless/b43/b43.h
@@ -115,6 +115,7 @@
 #define B43_MMIO_TSF_2                  0x636   /* core rev < 3 only */
 #define B43_MMIO_TSF_3                  0x638   /* core rev < 3 only */
 #define B43_MMIO_RNG                    0x65A
+#define B43_MMIO_IFSSLOT                0x684   /* Interframe slot time */
 #define B43_MMIO_IFSCTL                 0x688 /* Interframe space control */
 #define  B43_MMIO_IFSCTL_USE_EDCF       0x0004
 #define B43_MMIO_POWERUP_DELAY          0x6A8
diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
index 4c41cfe44f26..490fb45d1d05 100644
--- a/drivers/net/wireless/b43/main.c
+++ b/drivers/net/wireless/b43/main.c
@@ -628,10 +628,17 @@ static void b43_upload_card_macaddress(struct b43_wldev *dev)
 static void b43_set_slot_time(struct b43_wldev *dev, u16 slot_time)
 {
         /* slot_time is in usec. */
-        if (dev->phy.type != B43_PHYTYPE_G)
+        /* This test used to exit for all but a G PHY. */
+        if (b43_current_band(dev->wl) == IEEE80211_BAND_5GHZ)
                 return;
-        b43_write16(dev, 0x684, 510 + slot_time);
-        b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
+        b43_write16(dev, B43_MMIO_IFSSLOT, 510 + slot_time);
+        /* Shared memory location 0x0010 is the slot time and should be
+         * set to slot_time; however, this register is initially 0 and changing
+         * the value adversely affects the transmit rate for BCM4311
+         * devices. Until this behavior is unterstood, delete this step
+         *
+         * b43_shm_write16(dev, B43_SHM_SHARED, 0x0010, slot_time);
+         */
 }
 
 static void b43_short_slot_timing_enable(struct b43_wldev *dev)
diff --git a/drivers/net/wireless/iwlwifi/iwl-4965.c b/drivers/net/wireless/iwlwifi/iwl-4965.c
index 9b4b8b5c7574..31462813bac0 100644
--- a/drivers/net/wireless/iwlwifi/iwl-4965.c
+++ b/drivers/net/wireless/iwlwifi/iwl-4965.c
@@ -2008,7 +2008,7 @@ static void iwl4965_rx_reply_tx(struct iwl_priv *priv,
                         IWL_DEBUG_TX_REPLY(priv, "Retry scheduler reclaim scd_ssn "
                                            "%d index %d\n", scd_ssn , index);
                         freed = iwl_tx_queue_reclaim(priv, txq_id, index);
-                        priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
+                        iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
 
                         if (priv->mac80211_registered &&
                             (iwl_queue_space(&txq->q) > txq->q.low_mark) &&
diff --git a/drivers/net/wireless/iwlwifi/iwl-5000.c b/drivers/net/wireless/iwlwifi/iwl-5000.c
index de45f308b744..cffaae772d51 100644
--- a/drivers/net/wireless/iwlwifi/iwl-5000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-5000.c
@@ -1125,7 +1125,7 @@ static void iwl5000_rx_reply_tx(struct iwl_priv *priv,
                                         scd_ssn , index, txq_id, txq->swq_id);
 
                         freed = iwl_tx_queue_reclaim(priv, txq_id, index);
-                        priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
+                        iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
 
                         if (priv->mac80211_registered &&
                             (iwl_queue_space(&txq->q) > txq->q.low_mark) &&
@@ -1153,16 +1153,14 @@ static void iwl5000_rx_reply_tx(struct iwl_priv *priv,
                                    tx_resp->failure_frame);
 
                 freed = iwl_tx_queue_reclaim(priv, txq_id, index);
-                if (ieee80211_is_data_qos(tx_resp->frame_ctrl))
-                        priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
+                iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
 
                 if (priv->mac80211_registered &&
                     (iwl_queue_space(&txq->q) > txq->q.low_mark))
                         iwl_wake_queue(priv, txq_id);
         }
 
-        if (ieee80211_is_data_qos(tx_resp->frame_ctrl))
-                iwl_txq_check_empty(priv, sta_id, tid, txq_id);
+        iwl_txq_check_empty(priv, sta_id, tid, txq_id);
 
         if (iwl_check_bits(status, TX_ABORT_REQUIRED_MSK))
                 IWL_ERR(priv, "TODO:  Implement Tx ABORT REQUIRED!!!\n");
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.c b/drivers/net/wireless/iwlwifi/iwl-core.c
index 5461f105bd2d..f36f804804fc 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.c
+++ b/drivers/net/wireless/iwlwifi/iwl-core.c
@@ -2745,6 +2745,7 @@ int iwl_mac_config(struct ieee80211_hw *hw, u32 changed)
                         priv->staging_rxon.flags = 0;
 
                 iwl_set_rxon_channel(priv, conf->channel);
+                iwl_set_rxon_ht(priv, ht_conf);
 
                 iwl_set_flags_for_band(priv, conf->channel->band);
                 spin_unlock_irqrestore(&priv->lock, flags);
diff --git a/drivers/net/wireless/iwlwifi/iwl-core.h b/drivers/net/wireless/iwlwifi/iwl-core.h
index 27ca859e7453..b69e972671b2 100644
--- a/drivers/net/wireless/iwlwifi/iwl-core.h
+++ b/drivers/net/wireless/iwlwifi/iwl-core.h
@@ -446,6 +446,8 @@ void iwl_hw_txq_ctx_free(struct iwl_priv *priv);
 int iwl_hw_tx_queue_init(struct iwl_priv *priv,
                          struct iwl_tx_queue *txq);
 int iwl_txq_update_write_ptr(struct iwl_priv *priv, struct iwl_tx_queue *txq);
+void iwl_free_tfds_in_queue(struct iwl_priv *priv,
+                            int sta_id, int tid, int freed);
 int iwl_tx_queue_init(struct iwl_priv *priv, struct iwl_tx_queue *txq,
                       int slots_num, u32 txq_id);
 void iwl_tx_queue_free(struct iwl_priv *priv, int txq_id);
diff --git a/drivers/net/wireless/iwlwifi/iwl-rx.c b/drivers/net/wireless/iwlwifi/iwl-rx.c
index 6f36b6e79f5e..2dbce85404aa 100644
--- a/drivers/net/wireless/iwlwifi/iwl-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-rx.c
@@ -928,7 +928,10 @@ static void iwl_pass_packet_to_mac80211(struct iwl_priv *priv,
         if (ieee80211_is_mgmt(fc) ||
             ieee80211_has_protected(fc) ||
             ieee80211_has_morefrags(fc) ||
-            le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG)
+            le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG ||
+            (ieee80211_is_data_qos(fc) &&
+             *ieee80211_get_qos_ctl(hdr) &
+             IEEE80211_QOS_CONTROL_A_MSDU_PRESENT))
                 ret = skb_linearize(skb);
         else
                 ret = __pskb_pull_tail(skb, min_t(u16, IWL_LINK_HDR_MAX, len)) ?
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index cde09a890b73..90fbdb25399e 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -297,7 +297,7 @@ u8 iwl_add_station(struct iwl_priv *priv, const u8 *addr, bool is_ap, u8 flags,
 }
 EXPORT_SYMBOL(iwl_add_station);
 
-static void iwl_sta_ucode_deactivate(struct iwl_priv *priv, const char *addr)
+static void iwl_sta_ucode_deactivate(struct iwl_priv *priv, const u8 *addr)
 {
         unsigned long flags;
         u8 sta_id = iwl_find_station(priv, addr);
@@ -324,7 +324,7 @@ static void iwl_remove_sta_callback(struct iwl_priv *priv,
 {
         struct iwl_rem_sta_cmd *rm_sta =
                         (struct iwl_rem_sta_cmd *)cmd->cmd.payload;
-        const char *addr = rm_sta->addr;
+        const u8 *addr = rm_sta->addr;
 
         if (pkt->hdr.flags & IWL_CMD_FAILED_MSK) {
                 IWL_ERR(priv, "Bad return from REPLY_REMOVE_STA (0x%08X)\n",
diff --git a/drivers/net/wireless/iwlwifi/iwl-tx.c b/drivers/net/wireless/iwlwifi/iwl-tx.c
index 87ce2bd292c7..8f4071562857 100644
--- a/drivers/net/wireless/iwlwifi/iwl-tx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-tx.c
@@ -120,6 +120,20 @@ int iwl_txq_update_write_ptr(struct iwl_priv *priv, struct iwl_tx_queue *txq)
 EXPORT_SYMBOL(iwl_txq_update_write_ptr);
 
 
+void iwl_free_tfds_in_queue(struct iwl_priv *priv,
+                            int sta_id, int tid, int freed)
+{
+        if (priv->stations[sta_id].tid[tid].tfds_in_queue >= freed)
+                priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
+        else {
+                IWL_ERR(priv, "free more than tfds_in_queue (%u:%d)\n",
+                        priv->stations[sta_id].tid[tid].tfds_in_queue,
+                        freed);
+                priv->stations[sta_id].tid[tid].tfds_in_queue = 0;
+        }
+}
+EXPORT_SYMBOL(iwl_free_tfds_in_queue);
+
 /**
  * iwl_tx_queue_free - Deallocate DMA queue.
  * @txq: Transmit queue to deallocate.
@@ -1131,6 +1145,7 @@ int iwl_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index)
         struct iwl_queue *q = &txq->q;
         struct iwl_tx_info *tx_info;
         int nfreed = 0;
+        struct ieee80211_hdr *hdr;
 
         if ((index >= q->n_bd) || (iwl_queue_used(q, index) == 0)) {
                 IWL_ERR(priv, "Read index for DMA queue txq id (%d), index %d, "
@@ -1145,13 +1160,16 @@ int iwl_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index)
 
                 tx_info = &txq->txb[txq->q.read_ptr];
                 iwl_tx_status(priv, tx_info->skb[0]);
+
+                hdr = (struct ieee80211_hdr *)tx_info->skb[0]->data;
+                if (hdr && ieee80211_is_data_qos(hdr->frame_control))
+                        nfreed++;
                 tx_info->skb[0] = NULL;
 
                 if (priv->cfg->ops->lib->txq_inval_byte_cnt_tbl)
                         priv->cfg->ops->lib->txq_inval_byte_cnt_tbl(priv, txq);
 
                 priv->cfg->ops->lib->txq_free_tfd(priv, txq);
-                nfreed++;
         }
         return nfreed;
 }
@@ -1559,7 +1577,7 @@ void iwl_rx_reply_compressed_ba(struct iwl_priv *priv,
         if (txq->q.read_ptr != (ba_resp_scd_ssn & 0xff)) {
                 /* calculate mac80211 ampdu sw queue to wake */
                 int freed = iwl_tx_queue_reclaim(priv, scd_flow, index);
-                priv->stations[sta_id].tid[tid].tfds_in_queue -= freed;
+                iwl_free_tfds_in_queue(priv, sta_id, tid, freed);
 
                 if ((iwl_queue_space(&txq->q) > txq->q.low_mark) &&
                     priv->mac80211_registered &&
diff --git a/drivers/net/wireless/iwmc3200wifi/rx.c b/drivers/net/wireless/iwmc3200wifi/rx.c
index 6d6ed7485175..f727b4a83196 100644
--- a/drivers/net/wireless/iwmc3200wifi/rx.c
+++ b/drivers/net/wireless/iwmc3200wifi/rx.c
@@ -794,7 +794,7 @@ static int iwm_mlme_update_bss_table(struct iwm_priv *iwm, u8 *buf,
         }
 
         bss->bss = kzalloc(bss_len, GFP_KERNEL);
-        if (!bss) {
+        if (!bss->bss) {
                 kfree(bss);
                 IWM_ERR(iwm, "Couldn't allocate bss\n");
                 return -ENOMEM;
diff --git a/drivers/net/wireless/rtl818x/rtl8187_dev.c b/drivers/net/wireless/rtl818x/rtl8187_dev.c
index bc5726dd5fe4..7ba3052b0708 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_dev.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_dev.c
@@ -65,6 +65,7 @@ static struct usb_device_id rtl8187_table[] __devinitdata = {
         /* Sitecom */
         {USB_DEVICE(0x0df6, 0x000d), .driver_info = DEVICE_RTL8187},
         {USB_DEVICE(0x0df6, 0x0028), .driver_info = DEVICE_RTL8187B},
+        {USB_DEVICE(0x0df6, 0x0029), .driver_info = DEVICE_RTL8187B},
         /* Sphairon Access Systems GmbH */
         {USB_DEVICE(0x114B, 0x0150), .driver_info = DEVICE_RTL8187},
         /* Dick Smith Electronics */
diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c
index 8e952fdab764..cb2fd01eddae 100644
--- a/drivers/pci/hotplug/acpiphp_glue.c
+++ b/drivers/pci/hotplug/acpiphp_glue.c
@@ -720,12 +720,6 @@ static int acpiphp_bus_add(struct acpiphp_func *func)
                         -ret_val);
                 goto acpiphp_bus_add_out;
         }
-        /*
-         * try to start anyway.  We could have failed to add
-         * simply because this bus had previously been added
-         * on another add.  Don't bother with the return value
-         * we just keep going.
-         */
         ret_val = acpi_bus_start(device);
 
 acpiphp_bus_add_out:
diff --git a/drivers/pci/pcie/aer/aer_inject.c b/drivers/pci/pcie/aer/aer_inject.c
index 8c30a9544d61..223052b73563 100644
--- a/drivers/pci/pcie/aer/aer_inject.c
+++ b/drivers/pci/pcie/aer/aer_inject.c
@@ -321,7 +321,7 @@ static int aer_inject(struct aer_error_inj *einj)
         unsigned long flags;
         unsigned int devfn = PCI_DEVFN(einj->dev, einj->fn);
         int pos_cap_err, rp_pos_cap_err;
-        u32 sever, mask;
+        u32 sever, cor_mask, uncor_mask;
         int ret = 0;
 
         dev = pci_get_domain_bus_and_slot((int)einj->domain, einj->bus, devfn);
@@ -339,6 +339,9 @@ static int aer_inject(struct aer_error_inj *einj)
                 goto out_put;
         }
         pci_read_config_dword(dev, pos_cap_err + PCI_ERR_UNCOR_SEVER, &sever);
+        pci_read_config_dword(dev, pos_cap_err + PCI_ERR_COR_MASK, &cor_mask);
+        pci_read_config_dword(dev, pos_cap_err + PCI_ERR_UNCOR_MASK,
+                              &uncor_mask);
 
         rp_pos_cap_err = pci_find_ext_capability(rpdev, PCI_EXT_CAP_ID_ERR);
         if (!rp_pos_cap_err) {
@@ -374,17 +377,14 @@ static int aer_inject(struct aer_error_inj *einj)
         err->header_log2 = einj->header_log2;
         err->header_log3 = einj->header_log3;
 
-        pci_read_config_dword(dev, pos_cap_err + PCI_ERR_COR_MASK, &mask);
-        if (einj->cor_status && !(einj->cor_status & ~mask)) {
+        if (einj->cor_status && !(einj->cor_status & ~cor_mask)) {
                 ret = -EINVAL;
                 printk(KERN_WARNING "The correctable error(s) is masked "
                                 "by device\n");
                 spin_unlock_irqrestore(&inject_lock, flags);
                 goto out_put;
         }
-
-        pci_read_config_dword(dev, pos_cap_err + PCI_ERR_UNCOR_MASK, &mask);
-        if (einj->uncor_status && !(einj->uncor_status & ~mask)) {
+        if (einj->uncor_status && !(einj->uncor_status & ~uncor_mask)) {
                 ret = -EINVAL;
                 printk(KERN_WARNING "The uncorrectable error(s) is masked "
                                 "by device\n");
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index 98ffb2de22e9..446e4a94d7d3 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -681,7 +681,7 @@ static void pci_read_irq(struct pci_dev *dev)
         dev->irq = irq;
 }
 
-static void set_pcie_port_type(struct pci_dev *pdev)
+void set_pcie_port_type(struct pci_dev *pdev)
 {
         int pos;
         u16 reg16;
@@ -695,7 +695,7 @@ static void set_pcie_port_type(struct pci_dev *pdev)
         pdev->pcie_type = (reg16 & PCI_EXP_FLAGS_TYPE) >> 4;
 }
 
-static void set_pcie_hotplug_bridge(struct pci_dev *pdev)
+void set_pcie_hotplug_bridge(struct pci_dev *pdev)
 {
         int pos;
         u16 reg16;
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index c74694345b6e..d58b94030ef3 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -338,6 +338,23 @@ static void __devinit quirk_s3_64M(struct pci_dev *dev)
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_S3,      PCI_DEVICE_ID_S3_868,           quirk_s3_64M);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_S3,      PCI_DEVICE_ID_S3_968,           quirk_s3_64M);
 
+/*
+ * Some CS5536 BIOSes (for example, the Soekris NET5501 board w/ comBIOS
+ * ver. 1.33  20070103) don't set the correct ISA PCI region header info.
+ * BAR0 should be 8 bytes; instead, it may be set to something like 8k
+ * (which conflicts w/ BAR1's memory range).
+ */
+static void __devinit quirk_cs5536_vsa(struct pci_dev *dev)
+{
+        if (pci_resource_len(dev, 0) != 8) {
+                struct resource *res = &dev->resource[0];
+                res->end = res->start + 8 - 1;
+                dev_info(&dev->dev, "CS5536 ISA bridge bug detected "
+                                "(incorrect header); workaround applied.\n");
+        }
+}
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_CS5536_ISA, quirk_cs5536_vsa);
+
 static void __devinit quirk_io_region(struct pci_dev *dev, unsigned region,
         unsigned size, int nr, const char *name)
 {
diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c
index 07d14dfdf0b4..226b3e93498c 100644
--- a/drivers/platform/x86/acer-wmi.c
+++ b/drivers/platform/x86/acer-wmi.c
@@ -934,7 +934,7 @@ static int __devinit acer_backlight_init(struct device *dev)
         acer_backlight_device = bd;
 
         bd->props.power = FB_BLANK_UNBLANK;
-        bd->props.brightness = max_brightness;
+        bd->props.brightness = read_brightness(bd);
         bd->props.max_brightness = max_brightness;
         backlight_update_status(bd);
         return 0;
diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
index e67e4feb35cb..eb603f1d55ca 100644
--- a/drivers/platform/x86/thinkpad_acpi.c
+++ b/drivers/platform/x86/thinkpad_acpi.c
@@ -5771,7 +5771,7 @@ static void thermal_exit(void)
         case TPACPI_THERMAL_ACPI_TMP07:
         case TPACPI_THERMAL_ACPI_UPDT:
                 sysfs_remove_group(&tpacpi_sensors_pdev->dev.kobj,
-                                   &thermal_temp_input16_group);
+                                   &thermal_temp_input8_group);
                 break;
         case TPACPI_THERMAL_NONE:
         default:
diff --git a/drivers/power/wm97xx_battery.c b/drivers/power/wm97xx_battery.c
index fa39e759a275..6ea3cb5837c7 100644
--- a/drivers/power/wm97xx_battery.c
+++ b/drivers/power/wm97xx_battery.c
@@ -175,8 +175,14 @@ static int __devinit wm97xx_bat_probe(struct platform_device *dev)
                 dev_err(&dev->dev, "Do not pass platform_data through "
                         "wm97xx_bat_set_pdata!\n");
                 return -EINVAL;
-        } else
-                pdata = wmdata->batt_pdata;
+        }
+
+        if (!wmdata) {
+                dev_err(&dev->dev, "No platform data supplied\n");
+                return -EINVAL;
+        }
+
+        pdata = wmdata->batt_pdata;
 
         if (dev->id != -1)
                 return -EINVAL;
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 686ef270ecf7..b60a4c9f8f16 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -661,7 +661,7 @@ static int suspend_prepare(struct regulator_dev *rdev, suspend_state_t state)
 static void print_constraints(struct regulator_dev *rdev)
 {
         struct regulation_constraints *constraints = rdev->constraints;
-        char buf[80];
+        char buf[80] = "";
         int count = 0;
         int ret;
 
diff --git a/drivers/regulator/lp3971.c b/drivers/regulator/lp3971.c
index 76d08c282f9c..4f33a0f4a179 100644
--- a/drivers/regulator/lp3971.c
+++ b/drivers/regulator/lp3971.c
@@ -183,7 +183,7 @@ static int lp3971_ldo_set_voltage(struct regulator_dev *dev,
                 if (vol_map[val] >= min_vol)
                         break;
 
-        if (vol_map[val] > max_vol)
+        if (val > LDO_VOL_MAX_IDX || vol_map[val] > max_vol)
                 return -EINVAL;
 
         return lp3971_set_bits(lp3971, LP3971_LDO_VOL_CONTR_REG(ldo),
@@ -272,7 +272,7 @@ static int lp3971_dcdc_set_voltage(struct regulator_dev *dev,
                 if (vol_map[val] >= min_vol)
                         break;
 
-        if (vol_map[val] > max_vol)
+        if (val > BUCK_TARGET_VOL_MAX_IDX || vol_map[val] > max_vol)
                 return -EINVAL;
 
         ret = lp3971_set_bits(lp3971, LP3971_BUCK_TARGET_VOL1_REG(buck),
diff --git a/drivers/regulator/wm8350-regulator.c b/drivers/regulator/wm8350-regulator.c
index 1bbff099a546..e7b89e704af6 100644
--- a/drivers/regulator/wm8350-regulator.c
+++ b/drivers/regulator/wm8350-regulator.c
@@ -1504,7 +1504,8 @@ int wm8350_register_led(struct wm8350 *wm8350, int lednum, int dcdc, int isink,
         led->isink_init.consumer_supplies = &led->isink_consumer;
         led->isink_init.constraints.min_uA = 0;
         led->isink_init.constraints.max_uA = pdata->max_uA;
-        led->isink_init.constraints.valid_ops_mask = REGULATOR_CHANGE_CURRENT;
+        led->isink_init.constraints.valid_ops_mask
+                = REGULATOR_CHANGE_CURRENT | REGULATOR_CHANGE_STATUS;
         led->isink_init.constraints.valid_modes_mask = REGULATOR_MODE_NORMAL;
         ret = wm8350_register_regulator(wm8350, isink, &led->isink_init);
         if (ret != 0) {
@@ -1517,6 +1518,7 @@ int wm8350_register_led(struct wm8350 *wm8350, int lednum, int dcdc, int isink,
         led->dcdc_init.num_consumer_supplies = 1;
         led->dcdc_init.consumer_supplies = &led->dcdc_consumer;
         led->dcdc_init.constraints.valid_modes_mask = REGULATOR_MODE_NORMAL;
+        led->dcdc_init.constraints.valid_ops_mask =  REGULATOR_CHANGE_STATUS;
         ret = wm8350_register_regulator(wm8350, dcdc, &led->dcdc_init);
         if (ret != 0) {
                 platform_device_put(pdev);
diff --git a/drivers/rtc/rtc-fm3130.c b/drivers/rtc/rtc-fm3130.c
index 3a7be11cc6b9..812c66755083 100644
--- a/drivers/rtc/rtc-fm3130.c
+++ b/drivers/rtc/rtc-fm3130.c
@@ -376,20 +376,22 @@ static int __devinit fm3130_probe(struct i2c_client *client,
         }
 
         /* Disabling calibration mode */
-        if (fm3130->regs[FM3130_RTC_CONTROL] & FM3130_RTC_CONTROL_BIT_CAL)
+        if (fm3130->regs[FM3130_RTC_CONTROL] & FM3130_RTC_CONTROL_BIT_CAL) {
                 i2c_smbus_write_byte_data(client, FM3130_RTC_CONTROL,
                         fm3130->regs[FM3130_RTC_CONTROL] &
                                 ~(FM3130_RTC_CONTROL_BIT_CAL));
                 dev_warn(&client->dev, "Disabling calibration mode!\n");
+        }
 
         /* Disabling read and write modes */
         if (fm3130->regs[FM3130_RTC_CONTROL] & FM3130_RTC_CONTROL_BIT_WRITE ||
-            fm3130->regs[FM3130_RTC_CONTROL] & FM3130_RTC_CONTROL_BIT_READ)
+            fm3130->regs[FM3130_RTC_CONTROL] & FM3130_RTC_CONTROL_BIT_READ) {
                 i2c_smbus_write_byte_data(client, FM3130_RTC_CONTROL,
                         fm3130->regs[FM3130_RTC_CONTROL] &
                                 ~(FM3130_RTC_CONTROL_BIT_READ |
                                         FM3130_RTC_CONTROL_BIT_WRITE));
                 dev_warn(&client->dev, "Disabling READ or WRITE mode!\n");
+        }
 
         /* oscillator off?  turn it on, so clock can tick. */
         if (fm3130->regs[FM3130_CAL_CONTROL] & FM3130_CAL_CONTROL_BIT_nOSCEN)
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index fdb2e7c14506..5905936c7c60 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -1004,8 +1004,8 @@ static void dasd_handle_killed_request(struct ccw_device *cdev,
         if (device == NULL ||
             device != dasd_device_from_cdev_locked(cdev) ||
             strncmp(device->discipline->ebcname, (char *) &cqr->magic, 4)) {
-                DBF_DEV_EVENT(DBF_DEBUG, device, "invalid device in request: "
-                              "bus_id %s", dev_name(&cdev->dev));
+                DBF_EVENT_DEVID(DBF_DEBUG, cdev, "%s",
+                                "invalid device in request");
                 return;
         }
 
@@ -1078,8 +1078,8 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm,
         device = (struct dasd_device *) cqr->startdev;
         if (!device ||
             strncmp(device->discipline->ebcname, (char *) &cqr->magic, 4)) {
-                DBF_DEV_EVENT(DBF_DEBUG, device, "invalid device in request: "
-                              "bus_id %s", dev_name(&cdev->dev));
+                DBF_EVENT_DEVID(DBF_DEBUG, cdev, "%s",
+                                "invalid device in request");
                 return;
         }
 
diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
index 1c500c462225..1cca21aafaba 100644
--- a/drivers/s390/block/dasd_eckd.c
+++ b/drivers/s390/block/dasd_eckd.c
@@ -3033,7 +3033,7 @@ static void dasd_eckd_dump_sense_ccw(struct dasd_device *device,
         len += sprintf(page + len, KERN_ERR PRINTK_HEADER
                        " in req: %p CS: 0x%02X DS: 0x%02X CC: 0x%02X RC: %d\n",
                        req, scsw_cstat(&irb->scsw), scsw_dstat(&irb->scsw),
-                       scsw_cc(&irb->scsw), req->intrc);
+                       scsw_cc(&irb->scsw), req ? req->intrc : 0);
         len += sprintf(page + len, KERN_ERR PRINTK_HEADER
                        " device %s: Failing CCW: %p\n",
                        dev_name(&device->cdev->dev),
diff --git a/drivers/s390/block/dasd_ioctl.c b/drivers/s390/block/dasd_ioctl.c
index fc7b30b4a255..7039d9cf0fb4 100644
--- a/drivers/s390/block/dasd_ioctl.c
+++ b/drivers/s390/block/dasd_ioctl.c
@@ -260,7 +260,7 @@ static int dasd_ioctl_information(struct dasd_block *block,
         struct ccw_dev_id dev_id;
 
         base = block->base;
-        if (!base->discipline->fill_info)
+        if (!base->discipline || !base->discipline->fill_info)
                 return -EINVAL;
 
         dasd_info = kzalloc(sizeof(struct dasd_information2_t), GFP_KERNEL);
@@ -303,10 +303,7 @@ static int dasd_ioctl_information(struct dasd_block *block,
         dasd_info->features |=
                 ((base->features & DASD_FEATURE_READONLY) != 0);
 
-        if (base->discipline)
-                memcpy(dasd_info->type, base->discipline->name, 4);
-        else
-                memcpy(dasd_info->type, "none", 4);
+        memcpy(dasd_info->type, base->discipline->name, 4);
 
         if (block->request_queue->request_fn) {
                 struct list_head *l;
diff --git a/drivers/s390/block/dasd_proc.c b/drivers/s390/block/dasd_proc.c
index 6315fbd8e68b..71f95f54866f 100644
--- a/drivers/s390/block/dasd_proc.c
+++ b/drivers/s390/block/dasd_proc.c
@@ -72,7 +72,7 @@ dasd_devices_show(struct seq_file *m, void *v)
         /* Print device number. */
         seq_printf(m, "%s", dev_name(&device->cdev->dev));
         /* Print discipline string. */
-        if (device != NULL && device->discipline != NULL)
+        if (device->discipline != NULL)
                 seq_printf(m, "(%s)", device->discipline->name);
         else
                 seq_printf(m, "(none)");
@@ -92,10 +92,7 @@ dasd_devices_show(struct seq_file *m, void *v)
         substr = (device->features & DASD_FEATURE_READONLY) ? "(ro)" : " ";
         seq_printf(m, "%4s: ", substr);
         /* Print device status information. */
-        switch ((device != NULL) ? device->state : -1) {
-        case -1:
-                seq_printf(m, "unknown");
-                break;
+        switch (device->state) {
         case DASD_STATE_NEW:
                 seq_printf(m, "new");
                 break;
diff --git a/drivers/s390/char/sclp_vt220.c b/drivers/s390/char/sclp_vt220.c
index b9d2a007e93b..3796ffdb8479 100644
--- a/drivers/s390/char/sclp_vt220.c
+++ b/drivers/s390/char/sclp_vt220.c
@@ -495,6 +495,10 @@ sclp_vt220_open(struct tty_struct *tty, struct file *filp)
                 if (tty->driver_data == NULL)
                         return -ENOMEM;
                 tty->low_latency = 0;
+                if (!tty->winsize.ws_row && !tty->winsize.ws_col) {
+                        tty->winsize.ws_row = 24;
+                        tty->winsize.ws_col = 80;
+                }
         }
         return 0;
 }
diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c
index 999fe80c4051..62b654af9237 100644
--- a/drivers/s390/cio/qdio_main.c
+++ b/drivers/s390/cio/qdio_main.c
@@ -531,7 +531,7 @@ static inline int qdio_inbound_q_done(struct qdio_q *q)
         qdio_siga_sync_q(q);
         get_buf_state(q, q->first_to_check, &state, 0);
 
-        if (state == SLSB_P_INPUT_PRIMED)
+        if (state == SLSB_P_INPUT_PRIMED || state == SLSB_P_INPUT_ERROR)
                 /* more work coming */
                 return 0;
 
@@ -960,6 +960,8 @@ void qdio_int_handler(struct ccw_device *cdev, unsigned long intparm,
                         qdio_handle_activate_check(cdev, intparm, cstat,
                                                    dstat);
                 break;
+        case QDIO_IRQ_STATE_STOPPED:
+                break;
         default:
                 WARN_ON(1);
         }
diff --git a/drivers/s390/crypto/zcrypt_pcicc.c b/drivers/s390/crypto/zcrypt_pcicc.c
index a23726a0735c..142f72a2ca5a 100644
--- a/drivers/s390/crypto/zcrypt_pcicc.c
+++ b/drivers/s390/crypto/zcrypt_pcicc.c
@@ -373,6 +373,8 @@ static int convert_type86(struct zcrypt_device *zdev,
                         zdev->max_mod_size = PCICC_MAX_MOD_SIZE_OLD;
                         return -EAGAIN;
                 }
+                if (service_rc == 8 && service_rs == 72)
+                        return -EINVAL;
                 zdev->online = 0;
                 return -EAGAIN; /* repeat the request on a different device. */
         }
diff --git a/drivers/s390/crypto/zcrypt_pcixcc.c b/drivers/s390/crypto/zcrypt_pcixcc.c
index 79c120578e61..68f3e6204db8 100644
--- a/drivers/s390/crypto/zcrypt_pcixcc.c
+++ b/drivers/s390/crypto/zcrypt_pcixcc.c
@@ -470,6 +470,8 @@ static int convert_type86_ica(struct zcrypt_device *zdev,
                 }
                 if (service_rc == 12 && service_rs == 769)
                         return -EINVAL;
+                if (service_rc == 8 && service_rs == 72)
+                        return -EINVAL;
                 zdev->online = 0;
                 return -EAGAIN; /* repeat the request on a different device. */
         }
diff --git a/drivers/s390/scsi/zfcp_cfdc.c b/drivers/s390/scsi/zfcp_cfdc.c
index f932400e980a..0eb6eefd2c1a 100644
--- a/drivers/s390/scsi/zfcp_cfdc.c
+++ b/drivers/s390/scsi/zfcp_cfdc.c
@@ -12,6 +12,7 @@
 
 #include <linux/types.h>
 #include <linux/miscdevice.h>
+#include <asm/compat.h>
 #include <asm/ccwdev.h>
 #include "zfcp_def.h"
 #include "zfcp_ext.h"
@@ -163,7 +164,7 @@ static void zfcp_cfdc_req_to_sense(struct zfcp_cfdc_data *data,
 }
 
 static long zfcp_cfdc_dev_ioctl(struct file *file, unsigned int command,
-                                unsigned long buffer)
+                                unsigned long arg)
 {
         struct zfcp_cfdc_data *data;
         struct zfcp_cfdc_data __user *data_user;
@@ -175,7 +176,11 @@ static long zfcp_cfdc_dev_ioctl(struct file *file, unsigned int command,
         if (command != ZFCP_CFDC_IOC)
                 return -ENOTTY;
 
-        data_user = (void __user *) buffer;
+        if (is_compat_task())
+                data_user = compat_ptr(arg);
+        else
+                data_user = (void __user *)arg;
+
         if (!data_user)
                 return -EINVAL;
 
diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c
index 84450955ae11..7369c8911bcf 100644
--- a/drivers/s390/scsi/zfcp_dbf.c
+++ b/drivers/s390/scsi/zfcp_dbf.c
@@ -327,7 +327,7 @@ static void zfcp_dbf_hba_view_response(char **p,
                         break;
                 zfcp_dbf_out(p, "scsi_cmnd", "0x%0Lx", r->u.fcp.cmnd);
                 zfcp_dbf_out(p, "scsi_serial", "0x%016Lx", r->u.fcp.serial);
-                p += sprintf(*p, "\n");
+                *p += sprintf(*p, "\n");
                 break;
 
         case FSF_QTCB_OPEN_PORT_WITH_DID:
diff --git a/drivers/s390/scsi/zfcp_ext.h b/drivers/s390/scsi/zfcp_ext.h
index 03dec832b465..66bdb34143cb 100644
--- a/drivers/s390/scsi/zfcp_ext.h
+++ b/drivers/s390/scsi/zfcp_ext.h
@@ -108,6 +108,7 @@ extern void zfcp_fc_wka_ports_force_offline(struct zfcp_fc_wka_ports *);
 extern int zfcp_fc_gs_setup(struct zfcp_adapter *);
 extern void zfcp_fc_gs_destroy(struct zfcp_adapter *);
 extern int zfcp_fc_exec_bsg_job(struct fc_bsg_job *);
+extern int zfcp_fc_timeout_bsg_job(struct fc_bsg_job *);
 
 /* zfcp_fsf.c */
 extern int zfcp_fsf_open_port(struct zfcp_erp_action *);
@@ -129,9 +130,9 @@ extern void zfcp_fsf_req_dismiss_all(struct zfcp_adapter *);
 extern int zfcp_fsf_status_read(struct zfcp_qdio *);
 extern int zfcp_status_read_refill(struct zfcp_adapter *adapter);
 extern int zfcp_fsf_send_ct(struct zfcp_fc_wka_port *, struct zfcp_fsf_ct_els *,
-                            mempool_t *);
+                            mempool_t *, unsigned int);
 extern int zfcp_fsf_send_els(struct zfcp_adapter *, u32,
-                             struct zfcp_fsf_ct_els *);
+                             struct zfcp_fsf_ct_els *, unsigned int);
 extern int zfcp_fsf_send_fcp_command_task(struct zfcp_unit *,
                                           struct scsi_cmnd *);
 extern void zfcp_fsf_req_free(struct zfcp_fsf_req *);
diff --git a/drivers/s390/scsi/zfcp_fc.c b/drivers/s390/scsi/zfcp_fc.c
index ac5e3b7a3576..271399f62f1b 100644
--- a/drivers/s390/scsi/zfcp_fc.c
+++ b/drivers/s390/scsi/zfcp_fc.c
@@ -258,7 +258,8 @@ static int zfcp_fc_ns_gid_pn_request(struct zfcp_port *port,
         gid_pn->gid_pn_req.gid_pn.fn_wwpn = port->wwpn;
 
         ret = zfcp_fsf_send_ct(&adapter->gs->ds, &gid_pn->ct,
-                               adapter->pool.gid_pn_req);
+                               adapter->pool.gid_pn_req,
+                               ZFCP_FC_CTELS_TMO);
         if (!ret) {
                 wait_for_completion(&completion);
                 zfcp_fc_ns_gid_pn_eval(gid_pn);
@@ -421,7 +422,8 @@ static int zfcp_fc_adisc(struct zfcp_port *port)
         hton24(adisc->adisc_req.adisc_port_id,
                fc_host_port_id(adapter->scsi_host));
 
-        ret = zfcp_fsf_send_els(adapter, port->d_id, &adisc->els);
+        ret = zfcp_fsf_send_els(adapter, port->d_id, &adisc->els,
+                                ZFCP_FC_CTELS_TMO);
         if (ret)
                 kmem_cache_free(zfcp_data.adisc_cache, adisc);
 
@@ -532,7 +534,8 @@ static int zfcp_fc_send_gpn_ft(struct zfcp_fc_gpn_ft *gpn_ft,
         ct->req = &gpn_ft->sg_req;
         ct->resp = gpn_ft->sg_resp;
 
-        ret = zfcp_fsf_send_ct(&adapter->gs->ds, ct, NULL);
+        ret = zfcp_fsf_send_ct(&adapter->gs->ds, ct, NULL,
+                               ZFCP_FC_CTELS_TMO);
         if (!ret)
                 wait_for_completion(&completion);
         return ret;
@@ -668,15 +671,52 @@ static void zfcp_fc_ct_els_job_handler(void *data)
 {
         struct fc_bsg_job *job = data;
         struct zfcp_fsf_ct_els *zfcp_ct_els = job->dd_data;
-        int status = zfcp_ct_els->status;
-        int reply_status;
+        struct fc_bsg_reply *jr = job->reply;
 
-        reply_status = status ? FC_CTELS_STATUS_REJECT : FC_CTELS_STATUS_OK;
-        job->reply->reply_data.ctels_reply.status = reply_status;
-        job->reply->reply_payload_rcv_len = job->reply_payload.payload_len;
+        jr->reply_payload_rcv_len = job->reply_payload.payload_len;
+        jr->reply_data.ctels_reply.status = FC_CTELS_STATUS_OK;
+        jr->result = zfcp_ct_els->status ? -EIO : 0;
         job->job_done(job);
 }
 
+static struct zfcp_fc_wka_port *zfcp_fc_job_wka_port(struct fc_bsg_job *job)
+{
+        u32 preamble_word1;
+        u8 gs_type;
+        struct zfcp_adapter *adapter;
+
+        preamble_word1 = job->request->rqst_data.r_ct.preamble_word1;
+        gs_type = (preamble_word1 & 0xff000000) >> 24;
+
+        adapter = (struct zfcp_adapter *) job->shost->hostdata[0];
+
+        switch (gs_type) {
+        case FC_FST_ALIAS:
+                return &adapter->gs->as;
+        case FC_FST_MGMT:
+                return &adapter->gs->ms;
+        case FC_FST_TIME:
+                return &adapter->gs->ts;
+                break;
+        case FC_FST_DIR:
+                return &adapter->gs->ds;
+                break;
+        default:
+                return NULL;
+        }
+}
+
+static void zfcp_fc_ct_job_handler(void *data)
+{
+        struct fc_bsg_job *job = data;
+        struct zfcp_fc_wka_port *wka_port;
+
+        wka_port = zfcp_fc_job_wka_port(job);
+        zfcp_fc_wka_port_put(wka_port);
+
+        zfcp_fc_ct_els_job_handler(data);
+}
+
 static int zfcp_fc_exec_els_job(struct fc_bsg_job *job,
                                 struct zfcp_adapter *adapter)
 {
@@ -695,43 +735,27 @@ static int zfcp_fc_exec_els_job(struct fc_bsg_job *job,
         } else
                 d_id = ntoh24(job->request->rqst_data.h_els.port_id);
 
-        return zfcp_fsf_send_els(adapter, d_id, els);
+        els->handler = zfcp_fc_ct_els_job_handler;
+        return zfcp_fsf_send_els(adapter, d_id, els, job->req->timeout / HZ);
 }
 
 static int zfcp_fc_exec_ct_job(struct fc_bsg_job *job,
                                struct zfcp_adapter *adapter)
 {
         int ret;
-        u8 gs_type;
         struct zfcp_fsf_ct_els *ct = job->dd_data;
         struct zfcp_fc_wka_port *wka_port;
-        u32 preamble_word1;
 
-        preamble_word1 = job->request->rqst_data.r_ct.preamble_word1;
-        gs_type = (preamble_word1 & 0xff000000) >> 24;
-
-        switch (gs_type) {
-        case FC_FST_ALIAS:
-                wka_port = &adapter->gs->as;
-                break;
-        case FC_FST_MGMT:
-                wka_port = &adapter->gs->ms;
-                break;
-        case FC_FST_TIME:
-                wka_port = &adapter->gs->ts;
-                break;
-        case FC_FST_DIR:
-                wka_port = &adapter->gs->ds;
-                break;
-        default:
-                return -EINVAL; /* no such service */
-        }
+        wka_port = zfcp_fc_job_wka_port(job);
+        if (!wka_port)
+                return -EINVAL;
 
         ret = zfcp_fc_wka_port_get(wka_port);
         if (ret)
                 return ret;
 
-        ret = zfcp_fsf_send_ct(wka_port, ct, NULL);
+        ct->handler = zfcp_fc_ct_job_handler;
+        ret = zfcp_fsf_send_ct(wka_port, ct, NULL, job->req->timeout / HZ);
         if (ret)
                 zfcp_fc_wka_port_put(wka_port);
 
@@ -752,7 +776,6 @@ int zfcp_fc_exec_bsg_job(struct fc_bsg_job *job)
 
         ct_els->req = job->request_payload.sg_list;
         ct_els->resp = job->reply_payload.sg_list;
-        ct_els->handler = zfcp_fc_ct_els_job_handler;
         ct_els->handler_data = job;
 
         switch (job->request->msgcode) {
@@ -767,6 +790,12 @@ int zfcp_fc_exec_bsg_job(struct fc_bsg_job *job)
         }
 }
 
+int zfcp_fc_timeout_bsg_job(struct fc_bsg_job *job)
+{
+        /* hardware tracks timeout, reset bsg timeout to not interfere */
+        return -EAGAIN;
+}
+
 int zfcp_fc_gs_setup(struct zfcp_adapter *adapter)
 {
         struct zfcp_fc_wka_ports *wka_ports;
diff --git a/drivers/s390/scsi/zfcp_fc.h b/drivers/s390/scsi/zfcp_fc.h
index cb2a3669a384..0747b087390d 100644
--- a/drivers/s390/scsi/zfcp_fc.h
+++ b/drivers/s390/scsi/zfcp_fc.h
@@ -27,6 +27,8 @@
 #define ZFCP_FC_GPN_FT_MAX_ENT    (ZFCP_FC_GPN_FT_NUM_BUFS * \
                                         (ZFCP_FC_GPN_FT_ENT_PAGE + 1))
 
+#define ZFCP_FC_CTELS_TMO       (2 * FC_DEF_R_A_TOV / 1000)
+
 /**
  * struct zfcp_fc_gid_pn_req - container for ct header plus gid_pn request
  * @ct_hdr: FC GS common transport header
diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
index 482dcd97aa5d..e8fb4d9baa8b 100644
--- a/drivers/s390/scsi/zfcp_fsf.c
+++ b/drivers/s390/scsi/zfcp_fsf.c
@@ -1068,20 +1068,20 @@ static int zfcp_fsf_setup_ct_els_sbals(struct zfcp_fsf_req *req,
 static int zfcp_fsf_setup_ct_els(struct zfcp_fsf_req *req,
                                  struct scatterlist *sg_req,
                                  struct scatterlist *sg_resp,
-                                 int max_sbals)
+                                 int max_sbals, unsigned int timeout)
 {
         int ret;
-        unsigned int fcp_chan_timeout;
 
         ret = zfcp_fsf_setup_ct_els_sbals(req, sg_req, sg_resp, max_sbals);
         if (ret)
                 return ret;
 
         /* common settings for ct/gs and els requests */
-        fcp_chan_timeout = 2 * FC_DEF_R_A_TOV / 1000;
+        if (timeout > 255)
+                timeout = 255; /* max value accepted by hardware */
         req->qtcb->bottom.support.service_class = FSF_CLASS_3;
-        req->qtcb->bottom.support.timeout = fcp_chan_timeout;
-        zfcp_fsf_start_timer(req, (fcp_chan_timeout + 10) * HZ);
+        req->qtcb->bottom.support.timeout = timeout;
+        zfcp_fsf_start_timer(req, (timeout + 10) * HZ);
 
         return 0;
 }
@@ -1092,7 +1092,8 @@ static int zfcp_fsf_setup_ct_els(struct zfcp_fsf_req *req,
  * @pool: if non-null this mempool is used to allocate struct zfcp_fsf_req
  */
 int zfcp_fsf_send_ct(struct zfcp_fc_wka_port *wka_port,
-                     struct zfcp_fsf_ct_els *ct, mempool_t *pool)
+                     struct zfcp_fsf_ct_els *ct, mempool_t *pool,
+                     unsigned int timeout)
 {
         struct zfcp_qdio *qdio = wka_port->adapter->qdio;
         struct zfcp_fsf_req *req;
@@ -1111,7 +1112,7 @@ int zfcp_fsf_send_ct(struct zfcp_fc_wka_port *wka_port,
 
         req->status |= ZFCP_STATUS_FSFREQ_CLEANUP;
         ret = zfcp_fsf_setup_ct_els(req, ct->req, ct->resp,
-                                    FSF_MAX_SBALS_PER_REQ);
+                                    FSF_MAX_SBALS_PER_REQ, timeout);
         if (ret)
                 goto failed_send;
 
@@ -1188,7 +1189,7 @@ skip_fsfstatus:
  * @els: pointer to struct zfcp_send_els with data for the command
  */
 int zfcp_fsf_send_els(struct zfcp_adapter *adapter, u32 d_id,
-                      struct zfcp_fsf_ct_els *els)
+                      struct zfcp_fsf_ct_els *els, unsigned int timeout)
 {
         struct zfcp_fsf_req *req;
         struct zfcp_qdio *qdio = adapter->qdio;
@@ -1206,7 +1207,7 @@ int zfcp_fsf_send_els(struct zfcp_adapter *adapter, u32 d_id,
         }
 
         req->status |= ZFCP_STATUS_FSFREQ_CLEANUP;
-        ret = zfcp_fsf_setup_ct_els(req, els->req, els->resp, 2);
+        ret = zfcp_fsf_setup_ct_els(req, els->req, els->resp, 2, timeout);
 
         if (ret)
                 goto failed_send;
diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c
index 771cc536a989..8e6fc68d6bd4 100644
--- a/drivers/s390/scsi/zfcp_scsi.c
+++ b/drivers/s390/scsi/zfcp_scsi.c
@@ -652,6 +652,7 @@ struct fc_function_template zfcp_transport_functions = {
         .show_host_port_state = 1,
         .show_host_active_fc4s = 1,
         .bsg_request = zfcp_fc_exec_bsg_job,
+        .bsg_timeout = zfcp_fc_timeout_bsg_job,
         /* no functions registered for following dynamic attributes but
            directly set by LLDD */
         .show_host_port_type = 1,
diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c
index 2a889853a106..7e26ebc26661 100644
--- a/drivers/scsi/aacraid/aachba.c
+++ b/drivers/scsi/aacraid/aachba.c
@@ -293,7 +293,10 @@ int aac_get_config_status(struct aac_dev *dev, int commit_flag)
                         status = -EINVAL;
                 }
         }
-        aac_fib_complete(fibptr);
+        /* Do not set XferState to zero unless receives a response from F/W */
+        if (status >= 0)
+                aac_fib_complete(fibptr);
+
         /* Send a CT_COMMIT_CONFIG to enable discovery of devices */
         if (status >= 0) {
                 if ((aac_commit == 1) || commit_flag) {
@@ -310,13 +313,18 @@ int aac_get_config_status(struct aac_dev *dev, int commit_flag)
                                     FsaNormal,
                                     1, 1,
                                     NULL, NULL);
-                        aac_fib_complete(fibptr);
+                        /* Do not set XferState to zero unless
+                         * receives a response from F/W */
+                        if (status >= 0)
+                                aac_fib_complete(fibptr);
                 } else if (aac_commit == 0) {
                         printk(KERN_WARNING
                           "aac_get_config_status: Foreign device configurations are being ignored\n");
                 }
         }
-        aac_fib_free(fibptr);
+        /* FIB should be freed only after getting the response from the F/W */
+        if (status != -ERESTARTSYS)
+                aac_fib_free(fibptr);
         return status;
 }
 
@@ -355,7 +363,9 @@ int aac_get_containers(struct aac_dev *dev)
                 maximum_num_containers = le32_to_cpu(dresp->ContainerSwitchEntries);
                 aac_fib_complete(fibptr);
         }
-        aac_fib_free(fibptr);
+        /* FIB should be freed only after getting the response from the F/W */
+        if (status != -ERESTARTSYS)
+                aac_fib_free(fibptr);
 
         if (maximum_num_containers < MAXIMUM_NUM_CONTAINERS)
                 maximum_num_containers = MAXIMUM_NUM_CONTAINERS;
@@ -1245,8 +1255,12 @@ int aac_get_adapter_info(struct aac_dev* dev)
                          NULL);
 
         if (rcode < 0) {
-                aac_fib_complete(fibptr);
-                aac_fib_free(fibptr);
+                /* FIB should be freed only after
+                 * getting the response from the F/W */
+                if (rcode != -ERESTARTSYS) {
+                        aac_fib_complete(fibptr);
+                        aac_fib_free(fibptr);
+                }
                 return rcode;
         }
         memcpy(&dev->adapter_info, info, sizeof(*info));
@@ -1270,6 +1284,12 @@ int aac_get_adapter_info(struct aac_dev* dev)
 
                 if (rcode >= 0)
                         memcpy(&dev->supplement_adapter_info, sinfo, sizeof(*sinfo));
+                if (rcode == -ERESTARTSYS) {
+                        fibptr = aac_fib_alloc(dev);
+                        if (!fibptr)
+                                return -ENOMEM;
+                }
+
         }
 
 
@@ -1470,9 +1490,11 @@ int aac_get_adapter_info(struct aac_dev* dev)
                           (dev->scsi_host_ptr->sg_tablesize * 8) + 112;
                 }
         }
-
-        aac_fib_complete(fibptr);
-        aac_fib_free(fibptr);
+        /* FIB should be freed only after getting the response from the F/W */
+        if (rcode != -ERESTARTSYS) {
+                aac_fib_complete(fibptr);
+                aac_fib_free(fibptr);
+        }
 
         return rcode;
 }
@@ -1633,6 +1655,7 @@ static int aac_read(struct scsi_cmnd * scsicmd)
          *      Alocate and initialize a Fib
          */
         if (!(cmd_fibcontext = aac_fib_alloc(dev))) {
+                printk(KERN_WARNING "aac_read: fib allocation failed\n");
                 return -1;
         }
 
@@ -1712,9 +1735,14 @@ static int aac_write(struct scsi_cmnd * scsicmd)
          *      Allocate and initialize a Fib then setup a BlockWrite command
          */
         if (!(cmd_fibcontext = aac_fib_alloc(dev))) {
-                scsicmd->result = DID_ERROR << 16;
-                scsicmd->scsi_done(scsicmd);
-                return 0;
+                /* FIB temporarily unavailable,not catastrophic failure */
+
+                /* scsicmd->result = DID_ERROR << 16;
+                 * scsicmd->scsi_done(scsicmd);
+                 * return 0;
+                 */
+                printk(KERN_WARNING "aac_write: fib allocation failed\n");
+                return -1;
         }
 
         status = aac_adapter_write(cmd_fibcontext, scsicmd, lba, count, fua);
diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h
index 83986ed86556..619c02d9c862 100644
--- a/drivers/scsi/aacraid/aacraid.h
+++ b/drivers/scsi/aacraid/aacraid.h
@@ -12,7 +12,7 @@
  *----------------------------------------------------------------------------*/
 
 #ifndef AAC_DRIVER_BUILD
-# define AAC_DRIVER_BUILD 2461
+# define AAC_DRIVER_BUILD 24702
 # define AAC_DRIVER_BRANCH "-ms"
 #endif
 #define MAXIMUM_NUM_CONTAINERS  32
@@ -1036,6 +1036,9 @@ struct aac_dev
         u8                      printf_enabled;
         u8                      in_reset;
         u8                      msi;
+        int                     management_fib_count;
+        spinlock_t              manage_lock;
+
 };
 
 #define aac_adapter_interrupt(dev) \
diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
index 0391d759dfdb..9c0c91178538 100644
--- a/drivers/scsi/aacraid/commctrl.c
+++ b/drivers/scsi/aacraid/commctrl.c
@@ -153,7 +153,7 @@ cleanup:
                 fibptr->hw_fib_pa = hw_fib_pa;
                 fibptr->hw_fib_va = hw_fib;
         }
-        if (retval != -EINTR)
+        if (retval != -ERESTARTSYS)
                 aac_fib_free(fibptr);
         return retval;
 }
@@ -322,7 +322,7 @@ return_fib:
                 }
                 if (f.wait) {
                         if(down_interruptible(&fibctx->wait_sem) < 0) {
-                                status = -EINTR;
+                                status = -ERESTARTSYS;
                         } else {
                                 /* Lock again and retry */
                                 spin_lock_irqsave(&dev->fib_lock, flags);
@@ -593,10 +593,10 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
                                 u64 addr;
                                 void* p;
                                 if (upsg->sg[i].count >
-                                    (dev->adapter_info.options &
+                                    ((dev->adapter_info.options &
                                      AAC_OPT_NEW_COMM) ?
                                       (dev->scsi_host_ptr->max_sectors << 9) :
-                                      65536) {
+                                      65536)) {
                                         rcode = -EINVAL;
                                         goto cleanup;
                                 }
@@ -645,10 +645,10 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
                                 u64 addr;
                                 void* p;
                                 if (usg->sg[i].count >
-                                    (dev->adapter_info.options &
+                                    ((dev->adapter_info.options &
                                      AAC_OPT_NEW_COMM) ?
                                       (dev->scsi_host_ptr->max_sectors << 9) :
-                                      65536) {
+                                      65536)) {
                                         rcode = -EINVAL;
                                         goto cleanup;
                                 }
@@ -695,10 +695,10 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
                                 uintptr_t addr;
                                 void* p;
                                 if (usg->sg[i].count >
-                                    (dev->adapter_info.options &
+                                    ((dev->adapter_info.options &
                                      AAC_OPT_NEW_COMM) ?
                                       (dev->scsi_host_ptr->max_sectors << 9) :
-                                      65536) {
+                                      65536)) {
                                         rcode = -EINVAL;
                                         goto cleanup;
                                 }
@@ -734,10 +734,10 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
                                 dma_addr_t addr;
                                 void* p;
                                 if (upsg->sg[i].count >
-                                    (dev->adapter_info.options &
+                                    ((dev->adapter_info.options &
                                      AAC_OPT_NEW_COMM) ?
                                       (dev->scsi_host_ptr->max_sectors << 9) :
-                                      65536) {
+                                      65536)) {
                                         rcode = -EINVAL;
                                         goto cleanup;
                                 }
@@ -772,8 +772,8 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
                 psg->count = cpu_to_le32(sg_indx+1);
                 status = aac_fib_send(ScsiPortCommand, srbfib, actual_fibsize, FsaNormal, 1, 1, NULL, NULL);
         }
-        if (status == -EINTR) {
-                rcode = -EINTR;
+        if (status == -ERESTARTSYS) {
+                rcode = -ERESTARTSYS;
                 goto cleanup;
         }
 
@@ -810,7 +810,7 @@ cleanup:
         for(i=0; i <= sg_indx; i++){
                 kfree(sg_list[i]);
         }
-        if (rcode != -EINTR) {
+        if (rcode != -ERESTARTSYS) {
                 aac_fib_complete(srbfib);
                 aac_fib_free(srbfib);
         }
@@ -848,7 +848,7 @@ int aac_do_ioctl(struct aac_dev * dev, int cmd, void __user *arg)
          */
 
         status = aac_dev_ioctl(dev, cmd, arg);
-        if(status != -ENOTTY)
+        if (status != -ENOTTY)
                 return status;
 
         switch (cmd) {
diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c
index 666d5151d628..a7261486ccd4 100644
--- a/drivers/scsi/aacraid/comminit.c
+++ b/drivers/scsi/aacraid/comminit.c
@@ -194,7 +194,9 @@ int aac_send_shutdown(struct aac_dev * dev)
 
         if (status >= 0)
                 aac_fib_complete(fibctx);
-        aac_fib_free(fibctx);
+        /* FIB should be freed only after getting the response from the F/W */
+        if (status != -ERESTARTSYS)
+                aac_fib_free(fibctx);
         return status;
 }
 
@@ -304,6 +306,8 @@ struct aac_dev *aac_init_adapter(struct aac_dev *dev)
         /*
          *      Check the preferred comm settings, defaults from template.
          */
+        dev->management_fib_count = 0;
+        spin_lock_init(&dev->manage_lock);
         dev->max_fib_size = sizeof(struct hw_fib);
         dev->sg_tablesize = host->sg_tablesize = (dev->max_fib_size
                 - sizeof(struct aac_fibhdr)
diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c
index 956261f25181..94d2954d79ae 100644
--- a/drivers/scsi/aacraid/commsup.c
+++ b/drivers/scsi/aacraid/commsup.c
@@ -189,7 +189,14 @@ struct fib *aac_fib_alloc(struct aac_dev *dev)
 
 void aac_fib_free(struct fib *fibptr)
 {
-        unsigned long flags;
+        unsigned long flags, flagsv;
+
+        spin_lock_irqsave(&fibptr->event_lock, flagsv);
+        if (fibptr->done == 2) {
+                spin_unlock_irqrestore(&fibptr->event_lock, flagsv);
+                return;
+        }
+        spin_unlock_irqrestore(&fibptr->event_lock, flagsv);
 
         spin_lock_irqsave(&fibptr->dev->fib_lock, flags);
         if (unlikely(fibptr->flags & FIB_CONTEXT_FLAG_TIMED_OUT))
@@ -390,6 +397,8 @@ int aac_fib_send(u16 command, struct fib *fibptr, unsigned long size,
         struct hw_fib * hw_fib = fibptr->hw_fib_va;
         unsigned long flags = 0;
         unsigned long qflags;
+        unsigned long mflags = 0;
+
 
         if (!(hw_fib->header.XferState & cpu_to_le32(HostOwned)))
                 return -EBUSY;
@@ -471,9 +480,31 @@ int aac_fib_send(u16 command, struct fib *fibptr, unsigned long size,
         if (!dev->queues)
                 return -EBUSY;
 
-        if(wait)
+        if (wait) {
+
+                spin_lock_irqsave(&dev->manage_lock, mflags);
+                if (dev->management_fib_count >= AAC_NUM_MGT_FIB) {
+                        printk(KERN_INFO "No management Fibs Available:%d\n",
+                                                dev->management_fib_count);
+                        spin_unlock_irqrestore(&dev->manage_lock, mflags);
+                        return -EBUSY;
+                }
+                dev->management_fib_count++;
+                spin_unlock_irqrestore(&dev->manage_lock, mflags);
                 spin_lock_irqsave(&fibptr->event_lock, flags);
-        aac_adapter_deliver(fibptr);
+        }
+
+        if (aac_adapter_deliver(fibptr) != 0) {
+                printk(KERN_ERR "aac_fib_send: returned -EBUSY\n");
+                if (wait) {
+                        spin_unlock_irqrestore(&fibptr->event_lock, flags);
+                        spin_lock_irqsave(&dev->manage_lock, mflags);
+                        dev->management_fib_count--;
+                        spin_unlock_irqrestore(&dev->manage_lock, mflags);
+                }
+                return -EBUSY;
+        }
+
 
         /*
          *      If the caller wanted us to wait for response wait now.
@@ -516,14 +547,15 @@ int aac_fib_send(u16 command, struct fib *fibptr, unsigned long size,
                                 udelay(5);
                         }
                 } else if (down_interruptible(&fibptr->event_wait)) {
-                        fibptr->done = 2;
-                        up(&fibptr->event_wait);
+                        /* Do nothing ... satisfy
+                         * down_interruptible must_check */
                 }
+
                 spin_lock_irqsave(&fibptr->event_lock, flags);
-                if ((fibptr->done == 0) || (fibptr->done == 2)) {
+                if (fibptr->done == 0) {
                         fibptr->done = 2; /* Tell interrupt we aborted */
                         spin_unlock_irqrestore(&fibptr->event_lock, flags);
-                        return -EINTR;
+                        return -ERESTARTSYS;
                 }
                 spin_unlock_irqrestore(&fibptr->event_lock, flags);
                 BUG_ON(fibptr->done == 0);
@@ -689,6 +721,7 @@ int aac_fib_adapter_complete(struct fib *fibptr, unsigned short size)
 
 int aac_fib_complete(struct fib *fibptr)
 {
+        unsigned long flags;
         struct hw_fib * hw_fib = fibptr->hw_fib_va;
 
         /*
@@ -709,6 +742,13 @@ int aac_fib_complete(struct fib *fibptr)
          *      command is complete that we had sent to the adapter and this
          *      cdb could be reused.
          */
+        spin_lock_irqsave(&fibptr->event_lock, flags);
+        if (fibptr->done == 2) {
+                spin_unlock_irqrestore(&fibptr->event_lock, flags);
+                return 0;
+        }
+        spin_unlock_irqrestore(&fibptr->event_lock, flags);
+
         if((hw_fib->header.XferState & cpu_to_le32(SentFromHost)) &&
                 (hw_fib->header.XferState & cpu_to_le32(AdapterProcessed)))
         {
@@ -1355,7 +1395,10 @@ int aac_reset_adapter(struct aac_dev * aac, int forced)
 
                         if (status >= 0)
                                 aac_fib_complete(fibctx);
-                        aac_fib_free(fibctx);
+                        /* FIB should be freed only after getting
+                         * the response from the F/W */
+                        if (status != -ERESTARTSYS)
+                                aac_fib_free(fibctx);
                 }
         }
 
@@ -1759,6 +1802,7 @@ int aac_command_thread(void *data)
                                 struct fib *fibptr;
 
                                 if ((fibptr = aac_fib_alloc(dev))) {
+                                        int status;
                                         __le32 *info;
 
                                         aac_fib_init(fibptr);
@@ -1769,15 +1813,21 @@ int aac_command_thread(void *data)
 
                                         *info = cpu_to_le32(now.tv_sec);
 
-                                        (void)aac_fib_send(SendHostTime,
+                                        status = aac_fib_send(SendHostTime,
                                                 fibptr,
                                                 sizeof(*info),
                                                 FsaNormal,
                                                 1, 1,
                                                 NULL,
                                                 NULL);
-                                        aac_fib_complete(fibptr);
-                                        aac_fib_free(fibptr);
+                                        /* Do not set XferState to zero unless
+                                         * receives a response from F/W */
+                                        if (status >= 0)
+                                                aac_fib_complete(fibptr);
+                                        /* FIB should be freed only after
+                                         * getting the response from the F/W */
+                                        if (status != -ERESTARTSYS)
+                                                aac_fib_free(fibptr);
                                 }
                                 difference = (long)(unsigned)update_interval*HZ;
                         } else {
diff --git a/drivers/scsi/aacraid/dpcsup.c b/drivers/scsi/aacraid/dpcsup.c
index abc9ef5d1b10..9c7408fe8c7d 100644
--- a/drivers/scsi/aacraid/dpcsup.c
+++ b/drivers/scsi/aacraid/dpcsup.c
@@ -57,9 +57,9 @@ unsigned int aac_response_normal(struct aac_queue * q)
         struct hw_fib * hwfib;
         struct fib * fib;
         int consumed = 0;
-        unsigned long flags;
+        unsigned long flags, mflags;
 
-        spin_lock_irqsave(q->lock, flags);      
+        spin_lock_irqsave(q->lock, flags);
         /*
          *      Keep pulling response QEs off the response queue and waking
          *      up the waiters until there are no more QEs. We then return
@@ -125,12 +125,21 @@ unsigned int aac_response_normal(struct aac_queue * q)
                 } else {
                         unsigned long flagv;
                         spin_lock_irqsave(&fib->event_lock, flagv);
-                        if (!fib->done)
+                        if (!fib->done) {
                                 fib->done = 1;
-                        up(&fib->event_wait);
+                                up(&fib->event_wait);
+                        }
                         spin_unlock_irqrestore(&fib->event_lock, flagv);
+
+                        spin_lock_irqsave(&dev->manage_lock, mflags);
+                        dev->management_fib_count--;
+                        spin_unlock_irqrestore(&dev->manage_lock, mflags);
+
                         FIB_COUNTER_INCREMENT(aac_config.NormalRecved);
                         if (fib->done == 2) {
+                                spin_lock_irqsave(&fib->event_lock, flagv);
+                                fib->done = 0;
+                                spin_unlock_irqrestore(&fib->event_lock, flagv);
                                 aac_fib_complete(fib);
                                 aac_fib_free(fib);
                         }
@@ -232,6 +241,7 @@ unsigned int aac_command_normal(struct aac_queue *q)
 
 unsigned int aac_intr_normal(struct aac_dev * dev, u32 index)
 {
+        unsigned long mflags;
         dprintk((KERN_INFO "aac_intr_normal(%p,%x)\n", dev, index));
         if ((index & 0x00000002L)) {
                 struct hw_fib * hw_fib;
@@ -320,11 +330,25 @@ unsigned int aac_intr_normal(struct aac_dev * dev, u32 index)
                         unsigned long flagv;
                         dprintk((KERN_INFO "event_wait up\n"));
                         spin_lock_irqsave(&fib->event_lock, flagv);
-                        if (!fib->done)
+                        if (!fib->done) {
                                 fib->done = 1;
-                        up(&fib->event_wait);
+                                up(&fib->event_wait);
+                        }
                         spin_unlock_irqrestore(&fib->event_lock, flagv);
+
+                        spin_lock_irqsave(&dev->manage_lock, mflags);
+                        dev->management_fib_count--;
+                        spin_unlock_irqrestore(&dev->manage_lock, mflags);
+
                         FIB_COUNTER_INCREMENT(aac_config.NormalRecved);
+                        if (fib->done == 2) {
+                                spin_lock_irqsave(&fib->event_lock, flagv);
+                                fib->done = 0;
+                                spin_unlock_irqrestore(&fib->event_lock, flagv);
+                                aac_fib_complete(fib);
+                                aac_fib_free(fib);
+                        }
+
                 }
                 return 0;
         }
diff --git a/drivers/scsi/aic7xxx/aic79xx_core.c b/drivers/scsi/aic7xxx/aic79xx_core.c
index 4d419c155ce9..78971db5b60e 100644
--- a/drivers/scsi/aic7xxx/aic79xx_core.c
+++ b/drivers/scsi/aic7xxx/aic79xx_core.c
@@ -3171,13 +3171,16 @@ ahd_handle_nonpkt_busfree(struct ahd_softc *ahd)
                                 tinfo->curr.transport_version = 2;
                                 tinfo->goal.transport_version = 2;
                                 tinfo->goal.ppr_options = 0;
-                                /*
-                                 * Remove any SCBs in the waiting for selection
-                                 * queue that may also be for this target so
-                                 * that command ordering is preserved.
-                                 */
-                                ahd_freeze_devq(ahd, scb);
-                                ahd_qinfifo_requeue_tail(ahd, scb);
+                                if (scb != NULL) {
+                                        /*
+                                         * Remove any SCBs in the waiting
+                                         * for selection queue that may
+                                         * also be for this target so that
+                                         * command ordering is preserved.
+                                         */
+                                        ahd_freeze_devq(ahd, scb);
+                                        ahd_qinfifo_requeue_tail(ahd, scb);
+                                }
                                 printerror = 0;
                         }
                 } else if (ahd_sent_msg(ahd, AHDMSG_EXT, MSG_EXT_WDTR, FALSE)
@@ -3194,13 +3197,16 @@ ahd_handle_nonpkt_busfree(struct ahd_softc *ahd)
                                       MSG_EXT_WDTR_BUS_8_BIT,
                                       AHD_TRANS_CUR|AHD_TRANS_GOAL,
                                       /*paused*/TRUE);
-                        /*
-                         * Remove any SCBs in the waiting for selection
-                         * queue that may also be for this target so that
-                         * command ordering is preserved.
-                         */
-                        ahd_freeze_devq(ahd, scb);
-                        ahd_qinfifo_requeue_tail(ahd, scb);
+                        if (scb != NULL) {
+                                /*
+                                 * Remove any SCBs in the waiting for
+                                 * selection queue that may also be for
+                                 * this target so that command ordering
+                                 * is preserved.
+                                 */
+                                ahd_freeze_devq(ahd, scb);
+                                ahd_qinfifo_requeue_tail(ahd, scb);
+                        }
                         printerror = 0;
                 } else if (ahd_sent_msg(ahd, AHDMSG_EXT, MSG_EXT_SDTR, FALSE)
                         && ppr_busfree == 0) {
@@ -3217,13 +3223,16 @@ ahd_handle_nonpkt_busfree(struct ahd_softc *ahd)
                                         /*ppr_options*/0,
                                         AHD_TRANS_CUR|AHD_TRANS_GOAL,
                                         /*paused*/TRUE);
-                        /*
-                         * Remove any SCBs in the waiting for selection
-                         * queue that may also be for this target so that
-                         * command ordering is preserved.
-                         */
-                        ahd_freeze_devq(ahd, scb);
-                        ahd_qinfifo_requeue_tail(ahd, scb);
+                        if (scb != NULL) {
+                                /*
+                                 * Remove any SCBs in the waiting for
+                                 * selection queue that may also be for
+                                 * this target so that command ordering
+                                 * is preserved.
+                                 */
+                                ahd_freeze_devq(ahd, scb);
+                                ahd_qinfifo_requeue_tail(ahd, scb);
+                        }
                         printerror = 0;
                 } else if ((ahd->msg_flags & MSG_FLAG_EXPECT_IDE_BUSFREE) != 0
                         && ahd_sent_msg(ahd, AHDMSG_1B,
@@ -3251,7 +3260,7 @@ ahd_handle_nonpkt_busfree(struct ahd_softc *ahd)
          * the message phases.  We check it last in case we
          * had to send some other message that caused a busfree.
          */
-        if (printerror != 0
+        if (scb != NULL && printerror != 0
          && (lastphase == P_MESGIN || lastphase == P_MESGOUT)
          && ((ahd->msg_flags & MSG_FLAG_EXPECT_PPR_BUSFREE) != 0)) {
 
diff --git a/drivers/scsi/arm/fas216.c b/drivers/scsi/arm/fas216.c
index 477542602284..9e71ac611146 100644
--- a/drivers/scsi/arm/fas216.c
+++ b/drivers/scsi/arm/fas216.c
@@ -2516,7 +2516,7 @@ int fas216_eh_device_reset(struct scsi_cmnd *SCpnt)
                 if (info->scsi.phase == PHASE_IDLE)
                         fas216_kick(info);
 
-                mod_timer(&info->eh_timer, 30 * HZ);
+                mod_timer(&info->eh_timer, jiffies + 30 * HZ);
                 spin_unlock_irqrestore(&info->host_lock, flags);
 
                 /*
diff --git a/drivers/scsi/fcoe/fcoe.c b/drivers/scsi/fcoe/fcoe.c
index 10be9f36a4cc..2f47ae7cce91 100644
--- a/drivers/scsi/fcoe/fcoe.c
+++ b/drivers/scsi/fcoe/fcoe.c
@@ -2009,6 +2009,8 @@ static int fcoe_destroy(const char *buffer, struct kernel_param *kp)
         fcoe_interface_cleanup(fcoe);
         rtnl_unlock();
         fcoe_if_destroy(fcoe->ctlr.lp);
+        module_put(THIS_MODULE);
+
 out_putdev:
         dev_put(netdev);
 out_nodev:
@@ -2059,6 +2061,11 @@ static int fcoe_create(const char *buffer, struct kernel_param *kp)
         }
 #endif
 
+        if (!try_module_get(THIS_MODULE)) {
+                rc = -EINVAL;
+                goto out_nomod;
+        }
+
         rtnl_lock();
         netdev = fcoe_if_to_netdev(buffer);
         if (!netdev) {
@@ -2099,17 +2106,24 @@ static int fcoe_create(const char *buffer, struct kernel_param *kp)
         if (!fcoe_link_ok(lport))
                 fcoe_ctlr_link_up(&fcoe->ctlr);
 
-        rc = 0;
-out_free:
         /*
          * Release from init in fcoe_interface_create(), on success lport
          * should be holding a reference taken in fcoe_if_create().
          */
         fcoe_interface_put(fcoe);
+        dev_put(netdev);
+        rtnl_unlock();
+        mutex_unlock(&fcoe_config_mutex);
+
+        return 0;
+out_free:
+        fcoe_interface_put(fcoe);
 out_putdev:
         dev_put(netdev);
 out_nodev:
         rtnl_unlock();
+        module_put(THIS_MODULE);
+out_nomod:
         mutex_unlock(&fcoe_config_mutex);
         return rc;
 }
diff --git a/drivers/scsi/fcoe/libfcoe.c b/drivers/scsi/fcoe/libfcoe.c
index 9823291395ad..511cb6b371ee 100644
--- a/drivers/scsi/fcoe/libfcoe.c
+++ b/drivers/scsi/fcoe/libfcoe.c
@@ -1187,7 +1187,7 @@ static void fcoe_ctlr_timeout(unsigned long arg)
                         next_timer = fip->ctlr_ka_time;
 
                 if (time_after_eq(jiffies, fip->port_ka_time)) {
-                        fip->port_ka_time += jiffies +
+                        fip->port_ka_time = jiffies +
                                 msecs_to_jiffies(FIP_VN_KA_PERIOD);
                         fip->send_port_ka = 1;
                 }
diff --git a/drivers/scsi/libfc/fc_exch.c b/drivers/scsi/libfc/fc_exch.c
index 19d711cb938c..7f4364770e4a 100644
--- a/drivers/scsi/libfc/fc_exch.c
+++ b/drivers/scsi/libfc/fc_exch.c
@@ -1890,7 +1890,7 @@ static struct fc_seq *fc_exch_seq_send(struct fc_lport *lport,
         fc_exch_setup_hdr(ep, fp, ep->f_ctl);
         sp->cnt++;
 
-        if (ep->xid <= lport->lro_xid)
+        if (ep->xid <= lport->lro_xid && fh->fh_r_ctl == FC_RCTL_DD_UNSOL_CMD)
                 fc_fcp_ddp_setup(fr_fsp(fp), ep->xid);
 
         if (unlikely(lport->tt.frame_send(lport, fp)))
diff --git a/drivers/scsi/libfc/fc_fcp.c b/drivers/scsi/libfc/fc_fcp.c
index 881d5dfe8c74..6fde2fabfd9b 100644
--- a/drivers/scsi/libfc/fc_fcp.c
+++ b/drivers/scsi/libfc/fc_fcp.c
@@ -298,9 +298,6 @@ void fc_fcp_ddp_setup(struct fc_fcp_pkt *fsp, u16 xid)
 {
         struct fc_lport *lport;
 
-        if (!fsp)
-                return;
-
         lport = fsp->lp;
         if ((fsp->req_flags & FC_SRB_READ) &&
             (lport->lro_enabled) && (lport->tt.ddp_setup)) {
diff --git a/drivers/scsi/libfc/fc_lport.c b/drivers/scsi/libfc/fc_lport.c
index 0b165024a219..7ec8ce75007c 100644
--- a/drivers/scsi/libfc/fc_lport.c
+++ b/drivers/scsi/libfc/fc_lport.c
@@ -1800,7 +1800,8 @@ int fc_lport_bsg_request(struct fc_bsg_job *job)
         u32 did;
 
         job->reply->reply_payload_rcv_len = 0;
-        rsp->resid_len = job->reply_payload.payload_len;
+        if (rsp)
+                rsp->resid_len = job->reply_payload.payload_len;
 
         mutex_lock(&lport->lp_mutex);
 
diff --git a/drivers/scsi/libfc/fc_rport.c b/drivers/scsi/libfc/fc_rport.c
index 02300523b234..97923bb07765 100644
--- a/drivers/scsi/libfc/fc_rport.c
+++ b/drivers/scsi/libfc/fc_rport.c
@@ -623,7 +623,7 @@ static void fc_rport_plogi_resp(struct fc_seq *sp, struct fc_frame *fp,
 
                 tov = ntohl(plp->fl_csp.sp_e_d_tov);
                 if (ntohs(plp->fl_csp.sp_features) & FC_SP_FT_EDTR)
-                        tov /= 1000;
+                        tov /= 1000000;
                 if (tov > rdata->e_d_tov)
                         rdata->e_d_tov = tov;
                 csp_seq = ntohs(plp->fl_csp.sp_tot_seq);
diff --git a/drivers/scsi/libiscsi_tcp.c b/drivers/scsi/libiscsi_tcp.c
index db6856c138fc..4ad87fd74ddd 100644
--- a/drivers/scsi/libiscsi_tcp.c
+++ b/drivers/scsi/libiscsi_tcp.c
@@ -992,12 +992,10 @@ static struct iscsi_r2t_info *iscsi_tcp_get_curr_r2t(struct iscsi_task *task)
                 if (r2t == NULL) {
                         if (kfifo_out(&tcp_task->r2tqueue,
                             (void *)&tcp_task->r2t, sizeof(void *)) !=
-                            sizeof(void *)) {
-                                WARN_ONCE(1, "unexpected fifo state");
+                            sizeof(void *))
                                 r2t = NULL;
-                        }
-
-                        r2t = tcp_task->r2t;
+                        else
+                                r2t = tcp_task->r2t;
                 }
                 spin_unlock_bh(&session->lock);
         }
diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c
index 2445e399fd60..2445e399fd60 100755..100644
--- a/drivers/scsi/lpfc/lpfc_hbadisc.c
+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c
diff --git a/drivers/scsi/lpfc/lpfc_hw4.h b/drivers/scsi/lpfc/lpfc_hw4.h
index 8a2a1c5935c6..8a2a1c5935c6 100755..100644
--- a/drivers/scsi/lpfc/lpfc_hw4.h
+++ b/drivers/scsi/lpfc/lpfc_hw4.h
diff --git a/drivers/scsi/megaraid/megaraid_sas.c b/drivers/scsi/megaraid/megaraid_sas.c
index 708ea3157b60..d9b8ca5116bc 100644
--- a/drivers/scsi/megaraid/megaraid_sas.c
+++ b/drivers/scsi/megaraid/megaraid_sas.c
@@ -3781,6 +3781,7 @@ static int megasas_mgmt_compat_ioctl_fw(struct file *file, unsigned long arg)
             compat_alloc_user_space(sizeof(struct megasas_iocpacket));
         int i;
         int error = 0;
+        compat_uptr_t ptr;
 
         if (clear_user(ioc, sizeof(*ioc)))
                 return -EFAULT;
@@ -3793,9 +3794,22 @@ static int megasas_mgmt_compat_ioctl_fw(struct file *file, unsigned long arg)
             copy_in_user(&ioc->sge_count, &cioc->sge_count, sizeof(u32)))
                 return -EFAULT;
 
-        for (i = 0; i < MAX_IOCTL_SGE; i++) {
-                compat_uptr_t ptr;
+        /*
+         * The sense_ptr is used in megasas_mgmt_fw_ioctl only when
+         * sense_len is not null, so prepare the 64bit value under
+         * the same condition.
+         */
+        if (ioc->sense_len) {
+                void __user **sense_ioc_ptr =
+                        (void __user **)(ioc->frame.raw + ioc->sense_off);
+                compat_uptr_t *sense_cioc_ptr =
+                        (compat_uptr_t *)(cioc->frame.raw + cioc->sense_off);
+                if (get_user(ptr, sense_cioc_ptr) ||
+                    put_user(compat_ptr(ptr), sense_ioc_ptr))
+                        return -EFAULT;
+        }
 
+        for (i = 0; i < MAX_IOCTL_SGE; i++) {
                 if (get_user(ptr, &cioc->sgl[i].iov_base) ||
                     put_user(compat_ptr(ptr), &ioc->sgl[i].iov_base) ||
                     copy_in_user(&ioc->sgl[i].iov_len,
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index 608e675f68c8..1263d9796e89 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -1586,8 +1586,7 @@ typedef struct fc_port {
  */
 #define FCF_FABRIC_DEVICE       BIT_0
 #define FCF_LOGIN_NEEDED        BIT_1
-#define FCF_TAPE_PRESENT        BIT_2
-#define FCF_FCP2_DEVICE         BIT_3
+#define FCF_FCP2_DEVICE         BIT_2
 
 /* No loop ID flag. */
 #define FC_NO_LOOP_ID           0x1000
diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
index f61fb8d01330..8bc6f53691e9 100644
--- a/drivers/scsi/qla2xxx/qla_gbl.h
+++ b/drivers/scsi/qla2xxx/qla_gbl.h
@@ -453,6 +453,5 @@ extern void qla24xx_wrt_req_reg(struct qla_hw_data *, uint16_t, uint16_t);
 extern void qla25xx_wrt_req_reg(struct qla_hw_data *, uint16_t, uint16_t);
 extern void qla25xx_wrt_rsp_reg(struct qla_hw_data *, uint16_t, uint16_t);
 extern void qla24xx_wrt_rsp_reg(struct qla_hw_data *, uint16_t, uint16_t);
-extern struct scsi_qla_host * qla25xx_get_host(struct rsp_que *);
 
 #endif /* _QLA_GBL_H */
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index b4a0eac8f96d..3f8e8495b743 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -205,7 +205,7 @@ qla2x00_async_login_done(struct scsi_qla_host *vha, fc_port_t *fcport,
 
         switch (data[0]) {
         case MBS_COMMAND_COMPLETE:
-                if (fcport->flags & FCF_TAPE_PRESENT)
+                if (fcport->flags & FCF_FCP2_DEVICE)
                         opts |= BIT_1;
                 rval = qla2x00_get_port_database(vha, fcport, opts);
                 if (rval != QLA_SUCCESS)
@@ -2726,7 +2726,7 @@ qla2x00_configure_fabric(scsi_qla_host_t *vha)
 
                 /*
                  * Logout all previous fabric devices marked lost, except
-                 * tape devices.
+                 * FCP2 devices.
                  */
                 list_for_each_entry(fcport, &vha->vp_fcports, list) {
                         if (test_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags))
@@ -2739,7 +2739,7 @@ qla2x00_configure_fabric(scsi_qla_host_t *vha)
                                 qla2x00_mark_device_lost(vha, fcport,
                                     ql2xplogiabsentdevice, 0);
                                 if (fcport->loop_id != FC_NO_LOOP_ID &&
-                                    (fcport->flags & FCF_TAPE_PRESENT) == 0 &&
+                                    (fcport->flags & FCF_FCP2_DEVICE) == 0 &&
                                     fcport->port_type != FCT_INITIATOR &&
                                     fcport->port_type != FCT_BROADCAST) {
                                         ha->isp_ops->fabric_logout(vha,
@@ -3018,7 +3018,7 @@ qla2x00_find_all_fabric_devs(scsi_qla_host_t *vha,
                         fcport->d_id.b24 = new_fcport->d_id.b24;
                         fcport->flags |= FCF_LOGIN_NEEDED;
                         if (fcport->loop_id != FC_NO_LOOP_ID &&
-                            (fcport->flags & FCF_TAPE_PRESENT) == 0 &&
+                            (fcport->flags & FCF_FCP2_DEVICE) == 0 &&
                             fcport->port_type != FCT_INITIATOR &&
                             fcport->port_type != FCT_BROADCAST) {
                                 ha->isp_ops->fabric_logout(vha, fcport->loop_id,
@@ -3272,9 +3272,9 @@ qla2x00_fabric_dev_login(scsi_qla_host_t *vha, fc_port_t *fcport,
 
         rval = qla2x00_fabric_login(vha, fcport, next_loopid);
         if (rval == QLA_SUCCESS) {
-                /* Send an ADISC to tape devices.*/
+                /* Send an ADISC to FCP2 devices.*/
                 opts = 0;
-                if (fcport->flags & FCF_TAPE_PRESENT)
+                if (fcport->flags & FCF_FCP2_DEVICE)
                         opts |= BIT_1;
                 rval = qla2x00_get_port_database(vha, fcport, opts);
                 if (rval != QLA_SUCCESS) {
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index ffd0efdff40e..6fc63b98818c 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -1917,6 +1917,7 @@ qla24xx_msix_rsp_q(int irq, void *dev_id)
         struct rsp_que *rsp;
         struct device_reg_24xx __iomem *reg;
         struct scsi_qla_host *vha;
+        unsigned long flags;
 
         rsp = (struct rsp_que *) dev_id;
         if (!rsp) {
@@ -1927,15 +1928,15 @@ qla24xx_msix_rsp_q(int irq, void *dev_id)
         ha = rsp->hw;
         reg = &ha->iobase->isp24;
 
-        spin_lock_irq(&ha->hardware_lock);
+        spin_lock_irqsave(&ha->hardware_lock, flags);
 
-        vha = qla25xx_get_host(rsp);
+        vha = pci_get_drvdata(ha->pdev);
         qla24xx_process_response_queue(vha, rsp);
         if (!ha->flags.disable_msix_handshake) {
                 WRT_REG_DWORD(&reg->hccr, HCCRX_CLR_RISC_INT);
                 RD_REG_DWORD_RELAXED(&reg->hccr);
         }
-        spin_unlock_irq(&ha->hardware_lock);
+        spin_unlock_irqrestore(&ha->hardware_lock, flags);
 
         return IRQ_HANDLED;
 }
@@ -1946,6 +1947,7 @@ qla25xx_msix_rsp_q(int irq, void *dev_id)
         struct qla_hw_data *ha;
         struct rsp_que *rsp;
         struct device_reg_24xx __iomem *reg;
+        unsigned long flags;
 
         rsp = (struct rsp_que *) dev_id;
         if (!rsp) {
@@ -1958,10 +1960,10 @@ qla25xx_msix_rsp_q(int irq, void *dev_id)
         /* Clear the interrupt, if enabled, for this response queue */
         if (rsp->options & ~BIT_6) {
                 reg = &ha->iobase->isp24;
-                spin_lock_irq(&ha->hardware_lock);
+                spin_lock_irqsave(&ha->hardware_lock, flags);
                 WRT_REG_DWORD(&reg->hccr, HCCRX_CLR_RISC_INT);
                 RD_REG_DWORD_RELAXED(&reg->hccr);
-                spin_unlock_irq(&ha->hardware_lock);
+                spin_unlock_irqrestore(&ha->hardware_lock, flags);
         }
         queue_work_on((int) (rsp->id - 1), ha->wq, &rsp->q_work);
 
@@ -1979,6 +1981,7 @@ qla24xx_msix_default(int irq, void *dev_id)
         uint32_t        stat;
         uint32_t        hccr;
         uint16_t        mb[4];
+        unsigned long flags;
 
         rsp = (struct rsp_que *) dev_id;
         if (!rsp) {
@@ -1990,7 +1993,7 @@ qla24xx_msix_default(int irq, void *dev_id)
         reg = &ha->iobase->isp24;
         status = 0;
 
-        spin_lock_irq(&ha->hardware_lock);
+        spin_lock_irqsave(&ha->hardware_lock, flags);
         vha = pci_get_drvdata(ha->pdev);
         do {
                 stat = RD_REG_DWORD(&reg->host_status);
@@ -2039,7 +2042,7 @@ qla24xx_msix_default(int irq, void *dev_id)
                 }
                 WRT_REG_DWORD(&reg->hccr, HCCRX_CLR_RISC_INT);
         } while (0);
-        spin_unlock_irq(&ha->hardware_lock);
+        spin_unlock_irqrestore(&ha->hardware_lock, flags);
 
         if (test_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags) &&
             (status & MBX_INTERRUPT) && ha->flags.mbox_int) {
@@ -2277,30 +2280,3 @@ int qla25xx_request_irq(struct rsp_que *rsp)
         msix->rsp = rsp;
         return ret;
 }
-
-struct scsi_qla_host *
-qla25xx_get_host(struct rsp_que *rsp)
-{
-        srb_t *sp;
-        struct qla_hw_data *ha = rsp->hw;
-        struct scsi_qla_host *vha = NULL;
-        struct sts_entry_24xx *pkt;
-        struct req_que *req;
-        uint16_t que;
-        uint32_t handle;
-
-        pkt = (struct sts_entry_24xx *) rsp->ring_ptr;
-        que = MSW(pkt->handle);
-        handle = (uint32_t) LSW(pkt->handle);
-        req = ha->req_q_map[que];
-        if (handle < MAX_OUTSTANDING_COMMANDS) {
-                sp = req->outstanding_cmds[handle];
-                if (sp)
-                        return  sp->fcport->vha;
-                else
-                        goto base_que;
-        }
-base_que:
-        vha = pci_get_drvdata(ha->pdev);
-        return vha;
-}
diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c
index b901aa267e7d..ff17dee28613 100644
--- a/drivers/scsi/qla2xxx/qla_mid.c
+++ b/drivers/scsi/qla2xxx/qla_mid.c
@@ -636,13 +636,15 @@ failed:
 
 static void qla_do_work(struct work_struct *work)
 {
+        unsigned long flags;
         struct rsp_que *rsp = container_of(work, struct rsp_que, q_work);
         struct scsi_qla_host *vha;
+        struct qla_hw_data *ha = rsp->hw;
 
-        spin_lock_irq(&rsp->hw->hardware_lock);
-        vha = qla25xx_get_host(rsp);
+        spin_lock_irqsave(&rsp->hw->hardware_lock, flags);
+        vha = pci_get_drvdata(ha->pdev);
         qla24xx_process_response_queue(vha, rsp);
-        spin_unlock_irq(&rsp->hw->hardware_lock);
+        spin_unlock_irqrestore(&rsp->hw->hardware_lock, flags);
 }
 
 /* create response queue */
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 209f50e788a1..8529eb1f3cd4 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -1188,7 +1188,6 @@ qla2xxx_slave_configure(struct scsi_device *sdev)
         scsi_qla_host_t *vha = shost_priv(sdev->host);
         struct qla_hw_data *ha = vha->hw;
         struct fc_rport *rport = starget_to_rport(sdev->sdev_target);
-        fc_port_t *fcport = *(fc_port_t **)rport->dd_data;
         struct req_que *req = vha->req;
 
         if (sdev->tagged_supported)
@@ -1197,8 +1196,6 @@ qla2xxx_slave_configure(struct scsi_device *sdev)
                 scsi_deactivate_tcq(sdev, req->max_q_depth);
 
         rport->dev_loss_tmo = ha->port_down_retry_count;
-        if (sdev->type == TYPE_TAPE)
-                fcport->flags |= FCF_TAPE_PRESENT;
 
         return 0;
 }
@@ -2805,7 +2802,7 @@ void qla2x00_relogin(struct scsi_qla_host *vha)
 
                         fcport->login_retry--;
                         if (fcport->flags & FCF_FABRIC_DEVICE) {
-                                if (fcport->flags & FCF_TAPE_PRESENT)
+                                if (fcport->flags & FCF_FCP2_DEVICE)
                                         ha->isp_ops->fabric_logout(vha,
                                                         fcport->loop_id,
                                                         fcport->d_id.b.domain,
@@ -3141,7 +3138,10 @@ qla2x00_timer(scsi_qla_host_t *vha)
                         if (!IS_QLA2100(ha) && vha->link_down_timeout)
                                 atomic_set(&vha->loop_state, LOOP_DEAD);
 
-                        /* Schedule an ISP abort to return any tape commands. */
+                        /*
+                         * Schedule an ISP abort to return any FCP2-device
+                         * commands.
+                         */
                         /* NPIV - scan physical port only */
                         if (!vha->vp_idx) {
                                 spin_lock_irqsave(&ha->hardware_lock,
@@ -3158,7 +3158,7 @@ qla2x00_timer(scsi_qla_host_t *vha)
                                         if (sp->ctx)
                                                 continue;
                                         sfcp = sp->fcport;
-                                        if (!(sfcp->flags & FCF_TAPE_PRESENT))
+                                        if (!(sfcp->flags & FCF_FCP2_DEVICE))
                                                 continue;
 
                                         set_bit(ISP_ABORT_NEEDED,
diff --git a/drivers/scsi/qla2xxx/qla_sup.c b/drivers/scsi/qla2xxx/qla_sup.c
index 010e69b29afe..371dc895972a 100644
--- a/drivers/scsi/qla2xxx/qla_sup.c
+++ b/drivers/scsi/qla2xxx/qla_sup.c
@@ -2292,11 +2292,14 @@ qla25xx_read_optrom_data(struct scsi_qla_host *vha, uint8_t *buf,
         uint32_t faddr, left, burst;
         struct qla_hw_data *ha = vha->hw;
 
+        if (IS_QLA25XX(ha) || IS_QLA81XX(ha))
+                goto try_fast;
         if (offset & 0xfff)
                 goto slow_read;
         if (length < OPTROM_BURST_SIZE)
                 goto slow_read;
 
+try_fast:
         optrom = dma_alloc_coherent(&ha->pdev->dev, OPTROM_BURST_SIZE,
             &optrom_dma, GFP_KERNEL);
         if (!optrom) {
diff --git a/drivers/scsi/qla2xxx/qla_version.h b/drivers/scsi/qla2xxx/qla_version.h
index a65dd95507c6..ed36279a33c1 100644
--- a/drivers/scsi/qla2xxx/qla_version.h
+++ b/drivers/scsi/qla2xxx/qla_version.h
@@ -7,7 +7,7 @@
 /*
  * Driver version
  */
-#define QLA2XXX_VERSION      "8.03.01-k9"
+#define QLA2XXX_VERSION      "8.03.01-k10"
 
 #define QLA_DRIVER_MAJOR_VER    8
 #define QLA_DRIVER_MINOR_VER    3
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index d8927681ec88..c6642423cc67 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -749,9 +749,9 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes)
                          */
                         req->next_rq->resid_len = scsi_in(cmd)->resid;
 
+                        scsi_release_buffers(cmd);
                         blk_end_request_all(req, 0);
 
-                        scsi_release_buffers(cmd);
                         scsi_next_command(cmd);
                         return;
                 }
diff --git a/drivers/scsi/scsi_transport_fc.c b/drivers/scsi/scsi_transport_fc.c
index ddfcecd5099f..653f22a8deb9 100644
--- a/drivers/scsi/scsi_transport_fc.c
+++ b/drivers/scsi/scsi_transport_fc.c
@@ -3527,7 +3527,10 @@ fc_bsg_job_timeout(struct request *req)
         if (!done && i->f->bsg_timeout) {
                 /* call LLDD to abort the i/o as it has timed out */
                 err = i->f->bsg_timeout(job);
-                if (err)
+                if (err == -EAGAIN) {
+                        job->ref_cnt--;
+                        return BLK_EH_RESET_TIMER;
+                } else if (err)
                         printk(KERN_ERR "ERROR: FC BSG request timeout - LLD "
                                 "abort failed with status %d\n", err);
         }
diff --git a/drivers/serial/8250.c b/drivers/serial/8250.c
index c3e37c8e7e26..e9b15c3746fa 100644
--- a/drivers/serial/8250.c
+++ b/drivers/serial/8250.c
@@ -83,6 +83,9 @@ static unsigned int skip_txen_test; /* force skip of txen test at init time */
 
 #define PASS_LIMIT      256
 
+#define BOTH_EMPTY      (UART_LSR_TEMT | UART_LSR_THRE)
+
+
 /*
  * We default to IRQ0 for the "no irq" hack.   Some
  * machine types want others as well - they're free
@@ -1792,7 +1795,7 @@ static unsigned int serial8250_tx_empty(struct uart_port *port)
         up->lsr_saved_flags |= lsr & LSR_SAVE_FLAGS;
         spin_unlock_irqrestore(&up->port.lock, flags);
 
-        return lsr & UART_LSR_TEMT ? TIOCSER_TEMT : 0;
+        return (lsr & BOTH_EMPTY) == BOTH_EMPTY ? TIOCSER_TEMT : 0;
 }
 
 static unsigned int serial8250_get_mctrl(struct uart_port *port)
@@ -1850,8 +1853,6 @@ static void serial8250_break_ctl(struct uart_port *port, int break_state)
         spin_unlock_irqrestore(&up->port.lock, flags);
 }
 
-#define BOTH_EMPTY (UART_LSR_TEMT | UART_LSR_THRE)
-
 /*
  *      Wait for transmitter & holding register to empty
  */
diff --git a/drivers/serial/uartlite.c b/drivers/serial/uartlite.c
index 377f2712289e..ab2ab3c81834 100644
--- a/drivers/serial/uartlite.c
+++ b/drivers/serial/uartlite.c
@@ -394,7 +394,7 @@ static void ulite_console_write(struct console *co, const char *s,
                 spin_unlock_irqrestore(&port->lock, flags);
 }
 
-static int __init ulite_console_setup(struct console *co, char *options)
+static int __devinit ulite_console_setup(struct console *co, char *options)
 {
         struct uart_port *port;
         int baud = 9600;
diff --git a/drivers/spi/spi_sh_msiof.c b/drivers/spi/spi_sh_msiof.c
index 51e5e1dfa6e5..30973ec16a93 100644
--- a/drivers/spi/spi_sh_msiof.c
+++ b/drivers/spi/spi_sh_msiof.c
@@ -173,15 +173,12 @@ static void sh_msiof_spi_set_pin_regs(struct sh_msiof_spi_priv *p,
         int edge;
 
         /*
-         * CPOL CPHA     TSCKIZ RSCKIZ TEDG REDG(!)
-         *    0    0         10     10    1    0
-         *    0    1         10     10    0    1
-         *    1    0         11     11    0    1
-         *    1    1         11     11    1    0
-         *
-         * (!) Note: REDG is inverted recommended data sheet setting
+         * CPOL CPHA     TSCKIZ RSCKIZ TEDG REDG
+         *    0    0         10     10    1    1
+         *    0    1         10     10    0    0
+         *    1    0         11     11    0    0
+         *    1    1         11     11    1    1
          */
-
         sh_msiof_write(p, FCTR, 0);
         sh_msiof_write(p, TMDR1, 0xe2000005 | (lsb_first << 24));
         sh_msiof_write(p, RMDR1, 0x22000005 | (lsb_first << 24));
@@ -193,7 +190,7 @@ static void sh_msiof_spi_set_pin_regs(struct sh_msiof_spi_priv *p,
         edge = cpol ? cpha : !cpha;
 
         tmp |= edge << 27; /* TEDG */
-        tmp |= !edge << 26; /* REDG */
+        tmp |= edge << 26; /* REDG */
         tmp |= (tx_hi_z ? 2 : 0) << 22; /* TXDIZ */
         sh_msiof_write(p, CTR, tmp);
 }
diff --git a/drivers/ssb/main.c b/drivers/ssb/main.c
index 5681ebed9c65..03dfd27c4bfb 100644
--- a/drivers/ssb/main.c
+++ b/drivers/ssb/main.c
@@ -494,8 +494,7 @@ static int ssb_devices_register(struct ssb_bus *bus)
 #endif
                         break;
                 case SSB_BUSTYPE_SDIO:
-#ifdef CONFIG_SSB_SDIO
-                        sdev->irq = bus->host_sdio->dev.irq;
+#ifdef CONFIG_SSB_SDIOHOST
                         dev->parent = &bus->host_sdio->dev;
 #endif
                         break;
diff --git a/drivers/staging/Kconfig b/drivers/staging/Kconfig
index 94eb86319ff3..fc2e963e65e9 100644
--- a/drivers/staging/Kconfig
+++ b/drivers/staging/Kconfig
@@ -99,8 +99,6 @@ source "drivers/staging/line6/Kconfig"
 
 source "drivers/gpu/drm/vmwgfx/Kconfig"
 
-source "drivers/gpu/drm/radeon/Kconfig"
-
 source "drivers/gpu/drm/nouveau/Kconfig"
 
 source "drivers/staging/octeon/Kconfig"
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index 6e8bcdfd23b4..a678186f218f 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -1312,9 +1312,9 @@ static int processcompl(struct async *as, void __user * __user *arg)
         void __user *addr = as->userurb;
         unsigned int i;
 
-        if (as->userbuffer)
+        if (as->userbuffer && urb->actual_length)
                 if (copy_to_user(as->userbuffer, urb->transfer_buffer,
-                                 urb->transfer_buffer_length))
+                                 urb->actual_length))
                         goto err_out;
         if (put_user(as->status, &userurb->status))
                 goto err_out;
@@ -1334,14 +1334,11 @@ static int processcompl(struct async *as, void __user * __user *arg)
                 }
         }
 
-        free_async(as);
-
         if (put_user(addr, (void __user * __user *)arg))
                 return -EFAULT;
         return 0;
 
 err_out:
-        free_async(as);
         return -EFAULT;
 }
 
@@ -1371,8 +1368,11 @@ static struct async *reap_as(struct dev_state *ps)
 static int proc_reapurb(struct dev_state *ps, void __user *arg)
 {
         struct async *as = reap_as(ps);
-        if (as)
-                return processcompl(as, (void __user * __user *)arg);
+        if (as) {
+                int retval = processcompl(as, (void __user * __user *)arg);
+                free_async(as);
+                return retval;
+        }
         if (signal_pending(current))
                 return -EINTR;
         return -EIO;
@@ -1380,11 +1380,16 @@ static int proc_reapurb(struct dev_state *ps, void __user *arg)
 
 static int proc_reapurbnonblock(struct dev_state *ps, void __user *arg)
 {
+        int retval;
         struct async *as;
 
-        if (!(as = async_getcompleted(ps)))
-                return -EAGAIN;
-        return processcompl(as, (void __user * __user *)arg);
+        as = async_getcompleted(ps);
+        retval = -EAGAIN;
+        if (as) {
+                retval = processcompl(as, (void __user * __user *)arg);
+                free_async(as);
+        }
+        return retval;
 }
 
 #ifdef CONFIG_COMPAT
@@ -1475,9 +1480,9 @@ static int processcompl_compat(struct async *as, void __user * __user *arg)
         void __user *addr = as->userurb;
         unsigned int i;
 
-        if (as->userbuffer)
+        if (as->userbuffer && urb->actual_length)
                 if (copy_to_user(as->userbuffer, urb->transfer_buffer,
-                                 urb->transfer_buffer_length))
+                                 urb->actual_length))
                         return -EFAULT;
         if (put_user(as->status, &userurb->status))
                 return -EFAULT;
@@ -1497,7 +1502,6 @@ static int processcompl_compat(struct async *as, void __user * __user *arg)
                 }
         }
 
-        free_async(as);
         if (put_user(ptr_to_compat(addr), (u32 __user *)arg))
                 return -EFAULT;
         return 0;
@@ -1506,8 +1510,11 @@ static int processcompl_compat(struct async *as, void __user * __user *arg)
 static int proc_reapurb_compat(struct dev_state *ps, void __user *arg)
 {
         struct async *as = reap_as(ps);
-        if (as)
-                return processcompl_compat(as, (void __user * __user *)arg);
+        if (as) {
+                int retval = processcompl_compat(as, (void __user * __user *)arg);
+                free_async(as);
+                return retval;
+        }
         if (signal_pending(current))
                 return -EINTR;
         return -EIO;
@@ -1515,11 +1522,16 @@ static int proc_reapurb_compat(struct dev_state *ps, void __user *arg)
 
 static int proc_reapurbnonblock_compat(struct dev_state *ps, void __user *arg)
 {
+        int retval;
         struct async *as;
 
-        if (!(as = async_getcompleted(ps)))
-                return -EAGAIN;
-        return processcompl_compat(as, (void __user * __user *)arg);
+        retval = -EAGAIN;
+        as = async_getcompleted(ps);
+        if (as) {
+                retval = processcompl_compat(as, (void __user * __user *)arg);
+                free_async(as);
+        }
+        return retval;
 }
 
 
diff --git a/drivers/usb/gadget/f_eem.c b/drivers/usb/gadget/f_eem.c
index 0a577d5694fd..d4f0db58a8ad 100644
--- a/drivers/usb/gadget/f_eem.c
+++ b/drivers/usb/gadget/f_eem.c
@@ -358,7 +358,7 @@ done:
          * b15:         bmType (0 == data)
          */
         len = skb->len;
-        put_unaligned_le16((len & 0x3FFF) | BIT(14), skb_push(skb, 2));
+        put_unaligned_le16(len & 0x3FFF, skb_push(skb, 2));
 
         /* add a zero-length EEM packet, if needed */
         if (padlen)
@@ -464,7 +464,6 @@ static int eem_unwrap(struct gether *port,
                         }
 
                         /* validate CRC */
-                        crc = get_unaligned_le32(skb->data + len - ETH_FCS_LEN);
                         if (header & BIT(14)) {
                                 crc = get_unaligned_le32(skb->data + len
                                                         - ETH_FCS_LEN);
diff --git a/drivers/usb/gadget/multi.c b/drivers/usb/gadget/multi.c
index 429560100b10..76496f5d272c 100644
--- a/drivers/usb/gadget/multi.c
+++ b/drivers/usb/gadget/multi.c
@@ -29,7 +29,7 @@
 #if defined USB_ETH_RNDIS
 #  undef USB_ETH_RNDIS
 #endif
-#ifdef CONFIG_USB_ETH_RNDIS
+#ifdef CONFIG_USB_G_MULTI_RNDIS
 #  define USB_ETH_RNDIS y
 #endif
 
diff --git a/drivers/usb/gadget/r8a66597-udc.c b/drivers/usb/gadget/r8a66597-udc.c
index e220fb8091a3..8b45145b9136 100644
--- a/drivers/usb/gadget/r8a66597-udc.c
+++ b/drivers/usb/gadget/r8a66597-udc.c
@@ -26,6 +26,7 @@
 #include <linux/io.h>
 #include <linux/platform_device.h>
 #include <linux/clk.h>
+#include <linux/err.h>
 
 #include <linux/usb/ch9.h>
 #include <linux/usb/gadget.h>
diff --git a/drivers/usb/gadget/s3c-hsotg.c b/drivers/usb/gadget/s3c-hsotg.c
index 4b5dbd0127f5..5fc80a104150 100644
--- a/drivers/usb/gadget/s3c-hsotg.c
+++ b/drivers/usb/gadget/s3c-hsotg.c
@@ -2582,6 +2582,7 @@ err:
         hsotg->gadget.dev.driver = NULL;
         return ret;
 }
+EXPORT_SYMBOL(usb_gadget_register_driver);
 
 int usb_gadget_unregister_driver(struct usb_gadget_driver *driver)
 {
diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c
index c75d9270c752..19372673bf09 100644
--- a/drivers/usb/host/ehci-hub.c
+++ b/drivers/usb/host/ehci-hub.c
@@ -196,7 +196,9 @@ static int ehci_bus_suspend (struct usb_hcd *hcd)
                         if (hostpc_reg) {
                                 u32     t3;
 
+                                spin_unlock_irq(&ehci->lock);
                                 msleep(5);/* 5ms for HCD enter low pwr mode */
+                                spin_lock_irq(&ehci->lock);
                                 t3 = ehci_readl(ehci, hostpc_reg);
                                 ehci_writel(ehci, t3 | HOSTPC_PHCD, hostpc_reg);
                                 t3 = ehci_readl(ehci, hostpc_reg);
@@ -904,17 +906,18 @@ static int ehci_hub_control (
                         if ((temp & PORT_PE) == 0
                                         || (temp & PORT_RESET) != 0)
                                 goto error;
-                        ehci_writel(ehci, temp | PORT_SUSPEND, status_reg);
+
                         /* After above check the port must be connected.
                          * Set appropriate bit thus could put phy into low power
                          * mode if we have hostpc feature
                          */
+                        temp &= ~PORT_WKCONN_E;
+                        temp |= PORT_WKDISC_E | PORT_WKOC_E;
+                        ehci_writel(ehci, temp | PORT_SUSPEND, status_reg);
                         if (hostpc_reg) {
-                                temp &= ~PORT_WKCONN_E;
-                                temp |= (PORT_WKDISC_E | PORT_WKOC_E);
-                                ehci_writel(ehci, temp | PORT_SUSPEND,
-                                                        status_reg);
+                                spin_unlock_irqrestore(&ehci->lock, flags);
                                 msleep(5);/* 5ms for HCD enter low pwr mode */
+                                spin_lock_irqsave(&ehci->lock, flags);
                                 temp1 = ehci_readl(ehci, hostpc_reg);
                                 ehci_writel(ehci, temp1 | HOSTPC_PHCD,
                                         hostpc_reg);
diff --git a/drivers/usb/host/fhci-tds.c b/drivers/usb/host/fhci-tds.c
index d224ab467a40..e1232890c78b 100644
--- a/drivers/usb/host/fhci-tds.c
+++ b/drivers/usb/host/fhci-tds.c
@@ -105,7 +105,7 @@ void fhci_ep0_free(struct fhci_usb *usb)
                 if (ep->td_base)
                         cpm_muram_free(cpm_muram_offset(ep->td_base));
 
-                if (ep->conf_frame_Q) {
+                if (kfifo_initialized(&ep->conf_frame_Q)) {
                         size = cq_howmany(&ep->conf_frame_Q);
                         for (; size; size--) {
                                 struct packet *pkt = cq_get(&ep->conf_frame_Q);
@@ -115,7 +115,7 @@ void fhci_ep0_free(struct fhci_usb *usb)
                         cq_delete(&ep->conf_frame_Q);
                 }
 
-                if (ep->empty_frame_Q) {
+                if (kfifo_initialized(&ep->empty_frame_Q)) {
                         size = cq_howmany(&ep->empty_frame_Q);
                         for (; size; size--) {
                                 struct packet *pkt = cq_get(&ep->empty_frame_Q);
@@ -125,7 +125,7 @@ void fhci_ep0_free(struct fhci_usb *usb)
                         cq_delete(&ep->empty_frame_Q);
                 }
 
-                if (ep->dummy_packets_Q) {
+                if (kfifo_initialized(&ep->dummy_packets_Q)) {
                         size = cq_howmany(&ep->dummy_packets_Q);
                         for (; size; size--) {
                                 u8 *buff = cq_get(&ep->dummy_packets_Q);
diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c
index b7a661c02bcd..bee558aed427 100644
--- a/drivers/usb/host/r8a66597-hcd.c
+++ b/drivers/usb/host/r8a66597-hcd.c
@@ -35,7 +35,9 @@
 #include <linux/usb.h>
 #include <linux/platform_device.h>
 #include <linux/io.h>
+#include <linux/mm.h>
 #include <linux/irq.h>
+#include <asm/cacheflush.h>
 
 #include "../core/hcd.h"
 #include "r8a66597.h"
@@ -216,8 +218,17 @@ static void disable_controller(struct r8a66597 *r8a66597)
 {
         int port;
 
+        /* disable interrupts */
         r8a66597_write(r8a66597, 0, INTENB0);
-        r8a66597_write(r8a66597, 0, INTSTS0);
+        r8a66597_write(r8a66597, 0, INTENB1);
+        r8a66597_write(r8a66597, 0, BRDYENB);
+        r8a66597_write(r8a66597, 0, BEMPENB);
+        r8a66597_write(r8a66597, 0, NRDYENB);
+
+        /* clear status */
+        r8a66597_write(r8a66597, 0, BRDYSTS);
+        r8a66597_write(r8a66597, 0, NRDYSTS);
+        r8a66597_write(r8a66597, 0, BEMPSTS);
 
         for (port = 0; port < r8a66597->max_root_hub; port++)
                 r8a66597_disable_port(r8a66597, port);
@@ -811,6 +822,26 @@ static void enable_r8a66597_pipe(struct r8a66597 *r8a66597, struct urb *urb,
         enable_r8a66597_pipe_dma(r8a66597, dev, pipe, urb);
 }
 
+static void r8a66597_urb_done(struct r8a66597 *r8a66597, struct urb *urb,
+                              int status)
+__releases(r8a66597->lock)
+__acquires(r8a66597->lock)
+{
+        if (usb_pipein(urb->pipe) && usb_pipetype(urb->pipe) != PIPE_CONTROL) {
+                void *ptr;
+
+                for (ptr = urb->transfer_buffer;
+                     ptr < urb->transfer_buffer + urb->transfer_buffer_length;
+                     ptr += PAGE_SIZE)
+                        flush_dcache_page(virt_to_page(ptr));
+        }
+
+        usb_hcd_unlink_urb_from_ep(r8a66597_to_hcd(r8a66597), urb);
+        spin_unlock(&r8a66597->lock);
+        usb_hcd_giveback_urb(r8a66597_to_hcd(r8a66597), urb, status);
+        spin_lock(&r8a66597->lock);
+}
+
 /* this function must be called with interrupt disabled */
 static void force_dequeue(struct r8a66597 *r8a66597, u16 pipenum, u16 address)
 {
@@ -829,15 +860,9 @@ static void force_dequeue(struct r8a66597 *r8a66597, u16 pipenum, u16 address)
                 list_del(&td->queue);
                 kfree(td);
 
-                if (urb) {
-                        usb_hcd_unlink_urb_from_ep(r8a66597_to_hcd(r8a66597),
-                                        urb);
+                if (urb)
+                        r8a66597_urb_done(r8a66597, urb, -ENODEV);
 
-                        spin_unlock(&r8a66597->lock);
-                        usb_hcd_giveback_urb(r8a66597_to_hcd(r8a66597), urb,
-                                        -ENODEV);
-                        spin_lock(&r8a66597->lock);
-                }
                 break;
         }
 }
@@ -997,6 +1022,8 @@ static void start_root_hub_sampling(struct r8a66597 *r8a66597, int port,
 /* this function must be called with interrupt disabled */
 static void r8a66597_check_syssts(struct r8a66597 *r8a66597, int port,
                                         u16 syssts)
+__releases(r8a66597->lock)
+__acquires(r8a66597->lock)
 {
         if (syssts == SE0) {
                 r8a66597_write(r8a66597, ~ATTCH, get_intsts_reg(port));
@@ -1014,7 +1041,9 @@ static void r8a66597_check_syssts(struct r8a66597 *r8a66597, int port,
                         usb_hcd_resume_root_hub(r8a66597_to_hcd(r8a66597));
         }
 
+        spin_unlock(&r8a66597->lock);
         usb_hcd_poll_rh_status(r8a66597_to_hcd(r8a66597));
+        spin_lock(&r8a66597->lock);
 }
 
 /* this function must be called with interrupt disabled */
@@ -1274,10 +1303,7 @@ __releases(r8a66597->lock) __acquires(r8a66597->lock)
                 if (usb_pipeisoc(urb->pipe))
                         urb->start_frame = r8a66597_get_frame(hcd);
 
-                usb_hcd_unlink_urb_from_ep(r8a66597_to_hcd(r8a66597), urb);
-                spin_unlock(&r8a66597->lock);
-                usb_hcd_giveback_urb(hcd, urb, status);
-                spin_lock(&r8a66597->lock);
+                r8a66597_urb_done(r8a66597, urb, status);
         }
 
         if (restart) {
@@ -2466,6 +2492,12 @@ static int __devinit r8a66597_probe(struct platform_device *pdev)
         r8a66597->rh_timer.data = (unsigned long)r8a66597;
         r8a66597->reg = (unsigned long)reg;
 
+        /* make sure no interrupts are pending */
+        ret = r8a66597_clock_enable(r8a66597);
+        if (ret < 0)
+                goto clean_up3;
+        disable_controller(r8a66597);
+
         for (i = 0; i < R8A66597_MAX_NUM_PIPE; i++) {
                 INIT_LIST_HEAD(&r8a66597->pipe_queue[i]);
                 init_timer(&r8a66597->td_timer[i]);
diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c
index 0025847743f3..8b37a4b9839e 100644
--- a/drivers/usb/misc/sisusbvga/sisusb.c
+++ b/drivers/usb/misc/sisusbvga/sisusb.c
@@ -3245,6 +3245,7 @@ static struct usb_device_id sisusb_table [] = {
         { USB_DEVICE(0x0711, 0x0902) },
         { USB_DEVICE(0x0711, 0x0903) },
         { USB_DEVICE(0x0711, 0x0918) },
+        { USB_DEVICE(0x0711, 0x0920) },
         { USB_DEVICE(0x182d, 0x021c) },
         { USB_DEVICE(0x182d, 0x0269) },
         { }
diff --git a/drivers/usb/otg/Kconfig b/drivers/usb/otg/Kconfig
index de56b3d743d7..3d2d3e549bd1 100644
--- a/drivers/usb/otg/Kconfig
+++ b/drivers/usb/otg/Kconfig
@@ -44,6 +44,7 @@ config ISP1301_OMAP
 config USB_ULPI
         bool "Generic ULPI Transceiver Driver"
         depends on ARM
+        select USB_OTG_UTILS
         help
           Enable this to support ULPI connected USB OTG transceivers which
           are likely found on embedded boards.
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 216f187582ab..7638828e7317 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -50,7 +50,7 @@
  * Version Information
  */
 #define DRIVER_VERSION "v1.5.0"
-#define DRIVER_AUTHOR "Greg Kroah-Hartman <greg@kroah.com>, Bill Ryder <bryder@sgi.com>, Kuba Ober <kuba@mareimbrium.org>"
+#define DRIVER_AUTHOR "Greg Kroah-Hartman <greg@kroah.com>, Bill Ryder <bryder@sgi.com>, Kuba Ober <kuba@mareimbrium.org>, Andreas Mohr"
 #define DRIVER_DESC "USB FTDI Serial Converters Driver"
 
 static int debug;
@@ -145,10 +145,15 @@ static struct ftdi_sio_quirk ftdi_HE_TIRA1_quirk = {
 
 
 
+/*
+ * Device ID not listed? Test via module params product/vendor or
+ * /sys/bus/usb/ftdi_sio/new_id, then send patch/report!
+ */
 static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_AMC232_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_CANUSB_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_CANDAPTER_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_NXTCAM_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_0_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_1_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_SCS_DEVICE_2_PID) },
@@ -552,9 +557,16 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_IBS_PEDO_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_IBS_PROD_PID) },
         /*
-         * Due to many user requests for multiple ELV devices we enable
-         * them by default.
+         * ELV devices:
          */
+        { USB_DEVICE(FTDI_VID, FTDI_ELV_USR_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_ELV_MSM1_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_ELV_KL100_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_ELV_WS550_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_ELV_EC3000_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_ELV_WS888_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_ELV_TWS550_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_ELV_FEM_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_CLI7000_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_PPS7330_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_TFM100_PID) },
@@ -571,11 +583,17 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_ELV_PCK100_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_RFP500_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_FS20SIG_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_ELV_UTP8_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_WS300PC_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_ELV_WS444PC_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_FHZ1300PC_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_EM1010PC_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_WS500_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_ELV_HS485_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_ELV_UMS100_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_ELV_TFD128_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_ELV_FM3RX_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_ELV_WS777_PID) },
         { USB_DEVICE(FTDI_VID, LINX_SDMUSBQSS_PID) },
         { USB_DEVICE(FTDI_VID, LINX_MASTERDEVEL2_PID) },
         { USB_DEVICE(FTDI_VID, LINX_FUTURE_0_PID) },
@@ -697,6 +715,7 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(RATOC_VENDOR_ID, RATOC_PRODUCT_ID_USB60F) },
         { USB_DEVICE(FTDI_VID, FTDI_REU_TINY_PID) },
         { USB_DEVICE(PAPOUCH_VID, PAPOUCH_QUIDO4x4_PID) },
+        { USB_DEVICE(PAPOUCH_VID, PAPOUCH_AD4USB_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_DOMINTELL_DGQG_PID) },
         { USB_DEVICE(FTDI_VID, FTDI_DOMINTELL_DUSB_PID) },
         { USB_DEVICE(ALTI2_VID, ALTI2_N3_PID) },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index da92b4952ffb..c8951aeed983 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -38,6 +38,8 @@
 /* www.candapter.com Ewert Energy Systems CANdapter device */
 #define FTDI_CANDAPTER_PID 0x9F80 /* Product Id */
 
+#define FTDI_NXTCAM_PID         0xABB8 /* NXTCam for Mindstorms NXT */
+
 /* OOCDlink by Joern Kaipf <joernk@web.de>
  * (http://www.joernonline.de/dw/doku.php?id=start&idx=projects:oocdlink) */
 #define FTDI_OOCDLINK_PID       0xbaf8  /* Amontec JTAGkey */
@@ -161,22 +163,37 @@
 /*
  * ELV USB devices submitted by Christian Abt of ELV (www.elv.de).
  * All of these devices use FTDI's vendor ID (0x0403).
+ * Further IDs taken from ELV Windows .inf file.
  *
  * The previously included PID for the UO 100 module was incorrect.
  * In fact, that PID was for ELV's UR 100 USB-RS232 converter (0xFB58).
  *
  * Armin Laeuger originally sent the PID for the UM 100 module.
  */
+#define FTDI_ELV_USR_PID        0xE000  /* ELV Universal-Sound-Recorder */
+#define FTDI_ELV_MSM1_PID       0xE001  /* ELV Mini-Sound-Modul */
+#define FTDI_ELV_KL100_PID      0xE002  /* ELV Kfz-Leistungsmesser KL 100 */
+#define FTDI_ELV_WS550_PID      0xE004  /* WS 550 */
+#define FTDI_ELV_EC3000_PID     0xE006  /* ENERGY CONTROL 3000 USB */
+#define FTDI_ELV_WS888_PID      0xE008  /* WS 888 */
+#define FTDI_ELV_TWS550_PID     0xE009  /* Technoline WS 550 */
+#define FTDI_ELV_FEM_PID        0xE00A  /* Funk Energie Monitor */
 #define FTDI_ELV_FHZ1300PC_PID  0xE0E8  /* FHZ 1300 PC */
 #define FTDI_ELV_WS500_PID      0xE0E9  /* PC-Wetterstation (WS 500) */
 #define FTDI_ELV_HS485_PID      0xE0EA  /* USB to RS-485 adapter */
+#define FTDI_ELV_UMS100_PID     0xE0EB  /* ELV USB Master-Slave Schaltsteckdose UMS 100 */
+#define FTDI_ELV_TFD128_PID     0xE0EC  /* ELV Temperatur-Feuchte-Datenlogger TFD 128 */
+#define FTDI_ELV_FM3RX_PID      0xE0ED  /* ELV Messwertuebertragung FM3 RX */
+#define FTDI_ELV_WS777_PID      0xE0EE  /* Conrad WS 777 */
 #define FTDI_ELV_EM1010PC_PID   0xE0EF  /* Engery monitor EM 1010 PC */
 #define FTDI_ELV_CSI8_PID       0xE0F0  /* Computer-Schalt-Interface (CSI 8) */
 #define FTDI_ELV_EM1000DL_PID   0xE0F1  /* PC-Datenlogger fuer Energiemonitor (EM 1000 DL) */
 #define FTDI_ELV_PCK100_PID     0xE0F2  /* PC-Kabeltester (PCK 100) */
 #define FTDI_ELV_RFP500_PID     0xE0F3  /* HF-Leistungsmesser (RFP 500) */
 #define FTDI_ELV_FS20SIG_PID    0xE0F4  /* Signalgeber (FS 20 SIG) */
+#define FTDI_ELV_UTP8_PID       0xE0F5  /* ELV UTP 8 */
 #define FTDI_ELV_WS300PC_PID    0xE0F6  /* PC-Wetterstation (WS 300 PC) */
+#define FTDI_ELV_WS444PC_PID    0xE0F7  /* Conrad WS 444 PC */
 #define FTDI_PHI_FISCO_PID      0xE40B  /* PHI Fisco USB to Serial cable */
 #define FTDI_ELV_UAD8_PID       0xF068  /* USB-AD-Wandler (UAD 8) */
 #define FTDI_ELV_UDA7_PID       0xF069  /* USB-DA-Wandler (UDA 7) */
@@ -968,6 +985,7 @@
 #define PAPOUCH_VID                     0x5050  /* Vendor ID */
 #define PAPOUCH_TMU_PID                 0x0400  /* TMU USB Thermometer */
 #define PAPOUCH_QUIDO4x4_PID            0x0900  /* Quido 4/4 Module */
+#define PAPOUCH_AD4USB_PID              0x8003  /* AD4USB Measurement Module */
 
 /*
  * Marvell SheevaPlug
diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
index ac1b6449fb6a..3eb6143bb646 100644
--- a/drivers/usb/serial/sierra.c
+++ b/drivers/usb/serial/sierra.c
@@ -298,6 +298,7 @@ static struct usb_device_id id_table [] = {
         { USB_DEVICE(0x1199, 0x68A3),   /* Sierra Wireless Direct IP modems */
           .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
         },
+       { USB_DEVICE(0x413C, 0x08133) }, /* Dell Computer Corp. Wireless 5720 VZW Mobile Broadband (EVDO Rev-A) Minicard GPS Port */
 
         { }
 };
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index c932f9053188..49575fba3756 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -941,7 +941,7 @@ UNUSUAL_DEV(  0x07ab, 0xfccd, 0x0000, 0x9999,
 UNUSUAL_DEV(  0x07af, 0x0004, 0x0100, 0x0133,
                 "Microtech",
                 "USB-SCSI-DB25",
-                US_SC_SCSI, US_PR_BULK, usb_stor_euscsi_init,
+                US_SC_DEVICE, US_PR_DEVICE, usb_stor_euscsi_init,
                 US_FL_SCM_MULT_TARG ), 
 
 UNUSUAL_DEV(  0x07af, 0x0005, 0x0100, 0x0100,
diff --git a/drivers/video/efifb.c b/drivers/video/efifb.c
index eb12182b2059..d25df51bb0d2 100644
--- a/drivers/video/efifb.c
+++ b/drivers/video/efifb.c
@@ -161,8 +161,17 @@ static int efifb_setcolreg(unsigned regno, unsigned red, unsigned green,
         return 0;
 }
 
+static void efifb_destroy(struct fb_info *info)
+{
+        if (info->screen_base)
+                iounmap(info->screen_base);
+        release_mem_region(info->aperture_base, info->aperture_size);
+        framebuffer_release(info);
+}
+
 static struct fb_ops efifb_ops = {
         .owner          = THIS_MODULE,
+        .fb_destroy     = efifb_destroy,
         .fb_setcolreg   = efifb_setcolreg,
         .fb_fillrect    = cfb_fillrect,
         .fb_copyarea    = cfb_copyarea,
@@ -281,7 +290,7 @@ static int __init efifb_probe(struct platform_device *dev)
         info->par = NULL;
 
         info->aperture_base = efifb_fix.smem_start;
-        info->aperture_size = size_total;
+        info->aperture_size = size_remap;
 
         info->screen_base = ioremap(efifb_fix.smem_start, efifb_fix.smem_len);
         if (!info->screen_base) {
diff --git a/drivers/video/imxfb.c b/drivers/video/imxfb.c
index 66358fa825f3..b4b6deceed15 100644
--- a/drivers/video/imxfb.c
+++ b/drivers/video/imxfb.c
@@ -593,7 +593,8 @@ static int imxfb_activate_var(struct fb_var_screeninfo *var, struct fb_info *inf
  */
 static int imxfb_suspend(struct platform_device *dev, pm_message_t state)
 {
-        struct imxfb_info *fbi = platform_get_drvdata(dev);
+        struct fb_info *info = platform_get_drvdata(dev);
+        struct imxfb_info *fbi = info->par;
 
         pr_debug("%s\n", __func__);
 
@@ -603,7 +604,8 @@ static int imxfb_suspend(struct platform_device *dev, pm_message_t state)
 
 static int imxfb_resume(struct platform_device *dev)
 {
-        struct imxfb_info *fbi = platform_get_drvdata(dev);
+        struct fb_info *info = platform_get_drvdata(dev);
+        struct imxfb_info *fbi = info->par;
 
         pr_debug("%s\n", __func__);
 
diff --git a/drivers/video/mx3fb.c b/drivers/video/mx3fb.c
index 054ef29be479..772ba3f45e6f 100644
--- a/drivers/video/mx3fb.c
+++ b/drivers/video/mx3fb.c
@@ -324,8 +324,11 @@ static void sdc_enable_channel(struct mx3fb_info *mx3_fbi)
         unsigned long flags;
         dma_cookie_t cookie;
 
-        dev_dbg(mx3fb->dev, "mx3fbi %p, desc %p, sg %p\n", mx3_fbi,
-                to_tx_desc(mx3_fbi->txd), to_tx_desc(mx3_fbi->txd)->sg);
+        if (mx3_fbi->txd)
+                dev_dbg(mx3fb->dev, "mx3fbi %p, desc %p, sg %p\n", mx3_fbi,
+                        to_tx_desc(mx3_fbi->txd), to_tx_desc(mx3_fbi->txd)->sg);
+        else
+                dev_dbg(mx3fb->dev, "mx3fbi %p, txd = NULL\n", mx3_fbi);
 
         /* This enables the channel */
         if (mx3_fbi->cookie < 0) {
@@ -646,6 +649,7 @@ static int sdc_set_global_alpha(struct mx3fb_data *mx3fb, bool enable, uint8_t a
 
 static void sdc_set_brightness(struct mx3fb_data *mx3fb, uint8_t value)
 {
+        dev_dbg(mx3fb->dev, "%s: value = %d\n", __func__, value);
         /* This might be board-specific */
         mx3fb_write_reg(mx3fb, 0x03000000UL | value << 16, SDC_PWM_CTRL);
         return;
@@ -1486,12 +1490,12 @@ static int mx3fb_probe(struct platform_device *pdev)
                 goto ersdc0;
         }
 
+        mx3fb->backlight_level = 255;
+
         ret = init_fb_chan(mx3fb, to_idmac_chan(chan));
         if (ret < 0)
                 goto eisdc0;
 
-        mx3fb->backlight_level = 255;
-
         return 0;
 
 eisdc0:
diff --git a/drivers/watchdog/bfin_wdt.c b/drivers/watchdog/bfin_wdt.c
index c7b3f9df2317..2159e668751c 100644
--- a/drivers/watchdog/bfin_wdt.c
+++ b/drivers/watchdog/bfin_wdt.c
@@ -1,9 +1,8 @@
 /*
  * Blackfin On-Chip Watchdog Driver
- *  Supports BF53[123]/BF53[467]/BF54[2489]/BF561
  *
  * Originally based on softdog.c
- * Copyright 2006-2007 Analog Devices Inc.
+ * Copyright 2006-2010 Analog Devices Inc.
  * Copyright 2006-2007 Michele d'Amico
  * Copyright 1996 Alan Cox <alan@lxorguk.ukuu.org.uk>
  *
@@ -137,13 +136,15 @@ static int bfin_wdt_running(void)
  */
 static int bfin_wdt_set_timeout(unsigned long t)
 {
-        u32 cnt;
+        u32 cnt, max_t, sclk;
         unsigned long flags;
 
-        stampit();
+        sclk = get_sclk();
+        max_t = -1 / sclk;
+        cnt = t * sclk;
+        stamp("maxtimeout=%us newtimeout=%lus (cnt=%#x)", max_t, t, cnt);
 
-        cnt = t * get_sclk();
-        if (cnt < get_sclk()) {
+        if (t > max_t) {
                 printk(KERN_WARNING PFX "timeout value is too large\n");
                 return -EINVAL;
         }